diff --git a/docs/refguide.xml b/docs/refguide.xml
index da80e3df3..ba7c27c13 100644
--- a/docs/refguide.xml
+++ b/docs/refguide.xml
@@ -1850,11 +1850,7 @@ way.
provide all of this information. If Nmap was compiled with
OpenSSL support, it will connect to SSL servers to deduce the
service listening behind that encryption layer.SSLin version detection
- When RPC services are
- discovered, the Nmap RPC grinderRPC grinder
- ()
- is automatically used to determine the RPC program and version
- numbers. Some UDP ports are left in the
+ Some UDP ports are left in the
open|filtered state after a UDP port scan is
unable to determine whether the port is open or filtered. Version
detection will try to elicit a response from these ports (just as
@@ -1872,6 +1868,19 @@ way.
+ When RPC services are discovered, the Nmap RPC
+ grinderRPC grinder
+ is automatically used to determine the RPC program and version
+ numbers. It takes all the TCP/UDP ports detected as RPC and floods
+ them with SunRPC program NULL commands in an attempt to determine
+ whether they are RPC ports, and if so, what program and version
+ number they serve up. Thus you can effectively obtain the same info
+ as rpcinfo -p even if the target's portmapper is
+ behind a firewall (or protected by TCP wrappers). Decoys do not
+ currently work with
+ RPC scan.decoyswhich scans use
+
+
When Nmap receives responses from a service but cannot match
them to its database, it prints out a special fingerprint and
a URL for you to submit if to if you know for sure what is running
@@ -1898,6 +1907,10 @@ way.
Alternatively, you can use , which enables
version detection among other things.
+
+ is an alias for . Prior to March 2011, it
+ was used to active the RPC grinder separately from version
+ detection, but now these options are always combined.
@@ -1989,31 +2002,6 @@ way.
what you get with .
-
-
-
- (RPC scan)
-
- RPC scanRPC grinder
- RPC grinder
-
-
-
- This method works in conjunction with the various port
- scan methods of Nmap. It takes all the TCP/UDP ports found
- open and floods them with SunRPC program NULL commands in an
- attempt to determine whether they are RPC ports, and if so,
- what program and version number they serve up. Thus you can
- effectively obtain the same info as rpcinfo -p even if the
- target's portmapper is behind a firewall (or protected by
- TCP wrappers). Decoys do not currently work with
- RPC scan.decoyswhich scans use
- This is automatically enabled as part of version scan
- () if you request that. As version
- detection includes this and is much more comprehensive,
- is rarely needed.
-
-