mirror of
https://github.com/nmap/nmap.git
synced 2026-08-04 14:49:29 +00:00
merge soc07 r5216:5224, -r5206 - signature canonicalization and updates
This commit is contained in:
fyodor
parent
179d2b5766
commit
375ad32df4
4 changed files with 81 additions and 71 deletions
|
|
@ -1,5 +1,8 @@
|
|||
# Nmap Changelog ($Id$); -*-text-*-
|
||||
|
||||
o Performed a bunch of OS fingerprint text canonicalization thanks to
|
||||
reports of dozens of capitalization inconsistencies from Suicidal Bob.
|
||||
|
||||
4.22SOC2
|
||||
|
||||
o NSE compilation fixes by Stoiko and Kris
|
||||
|
|
|
|||
20
nmap-os-db
20
nmap-os-db
|
|
@ -372,8 +372,8 @@ T7(R=Y%DF=Y%T=3F%TG=3F%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
|
|||
U1(DF=N%T=3F%TG=3F%TOS=C0%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G)
|
||||
IE(DFI=N%T=3F%TG=3F%TOSI=S%CD=S%SI=S%DLI=S)
|
||||
|
||||
# Alcatel Speed-Touch Pro ADSL Modem (Firmware: Khdsaa3.270 (1003194))
|
||||
Fingerprint Alcatel Speed-Touch Pro ADSL Modem
|
||||
# Alcatel SpeedTouch Pro ADSL Modem (Firmware: Khdsaa3.270 (1003194))
|
||||
Fingerprint Alcatel SpeedTouch Pro ADSL Modem
|
||||
Class Alcatel | embedded || broadband router
|
||||
SEQ(SP=B-15%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=96-A0%TI=I%II=I%SS=S%TS=1)
|
||||
OPS(O1=M200NW0NNT11%O2=M200NW0NNT11%O3=M200NW0NNT11%O4=M200NW0NNT11%O5=M200NW0NNT11%O6=M200NNT11)
|
||||
|
|
@ -718,7 +718,7 @@ T7(R=Y%DF=N%T=40%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
|
|||
U1(DF=N%T=40%TG=40%TOS=0%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=0%RUL=G%RUD=G)
|
||||
IE(DFI=S%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S)
|
||||
|
||||
# Apple Mac OS X 10.4.8 (Tiger) on X86 Core Duo (first-gen Intel iMac 17"/1.83): Darwin 8.8.1 Darwin Kernel Version 8.8.1: Mon Sep 25 19:42:00 PDT 2006 root:xnu-792.13.8.obj~1/RELEASE_I386 i386 i386)
|
||||
# Apple Mac OS X 10.4.8 (Tiger) on x86 Core Duo (first-gen Intel iMac 17"/1.83): Darwin 8.8.1 Darwin Kernel Version 8.8.1: Mon Sep 25 19:42:00 PDT 2006 root:xnu-792.13.8.obj~1/RELEASE_I386 i386 i386)
|
||||
# Darwin 8.8.0 Darwin Kernel Version 8.8.0: Fri Sep 8 17:18:57 PDT 2006; root:xnu-792.12.6.obj~1/RELEASE_PPC Power Macintosh powerpc
|
||||
# Mac OS X Server 10.4.9 PowerPC Darwin 8.9.0
|
||||
# Darwin 8.9.1 Darwin Kernel Version 8.9.1: Thu Feb 22 20:58:18 PST 2007; root:xnu-792.18.15~1/RELEASE_PPC Power Macintosh powerpc (MacOS 10.4.9 Server [PPC])
|
||||
|
|
@ -741,7 +741,7 @@ IE(DFI=S%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S)
|
|||
|
||||
# Apple Mac OS 10.4.8/ppc (Darwin tetralyre 8.8.0 Darwin Kernel Version 8.8.0: Fri Sep 8 17:18:57 PDT
|
||||
# Darwin 8.8.1 Darwin Kernel Version 8.8.1: Mon Sep 25 19:42:00 PDT 2006; root:xnu-792.13.8.obj~1/RELEASE_I386 i386 i386
|
||||
# Apple Mac OS X 10.4.8 (Tiger) on X86 Core Duo
|
||||
# Apple Mac OS X 10.4.8 (Tiger) on x86 Core Duo
|
||||
# Apple Mac OS X 10.4.9, Darwin Kernel Version 8.9.1: Thu Feb 22 20:55:00 PST 2007; root:xnu-792.18.15~1/RELEASE_I386 i386 i386
|
||||
Fingerprint Apple Mac OS X 10.4.8 - 10.4.9 (Tiger)
|
||||
Class Apple | Mac OS X | 10.4.X | general purpose
|
||||
|
|
@ -3795,7 +3795,7 @@ U1(DF=N%T=40%TG=40%TOS=0%IPL=38%UN=0%RIPL=G%RID=1042%RIPCK=Z%RUCK=0%RUL=G%RUD=G)
|
|||
IE(DFI=S%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S)
|
||||
|
||||
# HP laserjet 4100n
|
||||
Fingerprint HP LaserJet 4100n printer
|
||||
Fingerprint HP LaserJet 4100N printer
|
||||
Class HP | embedded || printer
|
||||
SEQ(SP=13-1D%GCD=FA00|1F400|2EE00|3E800|4E200%ISR=98-A2%TI=I%II=I%SS=S%TS=U)
|
||||
OPS(O1=M5B4NW0%O2=M5B4NW0%O3=M5B4NW0%O4=M5B4NW0%O5=M5B4NW0%O6=M5B4)
|
||||
|
|
@ -6698,7 +6698,7 @@ U1(DF=N%T=40%TG=40%TOS=C0%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G)
|
|||
IE(DFI=N%T=40%TG=40%TOSI=S%CD=S%SI=S%DLI=S)
|
||||
|
||||
# Centos 4.3 Linux 2.6.17.11-grsec #1 Sat Sep 16 06:39:06 EDT 2006 i686 athlon i386 GNU/Linux
|
||||
# CentOS 4.4 Linux 2.6.17.11 (CentOS 4.4, X86, custom compiled kernel)
|
||||
# CentOS 4.4 Linux 2.6.17.11 (CentOS 4.4, x86, custom compiled kernel)
|
||||
Fingerprint Linux 2.6.17.11 (CentOS 4.3 or 4.4, x86)
|
||||
Class Linux | Linux | 2.6.X | general purpose
|
||||
SEQ(SP=BD-D5%GCD=<7%ISR=C3-D7%TI=Z%II=I%TS=U)
|
||||
|
|
@ -7952,7 +7952,7 @@ T7(R=Y%DF=N%T=80|81%TG=81%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
|
|||
U1(DF=N%T=80|81%TG=81%TOS=0%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G)
|
||||
IE(DFI=S%T=80|81%TG=81%TOSI=Z%CD=Z%SI=S%DLI=S)
|
||||
|
||||
# Taken on an X86 SMP machine
|
||||
# Taken on an x86 SMP machine
|
||||
Fingerprint Microsoft Windows 2000 SP4
|
||||
Class Microsoft | Windows | 2000 | general purpose
|
||||
SEQ(SP=7D-8A%GCD=<7%ISR=99-9D%TI=I%II=I%SS=S)
|
||||
|
|
@ -9179,7 +9179,7 @@ IE(DFI=N%T=80%TG=80%TOSI=S%CD=Z%SI=S%DLI=S)
|
|||
|
||||
# W2003 Server Standard Edition v 5.2 build3790.srv003_rtm.030324-2048 , no sp, MUI RU terminal server started app mode
|
||||
# Microsoft Windows XP Home SP2 (German) [Winver: Version 5.1 (build 2600.xpsp_sp2_gdr.050301-1519: Service Pack 2)]
|
||||
# Microsoft Windows 2003 (Swedish) X86 version 5.2 (Build 3790.srv03_rtm.030324-2048)
|
||||
# Microsoft Windows 2003 (Swedish) x86 version 5.2 (Build 3790.srv03_rtm.030324-2048)
|
||||
# Microsoft Windows Server 2003 Enterprise Edition 64-Bit with SP1
|
||||
# Microsoft Windows Server 2003 standard edition
|
||||
# Microsoft Windows 2003 Standard Edition (English) [Winver: Version 5.2 (build 3790.srv03_gdr.050225-1827
|
||||
|
|
@ -11665,7 +11665,7 @@ IE(DFI=N%T=41%TG=41%TOSI=Z%CD=S%SI=S%DLI=S)
|
|||
|
||||
# Symbol WS5000 Wireless Switch
|
||||
# Software 1.4.3.0-012R, firmware 2.2 (7/9/02)
|
||||
Fingerprint Symbol WS5000 Wireless Switch
|
||||
Fingerprint Symbol WS5000 wireless switch
|
||||
Class Symbol | embedded || WAP
|
||||
SEQ(SP=5-15%GCD=FA00|1F400|2EE00|3E800|4E200|5DC00%ISR=96-A0%TI=I%II=I%SS=S%TS=U)
|
||||
OPS(O1=M5B4%O2=M5B4%O3=M5B4%O4=M5B4%O5=M5B4%O6=M5B4)
|
||||
|
|
@ -12352,7 +12352,7 @@ U1(DF=N%T=FE%TG=FE%TOS=0%IPL=38%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G)
|
|||
IE(DFI=N%T=FE%TG=FE%TOSI=S%CD=S%SI=S%DLI=S)
|
||||
|
||||
# ZyNOS Firmware Version: V3.62(WK.16) ZyWALL 2
|
||||
Fingerprint ZyXEL ZyWall 2
|
||||
Fingerprint ZyXEL ZyWALL 2
|
||||
Class ZyXEL | ZyNOS || firewall
|
||||
SEQ(SP=0-29%GCD=1000|2000|3000|4000|5000|6000|64000|C8000|12C000|190000|1F4000|258000%ISR=AB-B5%TI=I%II=I%SS=S%TS=U)
|
||||
OPS(O1=|M200%O2=|M200%O3=|M200%O4=|M200%O5=|M200%O6=|M200)
|
||||
|
|
|
|||
|
|
@ -55,7 +55,7 @@ T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
|
||||
|
||||
# 3Com 812 OfficeConnect ADSL Router Firmware version: 2.0.0
|
||||
Fingerprint 3Com OfficeConnect 812 aDSL router
|
||||
Fingerprint 3Com OfficeConnect 812 ADSL router
|
||||
Class 3Com | embedded || broadband router
|
||||
TSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)
|
||||
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
|
||||
|
|
@ -67,7 +67,7 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
|
||||
|
||||
Fingerprint 3Com OfficeConnect Remote 812 aDSL Router
|
||||
Fingerprint 3Com OfficeConnect Remote 812 ADSL Router
|
||||
Class 3Com | embedded || broadband router
|
||||
TSeq(Class=TD%gcd=<C354%SI=<1E)
|
||||
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
|
||||
|
|
@ -496,10 +496,10 @@ T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
||||
PU(Resp=N)
|
||||
|
||||
# Alcatel Speed Touch Home running GV8BAA3.235 (992640)
|
||||
# Alcatel SpeedTouch Home running GV8BAA3.235 (992640)
|
||||
# Alcatel SpeedTouch Pro ADSL Router running NZ OS 3.281
|
||||
# Alcatel Speed Touch Home ADSL Modem (POTS), Ver 3.2
|
||||
Fingerprint Alcatel Speed Touch *DSL modem/router
|
||||
# Alcatel SpeedTouch Home ADSL Modem (POTS), Ver 3.2
|
||||
Fingerprint Alcatel SpeedTouch ADSL modem
|
||||
Class Alcatel | embedded || broadband router
|
||||
TSeq(Class=64K%IPID=I%TS=2HZ)
|
||||
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
|
||||
|
|
@ -511,8 +511,8 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E|F%ULEN=134%DAT=E)
|
||||
|
||||
# Alcatel Speed Touch 510 *DSL router (uses THOMSON UNIX embedded Version 4.0.0.9.0)
|
||||
Fingerprint Alcatel Speed Touch 510 *DSL modem/router
|
||||
# Alcatel SpeedTouch 510 *DSL router (uses THOMSON UNIX embedded Version 4.0.0.9.0)
|
||||
Fingerprint Alcatel SpeedTouch 510 ADSL modem
|
||||
Class Alcatel | embedded || broadband router
|
||||
TSeq(Class=64K%IPID=I%TS=2HZ)
|
||||
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
|
||||
|
|
@ -524,7 +524,7 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
Fingerprint Alcatel Speed Touch Pro aDSL modem
|
||||
Fingerprint Alcatel SpeedTouch Pro ADSL modem
|
||||
Class Alcatel | embedded || broadband router
|
||||
TSeq(Class=64K%IPID=I%TS=2HZ)
|
||||
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
|
||||
|
|
@ -2666,7 +2666,7 @@ T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Brother HL-2070N Printer Firmware Ver.1.03 (04.11.18)
|
||||
Fingerprint Brother HL-2070N Printer
|
||||
Fingerprint Brother HL-2070N printer
|
||||
Class Brother | embedded || printer
|
||||
TSeq(Class=RI%gcd=<6%SI=<1C67888&>48B5D%IPID=I%TS=U)
|
||||
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME)
|
||||
|
|
@ -3019,7 +3019,7 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
Fingerprint Chase IOLan Terminal Server
|
||||
Fingerprint Chase/Perle IOLAN terminal server
|
||||
Class Chase | embedded || terminal server
|
||||
T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
|
||||
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
||||
|
|
@ -3031,7 +3031,7 @@ T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
|
|||
PU(Resp=N)
|
||||
|
||||
# Chase/Perle IOLAN Terminal Server v3.5.02 CDi
|
||||
Fingerprint Chase/Perle IOLAN Terminal Server
|
||||
Fingerprint Chase/Perle IOLAN terminal server
|
||||
Class Chase | embedded || terminal server
|
||||
TSeq(Class=TD%gcd=<84%SI=<1E)
|
||||
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=)
|
||||
|
|
@ -3402,7 +3402,7 @@ PU(Resp=N)
|
|||
# The "True Random" is bogus, it is because of sequences
|
||||
# from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869
|
||||
# Cisco Localdirector 430, running OS 2.1
|
||||
Fingerprint Cisco Localdirector load balancer
|
||||
Fingerprint Cisco LocalDirector load balancer
|
||||
Class Cisco | embedded || load balancer
|
||||
TSeq(Class=TR|C)
|
||||
T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
|
||||
|
|
@ -7284,7 +7284,7 @@ PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
|
|||
|
||||
# FreeBSD 4.3-RC
|
||||
# FreeBSD 4.2-RELEASE i386
|
||||
Fingerprint FreeBSD 4.2 - 4.3-RC (X86)
|
||||
Fingerprint FreeBSD 4.2 - 4.3-RC (x86)
|
||||
Class FreeBSD | FreeBSD | 4.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<B23B8&>CD3%IPID=I%TS=100HZ)
|
||||
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
|
||||
|
|
@ -8021,8 +8021,8 @@ T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# GrandStream 486 Voice over IP adapter
|
||||
Fingerprint GrandStream 486 VoIP adapter
|
||||
Class GrandStream | embedded || VoIP adapter
|
||||
Fingerprint Grandstream 486 VoIP adapter
|
||||
Class Grandstream | embedded || VoIP adapter
|
||||
TSeq(Class=C%Val=3883537A%IPID=I%TS=U)
|
||||
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
|
||||
T2(Resp=Y%DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
|
||||
|
|
@ -8034,7 +8034,7 @@ T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
|
||||
|
||||
Fingerprint Grandstream HT-286 POTS<->VoIP phone gateway device
|
||||
Class GrandStream | embedded || VoIP adapter
|
||||
Class Grandstream | embedded || VoIP adapter
|
||||
TSeq(Class=C%Val=66559055%IPID=I%TS=U)
|
||||
T1(Resp=N)
|
||||
T2(Resp=Y%DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
|
||||
|
|
@ -8046,7 +8046,7 @@ T7(DF=Y%W=400%ACK=S++%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
Fingerprint Grandstream BT-100 IP Phone
|
||||
Class GrandStream | embedded || VoIP phone
|
||||
Class Grandstream | embedded || VoIP phone
|
||||
TSeq(Class=C%Val=FBD5528A%IPID=I%TS=U)
|
||||
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
|
||||
T2(Resp=Y%DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=)
|
||||
|
|
@ -8057,8 +8057,8 @@ T6(DF=Y%W=400%ACK=S++%Flags=AR%Ops=)
|
|||
T7(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
Fingerprint GrandStream BT-100 IP Phone
|
||||
Class GrandStream | embedded || VoIP phone
|
||||
Fingerprint Grandstream BT-100 IP Phone
|
||||
Class Grandstream | embedded || VoIP phone
|
||||
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
|
||||
T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=)
|
||||
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
|
||||
|
|
@ -8070,7 +8070,7 @@ PU(Resp=N)
|
|||
|
||||
# Grandstream BudgeTone101 VoIP phone, firmware 1.0.4.50
|
||||
Fingerprint Grandstream BT-101 IP phone
|
||||
Class GrandStream | embedded || VoIP phone
|
||||
Class Grandstream | embedded || VoIP phone
|
||||
TSeq(Class=C%Val=75DFD55D%IPID=I%TS=U)
|
||||
T1(Resp=N)
|
||||
T2(Resp=Y%DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=)
|
||||
|
|
@ -8082,8 +8082,8 @@ T7(DF=Y%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# GrandStream BT-101 with firmware 1.0.5.22
|
||||
Fingerprint GrandStream BT-101 IP phone
|
||||
Class GrandStream | embedded || VoIP phone
|
||||
Fingerprint Grandstream BT-101 IP phone
|
||||
Class Grandstream | embedded || VoIP phone
|
||||
TSeq(Class=C%Val=5CE04AC5%IPID=I%TS=U)
|
||||
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
|
||||
T2(Resp=Y%DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=)
|
||||
|
|
@ -8095,7 +8095,7 @@ T7(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
Fingerprint Grandstream BudgeTone 101 IP Phone
|
||||
Class GrandStream | embedded || VoIP phone
|
||||
Class Grandstream | embedded || VoIP phone
|
||||
TSeq(Class=C%IPID=I%TS=U)
|
||||
T1(Resp=N)
|
||||
T2(Resp=Y%DF=Y%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
|
||||
|
|
@ -8107,7 +8107,7 @@ T7(DF=Y%W=C00|800|1000%ACK=S++%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
Fingerprint Grandstream IP Phone
|
||||
Class GrandStream | embedded || VoIP phone
|
||||
Class Grandstream | embedded || VoIP phone
|
||||
TSeq(Class=C%IPID=I%TS=U)
|
||||
T1(Resp=N)
|
||||
T2(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
|
||||
|
|
@ -8120,8 +8120,8 @@ PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
|||
|
||||
# GrandStream BudgeTone-100 VoIP phone
|
||||
# GrandStream BudgeTone-100 1.0.5.16
|
||||
Fingerprint GrandStream VoIP Phone (BudgeTone-100)
|
||||
Class GrandStream | embedded || VoIP phone
|
||||
Fingerprint Grandstream VoIP Phone (BudgeTone-100)
|
||||
Class Grandstream | embedded || VoIP phone
|
||||
TSeq(Class=C%Val=4D86DFEA|F66461C1%IPID=I%TS=U)
|
||||
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
|
||||
T2(Resp=Y%DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
|
||||
|
|
@ -8134,7 +8134,7 @@ PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
|||
|
||||
# Grandstream Budge Tone 101 VoIP phone, firmware 1.0.5.16
|
||||
Fingerprint Grandstream VoIP Phone (BudgeTone-101)
|
||||
Class GrandStream | embedded || VoIP phone
|
||||
Class Grandstream | embedded || VoIP phone
|
||||
TSeq(Class=C%Val=4F4264AA%IPID=I%TS=U)
|
||||
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
|
||||
T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=)
|
||||
|
|
@ -11247,7 +11247,7 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)
|
||||
|
||||
# Linux kernel 2.4.4-4GB (X86) from Red hat
|
||||
# Linux kernel 2.4.4-4GB (x86) from Red hat
|
||||
Fingerprint Linux 2.4.4
|
||||
Class Linux | Linux | 2.2.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<FC5E4&>19E%IPID=Z%TS=U)
|
||||
|
|
@ -11583,7 +11583,7 @@ T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
|
|||
T7(Resp=N)
|
||||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
|
||||
|
||||
# Linux kernel 2.4.19C13_V (X86) Sun Cobalt RaQ550
|
||||
# Linux kernel 2.4.19C13_V (x86) Sun Cobalt RaQ550
|
||||
Fingerprint Linux 2.4.19
|
||||
Class Linux | Linux | 2.4.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<20DD6C4&>54211%IPID=Z%TS=100HZ)
|
||||
|
|
@ -11597,7 +11597,7 @@ T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
|
|||
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Mandrake 9.1 SMP 2.4.19-16mdksmp #1 SMP Fri Sep 20 16:08:37 CEST 2002 i686 unknown unknown GNU/Linux
|
||||
Fingerprint Linux 2.4.19 (Mandrake, X86)
|
||||
Fingerprint Linux 2.4.19 (Mandrake, x86)
|
||||
Class Linux | Linux | 2.4.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<263CFAC&>55266%IPID=Z%TS=U)
|
||||
T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
|
||||
|
|
@ -11648,7 +11648,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Linux kernel 2.4.20-4GB (X86)
|
||||
# Linux kernel 2.4.20-4GB (x86)
|
||||
Fingerprint Linux 2.4.20
|
||||
Class Linux | Linux | 2.4.X | general purpose
|
||||
TSeq(Class=RI%gcd=<8%SI=<1540758&>1B32B%IPID=I%TS=100HZ)
|
||||
|
|
@ -11752,7 +11752,7 @@ T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Linux localhost 2.4.20-30.9 #1 Wed Feb 4 20:44:26 EST 2004 i686 i686 i386 GNU/Linux
|
||||
Fingerprint Linux 2.4.20 (X86, Redhat 7.3)
|
||||
Fingerprint Linux 2.4.20 (x86, Redhat 7.3)
|
||||
Class Linux | Linux | 2.4.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<3A23C96&>949CB%IPID=Z%TS=100HZ)
|
||||
T1(DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW)
|
||||
|
|
@ -11794,7 +11794,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
|
||||
|
||||
# Linux kernel 2.4.20-wolk4.17s (X86)
|
||||
# Linux kernel 2.4.20-wolk4.17s (x86)
|
||||
# Linux demeter 2.4.20-wolk4.17s #1 i686 unknown
|
||||
# "Devil Linux 1.2.2" 2.4.27-grsec #1 SMP i686 AuthenticAMD unknown+GNU/Linux
|
||||
# Gentoo 2.4.28-hardened-r5 (Up to date with Gentoo Hardened Patches) on a Proliant 1600R
|
||||
|
|
@ -11903,7 +11903,7 @@ T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# SuSE Linux 8.1 (i386) 2.4.21 #4 SMP
|
||||
Fingerprint Linux 2.4.21 (Suse, X86)
|
||||
Fingerprint Linux 2.4.21 (Suse, x86)
|
||||
Class Linux | Linux | 2.4.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<2634758&>55644%IPID=Z%TS=100HZ)
|
||||
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
|
||||
|
|
@ -12043,7 +12043,7 @@ PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
|||
# Linux 2.6.7-hardened-r16 #1 x86_64 AMD Athlon(tm) 64 Processor 3000+ AuthenticAMD GNU/Linux
|
||||
# Slackware 10 kernel 2.6.7
|
||||
# Fedora Core 2 With Kernel 2.6.8-1
|
||||
# Kernel 2.6.3 (X86); Gentoo Distro
|
||||
# Kernel 2.6.3 (x86); Gentoo Distro
|
||||
# Gentoo Base System version 1.4.16 Linux linuxbox 2.6.9 #2 SMP+Pentium III (Coppermine) GenuineIntel GNU/Linux
|
||||
# Linux kernel 2.6.10-1.760_FC3 from Fedora Core 3
|
||||
Fingerprint Linux 2.4.22 or 2.6.3 - 2.6.10
|
||||
|
|
@ -12148,7 +12148,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Adamantix GNU/Linux with Linux 2.4.25-grsec (X86)
|
||||
# Adamantix GNU/Linux with Linux 2.4.25-grsec (x86)
|
||||
Fingerprint Linux 2.4.25 w/grsec (x86)
|
||||
Class Linux | Linux | 2.4.X | general purpose
|
||||
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
|
||||
|
|
@ -12512,7 +12512,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=14|30%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Linux kernel 2.6.8-1-k7-smp (X86) Debian GNU/Linux 3.1 (Sarge - testing)
|
||||
# Linux kernel 2.6.8-1-k7-smp (x86) Debian GNU/Linux 3.1 (Sarge - testing)
|
||||
# Linux 2.6.11-gentoo-r2-ck1
|
||||
# Linux 2.6.11-gentoo-r4 #1 i686 P4CPU+2.40GHz GenuineIntel GNU/Linux Gentoo Base System version 1.4.16
|
||||
# Linux 2.6.11-gentoo-r9-nymph #1i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
|
||||
|
|
@ -12619,7 +12619,7 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(Resp=N)
|
||||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Linux kernel 2.6.10 X86 Slackware 10.0
|
||||
# Linux kernel 2.6.10 x86 Slackware 10.0
|
||||
Fingerprint Linux 2.6.10
|
||||
Class Linux | Linux | 2.6.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<1FB5BDE&>51299%IPID=Z%TS=1000HZ)
|
||||
|
|
@ -12699,9 +12699,9 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Linux Kernel 2.6.3 (X86)
|
||||
# Linux Kernel 2.6.3 (x86)
|
||||
# Linux 2.6.7 #3 Sat Jul 17 13:25:29 EEST 2004 i486
|
||||
Fingerprint Linux 2.6.3 - 2.6.7 (X86)
|
||||
Fingerprint Linux 2.6.3 - 2.6.7 (x86)
|
||||
Class Linux | Linux | 2.6.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<205C682&>528B7%IPID=Z%TS=1000HZ)
|
||||
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
|
||||
|
|
@ -12742,7 +12742,7 @@ PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
|
|||
|
||||
# Slackware current kernel 2.6.9
|
||||
# Fedora Core 3 Linux Kernel 2.6.9 x86 (i386)
|
||||
# Linux kernel 2.6.4-52 from (X86) SuSE Linux 9.1
|
||||
# Linux kernel 2.6.4-52 from (x86) SuSE Linux 9.1
|
||||
# Debian Sarge Linux 2.6.6-1, i686 (x86)
|
||||
Fingerprint Linux 2.6.4 - 2.6.9
|
||||
Class Linux | Linux | 2.6.X | general purpose
|
||||
|
|
@ -12781,7 +12781,7 @@ PU(Resp=N)
|
|||
# Linux 2.6.8-24.11-default #1 Fri Jan 14 13:01:26 UTC 2005 i686 i686 i386 GNU/Linux
|
||||
# Linux 2.6.5-7.155.29-default #1 Thu Jun 2 12:07:05 UTC 2005 i686 i686 i386 GNU/Linux (SuSE+9.2 )
|
||||
# Linux Debian Sarge 2.6.11.7
|
||||
# Linux kernel 2.6.10-4GB (X86) with Debian GNU/Linux 3.1
|
||||
# Linux kernel 2.6.10-4GB (x86) with Debian GNU/Linux 3.1
|
||||
# Linux Kernel 2.6.7-1-686-smp from backports.org Debian Woody
|
||||
Fingerprint Linux 2.6.5 - 2.6.11
|
||||
Class Linux | Linux | 2.6.X | general purpose
|
||||
|
|
@ -12824,8 +12824,8 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Linux kernel 2.6.6-1-k7 (X86) from Debian Testing
|
||||
Fingerprint Linux 2.6.6-1-k7 (X86)
|
||||
# Linux kernel 2.6.6-1-k7 (x86) from Debian Testing
|
||||
Fingerprint Linux 2.6.6-1-k7 (x86)
|
||||
Class Linux | Linux | 2.6.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<235C288&>5A817%IPID=Z%TS=1000HZ)
|
||||
T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
|
||||
|
|
@ -12877,8 +12877,8 @@ T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(Resp=N)
|
||||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Linux kernel 2.6.7 (X86) from Mepis
|
||||
Fingerprint Linux 2.6.7 (X86)
|
||||
# Linux kernel 2.6.7 (x86) from Mepis
|
||||
Fingerprint Linux 2.6.7 (x86)
|
||||
Class Linux | Linux | 2.6.X | general purpose
|
||||
TSeq(Class=RI%gcd=<6%SI=<14E7284&>35813%IPID=Z%TS=U)
|
||||
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW)
|
||||
|
|
@ -12892,7 +12892,7 @@ PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
|||
|
||||
# Linux kernel 2.6.8 on PLD Linux
|
||||
# Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 Community
|
||||
# Linux kernel 2.6.8.1-10mdk (X86) from Mandrake 10.1 community
|
||||
# Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 community
|
||||
# Linux kernel 2.6.7-SMP from Knoppix 3.6
|
||||
# Linux 2.6.8.1-4-k7 i686 GNU/Linux
|
||||
Fingerprint Linux 2.6.7 - 2.6.8
|
||||
|
|
@ -13257,7 +13257,7 @@ T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
|
|||
PU(Resp=N)
|
||||
|
||||
# Bart's Network Boot Disk 2.7 http://www.nu2.nu/bootdisk/network/ i386
|
||||
Fingerprint Bart's Network Boot Disk 2.7 (X86) MS-DOS
|
||||
Fingerprint Bart's Network Boot Disk 2.7 (x86) MS-DOS
|
||||
Class Microsoft | DOS || general purpose
|
||||
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
|
||||
T1(DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M)
|
||||
|
|
@ -13810,7 +13810,7 @@ T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
|
|||
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
|
||||
|
||||
# Microsoft Windows 98 X86 No Service Pack
|
||||
# Microsoft Windows 98 x86 No Service Pack
|
||||
# Microsoft Windows 98 4.10.1998
|
||||
Fingerprint Microsoft Windows 98 4.10.1998
|
||||
Class Microsoft | Windows | 95/98/ME | general purpose
|
||||
|
|
@ -14762,7 +14762,7 @@ T6(Resp=N)
|
|||
T7(Resp=N)
|
||||
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Windows 2000 Version 5.0 Build 2195 SP 4 X86
|
||||
# Windows 2000 Version 5.0 Build 2195 SP 4 x86
|
||||
Fingerprint Microsoft Windows 2000 SP4
|
||||
Class Microsoft | Windows | NT/2K/XP | general purpose
|
||||
TSeq(Class=TR%gcd=<6%IPID=I)
|
||||
|
|
@ -16686,7 +16686,7 @@ PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
|||
|
||||
# 1262
|
||||
# NetBSD 1.6.2 (GENERIC) #0: Wed Feb 11 08:05:11 UTC 2004 sparc
|
||||
Fingerprint NetBSD 1.6.2 (X86)
|
||||
Fingerprint NetBSD 1.6.2 (x86)
|
||||
Class NetBSD | NetBSD || general purpose
|
||||
T1(DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
|
||||
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
||||
|
|
@ -16697,7 +16697,7 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# NetBSD 1.6.2 on X86
|
||||
# NetBSD 1.6.2 on x86
|
||||
# Avocent Switchview net KVM switch - this is a embedded device that makes a regular KVM accessible over IP.
|
||||
# NetBSD 2.0_BETA i386
|
||||
Fingerprint NetBSD 1.6.2 - 2.0_BETA or Avocent Switchview net KVM switch
|
||||
|
|
@ -16988,7 +16988,7 @@ PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
|||
|
||||
# Netopia R3100-I DSL Router Firmware version v4.7.2
|
||||
# Netopia 7100-C with firmware v4.6.3
|
||||
Fingerprint Netopia DSL Router
|
||||
Fingerprint Netopia DSL router
|
||||
Class Netopia | embedded || broadband router
|
||||
TSeq(Class=TD%gcd=<EA64%SI=<10E%IPID=I%TS=U)
|
||||
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
|
||||
|
|
@ -17543,7 +17543,7 @@ PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
|||
# Novell NetWare 5.1 SP8
|
||||
# Novell NetWare 6.5 SP3
|
||||
# Novell Open Enterprise Server, NetWare 6.5 Support Pack Revision 03
|
||||
# Novell NetWare Open Enterprise Server (OES) (English, First Customer Shipping version) installed with everything on it, X86
|
||||
# Novell NetWare Open Enterprise Server (OES) (English, First Customer Shipping version) installed with everything on it, x86
|
||||
Fingerprint Novell NetWare 5.1 SP8 or 6.5 SP3
|
||||
Class Novell | NetWare | 5.X | general purpose
|
||||
Class Novell | NetWare | 6.X | general purpose
|
||||
|
|
@ -18050,7 +18050,7 @@ T7(Resp=N)
|
|||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# OpenBSD 3.4 GENERIC#18 i386
|
||||
Fingerprint OpenBSD 3.4 (X86)
|
||||
Fingerprint OpenBSD 3.4 (x86)
|
||||
Class OpenBSD | OpenBSD | 3.X | general purpose
|
||||
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
|
||||
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
|
||||
|
|
@ -18314,7 +18314,7 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
|
|||
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
||||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# Packet8 BPA410 Broadband Phone Adapter
|
||||
# Packet8 BPA410 broadband phone adapter
|
||||
Fingerprint Packet8 BPA410 Broadband Phone Adapter
|
||||
Class Packet8 | embedded || VoIP adapter
|
||||
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
|
||||
|
|
@ -19939,7 +19939,7 @@ T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
|
|||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
|
||||
|
||||
# SonicWALL TZ 170 SonicOS 2.5.0.2 Enhanced
|
||||
Fingerprint SonicWALL TZ 170
|
||||
Fingerprint SonicWALL TZ 170 firewall
|
||||
Class SonicWALL | SonicOS || firewall
|
||||
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
|
||||
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
|
||||
|
|
@ -19951,7 +19951,7 @@ T6(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
|
|||
T7(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=)
|
||||
PU(Resp=N)
|
||||
|
||||
Fingerprint SonicWALL TZ 170 Firewall
|
||||
Fingerprint SonicWALL TZ 170 firewall
|
||||
Class SonicWALL | SonicOS || firewall
|
||||
TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
|
||||
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
|
||||
|
|
@ -19966,7 +19966,7 @@ PU(Resp=N)
|
|||
# SonicWALL TZ170 Firewall with SonicOS
|
||||
# SonicWALL FZ170 Unrestricted (firewall/VPN appliances) with SonicOS 2.6
|
||||
# SonicOS 3.0.0.4-41s on SonicWALL TZ 170
|
||||
Fingerprint SonicWALL TZ170 Firewall
|
||||
Fingerprint SonicWALL TZ 170 firewall
|
||||
Class SonicWALL | SonicOS || firewall
|
||||
TSeq(Class=64K%IPID=I%TS=2HZ)
|
||||
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
|
||||
|
|
@ -21620,7 +21620,7 @@ T7(Resp=N)
|
|||
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
|
||||
|
||||
# ZyXEL Zywall 10W (Firmware V3.62(WH.7))
|
||||
Fingerprint ZyXEL Zywall 10W firewall
|
||||
Fingerprint ZyXEL ZyWALL 10W firewall
|
||||
Class ZyXEL | ZyNOS || firewall
|
||||
TSeq(Class=TD%gcd=<2004%SI=<3C%IPID=I%TS=U)
|
||||
T1(DF=N%W=5780%ACK=S++%Flags=AS%Ops=M)
|
||||
|
|
|
|||
|
|
@ -2973,6 +2973,7 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: eMule\r\n.*<title>eMule (\d[-.\w]+)
|
|||
match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: eMule\r\n.*<title>eMule Plus (\d[-.\w]+) |s p/eMule Plus P2P/ v/$1/
|
||||
match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: aMule\r\n.*<title>aMule (\d[-.\w]+) - Web Control Panel</title>|s p/aMule P2P/ v/$1/
|
||||
match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: aMule\r\n| p/aMule P2P/
|
||||
match http m|^HTTP/1\.0 200 OK\r\nServer: Agent-ListenServer-HttpSvr/1\.0\r\n.*<ComputerName>([-.\w]+)</ComputerName><version>([\d\.]+)</version>|s p/Network Associates ePolicy Orchestrator/ i/Computername: $1 Version: $2/
|
||||
# Network Associates EPO 3.0
|
||||
match http m|^HTTP/1\.0 200 OK\r\nServer: Agent-ListenServer-HttpSvr/1\.0\r\n.*<ComputerName>([-.\w]+)</ComputerName>|s p/Network Associates ePolicy Orchestrator/ i/Computername: $1/
|
||||
match http m|^HTTP/1\.0 403 Forbidden\r\nServer: Agent-ListenServer-HttpSvr/1\.0\r\n| p/Network Associates ePolicy Orchestrator/
|
||||
|
|
@ -5528,8 +5529,14 @@ rarity 5
|
|||
ports 5060
|
||||
# Some VoIP phones take longer to respond
|
||||
totalwaitms 7500
|
||||
|
||||
# SIP Proxy Servers
|
||||
# OpenSER SIP Server
|
||||
match sip m|Server: OpenS[Ee][Rr] \((.*?) \((.*?)\)\)| p/OpenSER SIP Server/ v/$1/ i/$2/
|
||||
match sip m|Server: OpenS[Ee][Rr] \(([\w\d\.-]+) \(([\d\w/]+)\)\)| p/OpenSER SIP Server/ v/$1/ i/$2/
|
||||
# SIP Express Router
|
||||
match sip m|Server: Sip EXpress router \(([\w\d\.-]+) \(([\d\w/]+)\)\)| p/SIP Express Router/ v/$1/ i/$2/
|
||||
|
||||
# SIP User Agents
|
||||
# Polycom SoundPoint
|
||||
match sip m|User-Agent: PolycomSoundPointIP-SPIP_(\d+)-UA/([\d\.]+)| p/Polycom SoundPoint/ v/$1/ i/firmware $2/ d/VoIP phone/
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue