diff --git a/CHANGELOG b/CHANGELOG
index 3c7951a11..4edcc7b1e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -25,21 +25,27 @@ o Chagned the interesting ports array from a 65K-member array of
   some cases, and should also give a slight runtime performance
   boost. This patch was written by Paul Tarjan (ptarjan(a)gmail.com).
 
-o Integrated a bunch of nmap-service-probes fingerprints from Doug
+o Integrated a ton of nmap-service-probes fingerprints from Doug
   Hoyte (doug(a)hcsw.org)
 
-o The OS fingerprint is now provided in XML output if debugging is
-  enabled (-d) or verbosity is at least 2 (-v -v).  This patch was
-  sent by Okan Demirmen (okan(a)demirmen.com)
+o Integrated many nmap-service-probes changes from Bo Jiang
+  (jiangbo(a)brandeis.edu)
 
 o Added a stripped-down version of Dug Song's excellent libdnet
   networking library (v. 1.10).  This allows Nmap to send raw ethernet
   frames for the new ARP ping feature.
 
+o The OS fingerprint is now provided in XML output if debugging is
+  enabled (-d) or verbosity is at least 2 (-v -v).  This patch was
+  sent by Okan Demirmen (okan(a)demirmen.com)
+
 o Fixed the way tcp connect scan (-sT) respons to ICMP network
   unreachable responses (patch by Richard Moore
   (rich(a)westpoint.ltd.uk).
 
+o Changed routethrough() to use libdnet rather than all of my custom
+  code.
+
 o Fixed a crash problem related to non-portable varargs (vsnprintf)
   usage. Reports of this crash came from Alan William Somers
   (somers(a)its.caltech.edu) and Christophe (chris.branch(a)gmx.de).
@@ -94,6 +100,11 @@ o ultra_scan() now sets pseudo-random ACK values (rather than 0) for
 o Added a bunch of RPC numbers from nmap-rpc maintainer Eilon Gishri
   (eilon(a)aristo.tau.ac.il)
 
+o Added 'leet ASCII art to the confugrator!  ARTIST NOTE: If you think
+  the ASCII art sucks, feel free to send me alternatives.  Note that
+  only people compiling the UNIX source code get this. (ASCII artist
+  unknown).
+
 o Added a distcc probes and a bunch of smtp matches from Dirk Mueller
   (mueller(a)kde.org) to nmap-service-probes.  Also added AFS version
   probe and matches from Lionel Cons (lionel.cons(a)cern.ch).  And
@@ -126,11 +137,6 @@ o Changed from CVS to Subversion source control system (which
   change users will see is that "Id" tags in file headers use the SVN
   format for version numbering and such.
 
-o Added 'leet ASCII art to the confugrator!  ARTIST NOTE: If you think
-  the ASCII art sucks, feel free to send me alternatives.  Note that
-  only people compiling the UNIX source code get this. (ASCII artist
-  unknown).
-
 Nmap 3.81
 
 o Nmap now ships with and installs (in the same directory as other
diff --git a/Makefile.in b/Makefile.in
index 9385337d6..dbf3bae84 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,4 +1,4 @@
-export NMAP_VERSION = 3.83
+export NMAP_VERSION = 3.83.SOC1
 NMAP_NAME= nmap
 NMAP_URL= http://www.insecure.org/nmap/
 NMAP_PLATFORM=@host@
diff --git a/NmapOps.cc b/NmapOps.cc
index 0a8890ee4..7e68537cc 100644
--- a/NmapOps.cc
+++ b/NmapOps.cc
@@ -190,6 +190,7 @@ void NmapOps::Initialize() {
   debugging = DEBUGGING;
   verbose = DEBUGGING;
   randomize_hosts = 0;
+  sendpref = PACKET_SEND_NOPREF;
   spoofsource = 0;
   device[0] = '\0';
   interactivemode = 0;
@@ -328,6 +329,13 @@ void NmapOps::ValidateOptions() {
    fatal("Ping scan is not valid with any other scan types (the other ones all include a ping scan");
  }
 
+ if (sendpref == PACKET_SEND_NOPREF) {
+#ifdef WIN32
+   sendpref = PACKET_SEND_ETH_STRONG;
+#else
+   sendpref = PACKET_SEND_IP_WEAK;
+#endif
+ }
 /* We start with stuff users should not do if they are not root */
   if (!isr00t) {
 
diff --git a/NmapOps.h b/NmapOps.h
index 058955026..f30955808 100644
--- a/NmapOps.h
+++ b/NmapOps.h
@@ -122,6 +122,9 @@ class NmapOps {
   int TimeSinceStartMS(struct timeval *now=NULL); 
   struct in_addr v4source();
   const struct in_addr *v4sourceip();
+
+
+
   bool TCPScan(); /* Returns true if at least one chosen scan type is TCP */
   bool UDPScan(); /* Returns true if at least one chosen scan type is UDP */
 
@@ -138,6 +141,26 @@ class NmapOps {
 		             user). */
   int isr00t;
   int debugging;
+
+#define PACKET_SEND_NOPREF 1
+#define PACKET_SEND_ETH_WEAK 2
+#define PACKET_SEND_ETH_STRONG 4
+#define PACKET_SEND_ETH 6
+#define PACKET_SEND_IP_WEAK 8
+#define PACKET_SEND_IP_STRONG 16
+#define PACKET_SEND_IP 24
+
+  /* How should we send raw IP packets?  Nmap can generally use either
+     ethernet or raw ip sockets.  Which is better depends on platform
+     and goals.  A _STRONG preference means that Nmap should use the
+     preferred method whenever it is possible (obviously it isn't
+     always possible -- sending ethernet frames won't work over a PPP
+     connection).  This is useful when the other type doesn't work at
+     all.  A _WEAK preference means that Nmap may use the other type
+     where it is substantially more efficient to do so. For example,
+     Nmap will still do an ARP ping scan of a local network even when
+     the pref is SEND_IP_WEAK */
+  int sendpref;
   bool packetTrace() { return (debugging >= 3)? true : pTrace;  }
   bool versionTrace() { return packetTrace()? true : vTrace;  }
   // Note that packetTrace may turn on at high debug levels even if
diff --git a/Target.cc b/Target.cc
index cae3f0ebc..a5edd5e4e 100644
--- a/Target.cc
+++ b/Target.cc
@@ -119,17 +119,21 @@ void Target::Initialize() {
   osscan_performed = 0;
   wierd_responses = flags = 0;
   memset(&to, 0, sizeof(to));
-  device[0] = '\0';
   memset(&targetsock, 0, sizeof(targetsock));
   memset(&sourcesock, 0, sizeof(sourcesock));
-  targetsocklen = sourcesocklen = 0;
+  memset(&nexthopsock, 0, sizeof(nexthopsock));
+  targetsocklen = sourcesocklen = nexthopsocklen = 0;
+  directly_connected = -1;
   targetipstring[0] = '\0';
   nameIPBuf = NULL;
   memset(&MACaddress, 0, sizeof(MACaddress));
   memset(&SrcMACaddress, 0, sizeof(SrcMACaddress));
-  MACaddress_set = SrcMACaddress_set = false;
+  memset(&NextHopMACaddress, 0, sizeof(NextHopMACaddress));
+  MACaddress_set = SrcMACaddress_set = NextHopMACaddress_set = false;
   htn.msecs_used = 0;
   htn.toclock_running = false;
+  interface_type = devt_other;
+  devname[0] = devfullname[0] = '\0';
 }
 
 void Target::Recycle() {
@@ -177,7 +181,8 @@ void Target::GenerateIPString() {
 /* Fills a sockaddr_storage with the AF_INET or AF_INET6 address
      information of the target.  This is a preferred way to get the
      address since it is portable for IPv6 hosts.  Returns 0 for
-     success. */
+     success. ss_len must be provided.  It is not examined, but is set
+     to the size of the sockaddr copied in. */
 int Target::TargetSockAddr(struct sockaddr_storage *ss, size_t *ss_len) {
   assert(ss);
   assert(ss_len);  
@@ -307,6 +312,41 @@ const char *Target::NameIP() {
   return NameIP(nameIPBuf, MAXHOSTNAMELEN + INET6_ADDRSTRLEN);
 }
 
+  /* Returns the next hop for sending packets to this host.  Returns true if
+     next_hop was filled in.  It might be false, for example, if
+     next_hop has never been set */
+bool Target::nextHop(struct sockaddr_storage *next_hop, size_t *next_hop_len) {
+  if (nexthopsocklen <= 0)
+    return false;
+  assert(nexthopsocklen <= sizeof(*next_hop));
+  if (next_hop)
+    memcpy(next_hop, &nexthopsock, nexthopsocklen);
+  if (next_hop_len)
+    *next_hop_len = nexthopsocklen;
+  return true;
+}
+
+  /* If the host is directly connected on a network, set and retrieve
+     that information here.  directlyConnected() will abort if it hasn't
+     been set yet.  */
+void Target::setDirectlyConnected(bool connected) {
+  directly_connected = connected? 1 : 0;
+}
+
+bool Target::directlyConnected() {
+  assert(directly_connected == 0 || directly_connected == 1);
+  return directly_connected;
+}
+
+/* Note that it is OK to pass in a sockaddr_in or sockaddr_in6 casted
+     to sockaddr_storage */
+void Target::setNextHop(struct sockaddr_storage *next_hop, size_t next_hop_len) {
+  assert(next_hop_len > 0 && next_hop_len <= sizeof(nexthopsock));
+  memcpy(&nexthopsock, next_hop, next_hop_len);
+  nexthopsocklen = next_hop_len;
+}
+
+
   /* Starts the timeout clock for the host running (e.g. you are
      beginning a scan).  If you do not have the current time handy,
      you can pass in NULL.  When done, call stopTimeOutClock (it will
@@ -360,6 +400,22 @@ int Target::setSrcMACAddress(const u8 *addy) {
   return 0;
 }
 
+int Target::setNextHopMACAddress(const u8 *addy) {
+  if (!addy) return 1;
+  memcpy(NextHopMACaddress, addy, 6);
+  NextHopMACaddress_set = 1;
+  return 0;
+}
+
+/* Set the device names so that they can be returned by deviceName()
+   and deviceFullName().  The normal name may not include alias
+   qualifier, while the full name may include it (e.g. "eth1:1").  If
+   these are non-null, they will overwrite the stored version */
+void Target::setDeviceNames(const char *name, const char *fullname) {
+  if (name) Strncpy(devname, name, sizeof(devname));
+  if (fullname) Strncpy(devfullname, fullname, sizeof(devfullname));
+}
+
 /* Returns the 6-byte long MAC address, or NULL if none has been set */
 const u8 *Target::MACAddress() {
   return (MACaddress_set)? MACaddress : NULL;
@@ -368,3 +424,7 @@ const u8 *Target::MACAddress() {
 const u8 *Target::SrcMACAddress() {
   return (SrcMACaddress_set)? SrcMACaddress : NULL;
 }
+
+const u8 *Target::NextHopMACAddress() {
+  return (NextHopMACaddress_set)? NextHopMACaddress : NULL;
+}
diff --git a/Target.h b/Target.h
index 41ac66316..2d2015a9c 100644
--- a/Target.h
+++ b/Target.h
@@ -122,7 +122,8 @@ class Target {
   /* Fills a sockaddr_storage with the AF_INET or AF_INET6 address
      information of the target.  This is a preferred way to get the
      address since it is portable for IPv6 hosts.  Returns 0 for
-     success. */
+     success. ss_len must be provided.  It is not examined, but is set
+     to the size of the sockaddr copied in. */
   int TargetSockAddr(struct sockaddr_storage *ss, size_t *ss_len);
   /* Note that it is OK to pass in a sockaddr_in or sockaddr_in6 casted
      to sockaddr_storage */
@@ -159,6 +160,27 @@ class Target {
   /* This next version returns a STATIC buffer -- so no concurrency */
   const char *NameIP();
 
+  /* If the host is directly connected on a network, set and retrieve
+     that information here.  directlyConnected() will abort if it hasn't
+     been set yet.  */
+  void setDirectlyConnected(bool connected);
+  bool directlyConnected();
+
+  /* If the host is NOT directly connected, you can set the next hop
+     value here. It is OK to pass in a sockaddr_in or sockaddr_in6
+     casted to sockaddr_storage*/
+  void setNextHop(struct sockaddr_storage *next_hop, size_t next_hop_len);
+  /* Returns the next hop for sending packets to this host.  Returns true if
+     next_hop was filled in.  It might be false, for example, if
+     next_hop has never been set */
+  bool nextHop(struct sockaddr_storage *next_hop, size_t *next_hop_len);
+
+  /* Sets the interface type to one of: 
+     devt_ethernet, devt_loopback, devt_p2p, devt_other
+   */
+  void setIfType(devtype iftype) { interface_type = iftype; }
+  /* Returns -1 if it has not yet been set with setIfType() */
+  devtype ifType() { return interface_type; }
   /* Starts the timeout clock for the host running (e.g. you are
      beginning a scan).  If you do not have the current time handy,
      you can pass in NULL.  When done, call stopTimeOutClock (it will
@@ -177,9 +199,20 @@ class Target {
   /* Takes a 6-byte MAC address */
   int setMACAddress(const u8 *addy);
   int setSrcMACAddress(const u8 *addy);
+  int setNextHopMACAddress(const u8 *addy); // this should be the target's own MAC if directlyConnected()
+
   /* Returns a pointer to 6-byte MAC address, or NULL if none is set */
   const u8 *MACAddress();
   const u8 *SrcMACAddress();
+  const u8 *NextHopMACAddress();
+
+/* Set the device names so that they can be returned by deviceName()
+   and deviceFullName().  The normal name may not include alias
+   qualifier, while the full name may include it (e.g. "eth1:1").  If
+   these are non-null, they will overwrite the stored version */
+  void setDeviceNames(const char *name, const char *fullname);
+  const char *deviceName() { return *devname? devname : NULL; }
+  const char *deviceFullName() { return *devfullname? devfullname : NULL; }
 
   struct seq_info seq;
   FingerPrintResults *FPR;
@@ -191,26 +224,27 @@ class Target {
   int wierd_responses; /* echo responses from other addresses, Ie a network broadcast address */
   unsigned int flags; /* HOST_UP, HOST_DOWN, HOST_FIREWALLED, HOST_BROADCAST (instead of HOST_BROADCAST use wierd_responses */
   struct timeout_info to;
-  char device[64]; /* The device we transmit on -- make sure to adjust some str* calls if I ever change this size*/
 
- private:
+
+  private:
   char *hostname; // Null if unable to resolve or unset
   void Initialize();
   void FreeInternal(); // Free memory allocated inside this object
  // Creates a "presentation" formatted string out of the IPv4/IPv6 address
   void GenerateIPString();
-  struct sockaddr_storage targetsock, sourcesock;
-  size_t targetsocklen, sourcesocklen;
+  struct sockaddr_storage targetsock, sourcesock, nexthopsock;
+  size_t targetsocklen, sourcesocklen, nexthopsocklen;
+  int directly_connected; // -1 = unset; 0 = no; 1 = yes
 #ifndef INET6_ADDRSTRLEN
 #define INET6_ADDRSTRLEN 46
 #endif
   char targetipstring[INET6_ADDRSTRLEN];
   char *nameIPBuf; /* for the NameIP(void) function to return */
-  u8 MACaddress[6];
-  bool MACaddress_set;
-  u8 SrcMACaddress[6];
-  bool SrcMACaddress_set;
+  u8 MACaddress[6], SrcMACaddress[6], NextHopMACaddress[6];  
+  bool MACaddress_set, SrcMACaddress_set, NextHopMACaddress_set;
   struct host_timeout_nfo htn;
+  devtype interface_type;
+  char devname[32], devfullname[32];
 };
 
 #endif /* TARGET_H */
diff --git a/docs/nmap.dtd b/docs/nmap.dtd
index 12ed78f9d..235e45153 100644
--- a/docs/nmap.dtd
+++ b/docs/nmap.dtd
@@ -177,6 +177,9 @@
 
 <!-- these elements are written by output.c: printosscanoutput() -->
 
+                        hostname        CDATA           #IMPLIED
+                        ostype          CDATA           #IMPLIED
+                        devicetype      CDATA           #IMPLIED
 <!ELEMENT os		( portused* , osclass*, osmatch* ) >
 
 <!ELEMENT portused	EMPTY >
diff --git a/docs/nmap.usage.txt b/docs/nmap.usage.txt
index 8e51e930b..a28baf97c 100644
--- a/docs/nmap.usage.txt
+++ b/docs/nmap.usage.txt
@@ -1,4 +1,4 @@
-Nmap 3.83.DC1 Usage: nmap [Scan Type(s)] [Options] <host or net list>
+Nmap 3.83.SOC1 Usage: nmap [Scan Type(s)] [Options] <host or net list>
 Some Common Scan Types ('*' options require root privileges)
 * -sS TCP SYN stealth port scan (default if privileged (root))
   -sT TCP connect() port scan (default for unprivileged users)
diff --git a/idle_scan.cc b/idle_scan.cc
index 8f6871416..2b48313de 100644
--- a/idle_scan.cc
+++ b/idle_scan.cc
@@ -149,6 +149,8 @@ struct idle_proxy_info {
                  initialize_idleproxy) listens for TCP packets from
                  the probe_port of the proxy box */
   int rawsd; /* Socket descriptor for sending probe packets to the proxy */
+  struct eth_nfo eth; // For when we want to send probes via raw IP instead.
+  struct eth_nfo *ethptr; // points to eth if filled out, otherwise NULL
 };
 
 
@@ -189,7 +191,7 @@ int ipid_proxy_probe(struct idle_proxy_info *proxy, int *probes_sent,
     gettimeofday(&tv_sent[tries], NULL);
 
     /* Time to send the pr0be!*/
-    send_tcp_raw(proxy->rawsd, proxy->host.v4sourceip(), 
+    send_tcp_raw(proxy->rawsd, proxy->ethptr, proxy->host.v4sourceip(), 
 		 proxy->host.v4hostip(), o.ttl, base_port + tries,
 		 proxy->probe_port,
 		 seq_base + (packet_send_count++ * 500) + 1, ack, 
@@ -281,7 +283,6 @@ void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
   char *p, *q;
   char *endptr = NULL;
   int seq_response_num;
-  char *dev;
   int newipid;
   int i;
   char filter[512]; /* Libpcap filter string */
@@ -297,6 +298,7 @@ void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
   int distance;
   u16 ipids[NUM_IPID_PROBES]; 
   u8 probe_returned[NUM_IPID_PROBES];
+  struct route_nfo rnfo;
   assert(proxy);
   assert(proxyName);
 
@@ -330,47 +332,66 @@ void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
     fatal("Could not resolve idlescan zombie host: %s", name);
   }
   proxy->host.setTargetSockAddr(&ss, sslen);
-
+  
   /* Lets figure out the appropriate source address to use when sending
      the pr0bez */
+  proxy->host.TargetSockAddr(&ss, &sslen);
+  if (!route_dst(&ss, &rnfo))
+    fatal("Unable to find appropriate source address and device interface to use when sending packets to %s", proxyName);
+  
   if (o.spoofsource) {
     o.SourceSockAddr(&ss, &sslen);
     proxy->host.setSourceSockAddr(&ss, sslen);
-    Strncpy(proxy->host.device, o.device, sizeof(proxy->host.device));    
+    proxy->host.setDeviceNames(o.device, o.device);
   } else {
-    struct sockaddr_in *sin = (struct sockaddr_in *)&ss;
-    sslen = sizeof(*sin);
-    memset(sin, 0, sslen);
-    dev = routethrough(proxy->host.v4hostip(), &(sin->sin_addr));  
-    if (!dev) fatal("Unable to find appropriate source address and device interface to use when sending packets to %s", proxyName);
-    Strncpy(proxy->host.device, dev, sizeof(proxy->host.device));
-    sin->sin_family = AF_INET;
-#if HAVE_SOCKADDR_SA_LEN
-    sin->sin_len = sslen;
-#endif
-    proxy->host.setSourceSockAddr((struct sockaddr_storage *) sin, sslen);
+    proxy->host.setDeviceNames(rnfo.ii.devname, rnfo.ii.devfullname);
+    proxy->host.setSourceSockAddr(&rnfo.srcaddr, sizeof(rnfo.srcaddr));
   }
+  if (rnfo.direct_connect) {
+    proxy->host.setDirectlyConnected(true);
+  } else {
+    proxy->host.setDirectlyConnected(false);
+    proxy->host.setNextHop(&rnfo.nexthop, 
+			   sizeof(rnfo.nexthop));
+  }
+  proxy->host.setIfType(rnfo.ii.device_type);
+  if (rnfo.ii.device_type == devt_ethernet)
+    proxy->host.setSrcMACAddress(rnfo.ii.mac);
+  
   /* Now lets send some probes to check IPID algorithm ... */
   /* First we need a raw socket ... */
-  if ((proxy->rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 )
-    pfatal("socket trobles in get_fingerprint");
-  unblock_socket(proxy->rawsd);
-  broadcast_socket(proxy->rawsd);
+  if ((o.sendpref & PACKET_SEND_ETH) &&  proxy->host.ifType() == devt_ethernet) {
+    if (!setTargetNextHopMAC(&proxy->host))
+      fatal("%s: Failed to determine dst MAC address for Idle proxy", 
+	    __FUNCTION__);
+    memcpy(proxy->eth.srcmac, proxy->host.SrcMACAddress(), 6);
+    memcpy(proxy->eth.dstmac, proxy->host.NextHopMACAddress(), 6);
+    proxy->eth.ethsd = eth_open(proxy->host.deviceName());
+    proxy->rawsd = -1;
+    proxy->ethptr = &proxy->eth;
+  } else {
+    if ((proxy->rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 )
+      pfatal("socket trobles in get_fingerprint");
+    unblock_socket(proxy->rawsd);
+    broadcast_socket(proxy->rawsd);
 #ifndef WIN32
-  sethdrinclude(proxy->rawsd);
+    sethdrinclude(proxy->rawsd);
 #endif
+    proxy->eth.ethsd = NULL;
+    proxy->ethptr = NULL;
+  }
 
 /* Now for the pcap opening nonsense ... */
  /* Note that the snaplen is 152 = 64 byte max IPhdr + 24 byte max link_layer
   * header + 64 byte max TCP header. */
-  proxy->pd = my_pcap_open_live(proxy->host.device, 152,  (o.spoofsource)? 1 : 0, 50);
+  proxy->pd = my_pcap_open_live(proxy->host.deviceName(), 152,  (o.spoofsource)? 1 : 0, 50);
 
   p = strdup(proxy->host.targetipstr());
   q = strdup(inet_ntoa(proxy->host.v4source()));
   snprintf(filter, sizeof(filter), "tcp and src host %s and dst host %s and src port %hu", p, q, proxy->probe_port);
  free(p); 
  free(q);
- set_pcap_filter(&(proxy->host), proxy->pd, flt_icmptcp, filter);
+ set_pcap_filter(proxy->host.deviceName(), proxy->pd, flt_icmptcp, filter);
 /* Windows nonsense -- I am not sure why this is needed, but I should
    get rid of it at sometime */
 
@@ -391,7 +412,7 @@ void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
        a response with the exact request for timing purposes.  So I
        think I'll use TH_SYN, although it is a tough call. */
     /* We can't use decoys 'cause that would screw up the IPIDs */
-    send_tcp_raw(proxy->rawsd, proxy->host.v4sourceip(), 
+    send_tcp_raw(proxy->rawsd, proxy->ethptr, proxy->host.v4sourceip(), 
 		 proxy->host.v4hostip(), o.ttl, 
 		 o.magic_port + probes_sent + 1, proxy->probe_port, 
 		 sequence_base + probes_sent + 1, 0, TH_SYN|TH_ACK, 
@@ -428,7 +449,6 @@ void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
 	continue;
 
       if (ip->ip_p == IPPROTO_TCP) {
-	/*       readtcppacket((char *) ip, ntohs(ip->ip_len));  */
 	tcp = ((struct tcphdr *) (((char *) ip) + 4 * ip->ip_hl));
 	if (ntohs(tcp->th_dport) < (o.magic_port+1) || ntohs(tcp->th_dport) - o.magic_port > NUM_IPID_PROBES  || ntohs(tcp->th_sport) != proxy->probe_port || ((tcp->th_flags & TH_RST) == 0)) {
 	  if (o.debugging > 1) error("Received unexpected response packet from %s during initial ipid zombie testing", inet_ntoa(ip->ip_src));
@@ -508,7 +528,8 @@ void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName,
   if (first_target) {  
     for (probes_sent = 0; probes_sent < 4; probes_sent++) {  
       if (probes_sent) usleep(50000);
-      send_tcp_raw(proxy->rawsd, first_target, proxy->host.v4hostip(), 
+      send_tcp_raw(proxy->rawsd, proxy->ethptr, first_target, 
+		   proxy->host.v4hostip(), 
 		   o.ttl, o.magic_port, proxy->probe_port, 
 		   sequence_base + probes_sent + 1, 0, TH_SYN|TH_ACK, 
 		   ack, NULL, 0, NULL, 0);
@@ -634,6 +655,7 @@ int idlescan_countopen2(struct idle_proxy_info *proxy,
   int sleeptime;
   int lasttry = 0;
   int dotry3 = 0;
+  struct eth_nfo eth;
 
   if (seq == 0) seq = get_random_u32();
 
@@ -643,6 +665,15 @@ int idlescan_countopen2(struct idle_proxy_info *proxy,
   if (sent_time) memset(sent_time, 0, sizeof(*sent_time));
   if (rcv_time) memset(rcv_time, 0, sizeof(*rcv_time));
 
+  if (proxy->rawsd < 0) {
+    if (!setTargetNextHopMAC(target))
+      fatal("%s: Failed to determine dst MAC address for Idle proxy", 
+	    __FUNCTION__);
+    memcpy(eth.srcmac, target->SrcMACAddress(), 6);
+    memcpy(eth.dstmac, target->NextHopMACAddress(), 6);
+    eth.ethsd = eth_open(target->deviceName());
+  } else eth.ethsd = NULL;
+
   /* I start by sending out the SYN pr0bez */
   for(pr0be = 0; pr0be < numports; pr0be++) {
     if (o.scan_delay) enforce_scan_delay(NULL);
@@ -652,7 +683,8 @@ int idlescan_countopen2(struct idle_proxy_info *proxy,
        but doing it the straightforward way (using the same decoys as
        we use in probing the proxy box is risky.  I'll have to think
        about this more. */
-    send_tcp_raw(proxy->rawsd, proxy->host.v4hostip(), target->v4hostip(),
+    send_tcp_raw(proxy->rawsd, eth.ethsd? &eth : NULL, proxy->host.v4hostip(), 
+		 target->v4hostip(),
 		 o.ttl, proxy->probe_port, ports[pr0be], seq, 0, TH_SYN, 0,
 		 NULL, 0, o.extra_payload, o.extra_payload_length);
   }
@@ -739,6 +771,7 @@ int idlescan_countopen2(struct idle_proxy_info *proxy,
     if (rcv_time) *rcv_time = latestchange;
   }
   if (newipid > 0) proxy->latestid = newipid;
+  if (eth.ethsd) { eth_close(eth.ethsd); eth.ethsd = NULL; }
   return openports;
 }
 
diff --git a/libdnet-stripped/Makefile b/libdnet-stripped/Makefile
index 8485e7da4..eff85618e 100644
--- a/libdnet-stripped/Makefile
+++ b/libdnet-stripped/Makefile
@@ -91,7 +91,7 @@ AUTOMAKE = ${SHELL} /home/fyodor/nmap/libdnet-stripped/config/missing --run auto
 AWK = gawk
 CC = gcc
 CCDEPMODE = depmode=none
-CFLAGS = -g -O2 -Wall
+CFLAGS = -g -Wall
 CHECKINC = 
 CHECKLIB = 
 CPP = gcc -E
diff --git a/libdnet-stripped/src/Makefile b/libdnet-stripped/src/Makefile
index ed936fe8e..43ca4db94 100644
--- a/libdnet-stripped/src/Makefile
+++ b/libdnet-stripped/src/Makefile
@@ -96,7 +96,7 @@ AUTOMAKE = ${SHELL} /home/fyodor/nmap/libdnet-stripped/config/missing --run auto
 AWK = gawk
 CC = gcc
 CCDEPMODE = depmode=none
-CFLAGS = -g -O2 -Wall
+CFLAGS = -g -Wall
 CHECKINC = 
 CHECKLIB = 
 CPP = gcc -E
diff --git a/libdnet-stripped/src/intf.c b/libdnet-stripped/src/intf.c
index e523054ca..faa416760 100644
--- a/libdnet-stripped/src/intf.c
+++ b/libdnet-stripped/src/intf.c
@@ -119,12 +119,16 @@ intf_t *
 intf_open(void)
 {
 	intf_t *intf;
-	
+	int one = 1;
+
 	if ((intf = calloc(1, sizeof(*intf))) != NULL) {
 		intf->fd = intf->fd6 = -1;
 		
 		if ((intf->fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
 			return (intf_close(intf));
+
+		setsockopt(intf->fd, SOL_SOCKET, SO_BROADCAST, 
+			   (const char *) &one, sizeof(one));
 #ifdef SIOCGIFNETMASK_IN6
 		if ((intf->fd6 = socket(AF_INET6, SOCK_DGRAM, 0)) < 0) {
 #  ifdef EPROTONOSUPPORT
@@ -472,6 +476,7 @@ static int
 _intf_get_aliases(intf_t *intf, struct intf_entry *entry)
 {
 	struct ifreq *ifr, *lifr;
+	struct ifreq tmpifr;
 	struct addr *ap, *lap;
 	char *p;
 	
@@ -492,12 +497,15 @@ _intf_get_aliases(intf_t *intf, struct intf_entry *entry)
 		if ((p = strchr(ifr->ifr_name, ':')) != NULL)
 			*p = '\0';
 		
-		if (strcmp(ifr->ifr_name, entry->intf_name) != 0)
+		if (strcmp(ifr->ifr_name, entry->intf_name) != 0) {
+		  if (p) *p = ':';
 			continue;
+		}
 		
+		if (p) *p = ':'; /* Fix the name back up */
 		if (addr_ston(&ifr->ifr_addr, ap) < 0)
 			continue;
-		
+				
 		/* XXX */
 		if (ap->addr_type == ADDR_TYPE_ETH) {
 			memcpy(&entry->intf_link_addr, ap, sizeof(*ap));
@@ -506,6 +514,11 @@ _intf_get_aliases(intf_t *intf, struct intf_entry *entry)
 			if (ap->addr_ip == entry->intf_addr.addr_ip ||
 			    ap->addr_ip == entry->intf_dst_addr.addr_ip)
 				continue;
+			strlcpy(tmpifr.ifr_name, ifr->ifr_name, 
+			       sizeof(tmpifr.ifr_name));
+			if (ioctl(intf->fd, SIOCGIFNETMASK, &tmpifr) == 0)
+			  addr_stob(&tmpifr.ifr_addr, &ap->addr_bits);
+
 		}
 #ifdef SIOCGIFNETMASK_IN6
 		else if (ap->addr_type == ADDR_TYPE_IP6 && intf->fd6 != -1) {
@@ -547,16 +560,28 @@ intf_get(intf_t *intf, struct intf_entry *entry)
 static int
 _match_intf_src(const struct intf_entry *entry, void *arg)
 {
+	int matched = 0;
+	int cnt;
 	struct intf_entry *save = (struct intf_entry *)arg;
 	
-	if (entry->intf_addr.addr_type == ADDR_TYPE_IP &&
-	    entry->intf_addr.addr_ip == save->intf_addr.addr_ip) {
-		/* XXX - truncated result if entry is too small. */
-		if (save->intf_len < entry->intf_len)
-			memcpy(save, entry, save->intf_len);
-		else
-			memcpy(save, entry, entry->intf_len);
-		return (1);
+	if (entry->intf_addr.addr_type == ADDR_TYPE_IP && 
+	    entry->intf_addr.addr_ip == save->intf_addr.addr_ip)
+	  matched = 1;
+  
+	for (cnt = 0; !matched && cnt < (int) entry->intf_alias_num; cnt++) {
+	  if (entry->intf_alias_addrs[cnt].addr_type != ADDR_TYPE_IP)
+	    continue;
+	  if (entry->intf_alias_addrs[cnt].addr_ip == save->intf_addr.addr_ip)
+	    matched = 1;
+	}
+
+	if (matched) {
+	  /* XXX - truncated result if entry is too small. */
+	  if (save->intf_len < entry->intf_len)
+	    memcpy(save, entry, save->intf_len);
+	  else
+	    memcpy(save, entry, entry->intf_len);
+	  return (1);
 	}
 	return (0);
 }
@@ -678,14 +703,18 @@ intf_loop(intf_t *intf, intf_handler callback, void *arg)
 		if ((p = strchr(ifr->ifr_name, ':')) != NULL)
 			*p = '\0';
 		
-		if (pifr != NULL && strcmp(ifr->ifr_name, pifr->ifr_name) == 0)
+		if (pifr != NULL && strcmp(ifr->ifr_name, pifr->ifr_name) == 0) {
+		  if (p) *p = ':';
 			continue;
+		}
 
 		memset(ebuf, 0, sizeof(ebuf));
 		strlcpy(entry->intf_name, ifr->ifr_name,
 		    sizeof(entry->intf_name));
 		entry->intf_len = sizeof(ebuf);
 		
+		/* Repair the alias name back up. */
+		if (p) *p = ':';
 		if (_intf_get_noalias(intf, entry) < 0)
 			return (-1);
 		if (_intf_get_aliases(intf, entry) < 0)
diff --git a/mswin32/winip/winip.c b/mswin32/winip/winip.c
index fa90c4736..17bc9a003 100644
--- a/mswin32/winip/winip.c
+++ b/mswin32/winip/winip.c
@@ -653,126 +653,7 @@ static void winip_list_interfaces()
     }
 }
 
-//   Find a route to dest.  Fill in source, return device
-
-//   I will fail this if no raw, so nmap will still work
-
 typedef DWORD (__stdcall *PGBI)(IPAddr, PDWORD);
-char *routethrough(const struct in_addr *dest, struct in_addr *source)
-{
-  /*
-    In theory, GetBestInterface is ideal. But we need
-    the source address. Even though GetBestInterface
-    is still the fastest way to get the name,
-    ipaddr2devname is fast enough.  So we use
-    SIO_ROUTING_INTERFACE_QUERY.
-  */
-
-  //   the raw senders tend to iterate this
-  //   so we cache the results
-  static DWORD last_dest = 0;
-  static DWORD last_source;
-  static char dev[128];
-  struct sockaddr_in sin_dest, sin_source;
-
-  winip_test(0);
-  if(inited == 3)
-    {
-      static int warned = 0;
-      if(!warned)
- printf("routethrough: failing due to lack of any raw support\n");
-      warned = 1;
-    }
-
-  if(last_dest == dest->s_addr)
-    {
-      source->s_addr = last_source;
-      return dev;
-    }
-
-  ZeroMemory(&sin_dest, sizeof(sin_dest));
-  sin_dest.sin_family = AF_INET;
-  sin_dest.sin_addr = *dest;
-
-  if(wo.nt4route)
-    {
-      MIB_IPFORWARDROW ir;
-      int ifi;
-
-      if(0 != get_best_route(sin_dest.sin_addr.s_addr, &ir))
- {
-   if(o.debugging > 1)
-     printf("get_best_route failed, so routethrough will fail\n");
-
-   return NULL;
- }
-
-      if(-1 == (ifi = winif2ifi(ir.dwForwardIfIndex)))
- fatal("routethrough: got unmappable (new?) interface\n");
-
-      if(0 != ifi2ipaddr(ifi, &sin_source.sin_addr))
- fatal("routethrough: no IP for device %s\n", ifi2name(ifi));
-
-      if(!rawsock_avail && !iftable[ifi].pcapname) return NULL;
-
-      strcpy(dev, ifi2name(ifi));
-    }
-  else
-    {
-      SOCKET s;
-      DWORD br;
-
-      s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
-      if(s == INVALID_SOCKET)
- fatal("failed to create socket\n");
-
-      if(0 != WSAIoctl(s, SIO_ROUTING_INTERFACE_QUERY,
-         &sin_dest, sizeof(sin_dest),
-         &sin_source, sizeof(sin_source), &br, 0, 0))
- {
-   if(o.debugging)
-     printf("SIO_ROUTING_INTERFACE_QUERY(%s) failed (%d)\n", inet_ntoa(*dest), WSAGetLastError());
-   closesocket(s);
-   return NULL;
- }
-
-      closesocket(s);
-    }
-
-  //   localhost scan (fake) support
-  //   this allows localhost, but not 127.0.0.1, scans to seem to work
-  if(sin_source.sin_addr.s_addr == htonl(INADDR_LOOPBACK))
-    sin_source.sin_addr.s_addr = dest->s_addr;
-
-  if(0 != ipaddr2devname(dev, &sin_source.sin_addr))
-    {
-      if(o.debugging)
- {
-   printf("routethrough: %s routes through ", inet_ntoa(*dest));
-   printf("%s, but inaddr2devname failed\n",
-   inet_ntoa(sin_source.sin_addr));
- }
-
-      return 0;
-    }
-
-  if(!rawsock_avail &&
-     !iftable[ipaddr2ifi(sin_source.sin_addr.s_addr)].pcapname)
-    return NULL;
-
-  last_dest = dest->s_addr;
-  last_source = sin_source.sin_addr.s_addr;
-  *source = sin_source.sin_addr;
-
-  if(o.debugging > 1)
-    {
-      printf("%s will use interface ", inet_ntoa(*(struct in_addr*)&last_dest));
-      printf("%s\n", inet_ntoa(*(struct in_addr*)&last_source));
-    }
-
-  return dev;
-}
-
 
 //   socket and sendto replacements
 int win32_sendto(int sd, const char *packet, int len, 
@@ -816,7 +697,7 @@ void win32_pcap_close(pcap_t *pd)
   else rawrecv_close(pd);
 }
 
-pcap_t *my_pcap_open_live(char *device, int snaplen, int promisc, int to_ms)
+pcap_t *my_pcap_open_live(const char *device, int snaplen, int promisc, int to_ms)
 {
   int ifi = name2ifi(device);
   if(ifi == -1)
@@ -856,7 +737,7 @@ void sethdrinclude(int sd)
     }
 }
 
-void set_pcap_filter(Target *target,
+void set_pcap_filter(const char *device,
        pcap_t *pd, PFILTERFN filter, char *bpf, ...)
 {
   va_list ap;
@@ -871,7 +752,7 @@ void set_pcap_filter(Target *target,
       return;
     }
 
-  if (pcap_lookupnet(target->device, &localnet, &netmask, err0r) == -1)
+  if (pcap_lookupnet(device, &localnet, &netmask, err0r) == -1)
     ; /* fatal("Failed to lookup device subnet/netmask: %s", err0r);*/
 
   va_start(ap, bpf);
@@ -884,10 +765,6 @@ void set_pcap_filter(Target *target,
   if (o.debugging)
     log_write(LOG_STDOUT, "Packet capture filter: %s\n", buf);
 
-  /* Due to apparent bug in libpcap */
-  if (islocalhost(target->v4hostip()))
-    buf[0] = '\0';
-
   if (pcap_compile(pd, &fcode, buf, 0, netmask) < 0)
     fatal("Error compiling our pcap filter: %s\n", pcap_geterr(pd));
   if (pcap_setfilter(pd, &fcode) < 0 )
diff --git a/mswin32/winip/winip.h b/mswin32/winip/winip.h
index 8b9dd0a97..1220319eb 100644
--- a/mswin32/winip/winip.h
+++ b/mswin32/winip/winip.h
@@ -126,7 +126,7 @@ typedef int (*PFILTERFN)(const char *packet, unsigned int len); /* 1 to keep */
 //	Makes gcc happy
 //	One wonders why VC doesn't complain...
 class Target;
-EXTERNC void set_pcap_filter(Target *target, pcap_t *pd, PFILTERFN filter, char *bpf, ...);
+EXTERNC void set_pcap_filter(const char *device, pcap_t *pd, PFILTERFN filter, char *bpf, ...);
 
 
 typedef struct _IPNODE {
@@ -173,7 +173,7 @@ EXTERNC int get_best_route(DWORD dest, PMIB_IPFORWARDROW r);
 
 //	pcapsend interface
 EXTERNC void pcapsend_init();
-EXTERNC pcap_t *my_real_pcap_open_live(char *device, int snaplen, int promisc, int to_ms);
+EXTERNC pcap_t *my_real_pcap_open_live(const char *device, int snaplen, int promisc, int to_ms);
 EXTERNC int pcapsendraw(const char *packet, int len, 
 						struct sockaddr *to, int tolen);
 
diff --git a/nmap-os-fingerprints b/nmap-os-fingerprints
index 65131fd21..db044eff3 100644
--- a/nmap-os-fingerprints
+++ b/nmap-os-fingerprints
@@ -3951,7 +3951,7 @@ PU(Resp=N)
 # Brocade Fibre Switch, Firmware 2.6.0
 # Cisco Aironet 340 WAP running v 12.03T of the firmware (and VxWorks OS)
 Fingerprint Cisco Aironet WAP, Brocade Fibre Switch, or Sun Remote System Console
-Class Cisco | vxworks || WAP
+Class Cisco | VxWorks || WAP
 Class Brocade | embedded || switch
 Class Sun | embedded || remote management
 TSeq(Class=64K%IPID=I%TS=U)
@@ -10791,19 +10791,6 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
 T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
 PU(Resp=N)
 
-# Microsoft Windows Longhorn Preview, Version 6.0 Build 4051.idx 02.031001-1340
-Fingerprint Microsoft Windows Longhorn Preview
-Class Microsoft | Windows | Windows Longhorn | general purpose
-TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
-T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
-T2(Resp=N)
-T3(Resp=N)
-T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
-T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
-T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
-T7(Resp=N)
-PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
-
 # Microsoft Windows Server 2003, Enterprise Edition, Build 3790
 # Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947)
 Fingerprint Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947)
@@ -12388,6 +12375,19 @@ T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
 T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
 PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
 
+# Microsoft Windows Longhorn Preview, Version 6.0 Build 4051.idx 02.031001-1340
+Fingerprint Microsoft Windows Longhorn Preview
+Class Microsoft | Windows | Windows Longhorn | general purpose
+TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
+T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
+T2(Resp=N)
+T3(Resp=N)
+T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
+T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
+T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
+T7(Resp=N)
+PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
+
 # Windows 2000 Pro, Build 2195 SP4
 Fingerprint Microsoft Windows 2000 Pro SP4
 Class Microsoft | Windows || general purpose
diff --git a/nmap-service-probes b/nmap-service-probes
index e2ce38004..8061ab612 100644
--- a/nmap-service-probes
+++ b/nmap-service-probes
@@ -40,166 +40,177 @@ Probe TCP NULL q||
 # smtp services have lately been instituting an artificial pause (see
 # FEATURE('greet_pause') in Sendmail, for example)
 totalwaitms 6000
-match acap m|^\* ACAP \(IMPLEMENTATION \"CommuniGate Pro ACAP (\d[-.\w]+)\"\) | p/CommuniGate Pro ACAP server/ i/for mail client preference sharing/
+match acap m|^\* ACAP \(IMPLEMENTATION \"CommuniGate Pro ACAP (\d[-.\w]+)\"\) | p/CommuniGate Pro ACAP server/ i/for mail client preference sharing/ v/$1/
 match aim m|^\*\x01..\0\x04\0\0\0\x01$|s p/Pyboticide AIM chat filter/
 # AMANDA index server 2.4.2p2 on Linux 2.4
-match amanda m|^220 [-.\w]+ AMANDA index server \((\d[-.\w ]+)\) ready\.\r\n| p/Amanda backup system index server/ v/$1/
+match amanda m|^220 ([-.\w]+) AMANDA index server \((\d[-.\w ]+)\) ready\.\r\n| p/Amanda backup system index server/ v/$2/ h/$1/ o/Unix/
 # arkstats (part of arkeia-light 5.1.12 Backup server) on Linux 2.4.20
 match arkstats m|^\0`\0\x03\0\0\0\x1810\x000\x000\x00852224\0\0\0\0\0\0\0\0\0\0\0| p/Arkeia arkstats/
-
 match backdoorjeam m|^220 jeem\.mail\.pv ESMTP\r\n| p/Jeem backdoor/ i/**BACKDOOR**/
 # Bittorrent Client 3.2.1b on Linux 2.4.X
 match bittorent m|^\x13BitTorrent protocol\0\0\0\0\0\0\0\0| p/Bittorrent P2P client/
-
 # BMC Software Patrol Agent 3.45
 match bmc-softwarepatrol m|^\0\0\0\x17i\x02\x03..\0\x05\x02\0\x04\x02\x04\x03..\0\x03\x04\0\0\0\0\x01\x01\0| p/BMC Software Patrol Agent/
-match chargen m|^!"#\$%\&'\(\)\*\+,-\./0123456789:;<=>\?\@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\\\]\^_`abcdefgh\r\n"#\$%\&'\(\)\*\+,-\./0123456789:;<=>\?\@ABCDEF| p/Linux chargen/
+match chargen m|^!"#\$%\&'\(\)\*\+,-\./0123456789:;<=>\?\@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\\\]\^_`abcdefgh\r\n"#\$%\&'\(\)\*\+,-\./0123456789:;<=>\?\@ABCDEF| p/Linux chargen/ o/Linux/
 # Redhat 7.2, xinetd 2.3.7 chargen
-match chargen m|^\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\\\]\^_`abcdefghijklmnopq\r\n\+,-\./| p/xinetd chargen/
+match chargen m|^\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\\\]\^_`abcdefghijklmnopq\r\n\+,-\./| p/xinetd chargen/ o/Unix/
 # Sun Solaris 9; Windows
 match chargen m|^\ !"#\$%&'\(\)\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\\\]\^_|
 # Mandrake Linux 9.2, xinetd 2.3.11 chargen
-match chargen m|NOPQRSTUVWXYZ\[\\\]\^_`abcdefghijklm|
-
+match chargen m|NOPQRSTUVWXYZ\[\\\]\^_`abcdefghijklm| p/xinetd chargen/ o/Unix/
 # Citrix, Metaframe XP on Windows
-match citrix-ica m|^\x7f\x7fICA\0\x7f\x7fICA\0| p/Citrix Metaframe XP ICA/
+match citrix-ica m|^\x7f\x7fICA\0\x7f\x7fICA\0| p/Citrix Metaframe XP ICA/ o/Windows/
 match concertosendlog m|^Concerto Software\r\n\r\nEnsemblePro SendLog Server - Version (\d[-.\w]+)\r\n\r\nEnter Telnet Password\r\n#> | p/Concerto Software EnsemblePro CRM software SendLog Server/ v/$1/
 match concertotimesync m|^Concerto Software\r\n\r\nContactPro TimeSync Server - Version (\d[-.\w]+)\r\n\r\nEnter Telnet Password\r\n#> | p/Concerto Software EnsemblePro CRM software TimeSync Server/ v/$1/
-
 # CompTek AquaGateKeeper (Telephony package) http://aqua.comptek.ru
 match H.323/Q.931 m|^\x03\0\0.*@| p/CompTek AquaGateKeeper/
-
 match cvspserver m|^no repository configured in /| p/CVS pserver/ i/broken/
 match cvspserver m|^/usr/sbin/cvs-pserver: line \d+: .*cvs: No such file or directory\n| p/CVS pserver/ i/broken/
 match cvsup m|^OK \d+ \d+ ([-.\w]+) CVSup server ready\n| p/CVSup/ v/$1/
-
-match damewaremr m|^0\x11\0\0\0..\0......\r@\0\0\0\0\0\0\0\0\x01\0\0\0\x01\0\0\0\0\0\0\0.\0\0\0$|s p/DameWare Mini Remote Control/ i/Windows/
+match damewaremr m|^0\x11\0\0\0..\0......\r@\0\0\0\0\0\0\0\0\x01\0\0\0\x01\0\0\0\0\0\0\0.\0\0\0$|s p/DameWare Mini Remote Control/ o/Windows/
 # Linux
 match daytime m|^[0-3]\d [A-Z][A-Z][A-Z] 20\d\d \d\d:\d\d:\d\d \S+\r\n|
 # OpenBSD 3.2
 match daytime m|^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} +\d\d:\d\d:\d\d 20\d\d\r\n|
 # Solaris 8,9
-match daytime m|^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} +\d\d:\d\d:\d\d 20\d\d\n\r| p/Sun Solaris daytime/
+match daytime m|^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} +\d\d:\d\d:\d\d 20\d\d\n\r| p/Sun Solaris daytime/ o/Solaris/
 # Windows daytime
-match daytime m|^\d+:\d\d:\d\d [AP]M \d+/\d+/200\d\n$| p/Microsoft Windows USA daytime/
+match daytime m|^\d+:\d\d:\d\d [AP]M \d+/\d+/200\d\n$| p/Microsoft Windows USA daytime/ o/Windows/
 # Windows daytime - UK english I think (no AM/PM)
-match daytime m|^\d{1,2}:\d{1,2}:\d{1,2} \d{1,2}/\d{1,2}/200\d\n$| p/Microsoft Windows daytime/
+match daytime m|^\d\d:\d\d:\d\d \d\d.\d\d.200\d\n$| p/Microsoft Windows International daytime/ o/Windows/
+# daytime on Windows 2000 Server
+match daytime m|^.... \d{1,2}:\d{1,2}:\d{1,2} 200\d-\d{1,2}-\d{1,2}\n$| p/Microsoft Windows daytime/ o/Windows/
+# Windows NT daytime
+match daytime m|^[A-Z][a-z]+day, [A-Z][a-z]+ \d{1,2}, 200\d \d{1,2}:\d\d:\d\d\n\0$| p/Microsoft Windows daytime/ o/Windows/
+# Windows 2000 Adv Server sp-4 daytime
+match daytime m|^[A-Z][a-z][a-z] [A-Z][a-z][a-z] \d{1,2} \d{1,2}:\d{1,2}:\d{1,2} 200\d\n| p/Microsoft Windows daytime/ o/Windows/
+# Windows 2003 Server daytme
+match daytime m|^\d{1,2}\.\d{1,2}\.\d{1,2} \d\d/\d\d/200\d\n| p/Microsoft Windows daytime/ o/Windows/
+# Windows 2000 Prof. Central European format
+match daytime m|^\d{1,2}:\d\d:\d\d \d{1,2}\.\d{1,2}\.200\d\n$| p/Microsoft Windows daytime/ o/Windows/
 
 # Windows International daytime
-match daytime m|^\d\d:\d\d:\d\d \d\d.\d\d.200\d\n$| p/Microsoft Windows International daytime/
+match daytime m|^\d\d:\d\d:\d\d \d\d.\d\d.200\d\n$| p/Microsoft Windows International daytime/ o/Windows/
 # New Zealand format daytime - Windows 2000
-match daytime m|^[01]\d:\d\d:\d\d [AP]M [0-3]\d/[01]\d/0\d\n$| p/Microsoft Windows daytime/ i/New Zealand style/
+match daytime m|^[01]\d:\d\d:\d\d [AP]M [0-3]\d/[01]\d/0\d\n$| p/Microsoft Windows daytime/ i/New Zealand style/ o/Windows/
 # HP-UX B.11.00 A inetd daytime
-match daytime m|^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} \d\d:\d\d:\d\d [A-Z]+ 200\d\r\n$| p/HP-UX daytime/
+match daytime m|^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} \d\d:\d\d:\d\d [A-Z]+ 200\d\r\n$| p/HP-UX daytime/ o/HP-UX/
 # Tardis 2000 v1.4 on NT
 match daytime m|^^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} \d\d:\d\d:\d\d 200\d $| p/Tardis 2000 daytime/
 
-match dict m|^530 access denied\r\n$| p/dictd/ i/access denied/
-match dict m|^220 [-.\w]+ dictd ([-.\w/]+) on ([-.+ \w]+) <auth\.mime>| p/dictd/ v/$1/ i/on $2/
-match directconnect m/^\$MyNick ([-.\w]+)|\$Lock/ p/Direct Connect P2P/ i/User: $1/
+# TrueTime nts100 running WxWorks
+match daytime m|^[A-Z][a-z]{2}, [A-Z][a-z]{2} \d{1,2}, 200\d, \d\d:\d\d:\d\d-UTC$| p/Truetime nts100/
 
+# Cisco router daytime
+match daytime m|^[A-Z][a-z]+day, [A-Z][a-z]+ \d{1,2}, 200\d \d\d:\d\d:\d\d-MET(-DST)?\r\n| p/Cisco router daytime/ o/IOS/
+
+match dict m|^530 access denied\r\n$| p/dictd/ i/access denied/
+match dict m|^220 ([-.\w]+) dictd ([-.\w/]+) on ([-.+ \w]+) <auth\.mime>| p/dictd/ h/$1/ v/$2/ o/$3/
+match directconnect m/^\$MyNick ([-.\w]+)|\$Lock/ p/Direct Connect P2P/ i/User: $1/ o/Windows/
 match eggdrop m=^\r\n\r\n([-`|.\w]+)  \(Eggdrop v(\d[-.\w]+) +\([cC]\) *1997.*\r\n\r\n= p/Eggdrop irc bot console/ v/$2/ i/botname: $1/
 # This fallback is because many people customize their eggdrop
 # banners.  This rule should always be well below the detailed rule
 # above.
 match eggdrop m|Copyright \(C\) 1997 Robey Pointer\r\n.*Eggheads| p/Eggdrop IRC bot console/
-match finger m|\r\n {4}Line {5,8}User {6,8}Host\(s\) {13,18}Idle +Location\r\n| p/Cisco fingerd/
-
-match ftp m|^220 [-/.+\w]+ FTP server \(SecureTransport (\d[-.\w]+)\) ready\.\r\n| p/Tumbleweed SecureTransport ftpd/ v/$1/
+match finger m|\r\n {4}Line {5,8}User {6,8}Host\(s\) {13,18}Idle +Location\r\n| p/Cisco fingerd/ o/IOS/ d/router/
+match ftp m|^220 ([-/.+\w]+) FTP server \(SecureTransport (\d[-.\w]+)\) ready\.\r\n| p/Tumbleweed SecureTransport ftpd/ h/$1/ v/$2/
 match ftp m|^220 3Com 3CDaemon FTP Server Version (\d[-.\w]+)\r\n| p/3Com 3CDaemon ftpd/ v/$1/
 # GuildFTP 0.999.9 on Windows
-match ftp m|^220-GuildFTPd FTP Server \(c\) 1997-2002\r\n220-Version (\d[-.\w]+)\r\n220 Please enter your name:\r\n| p/Guild ftpd/ v/$1/ i/Windows/
+match ftp m|^220-GuildFTPd FTP Server \(c\) 1997-2002\r\n220-Version (\d[-.\w]+)\r\n220 Please enter your name:\r\n| p/Guild ftpd/ v/$1/ o/Windows/
 # Medusa Async V1.21 [experimental] on Linux 2.4
-match ftp m|^220 [-/.+\w]+ FTP server \(Medusa Async V(\d[^\)]+)\) ready\.\r\n| p/Medusa Async ftpd/ v/$1/
-match ftp m|^220 [-/.+\w]+\((\d[-.\w]+)\) FTP server \(EPSON ([^\)]+)\) ready\.\r\n| p/Epson printer ftpd/ v/$1/ i/Epson $2/
-match ftp m|^220 [-/.+\w]+ IBM TCP/IP for OS/2 - FTP Server ver \d+:\d+:\d+ on [A-Z]| p|IBM OS/2 ftpd|
-match ftp m|^220 [-/.+\w]+ Lexmark ([-/.+\w]+) FTP Server (\d[-.\w]+) ready\.\r\n| p/Lexmark printerftpd/ v/$2/ i/Lexmark $1/
+match ftp m|^220 ([-/.+\w]+) FTP server \(Medusa Async V(\d[^\)]+)\) ready\.\r\n| p/Medusa Async ftpd/ h/$1/ v/$2/
+match ftp m|^220 ([-/.+\w]+)\((\d[-.\w]+)\) FTP server \(EPSON ([^\)]+)\) ready\.\r\n| p/Epson printer ftpd/ h/$1/ v/$2/ i/Epson $3/ d/printer/
+match ftp m|^220 ([-/.+\w]+) IBM TCP/IP for OS/2 - FTP Server ver \d+:\d+:\d+ on [A-Z]| p|IBM OS/2 ftpd| h/$1/ o|OS/2|
+match ftp m|^220 ([-/.+\w]+) Lexmark ([-/.+\w]+) FTP Server (\d[-.\w]+) ready\.\r\n| p/Lexmark printer ftpd/ v/$2/ i/Lexmark $3/ h/$1/ d/printer/
 match ftp m|^220 Internet Rex (\d[-.\w ]+) \(([-/.+\w]+)\) FTP server awaiting your command\.\r\n| p/Internet Rex ftpd/ v/$1/ i/$2/
-match ftp m|^220 [-.+\w]+ FTP server \(Version (\d[-.\w]+)\(([^\)]+)\) [A-Z][a-z][a-z] [A-Z].*200\d\) ready\.\r\n| p/HP-UX ftpd/ v/$1/ i/$2/
-match ftp m|^530 Connection refused, unknown IP address\.\r\n$| p/Microsoft IIS ftpd/ i/IP address rejected/
+match ftp m|^220 ([-.+\w]+) FTP server \(Version (\d[-.\w]+)\(([^\)]+)\) [A-Z][a-z][a-z] [A-Z].*200\d\) ready\.\r\n| p/HP-UX ftpd/ h/$1/ v/$2/ i/$3/ o/HP-UX/
+match ftp m|^530 Connection refused, unknown IP address\.\r\n$| p/Microsoft IIS ftpd/ i/IP address rejected/ o/Windows/
 match ftp m|^220 PizzaSwitch FTP server ready\r\n| p/Xylan PizzaSwitch ftpd/
-match ftp m|^220 [-.+\w]+ IronPort FTP server \(V(\d[-.\w]+)\) ready\.\r\n| p/IronPort mail appliance ftpd/
-match ftp m|^220 WFTPD (\d[-.\w]+) service \(by Texas Imperial Software\) ready for new user\r\n| p/Texas Imperial Software WFTPD/ v/$1/
-match ftp m|^220 [-.+\w]+ FTP server \(Version (MICRO-[-.\w:#+ ]+)\) ready\.\r\n| p/Bay Networks MicroAnnex terminal server ftpd/ v/$1/
-match ftp m|^220 [-.+\w]+ FTP server \(Digital UNIX Version (\d[-.\w]+)\) ready\.\r\n| p/Digital UNIX ftpd/ v/$1/
-match ftp m|^220 [-.+\w]+ FTP server \(Version [\d.]+\+Heimdal (\d[-+.\w ]+)\) ready\.\r\n| p/Heimdal Kerberized ftpd/ v/$1/
-match ftp m|^500 OOPS: (could not bind listening IPv4 socket)\r\n$| p/vsftpd/ i/broken: $1/
-match ftp m|^500 00PS: vsftpd: (.*)\r\n| p/vsftpd/ i/broken: $1/
-match ftp m|^220-QTCP at [-.\w]+\r\n220| p|IBM OS/400 FTPd|
-match ftp m|^220-FileZilla Server version (\d[-.\w ]+)\r\n| p/FileZilla ftpd/ v/$1/
+match ftp m|^220 ([-.+\w]+) IronPort FTP server \(V(\d[-.\w]+)\) ready\.\r\n| p/IronPort mail appliance ftpd/ h/$1/ v/$2/
+match ftp m|^220 WFTPD (\d[-.\w]+) service \(by Texas Imperial Software\) ready for new user\r\n| p/Texas Imperial Software WFTPD/ v/$1/ o/Windows/
+match ftp m|^220 ([-.+\w]+) FTP server \(Version (MICRO-[-.\w:#+ ]+)\) ready\.\r\n| p/Bay Networks MicroAnnex terminal server ftpd/ h/$1/ v/$2/ d/terminal server/
+match ftp m|^220 ([-.+\w]+) FTP server \(Digital UNIX Version (\d[-.\w]+)\) ready\.\r\n| p/Digital UNIX ftpd/ h/$1/ v/$2/ o/Unix/ o/DIGITAL UNIX/
+match ftp m|^220 ([-.+\w]+) FTP server \(Version [\d.]+\+Heimdal (\d[-+.\w ]+)\) ready\.\r\n| p/Heimdal Kerberized ftpd/ h/$1/ v/$2/ o/Unix/
+match ftp m|^500 OOPS: (could not bind listening IPv4 socket)\r\n$| p/vsftpd/ i/broken: $1/ o/Unix/
+match ftp m|^500 00PS: vsftpd: (.*)\r\n| p/vsftpd/ i/broken: $1/ o/Unix/
+match ftp m|^220-QTCP at ([-.\w]+)\r\n220| p|IBM OS/400 FTPd| o|OS/400| h/$1/
+match ftp m|^220-FileZilla Server version (\d[-.\w ]+)\r\n| p/FileZilla ftpd/ v/$1/ o/Windows/
 # Netgear RP114 switch with integrated ftp server
 # Netgear RP114
-match ftp m|^220 ([-\w]+)? FTP version 1\.0 ready at | p/Netgear broadband router ftpd/ v/1.0/
-match ftp m|^220 [-.\w]+ FTP server \(GNU inetutils (\d[-.\w ]+)\) ready\.\r\n| p/GNU Inetutils FTPd/ v/$1/
-match ftp m|^220 .* \(glftpd (\d[-.0-9a-zA-Z]+)_(\w+)(\+TLS)?\) ready\.\r\n| p/glFtpD/ v/$1/ i/$2/
-match ftp m|^220 [-.\w]+ FTP server \(FirstClass v(\d[-.\w]+)\) ready\.\r\n| p/FirstClass FTP server/ v/$1/
-match ftp m|^220 [-.\w]+ FTP server \(Compaq Tru64 UNIX Version (\d[-.\w]+)\) ready\.\r\n| p/Compaq Tru64 ftp server/ v/$1/
-match ftp m|^220 AXIS ([-.\w]+) FTP Network Print Server V(\d[-.\w]+) [A-Z][a-z]| p/Axis network print server ftpd/ v/$2/ i/Model $1/
-match ftp m|^220 AXIS ([\d\w]+)V(\d\S+) (.*?) ready\.\n| p/AXIS $1 Webcam/ v/$2/ i/$3/
-match ftp m|^220 Axis (\d+) Network Camera (\d\S+) (.*?) ready\.\n| p/Axis $1 Webcam/ v/$2/ i/$3/
+match ftp m|^220 ([-\w]+)? FTP version 1\.0 ready at | p/Netgear broadband router ftpd/ v/1.0/ d/router/
+match ftp m|^220 ([-.\w]+) FTP server \(GNU inetutils (\d[-.\w ]+)\) ready\.\r\n| p/GNU Inetutils FTPd/ v/$2/ h/$1/
+match ftp m|^220 .* \(glftpd (\d[-.0-9a-zA-Z]+)_(\w+)(\+TLS)?\) ready\.\r\n| p/glFtpD/ v/$1/ i/$2/ o/Unix/
+match ftp m|^220 ([-.\w]+) FTP server \(FirstClass v(\d[-.\w]+)\) ready\.\r\n| p/FirstClass FTP server/ h/$1/ v/$2/
+match ftp m|^220 ([-.\w]+) FTP server \(Compaq Tru64 UNIX Version (\d[-.\w]+)\) ready\.\r\n| p/Compaq Tru64 ftp server/ h/$1/ v/$2/ o/Tru64 UNIX/
+match ftp m|^220 AXIS ([-.\w]+) FTP Network Print Server V(\d[-.\w]+) [A-Z][a-z]| p/Axis network print server ftpd/ v/$2/ i/Model $1/ d/print server/
+match ftp m|^220 AXIS ([\d\w]+)V(\d\S+) (.*?) ready\.\n| p/AXIS $1 Webcam/ v/$2/ i/$3/ d/webcam/
+match ftp m|^220 Axis (\d+) Network Camera (\d\S+) (.*?) ready\.\n| p/Axis $1 Webcam/ v/$2/ i/$3/ d/webcam/
 match ftp m|^220 AXIS (\d+) Video Server (\d\S+) (.*?) ready\.| p/AXIS $1 Video Server/ v/$2/ i/$3/
-match ftp m|^220-Cerberus FTP Server Personal Edition\r\n220-UNREGISTERED\r\n| p/Cerberus FTP Server/ i/Personal Edition; Unregistered/
-match ftp m|^220-GuildFTPd FTP Server \(c\) 2001\r\n220-Version (\d[-.\w]+)\r\n220 Please enter your name:\r\n| p/GuildFTPd/ v/$1/
-match ftp m|^220 FTP print service:V-(\d[-.\w]+)/Use the network password for the ID if updating\.\r\n| p/Brother printer ftpd/ v/$1/
-match ftp m|^220- APC FTP server ready\.\r\n220 \r\n$| p|APC ftp server| i|UPS/Power device|
-match ftp m|^220 [-\w]+ FTP server \(Version (\d.[.\d]+) ([A-Z][a-z]{2} [A-Z][a-z]{2} [0-9]+ [0-9:]+ .* [21][0-9]+)\) ready\.\r\n| p/HP-UX 10.x ftpd/ v/$1/
-match ftp m|^220 [-\w]+ FTP server \(Version (\d[-.\w]+) [A-Z][a-z]{2} [A-Z][a-z]{2} .*\) ready\.\r\n| p/AIX ftpd/ v/$1/
+match ftp m|^220-Cerberus FTP Server Personal Edition\r\n220-UNREGISTERED\r\n| p/Cerberus FTP Server/ i/Personal Edition; Unregistered/ o/Windows/
+match ftp m|^220-GuildFTPd FTP Server \(c\) 2001\r\n220-Version (\d[-.\w]+)\r\n220 Please enter your name:\r\n| p/GuildFTPd/ v/$1/ o/Windows/
+match ftp m|^220 FTP print service:V-(\d[-.\w]+)/Use the network password for the ID if updating\.\r\n| p/Brother printer ftpd/ v/$1/ d/printer/
+match ftp m|^220- APC FTP server ready\.\r\n220 \r\n$| p/APC ftp server/ d/power device/
+match ftp m|^220 ([-\w]+) FTP server \(Version (\d.[.\d]+) ([A-Z][a-z]{2} [A-Z][a-z]{2} [0-9]+ [0-9:]+ .* [21][0-9]+)\) ready\.\r\n| p/HP-UX 10.x ftpd/ h/$1/ v/$2/ o/HP-UX/ i/$3/
+match ftp m|^220 ([-\w]+) FTP server \(Version (\d[-.\w]+) [A-Z][a-z]{2} [A-Z][a-z]{2} .*\) ready\.\r\n| p/AIX ftpd/ h/$1/ v/$2/ o/AIX/
 match ftp m|^220[- ]Roxen FTP server running on Roxen (\d[-.\w]+)/Pike (\d[-.\w]+)\r\n| p/Roxen ftp server/ v/$1/ i/Pike $2/
 # Debian packaged oftpd 0.3.6-51 on Linux 2.6.0-test4 Debian
-match ftp m|^220 Service ready for new user\.\r\n| p/oftpd/
+match ftp m|^220 Service ready for new user\.\r\n| p/oftpd/ o/Unix/
 # ProFTPd 1.2.5
-match ftp m|^220  Server \(ProFTPD\) \[[-.\w]+\]\r\n| p/ProFTPd/
+match ftp m|^220  Server \(ProFTPD\) \[([-.\w]+)\]\r\n| p/ProFTPd/ h/$1/ o/Unix/
 # Mac OS X Client 10.2.6 built-in ftpd
 match ftp m|^220[ -].*FTP server \(lukemftpd (\d[-. \w]+)\) ready\.\r\n|s p/LukemFTPD/ v/$1/ i/Mac OS X uses lukemftpd derivative/
-match ftp m/^220.*Microsoft FTP Service \(Version (\d[^)]+)/ p/Microsoft ftpd/ v/$1/
+match ftp m/^220.*Microsoft FTP Service \(Version (\d[^)]+)/ p/Microsoft ftpd/ v/$1/ o/Windows/
 # This lame version doesn't give a version number
 # Windows 2003
-match ftp m/^220[ -]Microsoft FTP Service\r\n/ p/Microsoft ftpd/
-match ftp m/^220 Serv-U FTP Server v(\d\S+) for WinSock ready/ p/Serv-U ftpd/ v/$1/
-match ftp m/^220 Serv-U FTP-Server v(\d\S+) for WinSock ready/ p/Serv-U ftpd/ v/$1/
+match ftp m/^220[ -]Microsoft FTP Service\r\n/ p/Microsoft ftpd/ o/Windows/
+match ftp m/^220 Serv-U FTP Server v(\d\S+) for WinSock ready/ p/Serv-U ftpd/ v/$1/ o/Windows/
+match ftp m/^220 Serv-U FTP-Server v(\d\S+) for WinSock ready/ p/Serv-U ftpd/ v/$1/ o/Windows/
 match ftp m/^220-Sambar FTP Server Version (\d\S+)\x0d\x0a/ p/Sambar ftpd/ v/$1/
 # Sambar server V5.3 on Windows NT
 match ftp m|^220-FTP Server ready\r\n220-Use USER user@host for native FTP proxy\r\n220 Your FTP Session will expire after 300 seconds of inactivity\.\r\n| p/Sambar ftpd/
-match ftp m/^220 JD FTP Server Ready/ p/HP JetDirect ftpd/
-match ftp m/^220.*Check Point FireWall-1 Secure FTP server running on/s p/Check Point Firewall-1 ftpd/
-match ftp m/^220[- ].*FTP server \(Version (wu-[-.\w]+)/s p/WU-FTPD/ v/$1/
-match ftp m|^220-\r\n220 [-.\w]+ FTP server \(Version ([-.+\w()]+)\) ready\.\r\n$| p/WU-FTPD/ v/$1/
-match ftp m|^220 [-.\w]+ FTP server \(Version ([-.+\w()]+)\) ready\.\r\n$| p/WU-FTPD/ v/$1/
-match ftp m/^220 ProFTPD (\d\S+) Server/ p/ProFTPD/ v/$1/
-match ftp m/^220.*ProFTP[dD].*Server ready/ p/ProFTPD/
-match ftp m/^220.*NcFTPd Server / p/NcFTPd/
-match ftp m/^220.*FTP server \(SunOS 5\.([789])\) ready/ p/Sun Solaris $1 ftpd/
-match ftp m/^220.*FTP server \(SunOS (\S+)\) ready/ p/Sun SunOS ftpd/ v/$1/
-match ftp m/^220-[-.\w]+ IBM FTP.*(V\d+R\d+)/ p|IBM OS/390 ftpd| v|$1|
-match ftp m/^220 VxWorks \((\d[^)]+)\) FTP server ready/ p/VxWorks ftpd/ v/$1/
-match ftp m/^220 VxWorks \(VxWorks(\d[^)]+)\) FTP server ready/ p/VxWorks ftpd/ v/$1/
+match ftp m/^220 JD FTP Server Ready/ p/HP JetDirect ftpd/ d/print server/
+match ftp m/^220.*Check Point FireWall-1 Secure FTP server running on/s p/Check Point Firewall-1 ftpd/ d/firewall/
+match ftp m/^220[- ].*FTP server \(Version (wu-[-.\w]+)/s p/WU-FTPD/ v/$1/ o/Unix/
+match ftp m|^220-\r\n220 ([-.\w]+) FTP server \(Version ([-.+\w()]+)\) ready\.\r\n$| p/WU-FTPD/ h/$1/ v/$2/ o/Unix/
+match ftp m|^220 ([-.\w]+) FTP server \(Version ([-.+\w()]+)\) ready\.\r\n$| p/WU-FTPD/ h/$1/ v/$2/ o/Unix/
+match ftp m/^220 ProFTPD (\d\S+) Server/ p/ProFTPD/ v/$1/ o/Unix/
+match ftp m/^220.*ProFTP[dD].*Server ready/ p/ProFTPD/ o/Unix/
+match ftp m/^220.*NcFTPd Server / p/NcFTPd/ o/Unix/
+match ftp m/^220.*FTP server \(SunOS 5\.([789])\) ready/ p/Sun Solaris $1 ftpd/ o/Solaris/
+match ftp m/^220.*FTP server \(SunOS (\S+)\) ready/ p/Sun SunOS ftpd/ v/$1/ o/Solaris/
+match ftp m/^220-([-.\w]+) IBM FTP.*(V\d+R\d+)/ p|IBM OS/390 ftpd| h/$1/ v/$2/ o|OS/390|
+match ftp m/^220 VxWorks \((\d[^)]+)\) FTP server ready/ p/VxWorks ftpd/ v/$1/ o/VxWorks/
+match ftp m/^220 VxWorks \(VxWorks(\d[^)]+)\) FTP server ready/ p/VxWorks ftpd/ v/$1/ o/VxWorks/
 match ftp m/^220.*Welcome to .*Pure-?FTPd (\d\S+\s*)/ p/PureFTPd/ v/$1/
 match ftp m/^220.*Welcome to .*Pure-?FTPd[^(]+\r\n/ p/PureFTPd/
 match ftp m/^220.*Bienvenue sur .*Pure-?FTPd (\d[-.\w]+)/ p/PureFTPd/ v/$1/
-match ftp m/^220 ready, dude \(vsFTPd (\d[0-9.]+): beat me, break me\)\r\n/ p/vsFTPd/ v/$1/
-match ftp m/^220 \(vsFTPd ([-.\w]+)\)\r\n$/ p/vsFTPd/ v/$1/
-match ftp m/^220 TYPSoft FTP Server (\d\S+) ready\.\.\.\r\n/ p/TYPSoft ftpd/ v/$1/
+match ftp m/^220 ready, dude \(vsFTPd (\d[0-9.]+): beat me, break me\)\r\n/ p/vsFTPd/ v/$1/ o/Unix/
+match ftp m/^220 \(vsFTPd ([-.\w]+)\)\r\n$/ p/vsFTPd/ v/$1/ o/Unix/
+match ftp m/^220 TYPSoft FTP Server (\d\S+) ready\.\.\.\r\n/ p/TYPSoft ftpd/ v/$1/ o/Windows/
 match ftp m/^220-MegaBit Gear (\S+).*FTP server ready/ p/MegaBit Gear ftpd/ v/$1/
-match ftp m/^220.*WS_FTP Server (\d\S+)/ p/WS FTPd/ v/$1/
-match ftp m/^220 Features: a p \.\r\n$/ p/Publicfile ftpd/
-match ftp m/^220 [-.\w]+ FTP server \(Version (\S+) VFTPD, based on Version (\S+)\) ready\.\r\n$/ p/Virtual FTPD/ v/$1/ i/based on $2/
-match ftp m|220 [-.\w]+ FTP server \(Version (\S+)/OpenBSD, linux port (\S+)\) ready\.\r\n| p/OpenBSD ftpd/ v/$1/ i/Linux port $2/
-match ftp m|^220 [-.\w]+ FTP server \(Version (\S+)/OpenBSD/Linux-ftpd-([-.\w]+)\) ready.\r\n$| p/OpenBSD ftpd/ v/$1/ i/Linux port $2/
+match ftp m/^220.*WS_FTP Server (\d\S+)/ p/WS FTPd/ v/$1/ o/Windows/
+match ftp m/^220 Features: a p \.\r\n$/ p/Publicfile ftpd/ o/Unix/
+match ftp m/^220 ([-.\w]+) FTP server \(Version (\S+) VFTPD, based on Version (\S+)\) ready\.\r\n$/ p/Virtual FTPD/ h/$1/ v/$2/ i/based on $2/ o/Unix/
+match ftp m|220 ([-.\w]+) FTP server \(Version (\S+)/OpenBSD, linux port (\S+)\) ready\.\r\n| p/OpenBSD ftpd/ h/$1/ v/$2/ i/Linux port $2/ o/Linux/
+match ftp m|^220 ([-.\w]+) FTP server \(Version (\S+)/OpenBSD/Linux-ftpd-([-.\w]+)\) ready.\r\n$| p/OpenBSD ftpd/ h/$1/ v/$2/ i/Linux port $2/ o/Linux/
 match ftp m/^220 Interscan Version ([-\w.]+)/i p/Interscan Viruswall ftpd/ v/$1/
-match ftp m|^220 InterScan FTP VirusWall NT (\d[-.\w]+) \(([-.\w]+) Mode\), Virus scan (\w+)\r\n$| p/Interscan VirusWall NT/ v/$1/ i/Virus scan $3; $2 mode/
-match ftp m|^220 [-.\w]+ FTP server \(Version ([-.\w]+)/OpenBSD\) ready\.\r\n$| p/OpenBSD ftpd/ v/$1/
-match ftp m|^220-Welcome to [A-Z]+ FTP Service\.\r\n220 All unauthorized access is logged\.\r\n$| p/FileZilla ftpd/
-match ftp m|^220 [-.\w]+ FTP server \(Version (6.0\w+)\) ready.\r\n| p/FreeBSD ftpd/ v/$1/
+match ftp m|^220 InterScan FTP VirusWall NT (\d[-.\w]+) \(([-.\w]+) Mode\), Virus scan (\w+)\r\n$| p/Interscan VirusWall NT/ v/$1/ i/Virus scan $3; $2 mode/ o/Windows/
+match ftp m|^220 ([-.\w]+) FTP server \(Version ([-.\w]+)/OpenBSD\) ready\.\r\n$| p/OpenBSD ftpd/ h/$1/ v/$2/ o/OpenBSD/
+match ftp m|^220-Welcome to ([A-Z]+) FTP Service\.\r\n220 All unauthorized access is logged\.\r\n$| p/FileZilla ftpd/ h/$1/
+match ftp m|^220 ([-.\w]+) FTP server \(Version (6.0\w+)\) ready.\r\n| p/FreeBSD ftpd/ h/$1/ v/$2/ o/FreeBSD/
 # OpenBSD 3.4 beta running Pure-FTPd 1.0.16 with SSL/TLS
-match ftp m|^220---------- Welcome to Pure-FTPd \[privsep\] \[TLS\] ----------\r\n220-You are user number| p|Pure-FTPd| i|with SSL/TLS|
+match ftp m|^220---------- Welcome to Pure-FTPd \[privsep\] \[TLS\] ----------\r\n220-You are user number| p/Pure-FTPd/ i|with SSL/TLS|
 match ftp m|^220---------- .* Pure-FTPd ----------\r\n220-| p/Pure-FTPd/
 # Trolltech Troll-FTPD 1.28 (Only runs on Linux)
-match ftp m|^220-Setting memory limit to 1024\+1024kbytes\r\n220-Local time is now \d+:\d+ and the load is [.\d]+\.\r\n220 You will be disconnected after \d+ seconds of inactivity.\r\n$| p/Trolltech Troll-FTPd/ i/on Linux/
+match ftp m|^220-Setting memory limit to 1024\+1024kbytes\r\n220-Local time is now \d+:\d+ and the load is [.\d]+\.\r\n220 You will be disconnected after \d+ seconds of inactivity.\r\n$| p/Trolltech Troll-FTPd/ o/Linux/
 
 match ftp m|^220  FTP server \(Hummingbird Ltd\. \(HCLFTPD\) Version (7.1.0.0)\) ready\.\r\n$| p/Hummingbird FTP server/ v/$1/
 
-match ftp m|^220- .*\n220 [-.\w]+ FTP server \(Version (.*)\) ready\.\r\n|s p/BSD ftpd/ v/$1/
-match ftp m|^220 ArGoSoft FTP Server for Windows NT/2000/XP, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft ftpd/ v/$1/ i/Win32/
+match ftp m|^220- .*\n220 ([-.\w]+) FTP server \(Version (.*)\) ready\.\r\n|s p/BSD ftpd/ h/$1/ v/$2/
+match ftp m|^220 ArGoSoft FTP Server for Windows NT/2000/XP, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft ftpd/ v/$1/ o/Windows/
+# Xitami FTPd
+match ftp m|^220- \r\n.*www\.imatix\.com --\r\n|s p/Xitami ftpd/
+match ftp m|^220- Welcome to this Xitami FTP server, running version ([\d\w.]+) of Xitami\. \n You are user number (\d+) of a permitted (\d+) users\.| p/Xitami ftpd/ v/$1/ i|$2/$3 users|
 # Xitami FTPd
 match ftp m|^220- \r\n.*www\.imatix\.com --\r\n|s p/Xitami ftpd/
 match ftp m|^220- Welcome to this Xitami FTP server, running version ([\d\w.]+) of Xitami\. \n You are user number (\d+) of a permitted (\d+) users\.| p/Xitami ftpd/ v/$1/ i|$2/$3 users|
@@ -207,95 +218,108 @@ match ftp m|^220- Welcome to this Xitami FTP server, running version ([\d\w.]+)
 # Netware 6 - NWFTPD.NLM FTP Server Version 5.01w
 match ftp m|^220 Service Ready for new User\r\n$| p/Netware NWFTPD/
 match ftp m|^220-LRN\r\n220 Service Ready for new User\r\n| p/Netware NWFTPD/
-match ftp m|^220 ([-\w]+) FTP server \(NetWare (v[\d.]+)\) ready\.\r\n$| p/Novell Netware ftpd/ v/$2/
+match ftp m|^220 ([-\w]+) FTP server \(NetWare (v[\d.]+)\) ready\.\r\n$| p/Novell Netware ftpd/ h/$1/ v/$2/ o/NetWare/
 match ftp m|220  FTP Server for NW 3.1x, 4.xx  \((v1.10)\), \(c\) 199[0-9] HellSoft\.\r\n$| p/HellSoft FTP server for Netware 3.1x, 4.x/ v/$1/
-match ftp m|^220 [-.\w]+ MultiNet FTP Server Process V(\S+) at .+\r\n$| p/DEC OpenVMS MultiNet FTPd/ v/$1/
-match ftp m|^220-\r\n220 [-.\w]+ FTP server \(NetBSD-ftpd ([-.\w]+)\) ready.\r\n$| p/NetBSD ftpd/ v/$1/
-match ftp m|^220 ([-.\w]+) Network Management Card AOS v([-.\w]+) FTP server ready.\r\n$| p/APC AOS ftpd/ v/$2/ i/on APC $1 network management card/
+match ftp m|^220 ([-.\w]+) MultiNet FTP Server Process V(\S+) at .+\r\n$| p/DEC OpenVMS MultiNet FTPd/ h/$1/ v/$2/
+match ftp m|^220-\r\n220 ([-.\w]+) FTP server \(NetBSD-ftpd ([-.\w]+)\) ready.\r\n$| p/NetBSD ftpd/ h/$1/ v/$2/ o/NetBSD/
+match ftp m|^220 ([-.\w]+) Network Management Card AOS v([-.\w]+) FTP server ready.\r\n$| p/APC AOS ftpd/ v/$2/ i/on APC $1 network management card/ d/power device/ o/AOS/
 # G-Net BB0060 ADSL Modem - the ftpd might be by "GlobespanVirata" as that
 # is what the telnetd on this device said.
-match ftp m|^220 FTP Server \(Version 1.0\) ready.\r\n$| p/G-Net DSL Modem ftpd/ v/1.0/
+match ftp m|^220 FTP Server \(Version 1.0\) ready.\r\n$| p/G-Net DSL Modem ftpd/ v/1.0/ d/broadband router/
 # HP-UX B.11.00
-match ftp m|^220 [-.\w ]+ FTP server \(Version (1.1.2[.\d]+) [A-Z][a-z]{2} [A-Z][a-z]{2} .*\) ready.\r\n| p/HP-UX ftpd/ v/$1/
+match ftp m|^220 ([-.\w ]+) FTP server \(Version (1.1.2[.\d]+) [A-Z][a-z]{2} [A-Z][a-z]{2} .*\) ready.\r\n| p/HP-UX ftpd/ h/$1/ v/$2/ o/HP-UX/
 # 220 mirrors.midco.net FTP server ready.
 match ftp m|^220-.*\r\n    WarFTPd (\d[-.\w]+) \([\w ]+\) Ready\r\n|s p/WarFTPd/ v/$1/
 match ftp m|^220 Welcome to Windows FTP Server| p|Windows Ftp Server| i|Not from Microsoft - http://srv.nease.net/|
 # UnixWare 7.11
 match ftp m|^220 ([\w-_.]+) FTP server \(BSDI Version ([\w.]+)\) ready\.\r\n| p|BSDI/Unixware ftpd| v/$2/ h/$1/
+match ftp m|^220  FTP server \(Hummingbird Ltd\. \(HCLFTPD\) Version ([\d.]+)\) ready\.\r\n| p/Hummingbird ftpd/ v/$1/
+match ftp m|^220 OpenFTPD server ready\. .*\.\r\n| p/OpenFTPD/
+match ftp m|^220 ([\w\d-_.]+) FTP server \(NetBSD-ftpd 200\d+\) ready\.\r\n| p/NetBSD ftpd/ o/NetBSD/
+match ftp m|^220 CommuniGate Pro FTP Server ([\d.]+) ready\r\n| p/Communigate Pro ftpd/ v/$1/
+match ftp m|^220 CommuniGate Pro FTP Server ready\r\n| p/Communigate Pro ftpd/
+match ftp m|^421 Sorry you are not welcomed on this server\.\r\n$| p/BulletProof ftpd/ i/Banned/ o/Windows/
+match ftp m|^(220.*\r\n)?220 [Ee]valine FTP server \(Version:  Mac OS X|s p/Evaline ftpd/ o/Mac OS X/
+
 match ftp-proxy m|^220 Ftp service of Jana-Server ready\r\n| p/JanaServer ftp proxy/
-match ftp-proxy m|^220 [-.\w]+ FTP proxy \(Version (\d[-.\w]+)\) ready\.\r\n| p/Guantlet FTP proxy/ v/$1/
+match ftp-proxy m|^220 ([-.\w]+) FTP proxy \(Version (\d[-.\w]+)\) ready\.\r\n| p/Guantlet FTP proxy/ v/$1/
 # Frox FTP Proxy (frox-0.6.5) on Linux 2.2.X - http://frox.sourceforge.net/
 match ftp-proxy m|^220 Frox transparent ftp proxy\. Login with username\[@host\[:port\]\]\r\n| p/Frox ftp proxy/
 match ftp-proxy m|^501 Proxy unable to contact ftp server\r\n| p/Frox ftp proxy/
-match ftp-proxy m|^220 [-.+\w]+ FTP AnalogX Proxy (\d[-.\w]+) \(Release\) ready\r\n| p/AnalogX FTP proxy/ v/$1/
-match ftp-proxy m|^220 Secure Gateway FTP server ready\.\r\n| p/Symantec Enterprise Firewall FTP proxy/
+match ftp-proxy m|^220 ([-.+\w]+) FTP AnalogX Proxy (\d[-.\w]+) \(Release\) ready\r\n| p/AnalogX FTP proxy/ h/$1/ v/$2/
+match ftp-proxy m|^220 Secure Gateway FTP server ready\.\r\n| p/Symantec Enterprise Firewall FTP proxy/ d/firewall/
 match ftp-proxy m/^220-Sidewinder ftp proxy\.  You must login to the proxy first/ p/Sidewinder FTP proxy/
 match ftp-proxy m/^220-\r\x0a220-Sidewinder ftp proxy/s p/Sidewinder FTP proxy/
+match ftp-proxy m|^220 webshield2 FTP proxy ready\.\r\n| p/Webshield2 FTP proxy/ o/Windows/
 # TODO kerio?
 #match ftp m|^421 Service not available \(The FTP server is not responding\.\)\n$| v/unknown FTP server//service not responding/
-match vdr m|220 \S+ SVDRP VideoDiskRecorder (\d[^\;]+);| p/VDR/ v/$1/
+match vdr m|220(\S+) SVDRP VideoDiskRecorder (\d[^\;]+);| p/VDR/ h/$1/ v/$2/ d/media device/
 
 softmatch ftp m/^220 [-.\w ]+ftp.*\r\n$/i
 softmatch ftp m/^220-[-.\w ]+ftp.*\r\n220/i
 softmatch ftp m/^220[- ].*ftp server.*\r\n/i
 softmatch ftp m/^220-\r?\n220 - ftp/i
 
-match fw1-rlogin m|^\0Check Point FireWall-1 authenticated RLogin server running on [-.\w]+\r\n\r| p/Check Point FireWall-1 authenticated RLogin server/
-match gnats m|^200 [-.\w]+ GNATS server (\d[-.\w]+) ready\.\r\n| p/GNATS bugtracking system/ v/$1/
+match fw1-rlogin m|^\0Check Point FireWall-1 authenticated RLogin server running on ([-.\w]+)\r\n\r| p/Check Point FireWall-1 authenticated RLogin server/ i/$1/
+match gnats m|^200 ([-.\w]+) GNATS server (\d[-.\w]+) ready\.\r\n| p/GNATS bugtracking system/ h/$1/ v/$2/
 # Returns ASCII data in the following format:
 # |HardDrive1DevName|HardDrive1HardwareID|HardDrive1Temp|TempUnit|
 # |HardDrive2DevName|HardDrive2HardwareID|HardDrive2Temp|TempUnit|
 match hddtemp m+^\|/dev/hd\w\|+ p/hddtemp hard drive info server/
 # And now for some SORRY web servers that just blurt out an http "response" upon connection!!!
 match http m|^HTTP/1\.1 200 OK\r\nContent-type: text/html\r\nExpires: .*\r\nDate: .*\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n<HTML><TITLE>JAP</TITLE>\n| p/Java Anonymous Proxy/
-match http m|^HTTP/1.0 500\r\nContent-type: text/plain\r\n\r\nNo Scan Capable Devices Found\r\n| p/HP Embedded Web Server remote scan service/ i/no scanner found/
+match http m|^HTTP/1.0 500\r\nContent-type: text/plain\r\n\r\nNo Scan Capable Devices Found\r\n| p/HP Embedded Web Server remote scan service/ i/no scanner found/ d/printer/
 # SMC Barricade 7004ABR
-match http m|^HTTP/1\.0 301 Moved\r\nLocation: http://\d+\.\d+\.\d+\.\d+:88\r\n| p/SMB Barricade broadband router/ i/simply redirects to real web admin port 88/
-match hp-gsg m|^220 JetDirect GGW server \(version (\d[.\d]+)\) ready\r\n| p/HP JetDirect Generic Scan Gateway/ v/$1/
-match hylafax m|^220 [-.\w]+ server \(HylaFAX \(tm\) Version (\d[-.\w]+)\) ready\.\r\n$| p/HylaFAX/ v/$1/
+match http m|^HTTP/1\.0 301 Moved\r\nLocation: http://\d+\.\d+\.\d+\.\d+:88\r\n| p/SMB Barricade broadband router/ i/simply redirects to real web admin port 88/ d/router/
+match hp-gsg m|^220 JetDirect GGW server \(version (\d[.\d]+)\) ready\r\n| p/HP JetDirect Generic Scan Gateway/ v/$1/ d/printer/
+match hylafax m|^220 ([-.\w]+) server \(HylaFAX \(tm\) Version (\d[-.\w]+)\) ready\.\r\n$| p/HylaFAX/ h/$1/ v/$2/ d/printer/
 # Hylafax 4.1.6 on Linux 2.4
-match hylafax m|^130 Warning, client address \"[\d.]+\" is not listed for host name \"[-.\w]+\"\.\r\n| p/HylaFAX/ i/IP unauthorized/
+match hylafax m|^130 Warning, client address \"[\d.]+\" is not listed for host name \"([-.\w]+)\"\.\r\n| p/HylaFAX/ i/IP unauthorized/ h/$1/
 match ichat m|^\r\n                                Welcome To\r\n                             ichat ROOMS (\d[-.\w]+)\r\n==| p|^iChat Rooms| v|$1|
 match ident m|^flock\(\) on closed filehandle .*midentd| p/midentd/ i/broken/
 match ident m|^nullidentd -- version (\d[-.\w]+)\nCopyright | p/Nullidentd/ v/$1/ i/broken/
 
-match imap m|^\* OK [-/.+\w]+ Solstice \(tm\) Internet Mail Server \(tm\) (\d[-.\w]+) IMAP4 service - at | p/Sun Solstice Internet Mail Server imapd/ v/$1/
-match imap m|^\* OK GroupWise IMAP4rev1 Server Ready\r\n| p/Novell GroupWise imapd/
+match imap m|^\* OK ([-/.+\w]+) Solstice \(tm\) Internet Mail Server \(tm\) (\d[-.\w]+) IMAP4 service - at | p/Sun Solstice Internet Mail Server imapd/ h/$1/ v/$2/ o/Unix/
+match imap m|^\* OK GroupWise IMAP4rev1 Server Ready\r\n| p/Novell GroupWise imapd/ o/Unix/
 match imap m|^\* OK dbmail imap \(protocol version 4r1\) server (\d[-.\w]+) ready to run\r\n| p/DBMail imapd/ v/$1/ i/imapd version may differ from overal dbmail version number/
-match imap m|^\* OK [-.+\w]+ NetMail IMAP4 Agent server ready | p/Novell NetMail imapd/
+match imap m|^\* OK ([-.+\w]+) NetMail IMAP4 Agent server ready | p/Novell NetMail imapd/ h/$1/ o/Unix/
 match imap m|^\* OK IMAP4 Server \(IMail (\d[-.\w]+)\)\r\n| p/IMail imapd/ v/$1/
-match imap m|^\* OK Merak (\d[-.\w]+) IMAP4rev1 | p/Merak Mail Server imapd/ v/$1/ i/Windows/
-match imap m|^\* OK [-.+\w]+ IMAP4rev1 Mercury/32 v(\d[-.\w]+) server ready\.\r\n| p|Mercury/32 imapd| v|$1| i|Win32|
-match imap m|^\* OK [-.\w]+ IMAP4 service \(Netscape Messaging Server (\d[-.\w ]+) \(built ([\w ]+)\)\)\r\n| p/Netscape Messaging Server Imapd/ v/$1/ i/built $2/
-match imap m|^\* OK \[CAPABILITY .*\] [-.\w]+ IMAP4rev1 (20[\w.]+) at | p/UW imapd/ v/$1/
+match imap m|^\* OK Merak (\d[-.\w]+) IMAP4rev1 | p/Merak Mail Server imapd/ v/$1/ o/Windows/
+match imap m|^\* OK ([-.+\w]+) IMAP4rev1 Mercury/32 v(\d[-.\w]+) server ready\.\r\n| p|Mercury/32 imapd| h/$1/ v/$2/ o/Windows/
+match imap m|^\* OK ([-.\w]+) IMAP4 service \(Netscape Messaging Server (\d[-.\w ]+) \(built ([\w ]+)\)\)\r\n| p/Netscape Messaging Server Imapd/ h/$1/ v/$2/ i/built $3/
+match imap m|^\* OK \[CAPABILITY .*\] ([-.\w]+) IMAP4rev1 (20[\w.]+) at | p/UW imapd/ h/$1/ v/$2/
 match imap m|^\* OK eXtremail V(\d[-.\w]+) release (\d+) IMAP4 server started\r\n| p/eXtremail IMAP server/ v/$1.$2/
-match imap m|^\* OK [-.\w]+ NetMail IMAP4 Agent server ready <.*>\r\n| p/Novell Netmail imapd/
+match imap m|^\* OK ([-.\w]+) NetMail IMAP4 Agent server ready <.*>\r\n| p/Novell Netmail imapd/ h/$1/ o/Unix/
 # Alt-N MDaemon 6.5.1 imap server on Windows XP
-match imap m|^\* OK [-.\w]+ IMAP4rev1 MDaemon (\d[-.\w]+) ready\r\n| p/Alt-N MDaemon imapd/ v/$1/
+match imap m|^\* OK ([-.\w]+) IMAP4rev1 MDaemon (\d[-.\w]+) ready\r\n| p/Alt-N MDaemon imapd/ v/$2/ h/$1/
 # Dovecot IMAP Server - http://dovecot.procontrol.fi/
 match imap m|^\* OK dovecot ready\.\r\n| p/Dovecot imapd/
 match imap m|^\* OK.*?Courier-IMAP ready\. Copyright 1998-(\d+) Double Precision, Inc\.  See COPYING for distribution information\.\r\n| p/Courier Imapd/ i/released $1/
 match imap m|^\* OK \[CAPABILITY IMAP4rev1 .*?Courier-IMAP ready\. Copyright 1998-(\d+) Double Precision, Inc\.  See COPYING for distribution information\.\r\n| p/Courier IMAP4rev1 Imapd/ i/released $1/
-match imap m|^\* OK CommuniGate Pro IMAP Server ([-.\w]+) at [-.\w]+ ready\r\n$| p/CommuniGate Pro imapd/ v/$1/
+match imap m|^\* OK CommuniGate Pro IMAP Server ([-.\w]+) at ([-.\w]+) ready\r\n$| p/CommuniGate Pro imapd/ h/$1/ v/$2/
 # W-Imapd-SSL v2001adebian-6
-match imap m|^\* OK \[CAPABILITY IMAP4REV1 X-NETSCAPE LOGIN-REFERRALS STARTTLS AUTH=LOGIN\] \S+ IMAP4rev1 ([-.\w]+) at| p/UW-Imapd-SSL/ v/$1/
+match imap m|^\* OK \[CAPABILITY IMAP4REV1 X-NETSCAPE LOGIN-REFERRALS STARTTLS AUTH=LOGIN\](\S+) IMAP4rev1 ([-.\w]+) at| p/UW-Imapd-SSL/ h/$1/ v/$2/
 match imap m|^\* OK Domino IMAP4 Server Release (\d[-.\w]+) +ready| p/Lotus Domino imapd/ v/$1/
-match imap m|^\* OK Microsoft Exchange IMAP4rev1 server version ([-.\w]+) | p/Microsoft Exchange IMAP4rev1 server/ v/$1/
-match imap m|^\* OK Microsoft Exchange 2000 IMAP4rev1 server version (\d[-.\w]+) \([-.\w]+\) ready\.\r\n| p/Microsoft Exchange 2000 IMAP4rev1 server/ v/$1/
+match imap m|^\* OK Microsoft Exchange IMAP4rev1 server version ([-.\w]+) | p/Microsoft Exchange IMAP4rev1 server/ v/$1/ o/Windows/
+match imap m|^\* OK Microsoft Exchange 2000 IMAP4rev1 server version (\d[-.\w]+) \([-.\w]+\) ready\.\r\n| p/Microsoft Exchange 2000 IMAP4rev1 server/ v/$1/ o/Windows/
 match imap m|^\* OK \[CAPABILITY IMAP4REV1 .*IMAP4rev1 (200\d\.[-.\w]+) at| p/UW Imapd/ v/$1/
-match imap m|^\* OK [-.\w]+ Cyrus IMAP4 v([-.\w\+]+) server ready\r\n| p/Cyrus IMAP4/ v/$1/
-match imap m|^\* OK [-.\w]+ Cyrus IMAP4 Murder v([-.\w]+) server ready\r\n| p/Cyrus IMAP4 Murder/ v/$1/
+match imap m|^\* OK ([-.\w]+) Cyrus IMAP4 v([-.\w\+]+) server ready\r\n| p/Cyrus IMAP4/ h/$1/ v/$2/
+match imap m|^\* OK ([-.\w]+) Cyrus IMAP4 Murder v([-.\w]+) server ready\r\n| p/Cyrus IMAP4 Murder/ h/$1/ v/$2/
 match imap m|^\* OK Welcome to Binc IMAP v(\d[-.\w]+)| p/Binc IMAPd/ v/$1/
-match imap m|^\* OK [-.\w]+ IMAP4rev1 AppleMailServer (\d[-.\w]+) ready\r\n| p/AppleMailServer imapd/ v/$1/
-match imap m|^\* BYE Connection refused\r\n| p/Microsoft Exchange IMAP server/ i/refused/
+match imap m|^\* OK ([-.\w]+) IMAP4rev1 AppleMailServer (\d[-.\w]+) ready\r\n| p/AppleMailServer imapd/ h/$1/ v/$2/
+match imap m|^\* BYE Connection refused\r\n| p/Microsoft Exchange IMAP server/ i/refused/ o/Windows/
+match imap m/^\* OK IMAP4rev1 Server Classic Hamster (Vr.|Version) [\d.]+ \(Build ([\d.]+)\) greets you!\r\n/ p/Classic Hamster imapd/ v/$2/ o/Windows/
+
 softmatch imap m/^\* OK [-.\w,:+ ]+imap[-.\w,:+ ]+\r\n$/i
 
 # Cyrus IMSPD
 match imsp m|^\* OK Cyrus IMSP version (\d[-.\w]+) ready\r\n$| p/Cyrus IMSPd/ v/$1/
-match imap m|^\* OK Microsoft Exchange Server ([\d]+) IMAP4rev1 server version (\d[-.\w]+) \([-.\w]+\) ready\.\r\n| p/Microsoft Exchange Server $1/ v/$2/
+match imap m|^\* OK Microsoft Exchange Server ([\d]+) IMAP4rev1 server version (\d[-.\w]+) \([-.\w]+\) ready\.\r\n| p/Microsoft Exchange Server $1/ v/$2/ o/Windows/
 
 # ircd-hybrid 7 on Linux
 match irc m|^NOTICE AUTH :\*\*\* Looking up your hostname\.\.\.\r\nNOTICE AUTH :\*\*\* Checking Ident\r\nNOTICE AUTH :\*\*\* Got Ident response\r\nNOTICE AUTH :\*\*\* Couldn't look up your hostname\r\n$| p/Hybrid ircd/
+match irc m|^NOTICE AUTH :\*\*\* Looking up your hostname\.\.\.\r\nNOTICE AUTH :\*\*\* Checking Ident\r\nNOTICE AUTH :\*\*\* Found your hostname\r\n$| p/Hybrid ircd/
+
 # Hybrid6/PTlink6.15.0 ircd on Linux
 match irc m|^NOTICE AUTH :\*\*\* Looking up your hostname\.\.\.\r\nNOTICE AUTH :\*\*\* Found your hostname\r\n$| p/Hybrid ircd/
 # ircd 2.8/hybrid-6.3.1 on Linux
@@ -309,27 +333,27 @@ match irc-proxy m|^:dircproxy NOTICE AUTH :Looking up your hostname\.\.\.\r\n:di
 # dirkproxy (modificated dircproxy)
 match irc-proxy m|^:dirkproxy NOTICE AUTH :Looking up your hostname\.\.\.\r\n:dirkproxy NOTICE AUTH :Got your hostname\.\r\n| p/dirkproxy/
 # Unreal IRCD Server version 3.2 beta 17
-match irc m|^:[-.\w]+ NOTICE AUTH :\*\*\* Looking up your hostname\.\.\.\r\n| p/Unreal ircd/
+match irc m|(^:[-.\w]+) NOTICE AUTH :\*\*\* Looking up your hostname\.\.\.\r\n| p/Unreal ircd/ h/$1/
 # dancer-ircd 1.0.31+maint8-1
 match irc m|^NOTICE AUTH :\*\*\* Looking up your hostname\.\.\.\r\nNOTICE AUTH :\*\*\* Checking ident\r\nNOTICE AUTH :\*\*\* No identd \(auth\) response\r\nNOTICE AUTH :\*\*\* Found your hostname\r\n$| p/Dancer ircd/
 match irc m|^NOTICE AUTH :\*\*\* Looking up your hostname\.\.\.\r\nNOTICE AUTH :\*\*\* Found your hostname, welcome back\r\nNOTICE AUTH :\*\*\* Checking ident\r\nNOTICE AUTH :\*\*\* No identd \(auth\) response\r\n| p/Dancer ircd/
 match irc m|^NOTICE AUTH :\*\*\* Checking Ident\r\nNOTICE AUTH :\*\*\* Got ident response\r\n| p/ircu Undernet IRCd/
 # Bitlbee ircd 0.80
-match irc m|^:[-.\w]+ NOTICE AUTH :BitlBee-IRCd initialized, please go on\r\n| p/BitlBee IRCd/
+match irc m|(^:[-.\w]+) NOTICE AUTH :BitlBee-IRCd initialized, please go on\r\n| p/BitlBee IRCd/ h/$1/
 # PTlink6.15.2 on Linux 2.4
 match irc m|^NOTICE AUTH :\*\*\* Hostname lookup disabled, using your numeric IP\r\nNOTICE AUTH :\*\*\* Checking Ident\r\n| p/PTlink ircd/
-match irc m|^:[-.+\w]+ NOTICE AUTH :\*\*\* Looking up your hostname\.\.\.\n:[-.+\w]+ NOTICE AUTH :\*\*\* Checking Ident\n:[-.+\w]+ NOTICE AUTH :\*\*\* Found your hostname\n| p/Bahamut Dalnet ircd/ i/derived from DreamForge and Hybrid/
+match irc m|(^:[-.+\w]+) NOTICE AUTH :\*\*\* Looking up your hostname\.\.\.\n:[-.+\w]+ NOTICE AUTH :\*\*\* Checking Ident\n:[-.+\w]+ NOTICE AUTH :\*\*\* Found your hostname\n| p/Bahamut Dalnet ircd/ i/derived from DreamForge and Hybrid/ h/$1/
 match irc-proxy m|^:Welcome!psyBNC@lam3rz\.de NOTICE \* :psyBNC([-.\w]+)\r\n| p/psyBNC/ v/$1/
 # ISS RealSecure Server Sensor for Windows 6.5 on Windows NT 4.0 Server SP6a
 # ISS RealSecure ServerSensor 7.0 on Windows 2000 Server
 # ISS RealSecure Server Sensor 6.0 on Windows NT 4.0 Server SP6a
 # ISS RealSecure Server Sensor 7.0 issdaemon on Microsoft Windows NT Workstation with SP6a
-match issrealsecure m|^\0\0\0.\x08\x01\x03\x01\0.\x02\0\0..\0\0.\0\0\0..\0\0\x80\x04..\0.\0\xa0|s p/ISS RealSecure IDS/ i/Windows/
-match issrealsecure m|^\0\0\0.\x08\x01\x04\x01\0..\0\0..\0\0.\0\0\0..\0\0\x80\x04..\0.\0\xa0\0\0\0\0\0.\0\0\xa4\0\0|s p/ISS RealSecure IDS ServerSensor/ v/6.0 - 7.0/ i/Windows/
+match issrealsecure m|^\0\0\0.\x08\x01\x03\x01\0.\x02\0\0..\0\0.\0\0\0..\0\0\x80\x04..\0.\0\xa0|s p/ISS RealSecure IDS/ o/Windows/
+match issrealsecure m|^\0\0\0.\x08\x01\x04\x01\0..\0\0..\0\0.\0\0\0..\0\0\x80\x04..\0.\0\xa0\0\0\0\0\0.\0\0\xa4\0\0|s p/ISS RealSecure IDS ServerSensor/ v/6.0 - 7.0/ o/Windows/
 # I've only seen 1 example of the following. Probably not general enough
-match issrealsecure m|^\0\0\x01/\x08\x01\x03\x01\x01'\x04\0\0\0\x18\0\0\xa4\0\0\0f\x02\0\0\x80\x04\x06\0\0\x80\0\xa05Microsoft Enhanced RSA and AES Cryptographic Provider|s p/ISS Realsecure Workgroup Manager/
+match issrealsecure m|^\0\0\x01/\x08\x01\x03\x01\x01'\x04\0\0\0\x18\0\0\xa4\0\0\0f\x02\0\0\x80\x04\x06\0\0\x80\0\xa05Microsoft Enhanced RSA and AES Cryptographic Provider|s p/ISS Realsecure Workgroup Manager/ o/Windows/
 match klogin m|^\x01klogind: (All authentication systems disabled; connection refused)\.\.\r\n| p/MIT Kerberos klogin/ i/broken - $1/
-match lmtp m|^220 [-.\w]+ LMTP Cyrus v(\d[-.\w]+) ready\r\n| p/Cyrus Imap Daemon LMTP/ v/$1/
+match lmtp m|^220 ([-.\w]+) LMTP Cyrus v(\d[-.\w]+) ready\r\n| p/Cyrus Imap Daemon LMTP/ h/$1/ v/$2/
 # LSMS VPN Firewall GUI admin port
 # LSMS Redundancy port
 match lucent-fwadm m|^0001;2$| p/Lucent Secure Management Server/
@@ -348,7 +372,7 @@ match mldonkey m|^\xff\xfd\x1fWelcome to MLdonkey\n\x1b\[34mWelcome on mldonkey
 
 # Microsoft ActiveSync Version 3.7 Build 3083 (It's used for syncing
 # my ipaq it disapears when you remove the ipaq.)
-match msactivesync m|^\x16\0\x01\0\$\0U\0P\0T\0O\0D\0A\0T\0E\0\$\0\0\0$| p/Microsoft ActiveSync/
+match msactivesync m|^\x16\0\x01\0\$\0U\0P\0T\0O\0D\0A\0T\0E\0\$\0\0\0$| p/Microsoft ActiveSync/ o/Windows/
 match mud m|^\n\r\xff\xfbUDo you want ANSI color\? \(Y/n\) $| p|ROM-based MUD| i|http://rrp.rom.org/|
 
 match mysql m/^.\0\0\0\xffj\x04Host .* is not allowed to connect to this MySQL server$/ p/MySQL/ i/unauthorized/
@@ -357,46 +381,50 @@ match mysql m|^.\0\0\0\xffi\x04Host .* is blocked because of many connection err
 match mysql m/^.\0\0\0...Al sistema '[-.\w]+' non e` consentita la connessione a questo server MySQL$/ p/MySQL/
 match mysql m/^.\0\0\0.(3\.[-.\w]+)\0.*\x08\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0$/s p/MySQL/ v/$1/
 match mysql m/^.\0\0\0\n(3\.[-.\w]+)\0...\0/s p/MySQL/ v/$1/
-# r(NULL,2B,"'\0\0\0\n4.0.13\0\xdf\xbc\x02\0SC7)fHu5\0, \x08\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0")
+# r(null,2B,"'\0\0\0\n4.0.13\0\xdf\xbc\x02\0SC7)fHu5\0, \x08\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0")
 match mysql m/^.\0\0\0\n(4\.[-.\w]+)\0...\0/s p/MySQL/ v/$1/
 
-match ncacn_http m|^ncacn_http/([\d.]+)$| p/Microsoft Windows RPC over HTTP/ v/$1/
+match ncacn_http m|^ncacn_http/([\d.]+)$| p/Microsoft Windows RPC over HTTP/ v/$1/ o/Windows/
 # NCD Thinstar 300 running NCD Software 2.31 build 6
 match ncd-diag m|^WinCE/WBT Diagnostic port\n\rSerial Number: (\w+)  MAC Address: 0000(\w+)\s+.*CPU info: ([ -.+\w/ ]+)\r\n.*(Windows CE Kernel[-.+:\w ]+)\r|s p|NCD Thinster Terminal Diagnostic port| i|Serial# $1; MAC: $2; CPU: $3; $4|
 
-match netdevil m|^pass_pleaz$| p/Net-Devil backdoor/ i/Windows **TROJAN**/
+match netdevil m|^pass_pleaz$| p/Net-Devil backdoor/ i/**TROJAN**/ o/Windows/
 match netsaint m|^Sorry, you \(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\) are not among the allowed hosts\.\.\.\n$| p/Netsaint status daemon/
 # I love this service:
-match netstat m|^Active Internet connections \(.*\)\nProto Recv-Q Send-Q Local Address           Foreign Address         State      \n| p/Linux Netstat/
-match netstat m|^netstat: invalid option -- f\nusage: netstat \[-veenNcCF\]| p/Linux netstat/ i/broken/
+match netstat m|^Active Internet connections \(.*\)\nProto Recv-Q Send-Q Local Address           Foreign Address         State      \n| o/Linux/
+match netstat m|^netstat: invalid option -- f\nusage: netstat \[-veenNcCF\]| p/Linux netstat/ i/broken/ o/Linux/
+
+match netbus m|^NetBus ([\d.]+).*\r$| p/NetBus trojan/ v/$1/ o/Windows/
 
 match nntp m|^nnrpd: invalid option -- S\nUsage error\.\n| p/INN NNTPd/ i/broken/
 match nntp m|^502 You have no permission to talk\.  Goodbye.\r\n$| p/INN NNTPd/ i/unauthorized/
-match nntp m|^200 [-.\w]+ NNTP Service Ready - ([-.\w]+@[-.\w]+) \(DIABLO (\d[-.\w ]+)\)\r\n| p/Diablo NNTP service/ v/$2/ i/Admin: $1/
-match nntp m|^200 NNTP Service (\d[-.\w ]+) Version: (\d[-.\w ]+) Posting Allowed \r\n| p/Microsoft NNTP Service/ v/$2/ i/posting ok/
-match nntp m|^200 [-.\w]+ DNEWS Version  (\d[-.\w]+).*posting OK \r\n| p/Netwinsite DNEWS/ v/$1/ i/posting OK/
+match nntp m|^200 ([-.\w]+) NNTP Service Ready - ([-.\w]+@[-.\w]+) \(DIABLO (\d[-.\w ]+)\)\r\n| p/Diablo NNTP service/ h/$1/ v/$3/ i/Admin: $2/
+match nntp m|^200 NNTP Service (\d[-.\w ]+) Version: (\d[-.\w ]+) Posting Allowed \r\n| p/Microsoft NNTP Service/ v/$2/ i/posting ok/ o/Windows/
+match nntp m|^200 ([-.\w]+) DNEWS Version  (\d[-.\w]+).*posting OK \r\n| p/Netwinsite DNEWS/ h/$1/ v/$2/ i/posting OK/
 match nntp m|^200 Leafnode NNTP Daemon, version (\d[-.\w]+) running at| p/Leafnode NNTPd/ v/$1/
-match nntp m|^200 Lotus Domino NNTP Server for ([-./\w]+) \(Release (\d[-.\w]+), .*\) - Not OK to post\r\n$| p/Lotus Domino nntpd/ v/$2/ i/on $1; posting denied/
-match nntp m|^200 Lotus Domino NNTP Server for ([-./\w]+) \(Release (\d[-.\w]+), .*\) - OK to post\r\n$| p/Lotus Domino nntpd/ v/$2/ i/on $1; posting ok/
-softmatch nntp m|^200 [-\[\]\(\)!,/+:<>@.\w ]*nntp[-\[\]\(\)!,/+:<>@.\w ]*\r\n$|
-# Windows 2000 Server read:
-match nntp m|^200 NNTP Service 5\.00\.0984 Version: (5\.0\.2159.1) Posting Allowed \r\n| p/Microsoft NNTP Service/ v/$1/ i/posting OK/
-match nntp m|^200 NNTP Service Microsoft\xae Internet Services \d[-.\w]+ Version: (\d[-.\w]+) Posting Allowed \r\n| p/Microsoft NNTP Service/ v/$1/ i/posting OK/
-match nntp m|^502 Connection refused\r\n| p/Microsoft NNTP Service/ i/refused/
+match nntp m|^200 Lotus Domino NNTP Server for ([-./\w]+) \(Release (\d[-.\w]+), .*\) - Not OK to post\r\n$| p/Lotus Domino nntpd/ v/$2/ i/posting denied/ o/$1/
+match nntp m|^200 Lotus Domino NNTP Server for ([-./\w]+) \(Release (\d[-.\w]+), .*\) - OK to post\r\n$| p/Lotus Domino nntpd/ v/$2/ i/posting ok/ o/$1/
+
+match nntp m|^200 NNTP Service 5\.00\.0984 Version: (5\.0\.2159.1) Posting Allowed \r\n| p/Microsoft NNTP Service/ v/$1/ i/posting OK/ o/Windows 2000/
+match nntp m|^200 NNTP Service Microsoft\xae Internet Services (\d[-.\w]+) Version: (\d[-.\w]+) Posting Allowed \r\n| p/Microsoft NNTP Service $1/ v/$2/ i/posting OK/ o/Windows/
+match nntp m|^502 Connection refused\r\n| p/Microsoft NNTP Service/ i/refused/ o/Windows/
 # Windows NT 4.0 SP5-SP6 
-match nntp m|^200 Microsoft Exchange Internet News Service Version (5\.5\.[.\d]+) \(posting allowed\)\r\n| p/Microsoft Exchange Internet News Service/ v/$1/ i/posting allowed/
-#match nntp m|^200 [-.\w]+ InterNetNews NNRP server INN (\d[-.\w]+) ready \(posting ok\)\.\r\n| v/InterNetNews (INN)/$1/posting ok/
-match nntp m|^200 [-.\w]+ InterNetNews NNRP server INN (\d[-.\w ]+) ready \(posting ok\)\.\r\n| p/InterNetNews (INN)/ v/$1/ i/posting ok/
-match nntp m|^200 NNTP-Server Classic Hamster Vr\. \d[-.\w ]+ \(Build (\d[-.\w ]+)\) \(post ok\) says: Hi!\r\n| p/Classic Hamster NNTPd/ v/$1/ i/for Windows; posting ok/
-match nntp m|^200 ArGoSoft News Server for WinNT/2000/XP v ([\d.]+) ready\r\n| p/ArGoSoft nntpd/ v/$1/ i/Win32/
+match nntp m|^200 Microsoft Exchange Internet News Service Version (5\.5\.[.\d]+) \(posting allowed\)\r\n| p/Microsoft Exchange Internet News Service/ v/$1/ i/posting allowed/ o/Windows/
+#match nntp m|^200 ([-.\w]+) InterNetNews NNRP server INN (\d[-.\w]+) ready \(posting ok\)\.\r\n| v/InterNetNews (INN)/$2/posting ok/ h/$1/
+match nntp m|^200 ([-.\w]+) InterNetNews NNRP server INN (\d[-.\w ]+) ready \(posting ok\)\.\r\n| p/InterNetNews (INN)/ h/$1/ v/$2/ i/posting ok/
+match nntp m|^200 ArGoSoft News Server for WinNT/2000/XP v ([\d.]+) ready\r\n| p/ArGoSoft nntpd/ v/$1/ o/Windows/
+match nntp m|^400 No space left on device writing SMstore file -- throttling\r\n| p/InterNetNews (INN)/ i/HDD full/
+match nntp m/^200 NNTP-Server Classic Hamster (Vr\.|Version) \d[-.\w ]+ \(Build (\d[-.\w ]+)\) \(post ok\) says: Hi!\r\n/ p/Classic Hamster NNTPd/ v/$2/ i/posting ok/ o/Windows/
 # Netware News Server
 match nntp m|^200 ([\w.-_]+) NetWare-News-Server/([\d.]+) 'LDNUM' NNRP ready \(posting ok\)\.\r\n| p/NetWare nntpd/ v/$2/ h/$1/
+match nntp m|^200 Leafnode NNTP daemon, version ([\w.]+) at ([\w-_.]+) \r\n| p/Leafnode nntpd/ v/$1/ h/$2/
+softmatch nntp m|^200 [-\[\]\(\)!,/+:<>@.\w ]*nntp[-\[\]\(\)!,/+:<>@.\w ]*\r\n$|
 
 # Windows 2000 Server Windows Media Unicast Service (NsUnicast) - Nsum.exe
-match nsunicast m|^4\0\0\0V4\x12\0\0\0\0\0\0\0\0\x004\0\0\0\x04\0\xf0\0\xd3\x07\t\0.\0.\0.\0.\0.\0..\0\0\0\0.\0\0\0.\0\0\0\x02\0|s p/Microsoft Windows Media Unicast Service/ i/nsum.exe/
-match nsunicast m|^[4f]\0\0\0V4\x12\0\0\0\0\0\0\0\0\x00[4f]\0\0\0.\0\xf0\0\xd3\x07\t\0.\0.\0.\0.\0.\0..\0\0\0\0.\0\0\0..\0\0.\0|s p/Microsoft Windows Media Unicast Service/ i/nsum.exe/
+match nsunicast m|^4\0\0\0V4\x12\0\0\0\0\0\0\0\0\x004\0\0\0\x04\0\xf0\0\xd3\x07\t\0.\0.\0.\0.\0.\0..\0\0\0\0.\0\0\0.\0\0\0\x02\0|s p/Microsoft Windows Media Unicast Service/ i/nsum.exe/ o/Windows/
+match nsunicast m|^[4f]\0\0\0V4\x12\0\0\0\0\0\0\0\0\x00[4f]\0\0\0.\0\xf0\0\xd3\x07\t\0.\0.\0.\0.\0.\0..\0\0\0\0.\0\0\0..\0\0.\0|s p/Microsoft Windows Media Unicast Service/ i/nsum.exe/ o/Windows/
 
-match pcanywheredata m/^\0X\x08\0\}\x08\r\n\0\.\x08.*\.\.\.\r\n/s p/PCAnywhere/
+match pcanywheredata m/^\0X\x08\0\}\x08\r\n\0\.\x08.*\.\.\.\r\n/s p/PCAnywhere/ o/Windows/
 
 match pbmasterd m|^pbmasterd(\d[-.\w]+)@[-.+\w]+: | p/Symark Power Broker pbmasterd/ v/$1/ i/privilege separation software/
 match pblocald m|^pblocald(\d[-.\w]+)@[-.+\w]+: | p/Symark Power Broker pblocald/ v/$1/ i/privilege separation software/
@@ -408,88 +436,100 @@ match pop2 m|^\+ POP2 [-\[\].\w]+ v(20[-.\w]+) server ready\r\n$| p/UW POP2 serv
 match pop3 m|^\+OK POP3 AnalogX Proxy (\d[-.\w]+) \(Release\) ready\.\n$| p/AnalogX POP3 proxy/ v/$1/
 
 # Novell Groupwise 6.0.1
-match pop3 m|^\+OK GroupWise POP3 server ready\r\n$| p/Novell GroupWise pop3d/
+match pop3 m|^\+OK GroupWise POP3 server ready\r\n$| p/Novell GroupWise pop3d/ o/Unix/
 match pop3 m|^\+OK Ready when you are <200\d+\.| p/Hotmail Popper hotmail to pop3 gateway/
 match pop3 m|^\+OK Internet Rex POP3 server ready <| p/Internet Rex Pop3 server/
 match pop3 m|^\+OK DBMAIL pop3 server ready to rock <| p/DBMail pop3d/
 match pop3 m|^\+OK POP3 POPFile \(v(\d[-.\w]+)\) server ready\r\n| p/popfile pop3d/ v/$1/
 # Dots in Revision to prevent MY CVS from screwing it up
-match pop3 m|^\+OK [-.+\w]+ NetMail POP3 Agent \$Re..sion: ([\d.]+) \$\r\n| p/Novell NetMail pop3d/ i/File revision: $1/
-match pop3 m|^\+OK [-.+\w]+ Merak (\d[-.\w]+) POP3 | p/Merak mail server pop3d/ v/$1/
+match pop3 m|^\+OK ([-.+\w]+) NetMail POP3 Agent \$Re..sion: ([\d.]+) \$\r\n| p/Novell NetMail pop3d/ h/$1/ v/$2/ o/Unix/
+match pop3 m|^\+OK ([-.+\w]+) Merak (\d[-.\w]+) POP3 | p/Merak mail server pop3d/ h/$1/ v/$2/
 # Mercury/32 3.32 pop3 Server module on Windows XP
-match pop3 m|^\+OK <\d{6,10}\.\d{4,6}@[-.+\w]+>, POP3 server ready\.\r\n| p|Mercury/32 pop3d| i|Win32|
+match pop3 m|^\+OK <\d{6,10}\.\d{4,6}@([-.+\w]+)>, POP3 server ready\.\r\n| p|Mercury/32 pop3d| o|Windows| h|$1|
 # gnu/mailutils pop3d 0.3.2 on Linux
-match pop3 m|^\+OK POP3 Ready <\d{3,6}\.1[012]\d{8}@[-.\w]+>\r\n| p|GNU mailutils pop3d|
+match pop3 m|^\+OK POP3 Ready <\d{3,6}\.1[012]\d{8}@([-.\w]+)>\r\n| p|GNU mailutils pop3d| h|$1|
 # Solid POP3 Server 0.15 on Linux 2.4
-match pop3 m|^\+OK Solid POP3 server ready <\d{3,6}\.1[012]\d{8}@[-.\w]+>\r\n| p/Solid pop3d/
+match pop3 m|^\+OK Solid POP3 server ready\r\n| p/Solid pop3d/
+match pop3 m|^\+OK Solid POP3 server ready <\d{3,6}\.1[012]\d{8}@([-.\w]+)>\r\n| p/Solid pop3d/ h/$1/
 # Cyrus POP3 v2.0.16
-match pop3 m|^\+OK [-.\w]+ Cyrus POP3 v(\d[-.\w\+]+) server ready ?\r\n| p/Cyrus POP3/ v/$1/
-match pop3 m|^\+OK [-.\w]+ Cyrus POP3 Murder v(\d[-.\w\+]+) server ready ?\r\n| p/Cyrus POP3 Murder/ v/$1/
+match pop3 m|^\+OK ([-.\w]+) Cyrus POP3 v(\d[-.\w\+]+) server ready ?\r\n| p/Cyrus POP3/ h/$1/ v/$2/
+match pop3 m|^\+OK ([-.\w]+) Cyrus POP3 Murder v(\d[-.\w\+]+) server ready ?\r\n| p/Cyrus POP3 Murder/ h/$1/ v/$2/
+#  pop3d (GNU Mailutils 0.3) on Linux 2.4
+match pop3 m|^\+OK POP3 Ready <\d{3,6}\.1[012]\d{8}@(\w+)>\r\n| p/GNU Mailutils pop3d/ h/$1/
+# Solid POP3 Server 0.15_1 on FreeBSD
+match pop3 m|^\+OK ([\w\d-_]+\.[\w\d-_.]+) POP3 <\d{3,6}\.1[012]\d{8}@[-.\w]+>\r\n| p/Solid pop3d/ h/$1/
 #  pop3d (GNU Mailutils 0.3) on Linux 2.4
 match pop3 m|^\+OK POP3 Ready <\d{3,6}\.1[012]\d{8}@\w+>\r\n| p/GNU Mailutils pop3d/
 # dovecot 0.99.10 on Linux 2.4
 match pop3 m|^\+OK dovecot ready\.\r\n| p/Dovecot pop3d/
 # teapop 0.3.5 on Linux 2.4
-match pop3 m|^\+OK Teapop \[v(\d[-.\w ]+)\] - Teaspoon stirs around again .*\r\n| p/Teapop pop3d/ v/$1/
+match pop3 m|^\+OK Teapop \[v?(\d[-.\w ]+)\] - Teaspoon stirs around again .*\r\n| p/Teapop pop3d/ v/$1/
 # Qpopper v4.0.5 on Linux 2.4.19
 match pop3 m|^\+OK ready  \r\n$| p/Qpopper pop3d/
 # Jana Server 1.45 on WIn98
-match pop3 m|^\+OK POP3 server ready <Jana-Server>\r\n| p/Jana POP3 server/ i/Windows/
-match pop3 m|^\+OK AppleMailServer (\d[-.\w]+) POP3 server at [-.\w]+ ready <\d| p/AppleMailServer pop3d/ v/$1/
-match pop3 m|\+OK <10\d+\.\d+@[-.\w]+> \[XMail (\d[-.\w]+) \(([-./\w]+)\) POP3 Server\] service ready; | p/XMail pop3 server/ v/$1/ i/on $2/
+match pop3 m|^\+OK POP3 server ready <Jana-Server>\r\n| p/Jana POP3 server/ o/Windows/
+match pop3 m|^\+OK AppleMailServer (\d[-.\w]+) POP3 server at ([-.\w]+) ready <\d| p/AppleMailServer pop3d/ h/$1/ v/$2/
+match pop3 m|\+OK <10\d+\.\d+@([-.\w]+)> \[XMail (\d[-.\w]+) \(([-./\w]+)\) POP3 Server\] service ready; | p/XMail pop3 server/ h/$1/ v/$2/ o/$3/
 # Mail-Enable pop3 server 1.704
 match pop3 m|^\+OK Welcome to MailEnable POP3 Server\r\n| p/MailEnable POP3 Server/
-match pop3 m|^\+OK [-.\w]+ running Eudora Internet Mail Server (\d[-.\w]+) <.*>\r\n| p/Eudora Internet Mail Server pop3d/ v/$1/
+match pop3 m|^\+OK ([-.\w]+) running Eudora Internet Mail Server (\d[-.\w]+) <.*>\r\n| p/Eudora Internet Mail Server pop3d/ h/$1/ v/$2/
 # Qpopper 4.0.3 on Linux
 # QPopper 4.0.4 FreeBSD
-match pop3 m|^\+OK ready  <\d{1,5}\.10\d{8}@[-.\w]+>\r\n| p/Qualcomm Qpopper pop3d/
+match pop3 m|^\+OK ready  <\d{1,5}\.10\d{8}@([-.\w]+)>\r\n| p/Qualcomm Qpopper pop3d/ h/$1/
 match pop3 m|^\+OK POP3 Welcome to GNU POP3 Server Version (\d[-.\w]+) <.*>\r\n| p/GNU POP3 Server/ v/$1/
 match pop3 m|^\+OK eXtremail V(\d[-.\w]+) release (\d+) POP3 server ready <.*>\r\n| p/eXtremail pop3d/ v/$1.$2/
 match pop3 m|^\+OK POP3 Welcome to vm-pop3d (\d[-.\w]+) <.*>\r\n| p/vm-pop3d/ v/$1/ i/derived from gnu-pop3d/
 # tpop3d v1.4.2 on Linux - http://www.ex-parrot.com/~chris/tpop3d/
-match pop3 m|^\+OK <[\da-f]{32}@[-.\w]+>\r\n| p/tpop3d/
+match pop3 m|^\+OK <[\da-f]{32}@([-.\w]+)>\r\n| p/tpop3d/ h/$1/
 match pop3 m|^\+OK UCB based pop server \(version (\d[-.\w]+) at sionisten\) starting\.\r\n| p/Heimdal kerberized pop3/ v/$1/ i/UCB-pop3 derived/
 # VPOP3 (Virtual POP3 server) 2.0.0d on Windows 2000
 match pop3 m|^\+OK VPOP3 Server Ready <.*>\r\n| p/PSCS VPop3/
 match pop3 m|^\+OK Lotus Notes POP3 server version ([-.\w]+) ready .* on ([^/]+)/([^\.]+)\.\r\n| p/Lotus Domino POP3 server/ v/$1/ i/CN=$2;Org=$3/
 match pop3 m|^\+OK Lotus Notes POP3 server version ([-.\w]+) ready on | p/Lotus Domino POP3 server/ v/$1/
 match pop3 m|^\+OK POP3 hotwayd v(\d[-.\w]+) -> The POP3-HTTPMail Gateway\.| p/hotwayd pop3d/ v/$1/
-match pop3 m|^\+OK [-.\w]+ POP3 service \(Netscape Messaging Server (\d[^(]+) \(built ([\w ]+)\)\)\r\n| p/Netscape Messenging Server pop3/ v/$1/ i/built on $2/
-match pop3 m/^\+OK [-.\w]+ Cyrus POP3 v(\d[-.\w]+) server ready </ p/Cyrus pop3d/ v/$1/
-match pop3 m/^\+OK X1 NT-POP3 Server [-\w.]+ \(IMail ([^)]+)\)\r\n/ p/IMail pop3d/ v/$1/
+match pop3 m|^\+OK ([-.\w]+) POP3 service \(Netscape Messaging Server (\d[^(]+) \(built ([\w ]+)\)\)\r\n| p/Netscape Messenging Server pop3/ h/$1/ v/$2/ i/built on $3/
+match pop3 m/^\+OK ([-.\w]+) Cyrus POP3 v(\d[-.\w]+) server ready </ p/Cyrus pop3d/ h/$1/ v/$2/
+match pop3 m/^\+OK X1 NT-POP3 Server ([-\w.]+) \(IMail ([^)]+)\)\r\n/ p/IMail pop3d/ h/$1/ v/$2/
 match pop3 m/^\+OK POP3 \[cppop (\d[^]]+)\] at \[/ p/cppop pop3d/ v/$1/
-match pop3 m/^\+OK Microsoft Exchange 2000 POP3 server version (\S+).* ready\.\r\n/ p/MS Exchange 2000 pop3d/ v/$1/
-match pop3 m/^\+OK Microsoft Exchange POP3 server version (\S+) ready\r\n/ p/MS Exchange pop3d/ v/$1/
-match pop3 m/^\+OK Der Microsoft Exchange POP3-Server \(Version ([\d\.]+)\) ist betriebsbereit\.\r\n/ p/MS Exchange pop3d/ v/$1/ i/German/
+match pop3 m/^\+OK Microsoft Exchange 2000 POP3 server version (\S+).* ready\.\r\n/ p/MS Exchange 2000 pop3d/ v/$1/ o/Windows/
+match pop3 m/^\+OK Microsoft Exchange POP3 server version (\S+) ready\r\n/ p/MS Exchange pop3d/ v/$1/ o/Windows/
+match pop3 m/^\+OK Der Microsoft Exchange POP3-Server \(Version ([\d\.]+)\) ist betriebsbereit\.\r\n/ p/MS Exchange pop3d/ v/$1/ i/German/ o/Windows/
+match pop3 m/\+OK Microsoft Exchange POP3-server versie ([\d.]+) is gereed\.\r\n/ p/MS Exchange pop3d/ v/$1/ i/Dutch/
 match pop3 m/^\+OK QPOP \(version ([^)]+)\) at .*starting\./ p/Qpop pop3d/ v/$1/
 match pop3 m/^\+OK QPOP Modified by Compaq \(version ([^)]+)\) at .*starting\./ p/QPop pop3d/ v/$1/
 match pop3 m/^\+OK Qpopper .*\(version ([^)]+)\) at .*starting\./ p/Qpopper pop3d/ v/$1/
-match pop3 m/^\+OK [-.\w]+ POP3 server \(Netscape Mail Server v(\d[-.\w])\) ready/ p/Netscape Mail Server pop3d/ v/$1/
+match pop3 m/^\+OK ([-.\w]+) POP3 server \(Netscape Mail Server v(\d[-.\w])\) ready/ p/Netscape Mail Server pop3d/ h/$1/ v/$2/
 match pop3 m/^\+OK Cubic Circle's v(\d[-.\w]+) .* POP3 ready/ p/Cubic Circle Cucipop pop3d/ v/$1/
 match pop3 m/^\+OK CCProxy (\S+) POP3 Service Ready\r\n/ p/CCProxy pop3d/ v/$1/
 match pop3 m/^\+OK ArGoSoft Mail Server Freeware, Version \S+ \(([^)]+)\)\r\n$/ p/ArGoSoft freeware pop3d/ v/$1/
 match pop3 m|^\+OK ArGoSoft Mail Server, Version [-.\w]+ \(([-.\w]+)\)\r\n$| p/ArGoSoft Mail Server pop3d/ v/$1/
-match pop3 m|^\+OK ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [-.\w]+ \(([-.\w]+)\)\r\n$| p/ArGoSoft Mail Server Pro pop3d/ v/$1/ i/Win32/
-match pop3 m|^\+OK ([\w-.]+) ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft Pro/ v/$2/ i/Host $1; Win32/
-match pop3 m/^\+OK [-.\w]+ Execmail POP3 \((\d[^)]+)\)/ p/Execmail pop3d/ v/$1/
+match pop3 m|^\+OK ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [-.\w]+ \(([-.\w]+)\)\r\n$| p/ArGoSoft Mail Server Pro pop3d/ v/$1/ o/Windows/
+match pop3 m|^\+OK ([\w-.]+) ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft Pro/ v/$2/ h/$1/ o/Windows/
+match pop3 m/^\+OK ([-.\w]+) Execmail POP3 \((\d[^)]+)\)/ p/Execmail pop3d/ h/$1/ v/$2/
 match pop3 m/^\+OK MailSite POP3 Server (\S+) Ready </ p/MailSite pop3d/ v/$1/
 match pop3 m/^Proxy\+ POP3 server\. Insecure access - terminating\.\r\n/ p/Proxy+ pop3d/
-match pop3 m/^\+OK [-.\w]+ POP MDaemon (\S+) ready <MDAEMON/ p/MDaemon pop3d/ v/$1/
+match pop3 m/^\+OK ([-.\w]+) POP MDaemon (\S+) ready <MDAEMON/ p/MDaemon pop3d/ h/$1/ v/$2/
 # qmail-pop3d 1.03-1
-match pop3 m/^\+OK <\d{1,5}\.10\d{8}@[-.\w]+>\r\n$/ p/qmail-pop3d/
+match pop3 m/^\+OK <\d{1,5}\.10\d{8}@[-.\w]+>\r\n$/ p/qmail-pop3d/ o/Unix/
 # Courier Pop3 courier-pop3d-0.42.0-1.7.3
 match pop3 m|^\+OK Hello there\.\r\n$| p/Courier pop3d/
-match pop3 m/^\+OK [-.\w]+ VisNetic.MailServer.v([-.\w]+) POP3 / p/VisNetic MailServer pop3d/ v/$1/
-match pop3 m/^\+OK [-.\w]+ POP3 server \(Post\.Office v([-.\w]+) release ([-.\w]+) with ZPOP version ([-.\w]+)\) ready / p|Post.Office pop3d| v|$1 release $2| i|w/ZPOP $3|
+match pop3 m/^\+OK ([-.\w]+) VisNetic.MailServer.v([-.\w]+) POP3 / p/VisNetic MailServer pop3d/ h/$1/ v/$2/
+match pop3 m/^\+OK ([-.\w]+) POP3 server \(Post\.Office v([-.\w]+) release ([-.\w]+) with ZPOP version ([-.\w]+)\) ready / p|Post.Office pop3d| h|$1| v|$2 release $3| i|w/ZPOP $4|
 match pop3 m/^\+OK CommuniGate Pro POP3 Server ([-.\w]+) ready/ p/CommuniGate Pro/ v/$1/
 match pop3 m/^\+OK\r\n$/ p/Openwall popa3d/
-match pop3 m|^\+OK [-.\w]+ MultiNet POP3 Server Process V(\S+) at| p/DEC OpenVMS MultiNet pop3d/ v/$1/
-match pop3 m|^\+OK <.*>, MercuryP/NLM v(\d[-.\w]+) ready.\r\n$| p/Mercury POP3 server/ v/$1/ i/on Novell Netware/
-match pop3 m|^\+OK Microsoft Windows POP3 Service Version 1.0 <| p/Microsoft Windows 2003 POP3 Service/ v/1.0/
-match pop3 m|^\+OK POP3 [-.\w]+ v?(200\d\.[-.\w]+) server ready\r\n| p/UW Imap pop3 server/ v/$1/
+match pop3 m|^\+OK ([-.\w]+) MultiNet POP3 Server Process V(\S+) at| p/DEC OpenVMS MultiNet pop3d/ h/$1/ v/$2/
+match pop3 m|^\+OK <.*>, MercuryP/NLM v(\d[-.\w]+) ready.\r\n$| p/Mercury POP3 server/ v/$1/ o/Netware/
+match pop3 m|^\+OK Microsoft Windows POP3 Service Version 1.0 <| p/Microsoft Windows 2003 POP3 Service/ v/1.0/ o/Windows 2000/
+match pop3 m|^\+OK POP3 ([-.\w]+) v?(200\d\.[-.\w]+) server ready\r\n| p/UW Imap pop3 server/ h/$1/ v/$2/
 match pop3 m|^\+OK POP3 server ready <\w{11}>\r\n$| p/WebSTAR pop-3 server/
-match pop3 m|^\+OK TrendMicro IMSS (\d[-.\w ]+) POP3 Proxy at [-.\w]+\r\n| p/TrendMicro IMSS virus scanning POP3 proxy/ v/$1/
+match pop3 m|^\+OK TrendMicro IMSS (\d[-.\w ]+) POP3 Proxy at ([-.\w]+)\r\n| p/TrendMicro IMSS virus scanning POP3 proxy/ h/$1/ v/$2/
 match pop3 m|^\+OK Kerio MailServer (\d[-.\w]+) POP3 server ready <([-.\w@:]+)>\r\n$| p/Kerio MailServer POP3 Server/ v/$1/ i/$2/
+match pop3 m/^\+OK POP3-Server Classic Hamster (Vr\.|Version) [\d.]+ \(Build ([\d.]+)\) greets you! <.*>\r\n/ p/Classic Hamster pop3d/ v/$2/ o/Windows/
+match pop3 m|^\+OK Stalker POP3 Server ([\w.]+) at ([\w-_.]+) ready <.*>\r\n| p/Stalker pop3d/ v/$1/ h/$2/ o/Mac OS/
+match pop3 m|^\+OK ([\w-_.]+) POP3 service \(iPlanet Messaging Server ([\w-_.\s]+) \(built .*\)\)\r\n| p/iPlanet pop3d/ v/$2/ h/$2/
+match pop3 m|^\+OK Messaging Multiplexor \(iPlanet Messaging Server ([\w-_.\s]+) \(built .*\)\)\r\n| p/iPlanet messaging multiplexor/ v/$1/
+
+
 softmatch pop3 m|^\+OK [-\[\]\(\)!,/+:<>@.\w ]+\r\n$|
 
 # http://echelon.pl/pubs/poppassd.html
@@ -497,17 +537,20 @@ softmatch pop3 m|^\+OK [-\[\]\(\)!,/+:<>@.\w ]+\r\n$|
 # it changes the password of the user.
 # poppassd 1.8.1
 match pop3pw m|^200 ([-.\w]+ )?poppassd v(\d[-.\w]+) hello, who are you\?\r\n| p|Poppassd| v|$2| i|http://echelon.pl/pubs/poppassd.html|
+match pop3pw m|^200 poppassd hello, who are you\?\r\n| p/poppassd/
 match pop3pw m|^200 courierpassd v(\d[-.\w]+) hello, who are you\?\r\n| p/Courierpassd pop3 password change daemon/
-match pop3pw m|^200 [-.+\w]+ MercuryW PopPass server ready\.\r\n| p|Mercury/32 poppass service| i|Win32|
-match pop3pw m|^200 X1 NT-PWD Server [-.+\w]+ \(IMail (\d[-.\w]+)\)\r\n| p/IPSwitch Imail pop3 password change daemon/ v/$1/ i/Windows/
+match pop3pw m|^200 ([-.+\w]+) MercuryW PopPass server ready\.\r\n| p|Mercury/32 poppass service| o|Windows| h|$1|
+match pop3pw m|^200 X1 NT-PWD Server ([-.+\w]+) \(IMail (\d[-.\w]+)\)\r\n| p/IPSwitch Imail pop3 password change daemon/ h/$1/ v/$2/ o/Windows/
 match pop3pw m|^200 CommuniGate Pro PWD Server (\d[-.\w]+) ready <| p/CommuniGate Pro pop3 password change daemon/ v/$1/
 match pop3pw m|^\+OK ApplePasswordServer (\d[-.\w]+) password server at | p/ApplePasswordServer pop3 password change daemon/ v/$1/
+match pop3pw m|^200 Stalker Internet Password Server ready\. V\.([\w.]+)\r\n| p/Stalker Mail Server password change daemon/ v/$1/ o/Mac OS/
+
 match pmud m|^pmud (\d[-.\w]+) \d+\n| p|pmud| i|http://sf.net/projects/apmud|
-match printer m|^lpd \[@[-.\w]+\]: Print-services are not available to your host \([-.\w]+\)\.\n| p/BSD lpd/ i/Unauthorized host/
+match printer m|^lpd \[@([-.\w]+)\]: Print-services are not available to your host \([-.\w]+\)\.\n| p/BSD lpd/ i/Unauthorized host/ h/$1/
 # BSD lpr/lpd line printer spooling system (lpr v1:2000.05.07) on Linux 2.6.0-test5
-match printer m|[-.\w]+: lpd: Your host does not have line printer access\n| p|BSD/Linux lpd| i|access denied|
+match printer m|([-.\w]+): lpd: Your host does not have line printer access\n| p|BSD/Linux lpd| h|$1| i|access denied|
 # Linux 2.4.18 lpr 2000.05.07-4.2
-match printer m|^lpd: Host name for your address \(\d+\.\d+\.\d+\.\d+\) unknown\n$| p/Linux lpd/ i/client IP must resolve/
+match printer m|^lpd: Host name for your address \(\d+\.\d+\.\d+\.\d+\) unknown\n$| p/Linux lpd/ i/client IP must resolve/ o/Linux/
 match printer m|^([/\w]+/)?lpd: (.*)\n| p/lpd/ i/error: $2/
 
 # Windows QOTD service only has 12 quotes.  Found on Windows XP in
@@ -516,9 +559,9 @@ match qotd m/^"(My spelling is Wobbly\.|Man can climb to the highest summits,|In
 match qotd m/^"(Mi ortograf\xeda tiembla\. Es bueno revisarla,|un hombre puede escalar a las m\xe1s altas cumbre|Algo maravilloso a poner de manifiesto:|Cuando un necio hace algo de lo que se aveg\xfcenza,|En el cielo, un \xe1ngel no es nadie en concreto|Traigamos unos cuantos locos ahora\.|Era tan verdad como los impuestos\. Y no|Hay libros cortos que, para entenderlos como se merecen,|La prosperidad hace amistades, y la adversidad las|El uso principal de un PC es confirmar la ley de|Quedarse en lo conocido por miedo a lo desconocido,|Cuando las leyes son injustas, no obligan en el fuero|Magia equivale a cualquier avance en la ciencia\.|Vale mejor consumir vanidades de la vida,)/ p/Windows qotd/ i/Spanish/ o/Windows/
 # Some Italian qotds start with a space instead of a "
 match qotd m/^.(Voce dal sen fuggita|Semel in anno licet insanire|Cosa bella e mortal passa e non dura|Quando uno stupido compie qualcosa di cui si vergogna,|Se tu pagare come dici tu,|Fatti non foste a viver come bruti,|Sperare senza far niente e` come)/ p/Windows qotd/ i/Italian/ o/Windows/
-match qotd m/^"(Prazos longos sao f\xa0ceis de subscrever\.|Deus, para a felicidade do homem, inventou a f\x82 e o amor\.|Ao vencido, \xa2dio ou compaixao, ao vencedor, as batatas\.|Quem nao sabe que ao p\x82 de cada bandeira p\xa3blica,|Nao te irrites se te pagarem mal um benef\xa1cio; antes cair|A vida, como a antiga Tebas, tem cem portas\.)/ p/Windows qotd/ i/Portugese/
+match qotd m/^"(Prazos longos sao f\xa0ceis de subscrever\.|Deus, para a felicidade do homem, inventou a f\x82 e o amor\.|Ao vencido, \xa2dio ou compaixao, ao vencedor, as batatas\.|Quem nao sabe que ao p\x82 de cada bandeira p\xa3blica,|Nao te irrites se te pagarem mal um benef\xa1cio; antes cair|A vida, como a antiga Tebas, tem cem portas\.)/ p/Windows qotd/ i/Portugese/ o/Windows/
 # The German version doesn't start with "
-match qotd m/^(Wer wirklich Autorit\xe4t hat, wird sich nicht scheuen,|Moral ist immer die Zuflucht der Leute,|Beharrlichkeit wird zuweilen mit Eigensinn|Wer den Tag mit Lachen beginnt, hat ihn|Wenn uns keine Ausweg mehr bleibt,|Gesichter sind die Leseb\xfccher des Lebens|Grosse Ereignisse werfen mitunter ihre Schatten|Dichtung ist verpflichtet, sich nach den|Ohne Freihet geht das Leben|Liebe ist wie ein Verkehrsunfall\. Man wird angefahren)/ p/Windows qotd/ i/German/
+match qotd m/^(Wer wirklich Autorit\xe4t hat, wird sich nicht scheuen,|Moral ist immer die Zuflucht der Leute,|Beharrlichkeit wird zuweilen mit Eigensinn|Wer den Tag mit Lachen beginnt, hat ihn|Wenn uns keine Ausweg mehr bleibt,|Gesichter sind die Leseb\xfccher des Lebens|Grosse Ereignisse werfen mitunter ihre Schatten|Dichtung ist verpflichtet, sich nach den|Ohne Freihet geht das Leben|Liebe ist wie ein Verkehrsunfall\. Man wird angefahren)/ p/Windows qotd/ i/German/ o/Windows/
 match qotd m/^"(Clovek ma tri cesty, jak moudre jednat\. Nejprve premyslenim|Co je vubec hodno toho, aby to bylo vykonano,|Fantazie je dulezitejsi nez vedeni\.|Potize narustaji, cim vice se clovek blizi|Kdo nezna pristav, do ktereho se chce plavit,|Lidske mysleni ztraci smysl,|Nikdo nevi, co muze vykonat,|Nic neprekvapi lidi vice nez zdravy rozum|Zadny cil neni tak vysoky,)/ p/Windows qotd/ o/Windows/ i/Czech/
 
 match quagga m|^\r\nHello, this is quagga \(version (\d[-.\w]+)\)\.\r\nCopyright 1996-200| p/Quagga routing software/ v/$1/ i/Derivative of GNU Zebra/
@@ -529,9 +572,9 @@ match razor2 m|^sn=\w&srl=\d+&ep4=[-\w]+&a=\w&a=\w+\r\n$| p/Vipul's Razor2 anti-
 # 2036 (secure) by default but can be changed.
 # The unknown token looks like it might be signifigant but I can't
 # find any protocol descriptions. -Doug
-match rconj m|^\0.\0\x01\0\0\0\0.*\x0b\0\0\0\0([\w-_]+)\x00437|s p/Novell rconj/ i/Unknown token: $1/
+match rconj m|^\0.\0\x01\0\0\0\0.*\x0b\0\0\0\0([\w-_]+)\x00437|s p/Novell rconj/ i/Unknown token: $1/ o/Unix/
 
-match resvc m|^\{0000004c\} NODEINFO \(5\) \{38\}Version: (\d[-.\w ]+) Microsoft Routing Server ready\r\n  | p/Microsoft Exchange routing server/ v/$1/
+match resvc m|^\{0000004c\} NODEINFO \(5\) \{38\}Version: (\d[-.\w ]+) Microsoft Routing Server ready\r\n  | p/Microsoft Exchange routing server/ v/$1/ o/Windows/
 
 # RedHat 7.3 - rsync server version 2.5.4  protocol version 26
 # Redhat Linux 7.1
@@ -540,145 +583,147 @@ match rsync m|^@RSYNCD: (\d+)| i/protocol version $1/
 
 
 # Simple Asynchronous File Transfer (SAFT)
-match saft m|^220 ([\w-.]+) SAFT server \(sendfiled ([\w.]+) on ([\w]+)\) ready\.\r\n| p/sendfiled/ v/$2/ i/Host $1; $3/
+match saft m|^220 ([\w-.]+) SAFT server \(sendfiled ([\w.]+) on ([\w]+)\) ready\.\r\n| p/sendfiled/ v/$2/ h/$1/ o/$3/
 
 
-match sdmsvc m|^[\xaa\xff]$| p/LANDesk Software Distribution/ i/sdmsvc.exe/
+match sdmsvc m|^[\xaa\xff]$| p/LANDesk Software Distribution/ i/sdmsvc.exe/ o/Windows/
 # http://www.ietf.org/internet-drafts/draft-martin-managesieve-04.txt
 match sieve m|^NO Fatal error: Error initializing actions\r\n$| p|Cyrus timsieved| i|included w/cyrus imap|
 match sieve m|^\"IMPLEMENTATION\" \"Cyrus timsieved v(\d[-.\w]+)\"\r\n| p|Cyrus timsieved| i|included w/cyrus imap|
 match sftp m|^\+Shiva SFTP Service\0$| p/Shiva LanRover SFTP service/
 # HP-UX B.11.00 A 9000/785
-match shell m|^\x01remshd: getservbyname\n$| p/HP-UX Remshd/
+match shell m|^\x01remshd: getservbyname\n$| p/HP-UX Remshd/ o/HP-UX/
 
 # good SMTP banner regexps can be found here:
 # http://www.tty1.net/smtp-survey/measurement_en.html
-
-match smtp m|^220 [-/.+\w]+ SMTP AnalogX Proxy (\d[-.\w]+) \(Release\) ready\r\n| p/AnalogX SMTP proxy/ v/$1/
-
-match smtp m|^220 [-/.+\w]+ MailGate ready for ESMTP on | p/MailGate smtpd/ i/Windows/
-match smtp m|^220 [-/.+\w]+ SMTP ready to roll\r\n| p/Hotmail Popper hotmail to smtp gateway/
-match smtp m|^220 [-/.+\w]+ AvMailGate-(\d[-.\w]+)\r\n| p/AvMailGate smtp anti-virus mail gateway/ v/$1/
-match smtp m|^220 ([-/.+\w]+) Internet Rex ESMTP daemon at your service\.\r\n| p/Internet Rex smtpd/
-match smtp m|^220 [-.+\w]+ ESMTP NetIQ MailMarshal \(v(\d[-.\w]+)\) Ready\r\n| p/MailMarshal/ v/$1/
+match smtp m|^220 ([-/.+\w]+) SMTP AnalogX Proxy (\d[-.\w]+) \(Release\) ready\r\n| p/AnalogX SMTP proxy/ h/$1/ v/$2/  
+match smtp m|^220 ([-/.+\w]+) MailGate ready for ESMTP on | p/MailGate smtpd/ h/$1/ o/Windows/
+match smtp m|^220 ([-/.+\w]+) SMTP ready to roll\r\n| p/Hotmail Popper hotmail to smtp gateway/ h/$1/
+match smtp m|^220 ([-/.+\w]+) AvMailGate-(\d[-.\w]+)\r\n| p/AvMailGate smtp anti-virus mail gateway/ h/$1/ v/$2/
+match smtp m|^220 ([-/.+\w]+) Internet Rex ESMTP daemon at your service\.\r\n| p/Internet Rex smtpd/ h/$1/
+match smtp m|^220 ([-.+\w]+) ESMTP NetIQ MailMarshal \(v(\d[-.\w]+)\) Ready\r\n| p/MailMarshal/ h/$1/ v/$2/
 # I think the revision number is different than the official product version number
 # Dots in Revision to prevent MY CVS from screwing it up
-match smtp m|^220 [-.+\w]+ Novonyx SMTP ready \$Re..sion: ([\d.]+) \$\r\n| p|Novonyx Novell NetMail smtpd| i|Revision $1|
-match smtp m|^554-[-.+\w]+\.us\r\n554 Access denied\r\n$| p/IronPort appliance mail rejector/
-match smtp m|^220 eSafe@[-.+\w]+ Service ready\r\n| p/eSafe mail gateway/
+match smtp m|^220 ([-.+\w]+) Novonyx SMTP ready \$Re..sion: *([\d.]+) *\$\r\n| p|Novonyx Novell NetMail smtpd| h|$1| v|$2|
+match smtp m|^554-([-.+\w]+)\.us\r\n554 Access denied\r\n$| p/IronPort appliance mail rejector/ h/$1/
+match smtp m|^220 eSafe@([-.+\w]+) Service ready\r\n| p/eSafe mail gateway/ h/$1/
+match smtp m|^220 (\S+) ESMTP Merak (\d[^;]+);| p/Merak Mail Server smtpd/ h/$1/ v/$2/ o/Windows/
+match smtp m|^220.*?MERCUR SMTP[\s-]Server \(v([^)]+)\) for ([-.\w ]+) ready at | p/LAN-ACES MERCUR smtp server/ v/$1/ o/$2/
+match smtp m|^220 ([-.+\w]+) MasqMail (\d[-.\w]+) ESMTP\r\n| p/MasqMail smtpd/ h/$1/ v/$2/
+# Cisco NetWorks ESMTP server IOS (tm) 5300 Software (C5300-IS-M) on Cisco 5300 Access Server
+match smtp m|^220 ([-.+\w]+) Cisco NetWorks ESMTP server\r\n| p/Cisco IOS NetWorks smtp server/ h/$1/ d/terminal server/ o/IOS/
+match smtp m|^220 ([-.+\w]+) Mercury/32 v(\d[-.\w]+) ESMTP server ready\.\r\n| p|Mercury/32 smtpd| h|$1| v|$2| o|Windows|
+# Canon ImageRunner SMTP server (network scanner/copier/printer)
+match smtp m|^220 Canon[-.\w]+ ESMTP Ready\r\n| p/Canon printer smtp server/ d/printer/
 match smtp m|^220 .*?eSafe E?SMTP Service (\d\S+) ready| p/eSafe mail gateway/ v/$1/
 match smtp m|^220 .*?eSafe E?SMTP Service ready| p/eSafe mail gateway/
-match smtp m|^220 \S+ ESMTP Merak (\d[^;]+);| p/Merak Mail Server smtpd/ v/$1/ i/Windows/
-match smtp m|^220.*?MERCUR SMTP[\s-]Server \(v([^)]+)\) for ([-.\w ]+) ready at | p/LAN-ACES MERCUR smtp server/ v/$1/ i/$2/
-match smtp m|^220 [-.+\w]+ MasqMail (\d[-.\w]+) ESMTP\r\n| p/MasqMail smtpd/ v/$1/
-# Cisco NetWorks ESMTP server IOS (tm) 5300 Software (C5300-IS-M) on Cisco 5300 Access Server
-match smtp m|^220 [-.+\w]+ Cisco NetWorks ESMTP server\r\n| p/Cisco IOS NetWorks smtp server/
-match smtp m|^220 [-.+\w]+ Mercury/32 v(\d[-.\w]+) ESMTP server ready\.\r\n| p|Mercury/32 smtpd| v|$1| i|Win32|
 match smtp m|^520 Connection not authorised from this address\.\r\n| p|Mercury smtpd| i|Connection not authorised|
-# Canon ImageRunner SMTP server (network scanner/copier/printer)
-match smtp m|^220 Canon[-.\w]+ ESMTP Ready\r\n| p/Canon printer smtp server/
 # Exim 3.36 on Linux 2.4 blocking the given IP
 match smtp m|^554 SMTP service not available\r\n$| p/Exim smtpd/ i/Serviced refused (IP block)/
 # Jana Server 1.45 on Win98
-match smtp m|^220 Jana-Server Simple Mail Transfer Service ready\r\n| p/Jana mail server/ i/Windows/
-match smtp m|^220 <10\d+\.\d+@[-.\w]+> \[XMail (\d[-.\w]+) \(([-./\w]+)\) ESMTP Server\] service ready; | p/XMail SMTP server/ v/$1/ i/on $2/
-match smtp m|^220 [-.\w]+ FirstClass ESMTP Mail Server v(\d[-.\w]+) ready\r\n| p/FirstClass SMTP server/ v/$1/
-match smtp m|^220 [-.\w]+ AppleMailServer (\d[-.\w]+) SMTP Server Ready\r\n| p/AppleMailServer/ v/$1/
-match smtp m|^220 [-.\w]+ ESMTP CommuniGate Pro (\d[-.\w]+)\r\n| p/Communigate Pro SMTP/ v/$1/
-match smtp m|^220[- ][-.\w]+  MailSite ESMTP Receiver Version (\d[-.\w]+) Ready\r\n| p/Rockliffe MailSite/ v/$1/
-match smtp m|^220 [-.\w]+ eXtremail V(\d[-.\w]+) release (\d+) ESMTP server ready \.\.\.\r\n| p/eXtremail smtpd/ v/$1.$2/
-match smtp m|^220 Welcome to [-.\w]+ - VisNetic MailScan ESMTP Server BUILD (\d[-.\w]+)\r\n| p/VisNetic MailScan ESMTP server/ v/$1/
+match smtp m|^220 Jana-Server Simple Mail Transfer Service ready\r\n| p/Jana mail server/ o/Windows/
+match smtp m|^220 <10\d+\.\d+@([-.\w]+)> \[XMail (\d[-.\w]+) \(([-./\w]+)\) ESMTP Server\] service ready; | p/XMail SMTP server/ h/$1/ v/$2/ i/on $3/
+match smtp m|^220 ([-.\w]+) FirstClass ESMTP Mail Server v(\d[-.\w]+) ready\r\n| p/FirstClass SMTP server/ h/$1/ v/$2/
+match smtp m|^220 ([-.\w]+) AppleMailServer (\d[-.\w]+) SMTP Server Ready\r\n| p/AppleMailServer/ h/$1/ v/$2/
+match smtp m|^220 ([-.\w]+) ESMTP CommuniGate Pro (\d[-.\w]+)\r\n| p/Communigate Pro SMTP/ h/$1/ v/$2/
+match smtp m|^220[- ]([-.\w]+) MailSite ESMTP Receiver Version (\d[-.\w]+) Ready\r\n| p/Rockliffe MailSite/ h/$1/ v/$2/
+match smtp m|^220 ([-.\w]+) eXtremail V(\d[-.\w]+) release (\d+) ESMTP server ready \.\.\.\r\n| p/eXtremail smtpd/ h/$1/ v/$2.$3/
+match smtp m|^220 Welcome to ([-.\w]+) - VisNetic MailScan ESMTP Server BUILD (\d[-.\w]+)\r\n| p/VisNetic MailScan ESMTP server/ h/$1/ v/$2/
 # HP Service Desk 4.5 SMTP Server
-match smtp m|^220 [-.\w]+ service desk (\d[-.\w]+) SMTP Service Ready for input\.\r\n| p/HP Service Desk SMTP server/ v/$1/
+match smtp m|^220 ([-.\w]+) service desk (\d[-.\w]+) SMTP Service Ready for input\.\r\n| p/HP Service Desk SMTP server/ h/$1/ v/$2/
 # VPOP3 SMTP server 2.0.0d
-match smtp m|^220 [-.\w]+ VPOP3 SMTP Server Ready\r\n| p/PSCS VPOP3 mail server/
+match smtp m|^220 ([-.\w]+) VPOP3 SMTP Server Ready\r\n| p/PSCS VPOP3 mail server/ h/$1/
 # CommuniGate Pro 4.1.3 on Mac OS X 10.2.6
-match smtp m|^220 [-.\w]+ ESMTP CommuniGate Pro (\d[-.\w]+) is glad to see you!\r\n| p/CommuniGate Pro mail server/ v/$1/
-match smtp m|^220[ -][-.\w]+ ESMTP MDaemon (\d[-.\w]+); | p/Alt-N MDaemon mail server/ v/$1/
-match smtp m/^220 [-.+\w]+ \(IMail ([^)]+)\) NT-ESMTP Server/ p/IMail NT-ESMTP/ v/$1/
-match smtp m/^220 X1 NT-ESMTP Server [-.+\w]+ \(IMail ([^)]+)\)\r\n/ p/IMail NT-ESMTP/ v/$1/
-match smtp m/^220-[-.+\w]+ Microsoft SMTP MAIL ready at.*Version: ([-\w.]+)\r\n/ p/Microsoft SMTP/ v/$1/
-match smtp m/^220 [-.+\w]+ Microsoft ESMTP MAIL Service, Version: ([-\w.]+) ready/ p/Microsoft ESMTP/ v/$1/
-match smtp m/^220 [-.+\w]+ ESMTP Server \(Microsoft Exchange Internet Mail Service ([-\w.]+)\) ready/ p/Microsoft Exchange/ v/$1/
-match smtp m|^220[\s-]\S+ E?SMTP Sendmail (\d[^; ]+)| p/Sendmail/ v/$1/
-match smtp m|^220[\s-]\S+ Sendmail (SMI-\S+) ready at .*\r\n$| p/Sendmail/ v/$1/
-match smtp m/^220[- ][^\r\n]+ ESMTP Exim (V?\d\S+)/ p/Exim smtpd/ v/$1/
+match smtp m|^220 ([-.\w]+) ESMTP CommuniGate Pro (\d[-.\w]+) is glad to see you!\r\n| p/CommuniGate Pro mail server/ h/$1/ v/$2/
+match smtp m|^220[ -]([-.\w]+) ESMTP MDaemon (\d[-.\w]+); | p/Alt-N MDaemon mail server/ h/$1/ v/$2/
+match smtp m/^220 ([-.+\w]+) \(IMail ([^)]+)\) NT-ESMTP Server/ p/IMail NT-ESMTP/ h/$1/ v/$2/ o/Windows/
+match smtp m/^220 X1 NT-ESMTP Server ([-.+\w]+) \(IMail ([^)]+)\)\r\n/ p/IMail NT-ESMTP/ h/$1/ v/$2/ o/Windows/
+match smtp m/^220-([-.+\w]+) Microsoft SMTP MAIL ready at.*Version: ([-\w.]+)\r\n/ p/Microsoft SMTP/ h/$1/ v/$2/ o/Windows/
+match smtp m/^220 ([-.+\w]+) Microsoft ESMTP MAIL Service, Version: ([-\w.]+) ready/ p/Microsoft ESMTP/ h/$1/ v/$2/ o/Windows/
+match smtp m/^220 ([-.+\w]+) ESMTP Server \(Microsoft Exchange Internet Mail Service ([-\w.]+)\) ready/ p/Microsoft Exchange/ h/$1/ v/$2/ o/Windows/
+match smtp m|^220([\s-]\S+) E?SMTP Sendmail (\d[^; ]+)| p/Sendmail/ h/$1/ v/$2/ o/Unix/
+match smtp m|^220([\s-]\S+) Sendmail (SMI-\S+) ready at .*\r\n$| p/Sendmail/ h/$1/ v/$2/ o/Unix/
+match smtp m/^220([- ][^\r\n]+) ESMTP Exim (V?\d\S+)/ p/Exim smtpd/ h/$1/ v/$2/
+match smtp m/^220 CheckPoint FireWall-1 secure ESMTP server\r\n$/ p/Checkpoint FireWall-1 smtpd/ d/firewall/
+match smtp m/^220 CheckPoint FireWall-1 secure SMTP server\r\n$/ p/Checkpoint FireWall-1 smtpd/ d/firewall/
+match smtp m|^220 ([-.+\w]+) running IBM AS/400 SMTP V([\w]+)| p|IBM AS/400 smtpd| h|$1| v|$2|
+match smtp m|^220 ([-.+\w]+) ESMTP MailEnable Service, Version: (\d[.\w]+)-- ready at | p/MailEnable smptd/ h/$1/ v/$2/
+match smtp m/^220 ([-.+\w]+) ESMTP Mail Enable SMTP Service, Version: (\d[\w.]+)-- ready at/ p/MailEnable smptd/ h/$1/ v/$2/
+match smtp m/^220 ([-.+\w]+) ESMTP CPMTA-([-.+\w]+) - NO UCE\r\n/ p/CPMTA/ h/$1/ v/$2/ i/qmail-derived/
+match smtp m|^220 ([-.+\w]+) SMTP/smap Ready\.\r\n| p/Smap/ i/from firewall toolkit/ h/$1/
+match smtp m|^220 ([-.+\w]+) ESMTP service \(Netscape Messaging Server ([-.+ \w]+) \(built| p/Netscape Messaging Server/ h/$1/ v/$2/
+match smtp m|^220-InterScan Version (\S+) .*Ready\r\n220 ([-.+\w]+) NTMail \(v([-.+\w]+)/.* ready| p/Trend Micro InterScan/ h/$1/ v/$2/ i/on NTMail $3/ o/Windows/
+match smtp m|^220 ([-.\w]+) InterScan VirusWall NT ESMTP (\d[-.\w]+) \(build (\d+)\) ready at | p/Trend Micro InterScan VirusWall SMTP/ h/$1/ v/$2 build $3/  o/Windows/
+match smtp m|^220 ([-.+\w]+) GroupWise Internet Agent (\S+) .*Novell, Inc\..*Ready\r\n| p/Novell GroupWise/ h/$1/ v/$2/
 match smtp m|^220 \S+ \S+ ESMTP receiver fssmtpd(\d+) ready| p/fssmtpd/ v/$1/
 match smtp m/Failed to open configuration file.*exim/ p/Exim smtpd/ i/broken/
-match smtp m/^220 CheckPoint FireWall-1 secure ESMTP server\r\n$/ p/Checkpoint FireWall-1 smtpd/
-match smtp m/^220 CheckPoint FireWall-1 secure SMTP server\r\n$/ p/Checkpoint FireWall-1 smtpd/
-match smtp m|^220 [-.+\w]+ running IBM AS/400 SMTP V([\w]+)| p|IBM AS/400 smtpd| v|$1|
 match smtp m/^220 Trend Micro ESMTP ([-.+\w]+) ready\.\r\n$/ p/Trend Micro ESMTP/ v/$1/
-match smtp m|^220 [-.+\w]+ ESMTP MailEnable Service, Version: (\d[.\w]+)-- ready at | p/MailEnable smptd/ v/$1/
-match smtp m/^220 [-.+\w]+ ESMTP Mail Enable SMTP Service, Version: (\d[\w.]+)-- ready at/ p/MailEnable smptd/ v/$1/
-match smtp m/^220 [-.+\w]+ ESMTP CPMTA-([-.+\w]+) - NO UCE\r\n/ p/CPMTA/ v/$1/ i/qmail-derived/
-match smtp m|^220 [-.+\w]+ SMTP/smap Ready\.\r\n| p/Smap/ i/from firewall toolkit/
-match smtp m|^220 [-.+\w]+ ESMTP service \(Netscape Messaging Server ([-.+ \w]+) \(built| p/Netscape Messaging Server/ v/$1/
-match smtp m|^220-InterScan Version (\S+) .*Ready\r\n220 [-.+\w]+ NTMail \(v([-.+\w]+)/.* ready| p/Trend Micro InterScan/ v/$1/ i/on NTMail $2/
-match smtp m|^220 [-.\w]+ InterScan VirusWall NT ESMTP (\d[-.\w]+) \(build (\d+)\) ready at | p/Trend Micro InterScan VirusWall SMTP/ v/$1 build $2/
-match smtp m|^220 [-.+\w]+ GroupWise Internet Agent (\S+) .*Novell, Inc\..*Ready\r\n| p/Novell GroupWise/ v/$1/
 match smtp m|^220 Matrix SMTP Mail Server v([\w.]+) on <MATRIX_([\w]+)> Simple Mail Transfer Service Ready\r\n| p/Matrix SMTP Mail Server/ v/$1/ i/on Matrix $2/
-match smtp m|^220 \S+ WebShield SMTP V(\d\S.*?) Network Associates, Inc\. Ready at| p/Network Associates WebShield/ v/$1/
-match smtp m|^220 \S+ WebShielde250/SMTP Ready.| p/WebShielde250 smtpd/
-match smtp m|^220 [-.+\w]+ ESMTP MailMasher ready to boogie\r\n| p/MailMasher smtpd/
+
+match smtp m|^220(\S+) WebShield SMTP V(\d\S.*?) Network Associates, Inc\. Ready at| p/Network Associates WebShield/ h/$1/ v/$2/
+match smtp m|^220(\S+) WebShielde(\w+)/SMTP Ready.| p/WebShielde$2 smtpd/ h/$1/
+match smtp m|^220 ([-.+\w]+) ESMTP MailMasher ready to boogie\r\n| p/MailMasher smtpd/ h/$1/
 # 220 example.com ESMTP Postfix (2.0.13) (Mandrake Linux)
-match smtp m|^220 [-.\w]+ ESMTP Postfix \(([-.\w]+)\) \(([-.\w ]+)\)| p/Postfix smtpd/ v/$1/ i/$2/
+match smtp m|^220 ([-.\w]+) ESMTP Postfix \(([-.\w]+)\) \(([-.\w ]+)\)| p/Postfix smtpd/ h/$1/ v/$2/ i/$3/
 # postfix 1.1.11-0.woody2
-match smtp m|^220[\s-]\S+ ESMTP Postfix| p/Postfix smtpd/
-match smtp m|^220 [\*\d\ ]{10,300}\r\n| p|Cisco PIX sanatized smtpd|
-match smtp m|^220 ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [-.\w]+ \(([-.\w]+)\)\r\n| p/ArGoSoft Mail Server Pro/ v/$1/ i/Win32/
-match smtp m|^220 ([\w-.]+) ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft Mail Server Pro/ v/$2/ i/Host $1; Win32/
-match smtp m|^220 ([\w-.]+) ArGoSoft Mail Server, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft Mail Server/ v/$2/ i/Host $1/
-match smtp m|^220 [-.\w]+ ESMTP server \(Post.Office v([-.\w]+) release ([-.\w]+) ID# | p/Post.Office/ v/$1 release $2/
-match smtp m|^220 [-.\w]+ ESMTP VisNetic.MailServer.v([-.\w]+); | p/VisNetic MailServer/ v/$1/
+match smtp m|^220([\s-]\S+) ESMTP Postfix| p/Postfix smtpd/ h/$1/
+match smtp m|^220 [\*\d\ ]{10,300}\r\n| p|Cisco PIX sanatized smtpd| d|firewall|
+match smtp m|^220 ArGoSoft Mail Server Pro for WinNT/2000/XP, Version ([-.\w]+) \(([-.\w]+)\)\r\n| p/ArGoSoft Mail Server Pro/ v/$1/ i/$2/ o/Windows/
+match smtp m|^220 ([\w-.]+) ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft Mail Server Pro/ v/$2/ h/$1/ o/Windows/
+match smtp m|^220 ([\w-.]+) ArGoSoft Mail Server, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft Mail Server/ v/$2/ h/$1/
+match smtp m|^220 ([-.\w]+) ESMTP server \(Post.Office v([-.\w]+) release ([-.\w]+) ID# | p/Post.Office/ h/$1/ v/$2 release $3/
+match smtp m|^220 ([-.\w]+) ESMTP VisNetic.MailServer.v([-.\w]+); | p/VisNetic MailServer/ h/$1/ v/$2/
 # CommuniGate Pro 4.0.5
-match smtp m|^220 [-.\w]+ ESMTP Service. Welcome.\r\n$| p/CommuniGate Pro smtpd/
-match smtp m|^220 [-.\w]+ Process Software ESMTP service V([-.\w]+) ready| p/Process Software smtpd/ v/$1/ i/on OpenVMS/
-match smtp m|^220 [-.\w]+ Mercury (\d[-.\w]+) ESMTP server ready\.\r\n$| p/Mercury Mail smtpd/ v/$1/
-match smtp m|^220 [-.\w]+ ESMTP Service \(Lotus Domino Release (\d[-.\w]+)\) ready at | p/Lotus Domino smtpd/ v/$1/
+match smtp m|^220 ([-.\w]+) ESMTP Service. Welcome.\r\n$| p/CommuniGate Pro smtpd/ h/$1/
+match smtp m|^220 ([-.\w]+) Process Software ESMTP service V([-.\w]+) ready| p/Process Software smtpd/ h/$1/ v/$2/ o/OpenVMS/
+match smtp m|^220 ([-.\w]+) Mercury (\d[-.\w]+) ESMTP server ready\.\r\n$| p/Mercury Mail smtpd/ h/$1/ v/$2/
+match smtp m|^220 ([-.\w]+) ESMTP Service \(Lotus Domino Release (\d[-.\w]+)\) ready at | p/Lotus Domino smtpd/ h/$1/ v/$2/
+match smtp m|^220 ([-.\w]+) WebSTAR Mail Simple Mail Transfer Service Ready\r\n| p/WebSTAR SMTP server/ h/$1/
+match smtp m|^220 ([-.\w]+) Lotus SMTP MTA Service Ready\r\n$| p/Lotus Notes SMTP/ h/$1/
+match smtp m|^220 ([-.\w]+) SMTP NAVGW (\d[-.\w]+);| p/Norton Antivirus Gateway NAVGW/ h/$1/ v/$2/
+match smtp m|^220 ([-.\w]+) Kerio MailServer (\d[-.\w]+) ESMTP ready\r\n$| p/Kerio MailServer/ h/$1/ v/$2/
+match smtp m|^220 YSmtp(\S+) ESMTP service ready| p/Yahoo! smtpd/ h/$1/
+match smtp m|^220(\S+) GMX Mailservices ESMTP| p/GMX smtpd/ h/$1/
+match smtp m|^220(\S+) ESMTP MailMax (\d[-.\w\d]+)| p/MailMax smtpd/ h/$1/ v/$2/
+match smtp m|^220(\S+) ESMTP WEB.DE V([^\s\;]+)| p/Web.de smtpd/ h/$1/ v/$2/
 match smtp m|^relaylock: Error: PRODUCT_ROOT_D not defined\nrelaylock: Error: PRODUCT_ROOT_D not defined\n1\n$| p/Plesk relaylock smtp wrapper/ i/broken/
-match smtp m|^220 [-.\w]+ WebSTAR Mail Simple Mail Transfer Service Ready\r\n| p/WebSTAR SMTP server/
-match smtp m|^220 [-.\w]+ Lotus SMTP MTA Service Ready\r\n$| p/Lotus Notes SMTP/
-match smtp m|^220 [-.\w]+ SMTP NAVGW (\d[-.\w]+);| p/Norton Antivirus Gateway NAVGW/ v/$1/
-match smtp m|^220 [-.\w]+ Kerio MailServer (\d[-.\w]+) ESMTP ready\r\n$| p/Kerio MailServer/ v/$1/
-match smtp m|^220 YSmtp \S+ ESMTP service ready| p/Yahoo! smtpd/
 match smtp m|^220 Compuserve Office Mail Service \(lnxc-(\d+)\) ESMTP| p/Compuserve smtpd/ v/$1/
-match smtp m|^220 \S+ GMX Mailservices ESMTP| p/GMX smtpd/
-match smtp m|^220 \S+ ESMTP MailMax (\d[-.\w\d]+)| p/MailMax smtpd/ v/$1/
-match smtp m|^220 \S+ ESMTP WEB.DE V([^\s\;]+)| p/Web.de smtpd/ v/$1/
 match smtp m|^220 Welcome to Nemesis ESMTP server on \S+| p/Nemesis smtpd/
 match smtp m|^220 Welcome to the INDY SMTP Server\r\n$| p/INDY smtpd/
 match smtp m|^220 Postini E?SMTP (\d+) [\w\d_\+-]+ ready| p/Postini smtpd/ v/$1/
-match smtp m|^220 [\w\d-]+\.hotmail\.com Sending unsolicited commercial| p/Hotmail smtpd/
-match smtp m|^220[-\s]\S+ \(IntraStore TurboSendmail\) E?SMTP Service ready| p/TurboSendmail smtpd/
-match smtp m|^220[-\s]\S+ E?SMTP Mirapoint (\d[^\;]+);| p/Mirapoint smtpd/ v/$1/
-match smtp m|^220[-\s]\S+ Trend Micro InterScan Messaging Security Suite, Version: (\d\S+) ready| p/Trend Micro InterScan smtpd/ v/$1/
-match smtp m|^220[-\s]\S+.*?Server ESMTP \(iPlanet Messaging Server (\d[^\(\)]+)| p/Sun iPlanet smtdp/ v/$1/
-match smtp m|^220[-\s]\S+ running Eudora Internet Mail Server X (\d\S+)| p/Eudora smtpd/ v/$1/
-match smtp m|^220 \S+ - Maillennium E?SMTP| p/Maillennium smtpd/
-match smtp m|^220 \S+.*?SMTP \(Sun Internet Mail Server sims.(\d[^\)]+)\)| p/Sun sims smtpd/ v/$1/
-match smtp m|^220 \S+ ESMTP qpsmtpd (\d\S+) ready;| p/qpsmtpd/ v/$1/
-match smtp m|^220 \S+ ESMTP XWall v(\d\S+)| p/XWall smtpd/ v/$1/
-match smtp m|^220 \S+ ESMTP Service \(Worldmail (\d[^\)]+)\) ready| p/Worldmail smtpd/ v/$1/
-match smtp m|^220 \S+ eMail Sentinel (\d+) ESMTP Service ready| p/eMail Sentinel smtpd/ v/$1/
-match smtp m|^220 \S+ ESMTP mxl_mta-(\d[^\;]+);| p/mxl smtpd/ v/$1/
-match smtp m|^220 \S+ -- Server ESMTP \(SUN JES MTA 6\.x\)| p/SUN JES smtpd/ v/6.x/
-match smtp m|^220 \S+ Service ready by DvISE PostMan \((\d+)\) ESMTP Server| p/DvISE PostMan smtpd/ v/$1/
-match smtp m|^220 \S+ F-Secure Anti-Virus for Internet Mail ready| p/F-Secure AV SMTP Proxy/
-match smtp m|^220 \S+ Welcome to SpamFilter for ISP SMTP Server v(\d\S+)| p/LogSat SMTP Proxy/ v/$1/
+match smtp m|^220 ([\w\d-]+)\.hotmail\.com Sending unsolicited commercial| p/Hotmail smtpd/ h/$1/
+match smtp m|^220([-\s]\S+) \(IntraStore TurboSendmail\) E?SMTP Service ready| p/TurboSendmail smtpd/ h/$1/
+match smtp m|^220([-\s]\S+) E?SMTP Mirapoint (\d[^\;]+);| p/Mirapoint smtpd/ h/$1/ v/$2/
+match smtp m|^220([-\s]\S+) Trend Micro InterScan Messaging Security Suite, Version: (\d\S+) ready| p/Trend Micro InterScan smtpd/ h/$1/ v/$2/
+match smtp m|^220([-\s]\S+).*?Server ESMTP \(iPlanet Messaging Server (\d[^\(\)]+)| p/Sun iPlanet smtpd/ h/$1/ v/$2/
+match smtp m|^220([-\s]\S+) running Eudora Internet Mail Server X (\d\S+)| p/Eudora smtpd/ h/$1/ v/$2/
+match smtp m|^220(\S+) - Maillennium E?SMTP| p/Maillennium smtpd/ h/$1/
+match smtp m|^220 (\S+).*?SMTP \(Sun Internet Mail Server sims.(\d[^\)]+)\)| p/Sun sims smtpd/ h/$1/ v/$2/
+match smtp m|^220(\S+) ESMTP qpsmtpd (\d\S+) ready;| p/qpsmtpd/ h/$1/ v/$2/
+match smtp m|^220(\S+) ESMTP XWall v(\d\S+)| p/XWall smtpd/ h/$1/ v/$2/
+match smtp m|^220(\S+) ESMTP Service \(Worldmail (\d[^\)]+)\) ready| p/Worldmail smtpd/ h/$1/ v/$2/
+match smtp m|^220(\S+) eMail Sentinel (\d+) ESMTP Service ready| p/eMail Sentinel smtpd/ v/$1/
+match smtp m|^220(\S+) ESMTP mxl_mta-(\d[^\;]+);| p/mxl smtpd/ h/$1/ v/$2/
+match smtp m|^220(\S+) -- Server ESMTP \(SUN JES MTA 6\.x\)| p/SUN JES smtpd/ h/$1/ v/6.x/
+match smtp m|^220(\S+) Service ready by DvISE PostMan \((\d+)\) ESMTP Server| p/DvISE PostMan smtpd/ h/$1/ v/$2/
+match smtp m|^220(\S+) F-Secure Anti-Virus for Internet Mail ready| p/F-Secure AV SMTP Proxy/ h/$1/
+match smtp m|^220(\S+) Welcome to SpamFilter for ISP SMTP Server v(\d\S+)| p/LogSat SMTP Proxy/ h/$1/ v/$2/
 match smtp m|^220-TrendMicro IMSS SMTP proxy\r\n| p/TrendMicro SMTP Proxy/
-match smtp m|^220 \S+ ESMTP server \(InterMail v(\S+)| p/InterMail smtpd/ v/$1/
-match smtp m|^220 \S+ -- Server ESMTP \(Sun Java System Messaging Server (\d[^\(\)]+)| p/SUN JSMS smtpd/ v/$1/
+match smtp m|^220(\S+) ESMTP server \(InterMail v(\S+)| p/InterMail smtpd/ h/$1/ v/$2/
+match smtp m|^220(\S+) -- Server ESMTP \(Sun Java System Messaging Server (\d[^\(\)]+)| p/SUN JSMS smtpd/ h/$1/ v/$2/
 match smtp m|^220 jMailer SMTP Server\r\n$| p/jMailer smtpd/
 match smtp m/^220[- ][^ ]+ Smail-([^ ]+) .*ESMTP/s p/Smail-ESMTP/ v/$1/
 match smtp m/^220[- ][^ ]+ Smail-([^ ]+) / p/Smail/ v/$1/
-match smtp m|^220 ([\w.-_]+) Novonyx SMTP ready \$Revision$\r\n| p/Novell Novonyx smtpd/ v/$2/ h/$1/
 match smtp m|^220 \[([\w-_.]+)\] ESMTP amavisd-new service ready\r\n| p/amavisd smtpd/ h/$1/
+match smtp m/^220 SMTP-Server Classic Hamster (Vr\.|Version) [\d.]+ \(Build ([\d.]+)\)\r\n/ p/Classic Hamster smtpd/ v/$2/ o/Windows/
+match smtp m|^220-Stalker Internet Mail Server V.([\w.]+) is ready\.\r\n| p/Stalker smtpd/ v/$1/ o/Mac OS/
+match smtp m|^220 ([\w-_.]+) ESMTP MailMax ([\d.]+) [A-Z][a-z][a-z].*\r\n| p/MailMax smtpd/ v/$2/ h/$1/ o/Windows/
+
 
 
 softmatch smtp m|^220[\s-].*?E?SMTP[^\r]*\r\n|
 
-match snpp m|^220 [-.\w]+ SNPP server \(HylaFAX \(tm\) Version ([-.\w]+)\) ready.\r\n| p/HylaFAX SNPP/ v/$1/
+match snpp m|^220 ([-.\w]+) SNPP server \(HylaFAX \(tm\) Version ([-.\w]+)\) ready.\r\n| p/HylaFAX SNPP/ h/$1/ v/$2/
 match snpp m|^220 QuickPage v(\d[-.\w]+) SNPP server ready at | p/QuickPage SNPP/ v/$1/
 
 match sourceoffice m|^200\r\nProtocol-Version:(\d[.\d]+)\r\nMessage-ID:\d+\r\nDatabase .*\r\nContent-Length:\d+\r\n\r\n(\w:\\.*ini)\r\n\r\n| p/Sourcegear SourceOffSite/ i/Protocol $1; INI file: $2/
@@ -704,76 +749,78 @@ match ssh m|^SSH-(\d[.\d]+)-VShell_(\d[._\d]+) VShell\r\n$| p/VanDyke VShell/ v/
 match ssh m/^SSH-([.\d]+)-(\d[-.\w]+) sshlib: WinSSHD (\d[-.\w]+)\r\n/ p/Bitvise WinSSHD/ v/$3/ i/protocol $1/
 # Cisco VPN 3000 Concentrator
 # Cisco VPN Concentrator 3005 - Cisco Systems, Inc./VPN 3000 Concentrator Version 4.0.1.B Jun 20 2003
-match ssh m/^SSH-([.\d]+)-OpenSSH\n$/ p/OpenSSH/ i/protocol $1/
-match ssh m/^SSH-([.\d]+)-([.\d]+) Radware\n$/ p/Radware Linkproof SSH/ v/$2/ i/protocol $1/
-match ssh m|^SSH-1\.5-X\n| p/Cisco VPN Concentrator SSHd/ i/protocol 1.5/
+match ssh m/^SSH-([.\d]+)-OpenSSH\n$/ p/OpenSSH/ i/protocol $1/ d/terminal server/
+match ssh m/^SSH-([.\d]+)-([.\d]+) Radware\n$/ p/Radware Linkproof SSH/ v/$2/ i/protocol $1/ d/terminal server/
+match ssh m|^SSH-1\.5-X\n| p/Cisco VPN Concentrator SSHd/ i/protocol 1.5/ d/terminal server/
 softmatch ssh m/^SSH-([.\d]+)-/
 
 # Redhat Linux 7.1 - HAHAHAHAHAHA!!!! I love this service :) 
-match systat m|^USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND\n| p/Linux systat/
+match systat m|^USER       PID %CPU %MEM   VSZ  RSS TTY      STAT START   TIME COMMAND\n| p/Linux systat/ o/Linux/
 
 # Draytek Vigor 2600 aDSL router
-match telnet m|^\xff\xfd\x18\xff\xfb\x01\n\r\n\rPassword: | p/Draytek Vigor aDSL router telnetd/
+match telnet m|^\xff\xfd\x18\xff\xfb\x01\n\r\n\rPassword: | p/Draytek Vigor aDSL router telnetd/  d/broadband router/
 # IBM Infoprint 12 printer with JetDirect
-match telnet m|^\xff\xfc\x01\r\nPlease type \[Return\] two times, to initialize telnet configuration\r\nFor HELP type \"\?\"\r\n> | p/HP JetDirect printer telnetd/
+match telnet m|^\xff\xfc\x01\r\nPlease type \[Return\] two times, to initialize telnet configuration\r\nFor HELP type \"\?\"\r\n> | p/HP JetDirect printer telnetd/ d/printer/
+# HP JetDirect 300X print server
+match telnet m|^\xff\xfc\x01\r\nHP JetDirect\r\n\r\nPassword:$| p/HP JetDirect printer telnetd/ d/printer/
 # IBM High Performace Switch - Model 8275-416, Software version 1.1, Manufacturer IBM068
 match telnet m|^\x1b\[1;1H\x1b\[2J\x1b\[8;38H\x1b\[1;1H\x1b\[2;1H\(C\) Copyright IBM Corp\. 1999\x1b\[3;1HAll Rights Reserved\.| p/IBM switch telnetd/
 match telnet m|^\x1b\[H\x1b\[2JYou have connected to a FirstClass System\. Please login\.\.\.\r\nUserID: | p/FirstClass messaging system telnetd/
 # Cisco Catalyst management console
 # 3Com 3Com SuperStack II Switch 3300
-match telnet m|^\xff\xfd\x03\xff\xfb\x03\xff\xfb\x01| i|Usually a Cisco/3com switch|
-match telnet m|^\xff\xfb\x03\xff\xfb\x01\r\nSun\(tm\) Advanced Lights Out Manager (\d[-.\w]+) \(v(\d+)\)\r\n\r\nPlease login: | p/Sun Advanced Lights Out Manager/ v/$1/ i/on Sun v$2; for remote system control/
+match telnet m|^\xff\xfd\x03\xff\xfb\x03\xff\xfb\x01| i|Usually a Cisco/3com switch| d|switch|
+match telnet m|^\xff\xfb\x03\xff\xfb\x01\r\nSun\(tm\) Advanced Lights Out Manager (\d[-.\w]+) \(v(\d+)\)\r\n\r\nPlease login: | p/Sun Advanced Lights Out Manager/ v/$1/ i/on Sun v$2; for remote system control/ d/remote management/
 # Epson Stylus Color 900N telnet
-match telnet m|^\xff\xfb\x01\xff\xfb\x01Connected to [-/.+\w]+!\r\n\r\nPassword: | p/Epson printer telnetd/
+match telnet m|^\xff\xfb\x01\xff\xfb\x01Connected to [-/.+\w]+!\r\n\r\nPassword: | p/Epson printer telnetd/ d/printer/
 # This one may not technically be considered telnet protocol, but you seem to use it via telnet
 match telnet m|^220 SL4NT viewer service ready\r\n250 Currently connected channels: | p/Netal SLANT viewer/
 match telnet m|^\xff\xfb\x03\xff\xfb\0\xff\xfb\0\xff\xfd\0\xff.*\r\rFrontDoor (\d[-.\w]+)/|s p/FrontDoor FIDONet Mailer telnetd/ v/$1/
-match telnet m|^\xff\xfb\x01\xff\xfb\x03\r\nOK\r\n$| p/Motorola Vanguard router telnetd/
+match telnet m|^\xff\xfb\x01\xff\xfb\x03\r\nOK\r\n$| p/Motorola Vanguard router telnetd/ d/router/
 match telnet m|^\xff\xfb\x03\xff\xfd\x03\xff\xfc\x06.*\nPrecidia Technologies\r\n([-.+\w]+) Remote Configuration\r\n\nPassword\? |s p/Precidia serial2ethernet gateway telnetd/ i/model $1/
-match telnet m|^\xff\xfb\x01.*\n\rWelcome to the Xylan PizzaSwitch! Version (\d[-.\w]+)\n\rlogin   : |s p/Xylan PizzaSwitch telnetd/ v/$1/
+match telnet m|^\xff\xfb\x01.*\n\rWelcome to the Xylan PizzaSwitch! Version (\d[-.\w]+)\n\rlogin   : |s p/Xylan PizzaSwitch telnetd/ v/$1/ d/switch/
 # Bay Networks Accelar 1100 (version 2.0.5.5) switch
-match telnet m|^\xff\xfb\x01\r\n\r\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\r\r\* Bay Networks,Inc\..*(Accelar [-.+\w]+).*Software Release (\d[-.\w]+) |s p/Bay Networks Accelar switch telnetd/ v/$2/ i/$1/
-match telnet m|^\xff\xfb\x01\r\n\r\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\r\r\* Nortel Networks,Inc\..*\n\r\r\* Passport ([-.\w]+) .*\r\* Software Release (\d[-.\w]+) |s p/Nortel Networks Passport switch telnetd/ v/$2/ i/Passport $1/
+match telnet m|^\xff\xfb\x01\r\n\r\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\r\r\* Bay Networks,Inc\..*(Accelar [-.+\w]+).*Software Release (\d[-.\w]+) |s p/Bay Networks Accelar switch telnetd/ v/$2/ i/$1/ d/switch/
+match telnet m|^\xff\xfb\x01\r\n\r\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\r\r\* Nortel Networks,Inc\..*\n\r\r\* Passport ([-.\w]+) .*\r\* Software Release (\d[-.\w]+) |s p/Nortel Networks Passport switch telnetd/ v/$2/ i/Passport $1/ d/switch/
 # NCD Thinstar 300 running NCD Software 2.31 build 6
-match telnet m|^\xff\xfb\x03\xff\xfd\x03\xff\xfb\x01WinCE/WBT Command Shell Version (\d[-.\w]+)\r\nSerial Number: (\w+)  MAC Address: 0000(\w+)\r\nUUID: [-\w]+\r\nPassword: | p/NCD Thinster terminal command shell/ v/$1/ i/Serial# $2; MAC $3/
+match telnet m|^\xff\xfb\x03\xff\xfd\x03\xff\xfb\x01WinCE/WBT Command Shell Version (\d[-.\w]+)\r\nSerial Number: (\w+)  MAC Address: 0000(\w+)\r\nUUID: [-\w]+\r\nPassword: | p/NCD Thinster terminal command shell/ v/$1/ i/Serial# $2; MAC $3/ d/terminal/
 # Netopia 4542 aDSL router telnetd
-match telnet m|^\xff\xfb\x01\xff\xfd\x03\xff\xfb\x03\x1b\[2J\x1b\[Hname:| p/Netopia aDSL router telnetd/
+match telnet m|^\xff\xfb\x01\xff\xfd\x03\xff\xfb\x03\x1b\[2J\x1b\[Hname:| p/Netopia aDSL router telnetd/ d/broadband router/
 
 # NetportExpress PRO/100 3 port print server
-match telnet m|^\xff\xfb\x01\r\nNetportExpress\(tm\) ([-/.+\w]+)\r\n.*\r\n\r\nlogin: | p/Intel NetportExpress print server telnetd/ i/Model $1/
+match telnet m|^\xff\xfb\x01\r\nNetportExpress\(tm\) ([-/.+\w]+)\r\n.*\r\n\r\nlogin: | p/Intel NetportExpress print server telnetd/ i/Model $1/ d/print server/
 # 3Com OfficeConnect 812 Router telnetd
-match telnet m|^login: \xff\xfd\x03\xff\xfb\x03\xff\xfb\x01| p/3Com OfficeConnect router telnetd/
+match telnet m|^login: \xff\xfd\x03\xff\xfb\x03\xff\xfb\x01| p/3Com OfficeConnect router telnetd/ d/router/
 # Nortel Networks Instant Internet 100
-match telnet m|^\xff\xfb\x01\r\npassword: | p/Nortel Networks Instant Internet broadband router telnetd/
+match telnet m|^\xff\xfb\x01\r\npassword: | p/Nortel Networks Instant Internet broadband router telnetd/ d/broadband router/
 # Network Appliance ONTAP 6.3.3 telnet
 match telnet m|^\xff\xfb\x01\xff\xfd\x18\xff\xfd#| p/Network Appliance Ontap telnetd/
 # Netgear RP114 broadband router
-match telnet m|^\xff\xfb\x03\xff\xfb\x01\r\nPassword: | p/Netgear broadband router admin telnetd/
+match telnet m|^\xff\xfb\x03\xff\xfb\x01\r\nPassword: | p/Netgear broadband router admin telnetd/ d/broadband router/
 match telnet m|\xff\xfd\x18\xff\xfb\x01\x1b\[2J\x1b\[\?7l\x1b.*HP ([-.\w]+) ProCurve Switch ([-.\w]+)\r\n\rFirmware revision ([-.\w]+)\r\n\r\r| p/HP ProCurve Switch telnetd/ i/Model: $2; Firmware: $3/
 match telnet m|^Check Point FireWall-1 Client Authentication Server running on [-.\w]+\r\n\r\xff\xfb\x01\xff\xfe\x01\xff\xfb\x03User: | p/Check Point FireWall-1 Client Authenticaton Server/
 # Enterasys XP-8600 running E9.0.5.0
-match telnet m|^\xff\xfb\x03\xff\xfd\x01\xff\xfd\x1f\xff\xfb\x05\xff\xfd!| p/Enterasys XSR Security Router telnetd/
+match telnet m|^\xff\xfb\x03\xff\xfd\x01\xff\xfd\x1f\xff\xfb\x05\xff\xfd!| p/Enterasys XSR Security Router telnetd/ d/router/
 # Windows 2000 telnetd
-match telnet m|^\xff\xfd%\xff\xfb\x01\xff\xfd\x03\xff\xfd\x1f\xff\xfd\0\xff\xfb\0$| p/Microsoft Windows 2000 telnetd/
-match telnet m|^\xff\xfb\x01\xff\xfd\x03\xff\xfd\x1f\xff\xfd\0\xff\xfb\0Microsoft \(R\) Windows \(TM\) Version (\d[-.\w]+) \(Build (\d+)\)\r\nWelcome to Microsoft Telnet Service \r\nTelnet Server Build (\d[-.\w]+)\n\rlogin: | p/Microsoft Windows telnetd/ v/$3/ i/OS version $1 build $2/
+match telnet m|^\xff\xfd%\xff\xfb\x01\xff\xfd\x03\xff\xfd\x1f\xff\xfd\0\xff\xfb\0$| p/Microsoft Windows 2000 telnetd/ o/Windows 2000/
+match telnet m|^\xff\xfb\x01\xff\xfd\x03\xff\xfd\x1f\xff\xfd\0\xff\xfb\0Microsoft \(R\) Windows \(TM\) Version (\d[-.\w]+) \(Build (\d+)\)\r\nWelcome to Microsoft Telnet Service \r\nTelnet Server Build (\d[-.\w]+)\n\rlogin: | p/Microsoft Windows telnetd/ v/$3/ i/OS version $1 build $2/ o/Windows/
 # Windows XP telnetd
-match telnet m|^\xff\xfd%\xff\xfb\x01\xff\xfb\x03\xff\xfd'\xff\xfd\x1f\xff\xfd\0\xff\xfb\0| p/Microsoft Windows XP telnetd/
+match telnet m|^\xff\xfd%\xff\xfb\x01\xff\xfb\x03\xff\xfd'\xff\xfd\x1f\xff\xfd\0\xff\xfb\0| p/Microsoft Windows XP telnetd/ o/Windows XP/
 # IRIX 6.5.18f telnetd
-match telnet m|^\xff\xfd\x18\xff\xfd \xff\xfd#\xff\xfd\$| p/IRIX telnetd/ v/6.X/
+match telnet m|^\xff\xfd\x18\xff\xfd \xff\xfd#\xff\xfd\$| p/IRIX telnetd/ v/6.X/ o/IRIX/
 # OS 400 V4R4M0
 # OS/400 V5R1M0
-match telnet m|^\xff\xfd'\xff\xfd\x18$| p/IBM OS 400 telnetd/
+match telnet m|^\xff\xfd'\xff\xfd\x18$| p|IBM OS/400 telnetd| o|OS/400|
 # JetDirect Model: J4169A Firmware: L.21.11
-match telnet m|^\xff\xfb\x03\xff\xfb\x01\x07HP JetDirect\r\nPassword is not set\r\n| p/HP JetDirect printer telnetd/ i/No password/
+match telnet m|^\xff\xfb\x03\xff\xfb\x01\x07HP JetDirect\r\nPassword is not set\r\n| p/HP JetDirect printer telnetd/ i/No password/ d/printer/
 # HP Jetdirect telnet with password protection
-match telnet m|^\xff\xfb\x03\xff\xfb\x01\x07HP JetDirect\r\n\r\nEnter username: | p/HP JetDirect printer telnetd/
+match telnet m|^\xff\xfb\x03\xff\xfb\x01\x07HP JetDirect\r\n\r\nEnter username: | p/HP JetDirect printer telnetd/ d/printer/
 # HP MPE/iX 5.5 on HP 3000 telnet service
 match telnet m|^\xff\xfd\x03\xff\xfb\x01\xff\xfd!| p|HP MPE/iX telnetd|
 # Brother 1870N Printer
-match telnet m|^\x1b\[2J\x1b\[1;1f\xff\xfb\x01\xff\xfb\x03\xff\xfd\x03| p/Brother printer telnetd/
+match telnet m|^\x1b\[2J\x1b\[1;1f\xff\xfb\x01\xff\xfb\x03\xff\xfd\x03| p/Brother printer telnetd/ d/printer/
 # AIX 4.3.3.0
-match telnet m|^\xff\xfe%\xff\xfd\x18$| p/AIX telnetd/
-match telnet m|^\r\nEfficient ([-.\w ]+) Router \(([-.\d/]+)\) v(\d[-.\w]+) Ready\r\n\xff\xfb\x01\xff\xfb\x03\xff\xfd\x01\xff\xfe\x01Login: | p/Efficient router telnetd/ v/$3/ i/Model $1 - $2/
+match telnet m|^\xff\xfe%\xff\xfd\x18$| p/AIX telnetd/ o/AIX/
+match telnet m|^\r\nEfficient ([-.\w ]+) Router \(([-.\d/]+)\) v(\d[-.\w]+) Ready\r\n\xff\xfb\x01\xff\xfb\x03\xff\xfd\x01\xff\xfe\x01Login: | p/Efficient router telnetd/ v/$3/ i/Model $1 - $2/ d/router/
 # http://mldonkey.berlios.de/
 # mldonkey-2.5-3 telnet port
 match telnet m|^\xff\xfd\x1f\n\n\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\n                         Welcome to MLdonkey          \n| p/MLdonkey multi-network P2P admin port/
@@ -785,51 +832,51 @@ match telnet m|^\xff\xfb\x01\n\r\n.*Bay Networks (Bay[-.: \w]+)\n\r|s p/Bay Netw
 match telnet m/^Check Point FireWall-1 authenticated Telnet server running on/ p/Check Point Firewall-1 telnetd/
 match telnet m/^\r\nSpeedStream ([^(\r\n]+) \(.*\) v(\S+) Ready\r\n\xff\xfb\x01\xff\xfb\x03\xff\xfd/ p/SpeedStream $1/ v/$2/
 # Alcatel SpeedTouch 510 ADSL router - Admin Interface, version 4.0.2.0.0
-match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfb\x01\xff\xfb\x03Username : | p/Alcatel SpeedTouch DSL router admin interface/ d/router/
+match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfb\x01\xff\xfb\x03Username : | p/Alcatel SpeedTouch DSL router admin interface/ d/broadband router/
 match telnet m/^\r\nRaptor Firewall Secure Gateway\.\r\n\r\nAccess denied\.\r\n/ p/Symantec Raptor Firewall Secure Gateway telnetd/ i/Access Denied/
 match telnet m/^\*\*\*\*\*\*\* System Image Boot \*\*\*\*\*\*\*\n\r\n\rVina Technologies (.*) \((\d[-.\w]+ build \d+)\)\n\r/ p/Vina Technologies $1 telnetd/ v/$2/
 match telnet m/^\xff\xfb\x01\xff\xfd\x03\xff\xfb\x03\x1b\[0m\x1b\[2J\x1b\[01;00H\r\0Gigalink ([-+ \w]+)/ p/Gigalink telnetd/ i/on $1/
 match telnet m/^\xff\xfb\x03\xff\xfb.*D-Link.*Telnet Console.*Model\s+: ([-+\w]+)/s p/D-Link telnetd/ i/on $1/
 match telnet m|^\xff\xfb\x01\x1b\[0m\x1b\[2J\x1b\[0m\x1b\[9;20HCopyright\(C\) 1995-99 D-Link Systems Inc\.\x1b\[13;30HUser Name\x1b\[14;30HPassword\x1b\[23;10HMAC Address:\x1b\[8;29H([-.\w]+) Console Program\x1b\[13;41H| p/D-Link switch admin interface/ i/D-Link $1/
-match telnet m/^\xff\xfa\x18\x01\xff\xf0\xff\xfb\x01\xff\xfb\x03Ambit Cable Router\r\n\r\nLogin: / p/Ambit Cable Router telnetd/
-match telnet m|^\xff\xfc\x01\r\nHP JetDirect\r\n\r\nPlease type \"?\" for HELP, or \"/\" for current settings\r\n> $| p/HP JetDirect telnetd/
+match telnet m/^\xff\xfa\x18\x01\xff\xf0\xff\xfb\x01\xff\xfb\x03Ambit Cable Router\r\n\r\nLogin: / p/Ambit Cable Router telnetd/ d/broadband router/
+match telnet m|^\xff\xfc\x01\r\nHP JetDirect\r\n\r\nPlease type \"?\" for HELP, or \"/\" for current settings\r\n> $| p/HP JetDirect telnetd/ d/printer/
 match telnet m/^\n\rVina Technologies (.*) \((\d[-.\w]+ build \d+)\)/ p/Vina Technologies $1 telnetd/ v/$2/
 match telnet m/^\xff\xfd\x03\xff\xfb\x03\xff\xfb\x01\x1b\[0m\x1b\[1;1H\x1b\[2J\rD\r           \n\r             (DES-.*) Command Line Interface\n\r\n/ p/D-Link $1 telnetd/
-match telnet m/^\xff\xfb\x01\xff\xfb\x03\xff\xfc\x1f\n\r\n\rUser Access Verification\n\r\n\r\n\r\n\r\n\rShell version (\d\S+).*Maipu Communication Technology Co\./ p/Maipu Router/ i/shell v$1/
+match telnet m/^\xff\xfb\x01\xff\xfb\x03\xff\xfc\x1f\n\r\n\rUser Access Verification\n\r\n\r\n\r\n\r\n\rShell version (\d\S+).*Maipu Communication Technology Co\./ p/Maipu Router/ i/shell v$1/ d/router/
 match telnet m/^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x03\x1b.*Intel Corporation, ([-+. \w()]+)/s p/Intel telnetd/ i/on $1/
 match telnet m|^\r\nFlowPoint/(.*) Ready\r\n.*\xff\xfb\x01\xff\xfb| p/Flowpoint telnet/ i/on $1/
 match telnet m/Welcome to Tenor Multipath Switch Telnet Server.*Type: (\S+)/s p/Tenor telnetd/ v/$1/ i/on Multipath Switch/
 match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x01\x0d\x0a\x0d\x0aCisco\x20Systems.*Console/Telnet Access of the ([-. \w]+) for Configuration Purposes|s p/Cisco $1 telnetd/
 # Cisco 350 Series Wireless AP 11.05
-match telnet m|^\xff\xfb\x01\n\r\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08                           \x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08| p/Cisco WAP telnetd/
+match telnet m|^\xff\xfb\x01\n\r\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08                           \x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08\x08| p/Cisco WAP telnetd/ d/WAP/
 # Cisco 678 DSL router
-match telnet m|^\r\n\r\nUser Access Verification\r\nPassword:\xff\xfb\x01$| p/Cisco DSL router telnetd/
+match telnet m|^\r\n\r\nUser Access Verification\r\nPassword:\xff\xfb\x01$| p/Cisco DSL router telnetd/ d/broadband router/
 #  Cisco 2900 Catalyst switch, IOS 12.0(5)XU
 # Cisco 3600 router running IOS 12.X
 # Cisco 2600 IOS 12.0
-match telnet m/^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f.*User Access Verification\r\n\r\n(Username|Password): $/s p/Cisco telnetd/ i/IOS 12.X/
+match telnet m/^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f.*User Access Verification\r\n\r\n(Username|Password): $/s p/Cisco telnetd/ o/IOS 12.X/ d/switch/
 # Cisco Pix 501 PIX IOS 6.3(1) telnet
-match telnet m/^\xff\xfb\x03\xff\xfb\x01\xff\xfb\x03\xff\xfb\x01.*\r\nUser Access Verification\r\n\r\nPassword: /s p/Cisco telnetd/ i/IOS 6.X/
+match telnet m/^\xff\xfb\x03\xff\xfb\x01\xff\xfb\x03\xff\xfb\x01.*\r\nUser Access Verification\r\n\r\nPassword: /s p/Cisco telnetd/ o/IOS 6.X/ d/firewall/
 # Cisco Catalyst 6509 - WS-C6509 Software, Version NmpSW: 5.5(1)
-match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x01\r\n\r\nCisco Systems Console\r\n| p/Cisco Catalyst switch telnetd/
-match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f\r\n\r\nPassword required, but none set\r\n| p/Cisco router telnetd/ i/password required but not set/
-match telnet m|^Access not permitted\. Closing connection\.\.\.\n$|s p/Cisco catalyst switch telnetd/ i/access denied/
-match telnet m|^\xff\xfd\x18$| p/Cisco microswitch telnetd/
+match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x01\r\n\r\nCisco Systems Console\r\n| p/Cisco Catalyst switch telnetd/ d/switch/
+match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f\r\n\r\nPassword required, but none set\r\n| p/Cisco router telnetd/ i/password required but not set/ d/router/
+match telnet m|^Access not permitted\. Closing connection\.\.\.\n$|s p/Cisco catalyst switch telnetd/ i/access denied/ d/switch/
+match telnet m|^\xff\xfd\x18$| p/Cisco microswitch telnetd/ d/switch/
 # OpenBSD 2.3
 # FreeBSD 5.1
 match telnet m|^\xff\xfd%$| p/BSD-derived telnetd/
 # Solaris 9
-match telnet m|^\xff\xfd\x18\xff\xfd\x1f\xff\xfd#\xff\xfd'\xff\xfd\$$| p/Sun Solaris telnetd/
+match telnet m|^\xff\xfd\x18\xff\xfd\x1f\xff\xfd#\xff\xfd'\xff\xfd\$$| p/Sun Solaris telnetd/ o/Solaris/
 # Redhat Linux 7.3 telnet
-match telnet m|\xff\xfd\x18\xff\xfd \xff\xfd#\xff\xfd'$| p/Linux telnetd/
-match telnet m|^\xff\xfb\x01\n\rUser Name : $| p/APC network management card telnetd/
-match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x03\n\rUser Name : | p|APC telnetd| i|Power/UPS device|
+match telnet m|\xff\xfd\x18\xff\xfd \xff\xfd#\xff\xfd'$| p/Linux telnetd/ o/Linux/
+match telnet m|^\xff\xfb\x01\n\rUser Name : $| p/APC network management card telnetd/ d/power device/
+match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x03\n\rUser Name : | p|APC telnetd| i|Power/UPS device| d|power device|
 # G-Net BB0060 ADSL Modem
-match telnet m|^\xff\xfb\x01\xff\xfd\x03\xff\xfb\x03\n\r                         \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\r.*GlobespanVirata Inc\., Software Release ([-.\w]+)\n\r|s p/GlobespanVirata telnetd/ v/$1/ i/on broadbrand router/
+match telnet m|^\xff\xfb\x01\xff\xfd\x03\xff\xfb\x03\n\r                         \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\n\r.*GlobespanVirata Inc\., Software Release ([-.\w]+)\n\r|s p/GlobespanVirata telnetd/ v/$1/ d/broadbrand router/
 # HP-UX B.11.00 A
-match telnet m|^\xff\xfd\$$| p/HP-UX telnetd/
+match telnet m|^\xff\xfd\$$| p/HP-UX telnetd/ o/HP-UX/
 # Cayman-DSL Model 3220-H, DMT-ADSL (Alcatel) OS version 6.3.0
-match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfe\x01\n\rlogin: $| p/Cayman-DSL router telnetd/
+match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfe\x01\n\rlogin: $| p/Cayman-DSL router telnetd/ d/broadband router/
 # Blue Coat Port 80 Security Appliance  Model: Blue Coat SG400  Software Version: SGOS 2.1.6044 Software Release id: 19480 Service Pack 4
 # Maybe I should call this SGOS telnetd instead
 match telnet m|^\xff\xfb\x03\xff\xfb\x01\xff\xfd\x1f\r\n\r\nUsername: $| p/Blue Coat telnetd/
@@ -837,8 +884,8 @@ match telnet m|^\xff\xfb\x01@ Userid: | p/Shiva LanRover telnetd/
 # Netscreen ScreenOS 4.0.1r1.0 telnetd on a netscreen 5XT running firmware 4.0.1r1.0
 match telnet m|^\xff\xfd\x18\xff\xfb\x01\xff\xfe\x01Remote Management Console\r\n\r\nlogin: $| p/Netscreen ScreenOS telnetd/
 # Note that openwall telnetd is derived from OpenBSD telnetd
-match telnet m|^\xff\xfd\x18\xff\xfd \xff\xfd#\xff\xfd'\xff\xfd\$$| p|Openwall GNU/*/Linux telnetd|
-match telnet m|^\xff\xfc\x01\r\nHP JetDirect\r\n\r\nPlease type \"\?\" for HELP, or \"/\" for current settings\r\n> $| p/HP Jet Direct printer telnetd/
+match telnet m|^\xff\xfd\x18\xff\xfd \xff\xfd#\xff\xfd'\xff\xfd\$$| p|Openwall GNU/*/Linux telnetd| o|Linux|
+match telnet m|^\xff\xfc\x01\r\nHP JetDirect\r\n\r\nPlease type \"\?\" for HELP, or \"/\" for current settings\r\n> $| p/HP Jet Direct printer telnetd/ d/printer/
 match telnet m|^\xff\xfb\x01\xff\xfb\x03\r\nAXIS (\S+) TELNET| p/AXIS Webcam/ v/$1/
 match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f\r\n\r\nTelebit\'s NetBlazer Version (\S+)\r\n| p/Telebit NetBlazer/ v/$1/
 match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x03.*?FORE\x20Systems,\x20FORE\x20ES-2810.*?Version (\d[\d\.-]+)| p/FORE Systems ES-2810/ v/$1/
@@ -849,6 +896,10 @@ match telnet m|^\xff\xfb\x01login:\x20$| p/telnet/ i/generic/
 match telnet m|^\xff\xfb\x01\xff\xfd\x01\xff\xfb\x03\xff\xfd\x03\xff\xfb\x05\xff\xfd\x05Welcome to ([\w-_]+) Debug Terminal - \d*\n\r\n\r\n\rlogin:| p/hp StorageWorks SSL1016 tape autoloader/ i/Name: $1/
 match telnet m|^\xff\xfb\x01\xff\xfd\x03\xff\xfb\x03\r\n\r\nWelcome to Print Server\r\n\r\nPS>| p/Micronet SP733/ d/Print Server/
 match telnet m|^\x1b\[0m\x1b\[2J\x1b\[01;28HCONEXANT SYSTEMS, INC\.\x1b\[02;19H ACCESS RUNNER ADSL CONSOLE PORT\x1b\[24;01H>>>\x1b\[24;01HLOGON PASSWORD>\x1b\[02;53H3\.27\x1b\[24;17H\x1b\[24;17H\x1b\[24;17H\x1b\[24;17H| p/MICRONET SP3356/ d/router/
+match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x18\xff\xfd\x1f\r\n\r\nWelcome on (.*)\r\n\r\n\r\nUsername: | p/Cisco Router 2621/ i/Banner: $1/
+match telnet m|^\xff\xfb\x01\xff\xfd\x18\nTelnet Service on the PrintServer\n\n\rPassword: | p/Hawking Print Server telnetd/ d/print server/
+match telnet m|^\xff\xfb\x01\xff\xfb\x03\r\n\r\n Welcome to OpenVMS \(TM\) Alpha Operating System, Version V([\d.]+)    \r\n\r\n\rUsername: | p/OpenVMS telnetd/ o/OpenVMS $1/
+match telnet m|^\xff\xfb\x01\xff\xfb\x03\xff\xfd\x01\x1b\[0;37;40m\x1b\[2J\x1b\[0;37;40m\x1b\[1m\x1b\[5;27HVertical Horizon Stack Manager\x1b\[0;37;40m\x1b\[1m\x1b\[10;26HEnterasys Networks, Incorporated| p/Enterasys Vertical Horizon Manager/ d/switch/
 
 # tinc 1.0.2-2 on Linux
 match tinc m|^0 \w+ 17\n| p/tinc vpn daemon/
@@ -871,7 +922,7 @@ match vtun m|^VTUN server ver \. (\d[-.\w /]+)\n\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
 # http://www.3w.net/lan/faq.html
 match websense-eim m|^\x96\xfeS\xab$| p/Websense EIM/
 
-match winshell m/^Microsoft Windows ((2000)|(XP)|(NT 4\.0)) \[Version ([\d.]+)\]\r\n\(C\) Copyright 1985-20\d\d Microsoft Corp\.\r\n\r\n/ p/Microsoft Windows $1 $5 cmd.exe/
+match winshell m/^Microsoft Windows ((2000)|(XP)|(NT 4\.0)) \[Version ([\d.]+)\]\r\n\(C\) Copyright 1985-20\d\d Microsoft Corp\.\r\n\r\n/ p/Microsoft Windows $1 $5 cmd.exe/ o/Windows/
 
 # CcXstream Media Server 1.0.15 on Linux - Uses XBMSP (X-Box Media Streaming Protocol)
 match xbmsp m|^XBMSP-1\.0 1\.0 CcXstream Media Server (\d[-.\w]+)\n| p/CcXstream Media Server/ v/$1/
@@ -897,53 +948,57 @@ match smtp m|^220 PostCast SMTP server.*\r\n$| p/PostCast SMTP server/
 match omapi m|^\0\0\0d\0\0\0\x18$| p/ISC (BIND|DHCPD) OMAPI/
 match svnserve m|^\(\x20success\x20\(\x201\x202\x20\(\x20ANONYMOUS\x20\)\x20\(\x20edit-pipeline\x20\)\x20\)\x20\)\x20$| p/Subversion/
 match icecreamd m|^[\x14-\x1f]\0\0\0$| p/icecreamd/
-
-match apc-agent m|^\xac\xed\0\x05$| p/APC PowerChute agent/
+match apc-agent m|^\xac\xed\0\x05$| p/APC PowerChute agent/ d/power device/
+# OpenH323 Gatekeeper 2.0.3
+match afs3-fileserver m|^\xff\xfd\x03\xff\xfb\x05Version:\r\nGatekeeper\(GNU\) Version\(([\d.]+)\) Ext\(.*\) Build\(.*\) Sys\(Linux .*\)\r\n\r\n| p/OpenH323 Gatekeeper/ v/$1/ o/Linux/
 
 ##############################NEXT PROBE##############################
 Probe TCP GenericLines q|\r\n\r\n|
-ports 21,23,43,98,110,113,119,199,505,540,628,1040,1248,1467,1501,2010,3333,5432,5555,6112,6667-6670,8000,11965,30444
+ports 21,23,43,98,110,113,119,199,505,540,628,1040,1248,1467,1501,2010,3128,3333,5432,5555,6112,6667-6670,8000,11965,30444
 
 # bnetd (PvPGN BnetD Mod version 1.5.0) on Debian GNU/Linux (sid)
 match bnetd m|^BOT or Telnet Connection from \[127\.0\.0\.1\]\r\n\r\nEnter your account name and password\.\r\nSorry, there is no guest account\.\r\n\r\nUsername: | p/PvPGN BnetD Mod/ v/1.5.0/
 match bnetd m|^Username: $| p/bnetd open source Blizzard Battlenet server/
 # bnetd server 0.4.25 on Linux
 # Cisco PIX 501 running PIX IOS 6.3(1)
-match ciscopsdm m|^\xc0\0\x01\0....\0\0\0\x03| p/Cisco PIX Secure Database Manager/
+match ciscopsdm m|^\xc0\0\x01\0....\0\0\0\x03| p/Cisco PIX Secure Database Manager/ d/firewall/ o/IOS/
 match crossmatchverifier m|^Idle\r\n$| p/Cross Match Technologies Verifier fingerprint capture control port/
 # I think this type of eggdrop banner is only used when customized or such.
 match eggdrop m|^\r\nNickname\.\r\nSorry, that nickname format is invalid\.\r\n$| p/Eggdrop irc bot console/
 
 # Alcatel Speedtouch ADSL Router
-match ftp m|^220 Inactivity timer = \d+ seconds\. Use 'site idle <secs>' to change\.\r\n221 Goodbye \(badly formated command seen\)\.  You uploaded 0 and downloaded 0 kbytes\.\r\n221 Goodbye \(badly formated command seen\)\.  You uploaded 0 and downloaded 0 kbytes\.\r\n$| p/Alcatel Speedtouch aDSL router ftpd/ d/router/
+match ftp m|^220 Inactivity timer = \d+ seconds\. Use 'site idle <secs>' to change\.\r\n221 Goodbye \(badly formated command seen\)\.  You uploaded 0 and downloaded 0 kbytes\.\r\n221 Goodbye \(badly formated command seen\)\.  You uploaded 0 and downloaded 0 kbytes\.\r\n$| p/Alcatel Speedtouch aDSL router ftpd/ d/broadband router/
 # bftpd 1.0.22 on Linux 2.4
 match ftp m|^220 \r\n500 Unknown command: \"\"\r\n500 Unknown command: \"\"\r\n$| p/bftpd/
 # Multitech MultiVoip 410 VoIP gateway
-match ftp m|^220 Service ready\r\n500 Unsupported command\r\n$| p/Multitech MultiVoip 410 VoIP gateway ftpd/
+match ftp m|^220 Service ready\r\n500 Unsupported command\r\n$| p/Multitech MultiVoip 410 VoIP gateway ftpd/ d/VoIP adapter/
 # NetportExpress PRO/100 3 port print server
-match ftp m|^220 FTP server ready\.\r\n530 access denied\.\r\n| p/Intel NetportExpress print server ftpd/
+match ftp m|^220 FTP server ready\.\r\n530 access denied\.\r\n| p/Intel NetportExpress print server ftpd/ d/print server/
 # D-Link Print Server internal FTP daemon (Firmware version 1.38) - D-Link Print Server DP-101
-match ftp m|^220 FTP server ready\.\r\n501 Command not supported\.\r\n$| p/D-Link Printer Server ftpd/
-match ftp m|^220 [-.\w]+ FTP server ready\.\r\n530 Please login with USER and PASS\.\r\n530 Please login with USER and PASS\.\r\n$| p/Solaris ftpd/
+match ftp m|^220 FTP server ready\.\r\n501 Command not supported\.\r\n$| p/D-Link Printer Server ftpd/ d/print server/
+match ftp m|^220 ([-.\w]+) FTP server ready\.\r\n530 Please login with USER and PASS\.\r\n530 Please login with USER and PASS\.\r\n$| p/Solaris ftpd/ h/$1/ o/Solaris/
 # vsftpd (Very Secure FTP Daemon) 1.0.0 on linux with custom ftpd_banner
 # We'll have to see if this match is unique enough
 match ftp m|^220 .*\r\n530 Please login with USER and PASS\.\r\n530 Please login with USER and PASS\.\r\n|s p/vsFTPd/ i/customized banner/
-match ftp m|^220 [-.\w]+ FTP Server ready \.\.\.\r\n530 \r  : User not logged in\. Please login with USER and PASS first\.\r\n530 \r  : User not logged in\. Please login with USER and PASS first\.\r\n$| p/Bulletproof ftp server/ i/Windows/
+match ftp m|^220 ([-.\w]+) FTP Server ready \.\.\.\r\n530 \r  : User not logged in\. Please login with USER and PASS first\.\r\n530 \r  : User not logged in\. Please login with USER and PASS first\.\r\n$| p/Bulletproof ftp server/ o/Windows/ h/$1/
 # BulletProof FTP 2.21 on Windows 2000 Server
-match ftp m|^220 ftp\r\n$| p/Bulletproof ftp server/ i/Windows/
+match ftp m|^220 ftp\r\n$| p/Bulletproof ftp server/ o/Windows/
 # WarFTP Daemon 1.70 on Win2K
-match ftp m|^220 [-.+\w]+ FTP SERVICE ready\r\n500 Please enter a command\. Dunno how to interperet empty lines\.\.\.\r\n500 Please enter a command\. Dunno how to interperet empty lines\.\.\.\r\n$| p/WarFTPd/ i/Windows/
+match ftp m|^220 ([-.+\w]+) FTP SERVICE ready\r\n500 Please enter a command\. Dunno how to interperet empty lines\.\.\.\r\n500 Please enter a command\. Dunno how to interperet empty lines\.\.\.\r\n$| p/WarFTPd/ h/$1/ o/Windows/
 # GKrellM System Monitor 2.1.15 on Linux
 match gkrellm m|^<error>\nBad connect string!| p/GKrellM System Monitor/
 
-# Some web servers don't gie a 'Server: ' line for the Get request, but do for this probe.
-match http m|^HTTP/1\.1 400 .*\r\nServer: Microsoft-IIS/(\d[-.\w]+)\r\n| p/Microsoft IIS webserver/ v/$1/
+# Some web servers don't give a 'Server: ' line for the Get request, but do for this probe.
+match http m|^HTTP/1\.1 400 .*\r\nServer: Microsoft-IIS/(\d[-.\w]+)\r\n| p/Microsoft IIS webserver/ v/$1/ o/Windows/
 # Icecast version: 1.9+2.0alphasn
 match http m|^HTTP/1\.0 401 Authentication Required\r\nWWW-Authenticate: Basic realm=\"Icecast2 Server\"\r\n\r\nYou need to authenticate\r\n| p/Icecast streaming media server/
 # Network Flight Recorder v3.2 on Solaris 8 (sparc)
 match http m|^HTTP/1\.0 400 Bad request\r\n\r\n$| p/Network Flight Recorder IDS/
 # Cisco 350 Series 802.11 AP
-match http m|^HTTP/1\.0 400 Bad Request\r\nServer: thttpd/(\d[-.\w ]+)\r\n| p/thttpd/ v/$1/
+match http m|^HTTP/1\.0 400 Bad Request\r\nServer: thttpd/(\d[-.\w ]+)\r\n| p/thttpd/ v/$1/ d/WAP/
+# OpenPGP Public Key Server 0.9.6
+match http m|^HTTP/1\.0 400 Bad Request\r\nServer: pks_www/([\d.]+)\r\nContent-type: text/html\r\n\r\n<HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY></BODY>\r\n| p/OpenPGP Public Key Server/ v/$1/
+
 match icecast m|^HTTP/1\.0 200 OK\r\nServer: icecast/(\d[-.\w]+)\r\n| p|Shoutcast/Icecast streaming audio| v|$1|
 
 # slident 0.0.19
@@ -952,9 +1007,9 @@ match ident m|^0, 0: ERROR: UNKNOWN-ERROR\n$| p/slident/
 match ident m|^0,0:ERROR:UNKNOWN-ERROR\r\n$| p/mlidentd/
 # OpenBSD 3.2 identd
 # May apply to Linux too -- need to investigate further.
-match ident m|^0 , 0 : ERROR : UNKNOWN-ERROR\r\n$| p/OpenBSD identd/
+match ident m|^0 , 0 : ERROR : UNKNOWN-ERROR\r\n$| p/OpenBSD identd/ o/OpenBSD/
 # FreeBSD 4.8-RC inetd internal identd
-match ident m|^0 , 0 : ERROR : INVALID-PORT\r\n$| p/FreeBSD identd/
+match ident m|^0 , 0 : ERROR : INVALID-PORT\r\n$| p/FreeBSD identd/ o/FreeBSD/
 # pidentd-3.1a19-157
 match ident m|^ : ERROR : UNKNOWN-ERROR\r\n$| p/pidentd/
 match ident m|^0, 0 : ERROR : X-INVALID-REQUEST\r\n$| p/Minidentd/
@@ -972,7 +1027,7 @@ match inetd m|^<\d+>[A-Z][a-z][a-z] +\d+ \d+:\d+:\d+ inetd\[\d+\]: execv (/[-.\\
 # Diverse IRC bot
 match ircbot m|^ \r\nSorry, that nickname format is invalid\.\r\r\n$| p/Diverse IRC bot/
 # Part of Linux net-snmp-5.0.6-17
-match linuxconf m|^500 access denied: Check networking/linuxconf network access\r\n$| p/Linuxconf/ i/Access denied/
+match linuxconf m|^500 access denied: Check networking/linuxconf network access\r\n$| p/Linuxconf/ i/Access denied/ o/Linux/
 # Linuxconf 1.26r4
 match linuxconf m|^500 access denied: Check config/networking/misc/linuxconf network access\r\n<p>\r\nBy default,| p/Linuxconf/ i/Access denied/
 # Netsaint Status Daemon 2.15
@@ -982,17 +1037,17 @@ match nsclient m|^ERROR:Wrong password$| p/Netsaint Windows Client/
 
 match omniback m|^HP OpenView OmniBack II ([-.\w]+): INET, | p/HP OpenView OmniBack/ v/$1/
 # Mercury/32 3.32 PH Server module on Windows XP
-match ph-addressbook m|^598::Command not recognized\.\r\n598::Command not recognized\.\r\n$| p|Mercury/32 PH addressbook server| i|Win32|
+match ph-addressbook m|^598::Command not recognized\.\r\n598::Command not recognized\.\r\n$| p|Mercury/32 PH addressbook server| o|Windows|
 
-match pop3 m|^\+OK POP3 [-.+\w]+ v(\d[-.\w]+) server ready\r\n| p/ipop3d/ v/$1/
+match pop3 m|^\+OK POP3 ([-.+\w]+) v(\d[-.\w]+) server ready\r\n| p/ipop3d/ h/$1/ v/$2/
 # iopd 2003debian0.0304182231-1
-match pop3 m|^\+OK POP3 \[[-.\w]+\] v(200[-.\w]+) server ready\r\n-ERR Null command\r\n-ERR Null command\r\n| p/ipopd/ v/$1/
+match pop3 m|^\+OK POP3 \[([-.\w]+)\] v(200[-.\w]+) server ready\r\n-ERR Null command\r\n-ERR Null command\r\n| p/ipopd/ h/$1/ v/$2/
 # Solid POP3d 0.15
 match pop3 m|^\+OK Solid POP3 server ready\r\n-ERR unknown command\r\n-ERR unknown command\r\n$| p/Solid POP3d/
 # OS 400 V4R4M0
-match pop3 m|^\+OK POP3 server ready\r\n-ERR invalid command\r\n$| p/IBM OS 400 pop3d/
+match pop3 m|^\+OK POP3 server ready\r\n-ERR invalid command\r\n$| p/IBM OS 400 pop3d/ o|OS/400|
 # mailgate v3.5.177 on Win2K
-match pop3 m|^\+OK pop server ready\r\n$| p/MailGate pop3d/ i/Windows/
+match pop3 m|^\+OK pop server ready\r\n$| p/MailGate pop3d/ o/Windows/
 # Postgres 7.1.3
 match postgresql m|^EInvalid packet length\0$| p/PostgreSQL DB/
 # postgresql-7.2.3-5.73; linux 2.4.20-18.7 redhat 7.3
@@ -1002,11 +1057,13 @@ match qmqp m|^58:Dnetstring format error while receiving QMQP packet header,$| p
 # Ximian Red Carpet Daemon 1.4.4 on RedHat Linux 9.0
 match redcarpet m|^Status: 400 Bad Request\r\nContent-Length: 0\r\n\r\n| p/Ximian Red Carpet Daemon/
 
-match smux m|^A\x01\x02$| p/Linux SNMP multiplexer/
+match smux m|^A\x01\x02$| p/Linux SNMP multiplexer/ o/Linux/
 # Solaris 9
-match uucp m|^login: Please enter user name: Password: $| p/Solaris uucpd/
-match ups m|^32\r $| p/Cyber Power PowerPanelPlus UPS Server/ i/Windows/
+match uucp m|^login: Please enter user name: Password: $| p/Solaris uucpd/ o/Solaris/
+match ups m|^32\r $| p/Cyber Power PowerPanelPlus UPS Server/ o/Windows/
 match whois m|^%  No entries found for the selected source\(s\)\.\n$| p/Merit IRRD whoisd/
+match whois m|^Process query: ''\nQuery recognized as IP\.\nQuerying ([\w\d-_.]+):(\d+) with whois\.\n\n| p/gwhois/ i/Uses $1:$2/
+match whois m|^Process query: ''\nQuery recognized as IP\.\n| p/gwhois/
 match zebedee m|^\x02\x01$| p/Zebedee encrypted tunnel/
 
 match bmc-perform-service m|^SDPACK$| p/BMC Perform Service Daemon/
@@ -1021,17 +1078,21 @@ match nntp m|^200 Coruscant BBS News \(Synchronet NNTP Service v(\d[-.\w ]+)\)\r
 # wesnotd multiplayer network daemon (http://www.wesnoth.org/)
 match wesnotd m|^\0\0\0\x16\0\0\0\x1f\x02version\0\x040\..\..\0\0\x02mustlogin\0x05\x01\0| p/wesnotd/
 
-
-
-
 # SHOUTcast Distributed Network Audio: www.shoutcast.com
 match shoutcast m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/([\w\d]+).v([\d.]+).*icy-name:(.*?)\r\n|s p/SHOUTcast server ($1)/ v/$2/ i/Name: $3/
 match shoutcast m|^ICY 200 OK\r\n.*SHOUTcast Distributed Network Audio Server/([\w\d]+).v([\d.]+)|s p/SHOUTcast server ($1)/ v/$2/
 match shoutcast m|^ICY 401 Service Unavailable\r\n.*SHOUTcast Distributed Network Audio Server/([\w\d]+) v([\d.]+)|s p/SHOUTcast server ($1)/ v/$2/
 
+match bitkeeper m|^ERROR-Try help\nERROR-Try help\n$| p/Bitkeeper/
+match webcache m|^HTTP/1\.0 400 Bad Request\r\nExpires: .*\r\nContent-Type: text/html\r\n\r\n<html>\n<head><title>Bad formed request or url</title>\n| p/webcache/
+# Novell ZENworks for Desktops Imaging Proxy 4.01.03
+# Not sure if this is netware specific (linux too?) -Doug
+match zenimaging m|^\xff\xff\xfb&$| p/Novell ZENworks Imaging Proxy/
+
+
 ##############################NEXT PROBE##############################
 Probe TCP GetRequest q|GET / HTTP/1.0\r\n\r\n|
-ports 70,79,80-85,88,113,139,143,280,497,515,540,554,631,783,993,995,1220,1503,2030,3052,3128,3372,3531,3689,5000,5432,5800-5803,5900,6699,7070,8000-8010,8080-8085,8880-8888,9090,9999,10000,10005,11371,13722,15000,40193,4711
+ports 70,79,80-85,88,113,139,143,280,497,515,540,554,620,631,783,993,995,1220,1503,2030,3052,3128,3372,3531,3689,5000,5432,5800-5803,5900,6699,7070,8000-8010,8080-8085,8880-8888,9090,9999,10000,10005,11371,13722,15000,40193,4711
 sslports 443
 
 # Kerio PF 4.0.11 unregistered - Service process (Port 44xxx?) on MS W2K SP4+
@@ -1043,32 +1104,32 @@ match dantzretrospect m|^\0\xca\0\0\0\0\0\x04\0\0\0\0$| p/Dantz Retrospect/ v/6.
 match dnet-keyproxy m|^HTTP/1\.0 302 Found\r\nLocation: http://www\.distributed\.net/\r\n\r\n$| p/Distributed.Net HTTP Keyproxy/
 
 # Digital UNIX 5.6
-match finger m|^Login name: /         \t\t\tIn real life: \?\?\?\r\n\r\nLogin name: GET       \t\t\tIn real life: \?\?\?\r\n\r\nLogin name: HTTP/1\.0  \t\t\tIn real life: \?\?\?\r\n$| p/Digital UNIX fingerd/
+match finger m|^Login name: /         \t\t\tIn real life: \?\?\?\r\n\r\nLogin name: GET       \t\t\tIn real life: \?\?\?\r\n\r\nLogin name: HTTP/1\.0  \t\t\tIn real life: \?\?\?\r\n$| p/Digital UNIX fingerd/ o/DIGITAL UNIX/
 # Internet Rex v2.67 Beta 1a
 match finger m|^No such user No such user N\n$| p/Internet Rex finger server/
 # FreeBSD 4.9-STABLE /usr/libexec/fingerd/
-match finger m|^finger: /: no such user\nfinger: GET: no such user\nfinger: HTTP/1\.0: no such user\n$| p/FreeBSD fingerd/
+match finger m|^finger: /: no such user\r?\nfinger: GET: no such user\r?\nfinger: HTTP/1\.0: no such user\r?\n$| p/FreeBSD fingerd/ o/FreeBSD/
 # Bay Networks Micro Annex Comm. Server R10.0
 match finger m|^No such activity\.\r\n$| p/Bay Networks Micro Annex terminal server fingerd/
 # Mercury/32 3.32 Finger Server module on Windows XP
-match finger m|^GET / HTTP/1\.0 is not known at this site\.\r\n$| p|Mercury/32 fingerd| i|Win32|
+match finger m|^GET / HTTP/1\.0 is not known at this site\.\r\n$| p|Mercury/32 fingerd| o|Windows|
 # ffingerd 1.28
 match finger m|^That user does not want to be fingered\.\n$| p/ffingerd/
 # Finger 0.17 from debian linux (which is from Linux netkit I believe)
 # OpenBSD 2.3
 match finger m|^finger: GET: no such user\.\nfinger: /: no such user\.\nfinger: HTTP/1\.0: no such user\.\n$| p|BSD/Linux fingerd|
 # Linux port of in.fingerd from OpenBSD network tools - started with -w to show welcome banner
-match finger m|^\r\nWelcome to Linux version (\d[-.\w]+) at [-.\w]+ !\r\n\n.*(\d+) user.*\n\r\nfinger: GET: no such user\.\nfinger: /: no such user\.\nfinger: HTTP/1\.0: no such user\.\n| p/OpenBSD fingerd/ i/ported to Linux; Linux version $1; $2 users logged in/
+match finger m|^\r\nWelcome to Linux version (\d[-.\w]+) at ([-.\w]+) !\r\n\n.*(\d+) user.*\n\r\nfinger: GET: no such user\.\nfinger: /: no such user\.\nfinger: HTTP/1\.0: no such user\.\n| p/OpenBSD fingerd/ i/ported to Linux; $2 users logged in/ o/Linux version $1/ h/$2/ o/Linux/
 # Redhat Linux from finger-server-0.17-9 RPM
-match finger m|^finger: GET: no such user.\r\nfinger: /: no such user.\r\nfinger: HTTP/1.0: no such user.\r\n$| p/Linux fingerd/
+match finger m|^finger: GET: no such user.\r\nfinger: /: no such user.\r\nfinger: HTTP/1.0: no such user.\r\n$| p/Linux fingerd/ o/Linux/
 # NetBSD 1.6ZA (berkeley fingerd 8.1 sibling)
 match finger m|^finger: GET: no such user\nfinger: /: no such user\nfinger: HTTP/1\.0: no such user\n$| p/NetBSD fingerd/
 # Solaris 9
-match finger m|^Login       Name               TTY         Idle    When    Where\r\nGET                   \?\?\?\r\n/                     \?\?\?\r\nHTTP/1\.0              \?\?\?\r\n$| p/Sun Solaris fingerd/
+match finger m|^Login       Name               TTY         Idle    When    Where\r\nGET                   \?\?\?\r\n/                     \?\?\?\r\nHTTP/1\.0              \?\?\?\r\n$| p/Sun Solaris fingerd/ o/Solaris/
 # mlfingerd 1.1
 match finger m|^Information for user 'GET\+20\+2F\+20HTTP\+2F1\.0':\r\nUnknown user\.\r\n$| p/mlfingerd/
 # SGI IRIX 6.5.18f finger
-match finger m|^Login name: GET       \t\t\tIn real life: \?\?\?\r\n$| p/SGI IRIX fingerd/
+match finger m|^Login name: GET       \t\t\tIn real life: \?\?\?\r\n$| p/SGI IRIX fingerd/ o/IRIX/
 
 match gnutella m|^HTTP/1\.[01] 404 Not Found\r\nServer: gtk-gnutella/(\d[-.\w]+) \(([^\)\r\n]+)\)\r\n| p/gtk-gnutella P2P client/ v/$1/ i/$2/
 # LimeWire 3.5.8 on Suse Linux 8.1
@@ -1078,7 +1139,7 @@ match gnutella m|^HTTP/1\.1 404 Not Found\r\nServer: giFT-Gnutella/(\d[-.\w]+)\r
 match gnutella m|^HTTP/1\.1 200 OK\r\n.*\r\nServer: Shareaza (\d\S+)|s p/Shareaza/ v/$1/
 match gopher m|^HTTP/1\.0 200 Ok\r\nMIME-Version: 1\.0\r\nServer: GopherWEB/(\d[-.\w]+)\r\n| p/Internet Gopher Server/ i/Gopher+ protocol; GopherWeb $1/
 
-match http m|^HTTP/1\.0 401 Unauthorized\r\nPragma: no-cache\r\nContent-type: text/html\r\nWWW-Authenticate: Basic realm=\"Login to the Router Web Configurator\"\r\n\r\n<html>\n  <head>\n  <title>401 Unauthorized</title>\n  </head>\n<body>\n\n<div align=\"center\">| p/Draytek Vigor aDSL router webadmin/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nPragma: no-cache\r\nContent-type: text/html\r\nWWW-Authenticate: Basic realm=\"Login to the Router Web Configurator\"\r\n\r\n<html>\n  <head>\n  <title>401 Unauthorized</title>\n  </head>\n<body>\n\n<div align=\"center\">| p/Draytek Vigor aDSL router webadmin/ d/broadband router/
 match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: webfs/(\d[-.\w]+)\r\n| p/WebFS httpd/ v/$1/
 match http m|^HTTP/1\.0 200 OK\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n<HTML>\n<!-- Copyright IBM Corporation, 1999 -->\n<HEAD>\n<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=| p/IBM switch webadmin/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: WebCam2000/(\d[-.\w]+) \(([-/.+\w]+); www\.stratoware\.com/webcam2000/\)\r\n| p/Webcam2000 httpd/ v/$1/ i/$2/
@@ -1086,12 +1147,12 @@ match http m|^HTTP/1\.0 404 Not Found\r\nDate: .*\r\nServer: BWS/1\.0b3\r\n\r\n|
 match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: WebSite/(\d[-.\w]+)\r\n| p/Deerfield VisNetic WebSite Professional/ v/$1/
 match http m|^HTTP/1\.0 \d\d\d\r\nServer: Statistics Server (\d[-.\w]+)\r\n| p/DeepMetrix Statistics Server/ v/$1/
 match http m|^HTTP/1\.0 400 Bad Request\r\nServer: OfficeScan Client\r\nContent-Type: text/plain\r\nAccept-Ranges: bytes\r\nContent-Length: 4\r\n\r\nFail$| p/Trend Micro OfficeScan antivirus update client/
-match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: Tue, 07 Oct 2003 12:26:05 GMT\r\nAllow: GET, HEAD\r\nServer: Spyglass_MicroServer/(\d[-.\w]+)\r\n\r\n<html>\n\n<head>\n\n<title>.*PhaserLink| p/Tektronix Phaser printer webadmin/ i/Ebedded Spyglass MicroServer $1/
+match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: Tue, 07 Oct 2003 12:26:05 GMT\r\nAllow: GET, HEAD\r\nServer: Spyglass_MicroServer/(\d[-.\w]+)\r\n\r\n<html>\n\n<head>\n\n<title>.*PhaserLink| p/Tektronix Phaser printer webadmin/ i/Ebedded Spyglass MicroServer $1/ d/printer/
 match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: 3Com/v(\d[-.\w]+)\r\nWWW-Authenticate:Basic realm=\"device\"\r\n| p/3Com switch webadmin/ v/$1/
-match http m|^HTTP/1\.0 401 Unauthorized\nDate: .*\nServer: Acme\.Serve/v(\d[-.\w ]+)\nConnection: close\nExpires: .*\nWWW-Authenticate: Basic realm=\"PowerChute network shutdown\"\n|s p/APC Powerchute UPS web management/ i/Embedded Acme.Serv $1/
-match http m|^HTTP/1\.0 302 Found\r\nLocation: /index\.htm\r\n\r\n| p/Alcatal Speedtouch aDSL router webadmin/
+match http m|^HTTP/1\.0 401 Unauthorized\nDate: .*\nServer: Acme\.Serve/v(\d[-.\w ]+)\nConnection: close\nExpires: .*\nWWW-Authenticate: Basic realm=\"PowerChute network shutdown\"\n|s p/APC Powerchute UPS web management/ i/Embedded Acme.Serv $1/ d/power device/
+match http m|^HTTP/1\.0 302 Found\r\nLocation: /index\.htm\r\n\r\n| p/Alcatal Speedtouch aDSL router webadmin/ d/broadband router/
 match http m|^HTTP/1\.0 404 Not Found\r\nServer: pks_www/(\d[-.\w]+)\r\n| p/OpenPGP public key server/ v/$1/
-match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: Apache/0\.6\.5\r\nPragma: no-cache\r\nContent-type: text/html\r\nWWW-Authenticate: Basic realm=\"System Setup\"\r\n| p/BenQ AWL wireless router webadmin/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: Apache/0\.6\.5\r\nPragma: no-cache\r\nContent-type: text/html\r\nWWW-Authenticate: Basic realm=\"System Setup\"\r\n| p/BenQ AWL wireless router webadmin/ d/broadband router/
 # Orinoco bg-2000 Access Point
 match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: Agranat-EmWeb/R5_2_6\r\nWWW-Authenticate: Basic realm=\"gateway\"\r\n| p/Orinoco WAP webadmin/ i/Embedded webserver: Agranat-EmWeb 5.2.6/
 # ORiNOCO AP-600
@@ -1105,89 +1166,97 @@ match http-mgmt m|^HTTP/1\.1 200 OK\r\nServer: Virata-EmWeb/R6_0_1\r\n-ransfer-E
 match http-mgmt m|^HTTP/1\.1 301 Moved Permanently\r\nServer: Virata-EmWeb/R6_2_1\r\nLocation: https://([\d.]+)/\r\nContent-Type: text/html\r\nContent-Length: 90\r\n\r\n<HEAD><TITLE>Moved</TITLE></HEAD><BODY>| p/HP Color LaserJet 3500/ i/Virata embedded httpd 6.2.1/ d/printer/
 match http m|^HTTP/1\.1 301 Resource Moved\r\nCONTENT-LENGTH: 0\r\nEXPIRES: .*\r\nLocation: /hp/device/this\.LCDispatcher\r\nCACHE-CONTROL: no-cache\r\nSERVER: HP-ChaiSOE/([\d.]+)\r\n-ONNECTION: Keep-Alive\r\n\r\n| p/hp color LaserJet 4650/ i/HP-ChaiSOE $1/ d/printer/
 
+
+# HP Printers
+match http-mgmt m|^HTTP/1\.1 200 OK\r\nServer: Agranat-EmWeb/R5_2_6\r\nContent-Type: text/html;charset=ISO-8859-1\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n<HTML> \n<HEAD>\n<TITLE> | p/HP LaserJet/ i/Embedded webserver: Agranat-EmWeb 5.2.6/ d/printer/
+match http-mgmt m|^HTTP/1\.1 200 OK\r\nServer: Virata-EmWeb/R6_2_1\r\nContent-Type: text/html;charset=ISO-8859-1\r\nExpires: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n<!DOCTYPE html\nPUBLIC | p/HP LaserJet/ i/Embedded webserver: Agranat-EmWeb 6.2.1/ d/printer/
+match http-mgmt m|^HTTP/1\.1 200 OK\r\nServer: Virata-EmWeb/R6_2_1\r\nContent-Type: text/html;charset=utf-8\r\nExpires: Thu, 01 Jan 1970 00:00:00 GMT\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n<!--  DOCTYPE tag is included to support the XHTML  -->\n<!DOCTYPE html\n   PUBLIC | p/HP LaserJet/ i/Embedded webserver: Agranat-EmWeb 6.2.1/ d/printer/
+match http-mgmt m|^HTTP/1\.1 200 OK\r\nServer: Virata-EmWeb/R6_0_1\r\n-ransfer-Encoding: chunked\r\nContent-Type: text/html\r\nExpires: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n\n\n<!DOCTYPE html\nPUBLIC| p/HP JetDirect/ i/Embedded webserver: Virata-EmWeb 6.0.1/ d/printer/
+match http-mgmt m|^HTTP/1\.1 301 Moved Permanently\r\nServer: Virata-EmWeb/R6_2_1\r\nLocation: https://([\d.]+)/\r\nContent-Type: text/html\r\nContent-Length: 90\r\n\r\n<HEAD><TITLE>Moved</TITLE></HEAD><BODY>| p/HP Color LaserJet 3500/ i/Virata embedded httpd 6.2.1/ d/printer/
+match http m|^HTTP/1\.1 301 Resource Moved\r\nCONTENT-LENGTH: 0\r\nEXPIRES: .*\r\nLocation: /hp/device/this\.LCDispatcher\r\nCACHE-CONTROL: no-cache\r\nSERVER: HP-ChaiSOE/([\d.]+)\r\n-ONNECTION: Keep-Alive\r\n\r\n| p/hp color LaserJet 4650/ i/HP-ChaiSOE $1/ d/printer/
+
 match http m|^HTTP/1\.0 200 OK\nServer: stats\.mod/(\d[-.\w]+)\n| p/Eggdrop stats.mod web statistics module/ v/$1/
 match http m|^HTTP/1\.1 200 OK\r\nServer: PPR-httpd/(\d[-.\w]+)\r\n| p/PPR print spooling daemon ppradmin/ v/$1/
-match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: RAC_ONE_HTTP (\d[-.\w]+)\r\n| p/Dell Embedded Remote Access card webserver/ v/$1/
-match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n\r\n<HTML>\r\n<HEAD>\r\n<TITLE>EpsonNet WebAssist Rev\.(\d[-.\w]+)</TITLE>| p/EpsonNet WebAssist printer configuration/ v/$1/
-match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n\r\n<HTML><HEAD><META HTTP-EQUIV=\"Content-type\" CONTENT=\"text/html; charset=iso-8859-1\">\r\n<TITLE>Lexmark ([-/.+\w]+)</TITLE>| p/Lexmark printer webadmin/ i/Lexmark $1/
+match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: RAC_ONE_HTTP (\d[-.\w]+)\r\n| p/Dell Embedded Remote Access card webserver/ v/$1/ d/terminal server/
+match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n\r\n<HTML>\r\n<HEAD>\r\n<TITLE>EpsonNet WebAssist Rev\.(\d[-.\w]+)</TITLE>| p/EpsonNet WebAssist printer configuration/ v/$1/ d/printer/
+match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n\r\n<HTML><HEAD><META HTTP-EQUIV=\"Content-type\" CONTENT=\"text/html; charset=iso-8859-1\">\r\n<TITLE>Lexmark ([-/.+\w]+)</TITLE>| p/Lexmark printer webadmin/ i/Lexmark $1/ d/printer/
 match http m|^HTTP/1\.0 200 OK\nServer: III (\d[-.\w]+)\n| p/Innovative Interfaces Innopac httpd/ v/$1/
-match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-type: text/html\r\nWWW-Authenticate: Basic realm=\"CISCO_WEB\"\r\n| p/Cisco DSL router webadmin/
-match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\n.*Server: Allegro-Software-RomPager/([\w.]+)\r\n\r\n<HTML>\n<HEAD>\n<TITLE>Cisco Systems, Inc\.</TITLE>.*Cisco IP Phone (\d+)|s p/Cisco IP Phone $2/ i/Allegro RomPager $1/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nContent-type: text/html\r\nWWW-Authenticate: Basic realm=\"CISCO_WEB\"\r\n| p/Cisco DSL router webadmin/  d/broadband router/
+match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\n.*Server: Allegro-Software-RomPager/([\w.]+)\r\n\r\n<HTML>\n<HEAD>\n<TITLE>Cisco Systems, Inc\.</TITLE>.*Cisco IP Phone (\d+)|s p/Cisco IP Phone $2/ i/Allegro RomPager $1/ d/VoIP phone/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nRAKeepAliveHeader: \.\r\n| p/RemotelyAnywhere remote PC management webserver/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: Ipswitch-IMail/(\d[-.\w]+)\r\n| p/IPSwitch IMail web service/
 match http m|^HTTP/1\.0 200 OK\r\nContent-type: text/html\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n<html><head><title>Authentication Form</title></head><BODY BGCOLOR=\"#000000\" TEXT=\"#00FF00\"><p><h3 align=left><font face=\"arial,helvetica\">Client Authentication Remote Service</font>| p/Check Point Firewall-1 Client Authentication webserver/
 match http m|^HTTP/1\.0 404 Not Found\r\nDate: .*\r\nServer: Check Point SVN foundation\r\n| p/Check Point Firewall-1 SVN foundation service/
-match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: HP-UX_Apache-based_Web_Server/(\d[-.\w]+) (.*)\r\n| p/HP-UX httpd/ v/$1/ i/Apache derived; $2/
+match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: HP-UX_Apache-based_Web_Server/(\d[-.\w]+) (.*)\r\n| p/HP-UX httpd/ v/$1/ i/Apache derived; $2/ o/HP-UX/
 match http m|^HTTP/1\.1 302 Moved\r\nContent-type: text/html\r\nConnection: close\r\nLocation: /1[012]\d{8}/l\r\n\r\n<H1>Document| p/Novell NetMail ModWeb webmail/
 match http m/^GIF89a\xa8\0-\0\xf7\0\0\x03\x03\x03\x83\x83\x83\xc4\xc4\xc4\xfe\x02\x02\xc9\x85c\x85|\xb5\xe2\xe2\xe2\xca\xa2\x8e\xd4RRCCC\xdeb\"\xa5\xa5\xa5\xe7\xc5/ p/Tweak XP web advertisement blocker/
 # Management interface for Xerox Phaser printers. 
-match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: .*\r\nExpires: .*\r\nLast-Modified: .*\r\nPragma: no-cache\r\nServer: Allegro-Software-RomPager/(\d[-.\w]+)\r\n\r\n<HTML>\n<!--Copyright \(c\) Xerox Corporation | p/Xerox printer webadmin/ i/Embedded Allegro-Software-RomPager $1/
-match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: .*\r\nExpires: .*\r\nLast-Modified: .*\r\nPragma: no-cache\r\nServer: Allegro-Software-RomPager/(\d[-.\w]+)\r\n\r\n<html>\n<head>\n<title>\nHome - \nPhaser (\w+)</title>\n|s p/Xerox printer webadmin/ i/Printer $2; Embedded Allegro-Software-RomPager $1/
+match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: .*\r\nExpires: .*\r\nLast-Modified: .*\r\nPragma: no-cache\r\nServer: Allegro-Software-RomPager/(\d[-.\w]+)\r\n\r\n<HTML>\n<!--Copyright \(c\) Xerox Corporation | p/Xerox printer webadmin/ i/Embedded Allegro-Software-RomPager $1/ d/printer/
+match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: .*\r\nExpires: .*\r\nLast-Modified: .*\r\nPragma: no-cache\r\nServer: Allegro-Software-RomPager/(\d[-.\w]+)\r\n\r\n<html>\n<head>\n<title>\nHome - \nPhaser (\w+)</title>\n|s p/Xerox printer webadmin/ i/Printer $2; Embedded Allegro-Software-RomPager $1/ d/printer/
 match http m|^HTTP/1\.0 302 Moved Temporarily\r\nserver: IronPort httpd/(\d[-.\w]+)\r\n| p/IronPort mail appliance admin websever/ v/$1/
-match http m|^HTTP/1\.1 200 OK\r\nServer: Virata-EmWeb/R(\d[-.\w]+)\r\nContent-Type: text/html\r\nExpires: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n\n<html>\n<head><title>(CopperJet [-.+\w ]+)</title>| p/Allied Data CopperJet aDSL modem/ i/Embedded Virata-EmWeb $1; $2/
+match http m|^HTTP/1\.1 200 OK\r\nServer: Virata-EmWeb/R(\d[-.\w]+)\r\nContent-Type: text/html\r\nExpires: .*\r\nCache-Control: no-cache\r\nPragma: no-cache\r\n\r\n\n<html>\n<head><title>(CopperJet [-.+\w ]+)</title>| p/Allied Data CopperJet aDSL modem/ i/Embedded Virata-EmWeb $1; $2/ d/broadband router/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\nServer: dhttpd/(\d[-.\w]+)\r\n| p/dhttpd/ v/$1/
 match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: Snap Appliance, Inc\./(\d[-.\w]+)\r\n| p/Snap Appliance storage system webadmin/ v/$1/
 match http m|^HTTP/1\.0 200 OK\r\nPragma: no-cache\r\nContent-Type: text/html\r\n\r\n<HTML>\n<FRAMESET COLS=\"105,\*\" FRAMEBORDER=NO BORDER=0\nFRAMESPACING=0>\n<FRAME SRC=\"/side\.html\" SCROLLING=NO>\n<FRAME SRC=\"/startupdata\.html\">\n</FRAMESET>\n</HTML>\n$| p/Motorola cable modem webadmin/
-match http m|^HTTP/1\.0 200 OK\nDate: .*\nServer: Intel NetportExpressPro/(\d[-.\w]+)\n| p/Intel NetportExpress Pro print server webadmin/ v/$1/
-match http m|^HTTP/1\.0 200 Ok\r\nContent-Type: text/html; charset=\"utf-8\"\r\n\r\n<HTTP>\r\n<HEAD>\r\n  <TITLE>MythTV Status</TITLE>| p/MythTV Linux PVR webadmin/
-match http m|^HTTP/1\.0 302 Found\r\nLocation: http://[-.+\w]+:32\d\d\d/\r\n\r\n$| p/Sun Solaris Management Console/ i/Runs Tomcat webserver/
+match http m|^HTTP/1\.0 200 OK\nDate: .*\nServer: Intel NetportExpressPro/(\d[-.\w]+)\n| p/Intel NetportExpress Pro print server webadmin/ v/$1/ d/print server/
+match http m|^HTTP/1\.0 200 Ok\r\nContent-Type: text/html; charset=\"utf-8\"\r\n\r\n<HTTP>\r\n<HEAD>\r\n  <TITLE>MythTV Status</TITLE>| p/MythTV Linux PVR webadmin/ o/Linux/
+match http m|^HTTP/1\.0 302 Found\r\nLocation: http://[-.+\w]+:32\d\d\d/\r\n\r\n$| p/Sun Solaris Management Console/ i/Runs Tomcat webserver/ o/Solaris/
 # Cyclades PR2000 Router
-match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"PR2000 - Login\"\r\nContent-Type: text/html\r\nServer: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n.*</H1>This object on the Cyclades PR2000 - RomPager server is protected|s p/Cyclades PR2000 Router/ i/Allegro RomPager $1/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"PR2000 - Login\"\r\nContent-Type: text/html\r\nServer: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n.*</H1>This object on the Cyclades PR2000 - RomPager server is protected|s p/Cyclades PR2000 Router/ i/Allegro RomPager $1/ d/router/
 # 3Com OfficeConnect 812 Router telnetd
-match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"OCR-([-.\w]+)\"\r\nContent-Type: text/html\r\nServer: Allegro-Software-RomPager/(\d[-.\w]+)\r\n| p/3Com OfficeConnect Router webadmin/ i/Embedded Allegro-Software-RomPager $2; OfficeConnect OCR-$1/
-match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"APC Management Card\"\r\nContent-Type: text/html\r\nServer: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n| p/APC Management Web Server/ i/Allegro RomPager $1/
-match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"PDU\"\r\nServer: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n<HTML>\n<HEAD>\n<TITLE>Protected Object</TITLE>\n</HEAD>\n<BODY BGCOLOR=\"WHITE\">\n<H1>Protected Object</H1>\nThis object on the MasterSwitch Web Server is protected\.| p/APC masterswitch web server/ i/Allegro RomPager $1/
-match http m|^HTTP/1\.0 200 OK\r\nPragma: no-cache\r\nContent-Type: text/html\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.0 Transitional//EN\">\n.*<META NAME=Copyright CONTENT=\"Copyright \(c\) 2003 3Com Corporation\. All Rights Reserved\.\">\n.*<META http-equiv=\"3Cnumber\" content=\"([-.\w]+)\">\n|s p/3Com OfficeConnect router webadmin/ i/3Com` $1/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"OCR-([-.\w]+)\"\r\nContent-Type: text/html\r\nServer: Allegro-Software-RomPager/(\d[-.\w]+)\r\n| p/3Com OfficeConnect Router webadmin/ i/Embedded Allegro-Software-RomPager $2; OfficeConnect OCR-$1/ d/router/
+match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"APC Management Card\"\r\nContent-Type: text/html\r\nServer: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n| p/APC Management Web Server/ i/Allegro RomPager $1/ d/power device/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"PDU\"\r\nServer: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n<HTML>\n<HEAD>\n<TITLE>Protected Object</TITLE>\n</HEAD>\n<BODY BGCOLOR=\"WHITE\">\n<H1>Protected Object</H1>\nThis object on the MasterSwitch Web Server is protected\.| p/APC masterswitch web server/ i/Allegro RomPager $1/ d/power device/
+match http m|^HTTP/1\.0 200 OK\r\nPragma: no-cache\r\nContent-Type: text/html\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.0 Transitional//EN\">\n.*<META NAME=Copyright CONTENT=\"Copyright \(c\) 2003 3Com Corporation\. All Rights Reserved\.\">\n.*<META http-equiv=\"3Cnumber\" content=\"([-.\w]+)\">\n|s p/3Com OfficeConnect router webadmin/ i/3Com` $1/ d/router/
 match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n.*\r\nServer: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML//EN\">\n\n<html>\n\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; iso-8859-1\">\n<title>Summit Management Interface</title>|s p/Summit Management Interface/ i/Allegro RomPager $1/
 match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\n.*Server: Allegro-Software-RomPager/([\w.]+)\r\n\r\n\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.01 Transitional//EN\">\n<html>\n<head>\n<title>\nSoundBridge&nbsp;- Status</title>|s p/Roku Sound Bridge Web Interface/ i/Allegro RomPager $1/
 
-match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"\r\n\r\n<title>401 Unauthorized</title><body><h1>401 Unauthorized</h1></body>| p/Acer Warplink Firewall Router webadmin/
-match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: httpd\r\nDate: Fri, 09 Jan 1970 11:48:03 GMT\r\nWWW-Authenticate: Basic realm=\"Sitecom WL-([-.\w]+)\"\r\n| p/Sitecom webadmin/ i/Sitecom WL-$1 WAP/
-match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.0 Transitional//EN\"><html><body bgcolor=\"#C0C0C0\" text=\"#000000\" vlink=\"#800080\" link=\"#0000FF\"><P><h1>TempTrax Digital Thermometer</h1>| p/SensaTronics TempTrax Digital Thermometer/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"\r\n\r\n<title>401 Unauthorized</title><body><h1>401 Unauthorized</h1></body>| p/Acer Warplink Firewall Router webadmin/ d/router/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: httpd\r\nDate: Fri, 09 Jan 1970 11:48:03 GMT\r\nWWW-Authenticate: Basic realm=\"Sitecom WL-([-.\w]+)\"\r\n| p/Sitecom webadmin/ i/Sitecom WL-$1/ d/WAP/
+match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.0 Transitional//EN\"><html><body bgcolor=\"#C0C0C0\" text=\"#000000\" vlink=\"#800080\" link=\"#0000FF\"><P><h1>TempTrax Digital Thermometer</h1>| p/SensaTronics TempTrax Digital Thermometer/ d/specialized/
 match http m|^HTTP/1\.1 401 Unauthorised\r\nServer: Zeus/(\d[-.\w]+)\r\n.*WWW-Authenticate: basic realm=\"Zeus Admin Server\"\r\n|s p/Zeus httpd Admin Server/ v/$SUBST(1,"_",".")/
 match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Zeus/(\d[-.\w]+)\r\n| p/Zeus httpd/ v/$1/
 match http m|^HTTP/1\.0 404 File not Found\r\nServer: SPiN ChatSystem/(\d[-.\w]+)\r\n| p/SPiN web chat system/ v/$1/
 # Netgear FR114P Firewall Router
-match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: IP_SHARER WEB (\d[-.\w]+)\r\nWWW-Authenticate: Basic realm=\"(FR[-.\w+]+)\"\r\n| p/Netgear FR-series firewall router webadmin/ i/Model $2; Embedded webserver: IP_SHARED WEB $1/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: IP_SHARER WEB (\d[-.\w]+)\r\nWWW-Authenticate: Basic realm=\"(FR[-.\w+]+)\"\r\n| p/Netgear FR-series firewall router webadmin/ i/Model $2; Embedded webserver: IP_SHARED WEB $1/ d/router/
 # Netgear FR314 Firewall Router
-match http m|^HTTP/1\.0 200 OK\r\nServer: NETGEAR Firewall\r\n| p/Netgear FR-series firewall router webadmin/
+match http m|^HTTP/1\.0 200 OK\r\nServer: NETGEAR Firewall\r\n| p/Netgear FR-series firewall router webadmin/ d/router/
 # Netgear FVS318 Firewall/Router
-match http m|^HTTP/1\.0 200 OK\r\nServer: Netgear\r\nContent-Type: text/html\r\nPragma: no-cache\r\nLast Modified: .*\r\nConnection: close\r\n\r\n<html>\r\t<head>\r\t\t<meta http-equiv=\"content-type\" content=\"text/html;charset=ISO-8859-1\">\r\t\t<title>\r\t\t\tNETGEAR Router \r| p/Netgear router webadmin/
+match http m|^HTTP/1\.0 200 OK\r\nServer: Netgear\r\nContent-Type: text/html\r\nPragma: no-cache\r\nLast Modified: .*\r\nConnection: close\r\n\r\n<html>\r\t<head>\r\t\t<meta http-equiv=\"content-type\" content=\"text/html;charset=ISO-8859-1\">\r\t\t<title>\r\t\t\tNETGEAR Router \r| p/Netgear router webadmin/ d/router/
 # Netgear RP614 firmware version 4.12
-match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(RP\d+)\"\r\nServer: Embedded HTTPD v(\d[-.\w]+), | p/Netgear router webadmin/ i/Netgear $1; Delta Networks Embedded HTTPd $2/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(RP\d+)\"\r\nServer: Embedded HTTPD v(\d[-.\w]+), | p/Netgear router webadmin/ i/Netgear $1; Delta Networks Embedded HTTPd $2/ d/broadband router/
 # CiscoSecure ACS 3.1 on Windows 2000 Server
 # Cisco Secure ACS for Windows 2000
-match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\nContent-length: .*\r\n\r\n<html>\r\n<head>\r\n<title>CiscoSecure ACS Login</title>| p/Cisco Secure ACS web interface/
+match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\nContent-length: .*\r\n\r\n<html>\r\n<head>\r\n<title>CiscoSecure ACS Login</title>| p/Cisco Secure ACS web interface/ o/Windows/
 # Pix Device Manager (PDM) version 3.01
-match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: .*\r\nContent-Type: text/html\r\nExpires: .*\r\nWWW-Authenticate: Basic realm=\"PIX\"| p/Cisco PIX Device Manager/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: .*\r\nContent-Type: text/html\r\nExpires: .*\r\nWWW-Authenticate: Basic realm=\"PIX\"| p/Cisco PIX Device Manager/ d/firewall/
 
-match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: DHost/(\d[-.\w]+) HttpStk/(\d[-.\w]+)\r\n| p/Novell eDirectory DHOST httpd/ v/$1/ i/HttpStk: $2; used by iMonitor/
+match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: DHost/(\d[-.\w]+) HttpStk/(\d[-.\w]+)\r\n| p/Novell eDirectory DHOST httpd/ v/$1/ i/HttpStk: $2; used by iMonitor/ o/Unix/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: 3ware/(\d[-.\w]+)\r\n| p/3Ware web interface/ v/$1/ i/RAID storage/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: Cherokee/(\d[-.\w]+)\r\n| p/Cherokee httpd/ v/$1/
 match http m|^HTTP/1\.0 200 OK\r\nServer: HomeSeer\r\n| p/HomeSeer Home Control Web Interface/
 # Multitech MultiVoip 410 VoIP gateway
-match http m|^HTTP/1\.1 200 OK\r\nServer: RTXCweb Software (\d[-.\w]+)\r\nDate: .*\r\nContent-type: text/html\r\n\r\n<html>\r\n<head>\r\n<META HTTP-EQUIV=\"PRAGMA\" CONTENT=\"NO-CACHE\">\r\n<META HTTP-EQUIV=\"EXPIRES\" CONTENT=\"-1\">\r\n<script language = \"Javascript\">\r\nvar title_string = \" v \[Firmware - [\w ]+\]| p/Multitech MultiVoip VoIP gateway web interface/ i/Embedded webserver: RTXCweb $1/
+match http m|^HTTP/1\.1 200 OK\r\nServer: RTXCweb Software (\d[-.\w]+)\r\nDate: .*\r\nContent-type: text/html\r\n\r\n<html>\r\n<head>\r\n<META HTTP-EQUIV=\"PRAGMA\" CONTENT=\"NO-CACHE\">\r\n<META HTTP-EQUIV=\"EXPIRES\" CONTENT=\"-1\">\r\n<script language = \"Javascript\">\r\nvar title_string = \" v \[Firmware - [\w ]+\]| p/Multitech MultiVoip VoIP gateway web interface/ i/Embedded webserver: RTXCweb $1/ d/VoIP adapter/
 # NetComm NB1300 ADSL Modem/Router
-match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: WindWeb/(\d[-.\w]+)\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"([-./\w ]+)\"\r\nContent-Type: text/html\r\n\r\nHasbani Web Server| p/WindWeb embedded webserver/ v/$1/ i/As on NetComm DSL modems; Realm: $2; Calls itself Hasbani Web Server/
-match http m|^HTTP/1\.0 200 OK\r\nServer: SimpleServer:WWW/(\d[-.\w]+)\r\n| p/AnalogX SimpleServer httpd/ v/$1/ i/Windows/
+match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: WindWeb/(\d[-.\w]+)\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"([-./\w ]+)\"\r\nContent-Type: text/html\r\n\r\nHasbani Web Server| p/WindWeb embedded webserver/ v/$1/ i/As on NetComm DSL modems; Realm: $2; Calls itself Hasbani Web Server/ d/broadband router/
+match http m|^HTTP/1\.0 200 OK\r\nServer: SimpleServer:WWW/(\d[-.\w]+)\r\n| p/AnalogX SimpleServer httpd/ v/$1/ o/Windows/
 # Xitami - Try to match PHP first!
 match http m|^HTTP/1\.[01] \d\d\d .*\r\nContent-Length: \d+\r\nX-Powered-By: ([-/.\w ]+)\r\nContent-Type: .*\r\nServer: Xitami\r\n| p/Xitami httpd/ i/$1/
 match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: Xitami\r\n|s p/Xitami httpd/
 match http-admin m|^ERROR: Malformed startup string$| p/Xitami httpd admin port/
-
+match http m|^HTTP/1\.1 500 Server Error\r\nConnection: close\r\nContent-Length: \d+\r\nDate: .*\r\nServer: Radio UserLand/(\d[.\w ]+)-([-.\w ]+)\r\n\r\n| p/Radio Userland blog server/ v/$1/ i/$2/ d/printer/
 match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: CANON HTTP Server Ver(\d[-.\w ]+)\r\n| p/Canon printer web interface/ v/$1/
-match http m|^HTTP/1\.1 500 Server Error\r\nConnection: close\r\nContent-Length: \d+\r\nDate: .*\r\nServer: Radio UserLand/(\d[.\w ]+)-([-.\w ]+)\r\n\r\n| p/Radio Userland blog server/ v/$1/ i/$2/
 match http m|^HTTP/1\.1 302 Moved Temporarily\r\nPragma: no-cache\r\nLocation: /servlet/nodeinfo/\r\nExpires: .*\r\nCache-Control: post-check=0, pre-check=0\r\nConnection: close\r\nContent-type: \r\nServer: Fred (\d[-.\w]+) \(build (\d+)\) HTTP Servlets\r\n\r\n| p/Freenet Fred anonymous P2P/ v/$1 build $2/
 match http m|^HTTP/1\.0 200 Ok\r\nServer: diva_httpd\r\n| p/Eicon Diva ISDN card configuration server/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: Resin/(\d[-.\w]+)\r\n| p/Caucho Resin JSP engine/ v/$1/
-match http m|^HTTP/1\.0 \d\d\d .*\r\nMIME-Version: 1\.0\r\nServer: linuxconf/(\d[-.\w]+)\r\n| p/Linuxconf web configuration server/ v/$1/
+match http m|^HTTP/1\.0 \d\d\d .*\r\nMIME-Version: 1\.0\r\nServer: linuxconf/(\d[-.\w]+)\r\n| p/Linuxconf web configuration server/ v/$1/ o/Linux/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: TinyWeb/(\d[-.\w]+)\r\n| p/Tinyweb httpd/ v/$1/ i/on Windows/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: WebSitePro/(\d[-.\w]+)\r\n| p/O'Reilly WebSite Pro/ v/$1/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: Lucent Security Management Admin Server \r\n| p/Lucent Security Management Admin Server/ i/Lucent VPN Firewall/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: thttpd/(\d[-.\w]+) (\w+)\r\n| p/thttpd/ v/$1 $2/
 match http m|^HTTP/1\.1 .*\r\nDate: .*\r\nServer: FirstClass/(\d[-.\w]+)\r\n| p/FirstClass webserver/ v/$1/
 match http m|^HTTP/1\.1 400 Bad request\r\nServer: Citrix Web PN Server\r\n| p/Citrix Metafrme ICA Browser/
-match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: HP-ChaiServer/(\d[-.\w]+)\r\nContent-length: 0\r\n\r\n|s p/HP JetDirect printer webadmin/ i/HP-ChaiServer $1/
+match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: HP-ChaiServer/(\d[-.\w]+)\r\nContent-length: 0\r\n\r\n|s p/HP JetDirect printer webadmin/ i/HP-ChaiServer $1/ d/printer/
 # mldonkey-2.5-3 http port on Linux 2.4.21
 match http m|^HTTP/1\.0 200 OK\r\nServer: MLdonkey\r\n.*\r\n\r\n<html>\n<head>\n\n<title>MLdonkey: Web Interface</title>\n|s p/MLdonkey multi-network P2P web interface/
 # Docupoint Discovery 3.0(Apache) on Windows 2000 Professional
@@ -1198,7 +1267,7 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: eMule\r\n.*<title>eMule (\d[-.\w]+)
 match http m|^HTTP/1\.0 200 OK\r\nServer: Agent-ListenServer-HttpSvr/1\.0\r\n.*<ComputerName>([-.\w]+)</ComputerName>|s p/Network Associates ePolicy Orchestrator/ i/Computername: $1/
 match http m|^HTTP/1\.0 403 Forbidden\r\nServer: Agent-ListenServer-HttpSvr/1\.0\r\n| p/Network Associates ePolicy Orchestrator/
 
-match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Debut/(\d[-.\w]+)\r\n| p|Brother printer webadmin| i|Embedded server: Debut $1|
+match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Debut/(\d[-.\w]+)\r\n| p|Brother printer webadmin| i|Embedded server: Debut $1| d|printer|
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: kpf\r\n| p/KDE Public Fileserver/
 match http m|^HTTP/1\.1 200 OK\r\nServer: Netscape-FastTrack/(\d[-.\w]+)\r\n| p/Sun Iplanet webserver/ v/$1/
 match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: dwhttpd/(\d[-.\w]+) \(([^\r\n\)]+)\)\r\nContent-type: text/html\r\n\r\n  \n  \t<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3\.2//EN\">\n  <HTML>\n    <HEAD>\n      \n      <TITLE>AnswerBook2: Personal Library</TITLE>\n| p/Sun AnswerBook2 webserver/ v/$1/ i/$2/
@@ -1214,11 +1283,14 @@ match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: Zope/\((?:Zope )?([\d\w][^\,\)]+
 match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Oracle XML DB/(Oracle[\w]+ Enterprise Edition Release) (\d[-.\w]+) |s p/Oracle XML DB webserver/ v/$2/ i/$1/
 match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Oracle9iAS \((\d[-.\w]+)\) Containers for J2EE\r\n| p/Oracle 9iAS J2EE webserver/ v/$1/
 match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nAllow: .*\r\nServer: Oracle9iAS-Web-Cache/(\d[-.\w]+)\r\n| p/Oracle 9iAS Web Cache/ v/$1/
-# ntop 2.1.56
-match http m|^HTTP/1\.0 \d\d\d .*\nServer: ntop/(\d[-.\w]+) \(([-.\w]+)\)\n|s p/Ntop web interface/ v/$1/ i/$2/
-match http m|^HTTP/1\.0 \d\d\d .*\nServer: ntop/(\d[-.\w]+) \([^\)\r]+\)\r\n|s p/Ntop web interface/ v/$1/
-# Ntop 2.1.3
-match http m|HTTP/1\.0 \d\d\d .*\nDate: .*\nCache-Control: .*\nConnection: .*\nServer: ntop/(\d[-.\w]+) ([-.\w ]+) \(([-.\w]+)\)\n| p/Ntop web interface/ v/$1/ i/$2; $3/
+# ntop - lots of submissions
+match ntop-http m|^HTTP/1\.0 \d\d\d .*\nServer: ntop/(\d[-.\w]+) [^\r\n]*\([\w\d-]*linux[\w\d-]*\)\r?\n|s p/Ntop web interface/ v/$1/ o/Linux/
+match ntop-http m|^HTTP/1\.0 \d\d\d .*\nServer: ntop/(\d[-.\w]+) \([\w\d-.]*freebsd[\w\d-.]*\)\r?\n|s p/Ntop web interface/ v/$1/ o/FreeBSD/
+match ntop-http m|^HTTP/1\.0 \d\d\d .*\nServer: ntop/(\d[-.\w]+) \(([-.\w]+)\)\n|s p/Ntop web interface/ v/$1/ i/$2/
+match ntop-http m|^HTTP/1\.0 \d\d\d .*\nServer: ntop/(\d[-.\w]+) \([^\)\r]+\)\r\n|s p/Ntop web interface/ v/$1/
+match ntop-http m|^HTTP/1\.0 \d\d\d .*\r\n.*Server: ntop/([\d.]+)|s p/Ntop web interface/ v/$1/
+match ntop-http m|^HTTP/1\.0 401 Unauthorized to access the document\nWWW-Authenticate: Basic realm=\"ntop HTTP server\"\n| p/Ntop web interface/
+
 match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Apt-proxy (\d[-.\w]+)\r\n|s p/Debian Apt-proxy/ v/$1/
 match http m|^HTTP/1\.0 404 NON-EXISTENT BACKEND\r\n\r\n$| p/Debian Apt-proxy/ i/Broken: no backend/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: mini_httpd/(\d[-.\w]+) | p/Mini_httpd/ v/$1/
@@ -1236,15 +1308,15 @@ match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: Embedded HTTP Server (\d[-.\
 # D-Link DWL-1000AP Wireless Access Point
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: PSIWBL/(\d[-.\w]+)\r\nDate: .*\r\nWWW-Authenticate: Basic realm=\"Enter Password \(Leave User Name Empty\)\"\r\n| p/D-Link web admin server/ i/Embedded webserver: PSIWBL $1/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: WhatsUp_Gold/(\d[-.\w]+)\r\n| p/IPswitch Whats Up Gold/ v/$1/
-match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(MR[-.\w]+)\"\r\nContent-Type: text/html\r\nServer: ZyXEL-RomPager/(\d[-.\w]+)\r\n\r\n| p|NetGear webadmin| i|NetGear $1 WAP/Router; Embedded webserver: ZyXEL-RomPager $2|
-match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(R[PT][-.\w]+)\"\r\nContent-Type: text/html\r\nServer: ZyXEL-RomPager/(\d[-.\w]+)\r\n\r\n| p|NetGear webadmin| i|NetGear $1 router; Embedded webserver: ZyXEL-RomPager $2|
+match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(MR[-.\w]+)\"\r\nContent-Type: text/html\r\nServer: ZyXEL-RomPager/(\d[-.\w]+)\r\n\r\n| p|NetGear webadmin| i|NetGear $1 WAP/Router; Embedded webserver: ZyXEL-RomPager $2| d|WAP|
+match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(R[PT][-.\w]+)\"\r\nContent-Type: text/html\r\nServer: ZyXEL-RomPager/(\d[-.\w]+)\r\n\r\n| p|NetGear webadmin| i|NetGear $1 router; Embedded webserver: ZyXEL-RomPager $2| d|router|
 # Netgear MR814 wireless router remote administration, Firmware 4.13 Aug 20 2003
-match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(MR[-.+\w]+)\"\r\nServer: Embedded HTTPD v(\d[-.\w]+), (.*)\r\n| p/NetGear MR-series WAP/ i/$1; Embedded HTTPD $2, $3/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"(MR[-.+\w]+)\"\r\nServer: Embedded HTTPD v(\d[-.\w]+), (.*)\r\n| p/NetGear MR-series WAP/ i/$1; Embedded HTTPD $2, $3/ d/WAP/
 match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"Prestige ([-.\w ]+)\"\r\nContent-Type: text/html\r\nServer: ZyXEL-RomPager/(\d[-.\w ]+)\r\n\r\n| p|ZyXEL Prestige webadmin| v|$2| i|Prestige model $1|
 match http m|^HTTP/1\.1 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"Prestige ([-.\w ]+)\"\r\nContent-Type: text/html\r\nServer: RomPager/(\d[-.\w ]+) ([-./\w]+)\r\n\r\n| p|ZyXEL Prestige webadmin| v|$2| i|Prestige model $1; $3|
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: Roxen/(\d[-.\w]+)\r\n|s p/Roxen webserver/ v/$1/
 # A-link (Avaks) Hasbani Web Server on RoadRunner 44b ADSL Router
-match http m|^HTTP/1\.1 403 Forbidden\r\nServer: WindWeb/(\d[-.\w]+)\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"Home Gateway\"\r\nContent-Type: text/html\r\n\r\nHasbani Web Server| p/A-link Hasbani webadmin/ i/Runs WindWeb $1 embedded httpd; Often a DSL router/
+match http m|^HTTP/1\.1 403 Forbidden\r\nServer: WindWeb/(\d[-.\w]+)\r\nConnection: close\r\nWWW-Authenticate: Basic realm=\"Home Gateway\"\r\nContent-Type: text/html\r\n\r\nHasbani Web Server| p/A-link Hasbani webadmin/ i/Runs WindWeb $1 embedded httpd; Often a DSL router/ d/broadband router/
 # Sambar Server V5.3 on Windows NT
 match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: SAMBAR\r\n| p/Sambar webserver/
 match http m|^HTTP/1\.1 .*\r\nDate: .*\r\nServer: aEGiS_nanoweb/(\d[-.\w]+) \(([^\)]+)\)\r\n| p/AEGiS Nanoweb httpd/ v/$1/ i/$2/
@@ -1253,10 +1325,11 @@ match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: WebLogic WebLogic Server (\d[-.\w]+
 # Samba 3.0.0rc4-Debian
 match http m|^HTTP/1\.0 401 Authorization Required\r\nWWW-Authenticate: Basic realm=\"SWAT\"\r\n| p/Samba SWAT administration server/
 match http m|^HTTP/1\.0 200 OK\r\nConnection: close\r\nDate: .*\r\nExpires: .*\r\nContent-type: text/html\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3\.2//EN\">\n<HTML>\n<HEAD>\n<TITLE>Samba Web Administration Tool</TITLE>| p/Samba SWAT administration server/
+match http m|^HTTP/1\.0 403 Forbidden\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<HTML><HEAD><TITLE>403 Forbidden</TITLE></HEAD><BODY><H1>403 Forbidden</H1>Samba is configured to deny access from this client\n<br>Check your \"hosts allow\" and \"hosts deny\" options in smb\.conf <p></BODY></HTML>\r\n\r\n$| p/Samba SWAT administration server/ i/Access denied/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: icecast/(\d[-.\w]+)\r\n| p/Icecast streaming media server/ v/$1/
 match http m|^HTTP/1\.0 200 OK\r\nServer: HP-Web-Server-(\d[-.\w]+)\r\n.*<!-- framework\.ini ([A-Z]:\\[-.\w \\]+)-->|s p/HP Web Jetwebadmin/ v/$1/ i/framework.ini: $2/
-match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: HP Web Jetadmin/(\d[-.\w]+) (.*)\r\n| p/HP Web Jetadmin print server/ v/$1/ i/$2/
-match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: HP-Web-JetAdmin-(\d[-.\w]+)\r\n| p/HP Web Jetadmin print server/ v/$1/
+match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: HP Web Jetadmin/(\d[-.\w]+) (.*)\r\n| p/HP Web Jetadmin print server/ v/$1/ i/$2/ d/print server/
+match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: HP-Web-JetAdmin-(\d[-.\w]+)\r\n| p/HP Web Jetadmin print server/ v/$1/ d/print server/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: Tomcat Web Server/(\d[-.\w ]+) \( ([^)]+) \)\r\n|s p/Apache Tomcat webserver/ v/$1/ i/$2/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: Tomcat Web Server/(\d[-.\w ]+)\r\n\r\n|s p/Apache Tomcat webserver/ v/$1/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServlet-Engine: Tomcat Web Server/(\d[-.\w]+) \(([^\)]+)\)\r\n|s p/Apache Tomcat webserver/ v/$1/ i/$2/
@@ -1270,26 +1343,26 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Apache/(\d[-.\w]+)\r\n|s p/Apache h
 match http m|^HTTP/1\.[01] \d\d\d.*\r\nDate: .*\r\nServer: Apache\r\n| p/Apache httpd/
 match http m|^HTTP/1\.[01] \d\d\d.*\r\nDate: .*\r\nServer: Apache +\(([^\r\n\)]+)\)\r\n| p/Apache httpd/ i/$1/
 match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: IBM_HTTP_Server/(\d[-.\w]+) (Apache/.*)\r\n| p/IBM HTTP Server/ v/$1/ i/Based on $2/
-match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Apache-AdvancedExtranetServer/(\d[-.\w]+) \(Mandrake Linux/[-.\w]+\) (.*)\r\n| p/Apache Advanced Extranet Server httpd/ v/$1/ i/Mandrake Linux; $2/
-match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Apache-AdvancedExtranetServer/(\d[-.\w]+) \(Mandrake Linux/[-.\w]+\)\r\n| p/Apache Advanced Extranet Server httpd/ v/$1/ i/Mandrake Linux/
-match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Apache-AdvancedExtranetServer/(\d[-.\w]+) \(Linux-Mandrake/[-.\w]+\)\r\n| p/Apache Advanced Extranet Server httpd/ v/$1/ i/Mandrake Linux/
-match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Apache-AdvancedExtranetServer/(\d[-.\w]+)\r\n| p/Apache Advanced Extranet Server httpd/ v/$1/ i/Mandrake Linux/
+match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Apache-AdvancedExtranetServer/(\d[-.\w]+) \(Mandrake Linux/[-.\w]+\) (.*)\r\n| p/Apache Advanced Extranet Server httpd/ v/$1/ o/Mandrake Linux/ i/$2/
+match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Apache-AdvancedExtranetServer/(\d[-.\w]+) \(Mandrake Linux/[-.\w]+\)\r\n| p/Apache Advanced Extranet Server httpd/ v/$1/ o/Mandrake Linux/
+match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Apache-AdvancedExtranetServer/(\d[-.\w]+) \(Linux-Mandrake/[-.\w]+\)\r\n| p/Apache Advanced Extranet Server httpd/ v/$1/ o/Mandrake Linux/
+match http m|^HTTP/1\.1 \d\d\d .*\r\nDate: .*\r\nServer: Apache-AdvancedExtranetServer/(\d[-.\w]+)\r\n| p/Apache Advanced Extranet Server httpd/ v/$1/ o/Mandrake Linux/
 match http m|^HTTP/1.[10] \d\d\d.*\r\nDate:.*\r\nServer: Stronghold/([-.\w]+) Apache/([-.\w]+)| p/Apache Stronghold httpd/ v/$1/ i/based on Apache $2/
 match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Apache Tomcat/(\d[-.\w]+)|s p/Apache Tomcat/ v/$1/
 match http m|^HTTP/1\.1 \d\d\d.*\r\nServer: Apache[- ]Coyote/(\d[-\d.]+)\r\n|s p|Apache Tomcat/Coyote JSP engine| v|$1|
 match http m|^HTTP/1\.1.*\r\nServer: Netscape-Enterprise/([-.\w]+)\r\n| p/Netscape Enterprise httpd/ v/$1/
 # Citrix NFuse 2.0 on MS IIS 5.0
-match http m|^HTTP/1\.[01].*\r\nServer: Microsoft-IIS/([-.\w]+)\r\n.*\r\nContent-Location: http://[^/]+/nfuse.htm\r\n.*\r\n---- NFuse ([-.\w]+) \(Build |s p/Citrix NFuse/ v/$2/ i/Microsoft IIS $1/
-match http m|^HTTP/1\.[01].*\r\nServer: Microsoft-IIS/([-.\w]+)\r\n|s p/Microsoft IIS webserver/ v/$1/
-match http m|^HTTP/1\.0 200 OK\r\nDate: .+\r\nServer: Tomcat/([-.\w]+)\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nServlet-Engine: Tomcat/[-.\w]+ \(Java ([-.\w]+); SunOS ([-.\w]+) (\w+); java\.vendor=Sun Microsystems Inc\.\)\r\n| p/Solaris management console server/ i/SunOS $3 $4; Java $2; Tomcat $1/
+match http m|^HTTP/1\.[01].*\r\nServer: Microsoft-IIS/([-.\w]+)\r\n.*\r\nContent-Location: http://[^/]+/nfuse.htm\r\n.*\r\n---- NFuse ([-.\w]+) \(Build |s p/Citrix NFuse/ v/$2/ i/Microsoft IIS $1/ o/Windows/
+match http m|^HTTP/1\.[01].*\r\nServer: Microsoft-IIS/([-.\w]+)\r\n|s p/Microsoft IIS webserver/ v/$1/ o/Windows/
+match http m|^HTTP/1\.0 200 OK\r\nDate: .+\r\nServer: Tomcat/([-.\w]+)\r\nContent-Type: text/html\r\nContent-Length: \d+\r\nServlet-Engine: Tomcat/[-.\w]+ \(Java ([-.\w]+); SunOS ([-.\w]+) (\w+); java\.vendor=Sun Microsystems Inc\.\)\r\n| p/Solaris management console server/ i/Java $2; Tomcat $1/ o/SunOS $3 $4/
 match http m|^HTTP/1\.1 200 OK\r\n.+Server: CommuniGatePro/([-.\w]+)\r\n|s p/CommuniGate Pro httpd/ v/$1/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: DSS ([-.\w]+) Admin Server/([-.\w]+)| p/DarwinStreamingServer/ v/$1/ i/Admin Server $2/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nServer: QTSS (\d[-.\w]+) Admin Server/(\d[-.\w]+)\r\n| p/Apple QTSS Admin Server/ v/$2/ i/from QTSS $2/
 match http m|^HTTP/1\.0 200 OK\r\nServer: fnord/(\d[-.\w]+)\r\n| p/Fnord httpd/ v/$1/
 match http m|^HTTP/1\.0 404 Not Found\r\nContent-Type: text/html\r\nConnection: close\r\n\r\n<title>Not Found</title>This host is not served here\.$| p/Fnord httpd/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: MiniServ/0.01\r\n|s p/Webmin httpd/
-match http m|^HTTP/1.1 200 OK\r\nServer: NetWare-Enterprise-Web-Server/([-.\w]+)\r\n| p/Novell Netware enterprise web server/ v/$1/
-match http m|^HTTP/1.1 302 Object Moved Temporarily\r\nServer: NetWare HTTP Stack\r\n| p/Novell Netware HTTP Stack/ i/HTTPSTK.NLM/
+match http m|^HTTP/1.1 200 OK\r\nServer: NetWare-Enterprise-Web-Server/([-.\w]+)\r\n| p/Novell Netware enterprise web server/ v/$1/ o/NetWare/
+match http m|^HTTP/1.1 302 Object Moved Temporarily\r\nServer: NetWare HTTP Stack\r\n| p/Novell Netware HTTP Stack/ i/HTTPSTK.NLM/ o/NetWare/
 match http m|^HTTP/1.1 \d\d\d [\w ]+\r\nServer: NetWare HTTP Stack\r\n| p/Novell Netware HTTP Stack/ i/HTTPSTK.NLM/
 
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: HTTPd-WASD/([-.\w]+) OpenVMS/VAX\r\n| p|HTTPd-WASD| v|$1| i|on OpenVMS/VAX)|
@@ -1301,10 +1374,10 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Lotus-Domino(/0)?\r\n| p/Lotus Domi
 # what the telnetd on this device said).
 match http m|^HTTP/1.1 302 Document Follows\r\nLocation: /hag/pages/home.ssi\r\n\r\n$| p/GlobespanVirata httpd/ i/on broadband router/
 match http m|^HTTP/1.0 200 OK\r\nServer:HTTP/1.0\r\n.*<title>Hewlett Packard</title>|s p/HP Jetdirect httpd/
-match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: EHTTP/([.\d]+)\r\nWWW-Authenticate: Basic realm=\"HP ([-.\w]+)\"\r\n| p/HP printer EHTTP admin server/ v/$1/ i/HP $2 printer/
-match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Virata-EmWeb/([-.\w]+)\r\n.*\r\n\r\n\n<!--\nFile name: index\.html\n\nThis is the 'parent' file that calls the individual child frames\. \nThis is the file that is first accessed when the user types http://<ipaddress> \nin the browser toolbar\. \n\nThe UI Architecture consists of a total of 4 frames\. This file calls 3 high-level |s p/HP LaserJet printer webadmin/ i/Virata-EmWeb embedded server $1/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: EHTTP/([.\d]+)\r\nWWW-Authenticate: Basic realm=\"HP ([-.\w]+)\"\r\n| p/HP printer EHTTP admin server/ v/$1/ i/HP $2 printer/ d/printer/
+match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Virata-EmWeb/([-.\w]+)\r\n.*\r\n\r\n\n<!--\nFile name: index\.html\n\nThis is the 'parent' file that calls the individual child frames\. \nThis is the file that is first accessed when the user types http://<ipaddress> \nin the browser toolbar\. \n\nThe UI Architecture consists of a total of 4 frames\. This file calls 3 high-level |s p/HP LaserJet printer webadmin/ i/Virata-EmWeb embedded server $1/ d/printer/
 match http m|^HTTP/1\.0 \d{3} .*\r\nServer: CompaqHTTPServer/([.\w\d]+)\r\n|s p/Compaq Insight Manager HTTP server/ v/$1/
-match http m|^HTTP/1\.1 401 Authorization Required\r\nWWW-Authenticate: Basic realm="Linksys ([-.A-Z\d/ ]+)"\r\n| p/Linksys router web admin server/ i/device model $1/
+match http m|^HTTP/1\.1 401 Authorization Required\r\nWWW-Authenticate: Basic realm="Linksys ([-.A-Z\d/ ]+)"\r\n| p/Linksys router web admin server/ i/device model $1/ d/router/
 match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Insight Manager (\d)\r\n\r\n|s p/Compaq Insight Manager/ v/$1/
 match http m|^HTTP/1\.1 200 OK\r\nContent-Length: \d+\r\nConnection: close\r\nPragma: no-cache\r\nCache-Control: no-cache, no-store, must-revalidate\r\nExpires: 0\r\nContent-Type: text/html\r\n\r\n| p/GNU Httptunnel/
 # Blue Coat Port 80 Security Appliance Model: Blue Coat SG400 Software Version: SGOS 2.1.6044 Software Release id: 19480 Service Pack 4
@@ -1318,7 +1391,7 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: (Oracle[-.\w/]+) Oracle HTTP Server
 match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Oracle HTTP Server Powered by Apache\r\n|s p/Oracle HTTP Server Powered by Apache/
 match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: Oracle HTTP Server Powered by Apache/([-.\w]+)\r\n|s p/Oracle HTTP Server Powered by Apache/ v/$1/
 match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: Embedded HTTP Server (\d[.\d]+)\r\nWWW-Authenticate: Basic realm=\"([-+.\w]+)\"\r\nConnection:| p/D-Link Embedded HTTP Server/ v/$1/ i/on D-Link $2/
-match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n.*Pragma: no-cache\r\nServer: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n<HTML><head>\n<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=iso-8859-1\">\n<TITLE></TITLE></HEAD><frameset framespacing=\"0\" BORDER=\"false\" frameborder=\"0\" rows=\"90,\*\">\n  <frame NAME=\"fLogo\" scrolling=\"no\" noresize src=\"/html/Hlogo\.html\"|s p/D-Link DSL-300g or g+/ i/Allegro RomPager $1/
+match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n.*Pragma: no-cache\r\nServer: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n<HTML><head>\n<META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html; charset=iso-8859-1\">\n<TITLE></TITLE></HEAD><frameset framespacing=\"0\" BORDER=\"false\" frameborder=\"0\" rows=\"90,\*\">\n  <frame NAME=\"fLogo\" scrolling=\"no\" noresize src=\"/html/Hlogo\.html\"|s p/D-Link DSL-300g or g+/ i/Allegro RomPager $1/ d/broadband router/
 match http m|^HTTP/1\.0 401 Unauthorized\r\nWWW-Authenticate: Basic realm=\"IntelEmbeddedWeb@Express460T\"\r\nContent-Type: text/html\r\nServer: Allegro-Software-RomPager/([\w.]+)\r\n| p/Intel 460T Standalone Switch/ i/Allegro RomPager $1/
 # Some D-Link Switches
 match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n.*Server: Allegro-Software-RomPager/ ?([\w.]+)\r\n\r\n.*DES-(\d+) Web Management|s p/D-Link DES-$2 Switch/ i/Allegro RomPager $1/
@@ -1328,19 +1401,19 @@ match http m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html\r\n.*Server: Allegro-S
 match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nMIME-Version: 1\.0\r\nServer: Wapapi/1\.1\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n<html>\r\n<head><title>iCal Tutorial:  Introduction</title></head>| p/Brown Bear iCal web calendar/
 match http m|^HTTP/1\.1 401 Unauthorized\r\nDate: .*\r\nServer: (Virata-EmWeb/R6_0_1)\r\nWWW-Authenticate: Basic realm=\"Administration Tools\"\r\n\r\n401 Unauthorized\r\n$| p/Netscreen administrative web server/ i/runs $1/
 # Phaser860 Printer
-match http m|^HTTP/1\.1 404 Not Found\r\nDate: .*\r\nAllow: GET, HEAD\r\nServer: Spyglass_MicroServer/(\d[-.\w]+)\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n<HTML><HEAD><TITLE>Not Found</TITLE></HEAD>\r\n<BODY>The requested URL was not found\.</BODY></HTML>\r\n| p/Spyglass MicroServer embedded webserver/ v/$1/
+match http m|^HTTP/1\.1 404 Not Found\r\nDate: .*\r\nAllow: GET, HEAD\r\nServer: Spyglass_MicroServer/(\d[-.\w]+)\r\nContent-Type: text/html\r\nContent-Length: \d+\r\n\r\n<HTML><HEAD><TITLE>Not Found</TITLE></HEAD>\r\n<BODY>The requested URL was not found\.</BODY></HTML>\r\n| p/Spyglass MicroServer embedded webserver/ v/$1/ d/printer/
 # Cisco Catalyst 3500-XL switch IOS 12.0(5)XU
-match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: .*\r\nContent-type: text/html\r\nExpires: .*\r\nWWW-Authenticate: Basic realm=\"level 15 access\"\r\n\r\n<HEAD><TITLE>Authorization Required</TITLE></HEAD><BODY><H1>Authorization Required</H1>Browser not authentication-capable or authentication failed\.</BODY>\r\n\r\n$| p/Cisco IOS administrative webserver/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nDate: .*\r\nContent-type: text/html\r\nExpires: .*\r\nWWW-Authenticate: Basic realm=\"level 15 access\"\r\n\r\n<HEAD><TITLE>Authorization Required</TITLE></HEAD><BODY><H1>Authorization Required</H1>Browser not authentication-capable or authentication failed\.</BODY>\r\n\r\n$| p/Cisco IOS administrative webserver/ d/switch/ o/IOS/
 # Cisco 828 G.SHDSL
-match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: cisco-IOS/(\d[-.\w ]+) HTTP-server/(\d[-().\w ]+)\r\n| p/Cisco IOS administrative webserver/ v/$2/ i/IOS $1/
+match http m|^HTTP/1\.0 200 OK\r\nDate: .*\r\nServer: cisco-IOS/(\d[-.\w ]+) HTTP-server/(\d[-().\w ]+)\r\n| p/Cisco IOS administrative webserver/ v/$2/ o/IOS $1/
 # Xerox Document Centre (DocuCentre) 425
 match http m|^HTTP/1\.1 200 OK\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nDate: .*\r\nAllow: GET, HEAD\r\nServer: Xerox_MicroServer/([-.\w]+)\r\nExpires: .*\r\nCache-Control: no-cache\r\n\r\n<HTML>\n<HEAD>\n<TITLE>([-.+ \w]+)</TITLE>| p/Xerox MicroServer httpd/ v/$1/ i/on $2/
 match http m|^HTTP/1\.1 200 OK\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nDate: .*\r\nAllow: GET, HEAD\r\nServer: Xerox_MicroServer/([-.\w]+)\r\n| p|Xerox MicroServer httpd| v|$1| i|usually a printer/copier|
-match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: .*\r\nAllow: GET, HEAD\r\nServer: Spyglass_MicroServer/(\d[-.\w]+)\r\nLast-Modified: .*\r\nExpires: .*\r\nPragma: no-cache\r\n\r\n\n<html> \n<head>\n   <meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\">\n   <meta name=\"keywords\" content=\"printer; embedded web server; int| p/Spyglass MicroServer/ v/$1/ i/embedded in printer/
-match http m|^HTTP/1\.0 500 Internal Server Error\r\nServer: Cougar (\d[-.\w]+)\r\n\r\n$| p/Microsoft Windows Media Server/ v/$1/
-match http m|^HTTP/1\.0 200 OK\r\nContent-Type: video/x-ms-asf\r\nCache-Control: max-age=0, no-cache\r\nServer: Cougar/(\d[-.\w]+)\r\n| p/Microsoft Windows Media Server/ v/$1/
+match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\nDate: .*\r\nAllow: GET, HEAD\r\nServer: Spyglass_MicroServer/(\d[-.\w]+)\r\nLast-Modified: .*\r\nExpires: .*\r\nPragma: no-cache\r\n\r\n\n<html> \n<head>\n   <meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\">\n   <meta name=\"keywords\" content=\"printer; embedded web server; int| p/Spyglass MicroServer/ v/$1/ i/embedded in printer/ d/printer/
+match http m|^HTTP/1\.0 500 Internal Server Error\r\nServer: Cougar (\d[-.\w]+)\r\n\r\n$| p/Microsoft Windows Media Server/ v/$1/ o/Windows/
+match http m|^HTTP/1\.0 200 OK\r\nContent-Type: video/x-ms-asf\r\nCache-Control: max-age=0, no-cache\r\nServer: Cougar/(\d[-.\w]+)\r\n| p/Microsoft Windows Media Server/ v/$1/ o/Windows/
 match http m|^HTTP/1\.[01] \d\d\d .*Server: NetApp/(\d[-.\w]+)\r\n|s p/NetApp filer httpd/ v/$1/
-match http m|^HTTP/1\.0 200 OK\r\nServer: RapidLogic/(\d[.\d]+)\r\nMIME-version: 1\.0\r\nContent-type: text/html\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.0 Frameset//EN\"\r\n\t\t\t\"http://www\.w3\.org/TR/REC-html40/frameset\.dtd\">\r\n<HTML>\r\n<HEAD>\r\n\t<TITLE>Netopia Router Web </TITLE>| p/Netopia RapidLogic admin server/ v/$1/
+match http m|^HTTP/1\.0 200 OK\r\nServer: RapidLogic/(\d[.\d]+)\r\nMIME-version: 1\.0\r\nContent-type: text/html\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.0 Frameset//EN\"\r\n\t\t\t\"http://www\.w3\.org/TR/REC-html40/frameset\.dtd\">\r\n<HTML>\r\n<HEAD>\r\n\t<TITLE>Netopia Router Web </TITLE>| p/Netopia RapidLogic admin server/ v/$1/ d/router/
 match http m|^HTTP/1\.1 200 OK\r\nServer: WebSTAR/(\d[-.()\w]+) ID/| p/WebSTAR httpd/ v/$1/
 match http m|^HTTP/1\.1 401 Unauthorized\r\nServer: Agranat-EmWeb/R5_2_6\r\nWWW-Authenticate: Basic realm=\"accessPoint\"\r\n\r\n401 Unauthorized\r\n$| p/Orinoco AP-200 webadmin/ i/Embedded Agrant-EmWeb R5_2_6/
 match http m|^HTTP/1\.0 404 NO_STREAM_FOUND\r\nConnection: close\r\n\r\n$| p/Chain Cast P2P streaming service/
@@ -1359,9 +1432,9 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: WebSphere Application Server/(.+)\r
 
 match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: JRun Web Server\r\n| p/JRun Web Server/
 
-match http m|^401 Access denied\r\nWWW-Authenticate: Negotiate \r\nContent-length: 0\r\n\r\n| p/Microsoft IIS 5.0 WebDAV/ i/access denied/
+match http m|^401 Access denied\r\nWWW-Authenticate: Negotiate \r\nContent-length: 0\r\n\r\n| p/Microsoft IIS 5.0 WebDAV/ i/access denied/ o/Windows/
 
-match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\n.*Server: RomPager/([\w.]+) UPnP/([\w.]+)\r\n\r\n\n<html><head>.*<title>ZyXEL Prestige Router</title>|s p/ZyXEL Prestige Router/ i/Allegro RomPager $1; UPnP $2/
+match http m|^HTTP/1\.1 200 OK\r\nContent-Type: text/html\r\n.*Server: RomPager/([\w.]+) UPnP/([\w.]+)\r\n\r\n\n<html><head>.*<title>ZyXEL Prestige Router</title>|s p/ZyXEL Prestige Router/ i/Allegro RomPager $1; UPnP $2/ d/router/
 
 
 match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: RomPager/([-.\w/ ]+)\r\n|s p/Embedded Allegro RomPager webserver/ v/$1/ i/ZyXEL ZyWALL 2/
@@ -1370,7 +1443,7 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: IDSL MailGate (\d[-.\w]+)\r\n| p/Ma
 match http m|^HTTP/1\.0 \d\d\d .*<TITLE>The AXIS 200 Home|s p/AXIS 200 Webcam/
 
 match http m|^HTTP/1\.[01] 200 OK\nServer: Anti-Web V([\d.]+) \(([\w .-]+)\)\n| p/Anti-Web httpd/ v/$1/ i/Quote: $2/
-match http m|^HTTP/1\.0 200 OK\r\nServer: ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft Mail Server Pro httpd/ v/$1/ i/Win32/
+match http m|^HTTP/1\.0 200 OK\r\nServer: ArGoSoft Mail Server Pro for WinNT/2000/XP, Version [\d.]+ \(([\d.]+)\)\r\n| p/ArGoSoft Mail Server Pro httpd/ v/$1/ o/Windows/
 match http m|^HTTP/1\.0 400 Bad Request\r\nConnection: Close\r\n\r\n<HTML><HEAD>\n<TITLE>ERROR: The requested URL could not be retrieved</TITLE>\n</HEAD><BODY>\n<H2>The requested URL could not be retrieved</H2>\n<HR>\n<P>\nWhile trying to retrieve the URL:\n| p/WebSense http filter/
 # Lantronix ThinWeb Manager
 match http m|^HTTP/1\.0 200 OK\r\nServer: Gordian Embedded([\d.]+)\r\nContent-type: text/html\r\n.*\r\n\r\n\n<HTML>\n<HEAD>\n<TITLE>Lantronix ThinWeb Manager ([\d.]+): Home</TITLE>\n|s p/Lantronix ThinWeb Manager/ v/$2/ i/Gordian Embedded $1/
@@ -1378,8 +1451,26 @@ match http m|^HTTP/1\.0 200 OK\r\nServer: Gordian Embedded([\d.]+)\r\nContent-ty
 match http m|^HTTP/1\.1 302 Found\r\nDate: .*\r\nLocation: /iw/webdesk/login/\r\nX-Cache: MISS from .*\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n| p/Interwoven TeamSite/
 match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: OpenSA/([\d.]+) / Apache/([\d.]+) \((\w*)\) mod_ssl/([\d.]+) OpenSSL/([\d.]+)\r\n.*<LINK REL=\"SHORTCUT ICON\" HREF=\"http://([\w.-_]+)/iss\.ico\">\r\n<TITLE> System Scanner Vista Welcome Page </TITLE>\r\n|s p/ISS System Scanner Vista/ i|OpenSA/$1 Apache/$2 mod_ssl/$4 OpenSSL/$5| o/$3/ h/$6/
 match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: BaseHTTP/([\d.]+) Python/([\d.]+) edna/([\d.]+)\r\n| p/Edna Streaming MP3 Server/ v/$3/ i|BaseHTTP/$1 Python/$2|
-
 match http m|^HTTP/1\.0 400 Bad Request\r\nServer: Speed Touch WebServer/([\d.]+)\r\nContent-type: text/html\r\nContent-length: \d*\r\n\r\nHTTP/1\.0 400 Bad Request\r\n: Invalid or incomplete request\.\r\n\r\n| p/Alcatel Speedtouch aDSL router httpd/ v/$1/ d/router/
+# Management Interface for Netscape FastTrack web server 2.01
+match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: Netscape-Administrator/([\d.]+)\r\n| p/Netscape FastTrack Administrator/ v/$1/
+# Siemens SpeedStream 2-port SS2601 Router
+match http m|^HTTP/1\.0 200 Document follows\r\nServer: IP_SHARER WEB ([\d.]+)\r\nContent-type: text/html\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4\.0 Transitional//EN\">\n\n<html><head><title>Setup</title>| p/Siemens SpeedStream SS2601/ i/IP_SHARER WEB $1/ d/router/
+
+match http m|^HTTP/1\.1 \d\d\d .*\r\nWWW-Authenticate: Basic realm=\"InterMapper\"\r\n.*\r\nServer: InterMapper/([\d.]+)\r\n|s p/InterMapper Network Monitor httpd/ v/$1/
+match http m|^HTTP/1\.0 200 OK\r\n.*\r\nServer: ZOT-PS-13/([\d.]+)\r\n|s p/Hawking Print Server httpd/ v/$1/ d/print server/
+match http m|^HTTP/1\.0 302 Temporarily Moved\nLocation: /winamp\?page=main\nConnection: close\nContent-type: text/html\n\n<html>\n<head>\n<title>Winamp Web Interface</title>| p/Winamp Web Interface/
+match http m|^HTTP/1\.[01] \d\d\d .*\r\n.*Server: Lasso/([\d.]+)\r\n\r\n|s p/Lasso httpd/ v/$1/
+match http m|^HTTP/1\.0 200 OK\r\nServer: BaseHTTP/([\d.]+) Python/([\d.]+)\r\nDate: .*\r\nContent-Type: text/html\r\n\r\n<html><head><title>Roundup trackers index</title></head>\n<body><h1>Roundup trackers index</h1>| p/Roundup issue tracker/ i|BaseHTTP/$1 Python/$2|
+match http m|^HTTP/1\.0 \d\d\d .*\r\nServer: fwlogwatch ([\d.]+) 200\d/\d\d/\d\d \(C\) Boris Wesslowski, RUS-CERT\r\n| p/fwlogwatch/ v/$1/
+match http m|^HTTP/1\.0 \d\d\d .*\r\nConnection: close\r\nServer: GNUMP3d ([\d.]+)\r\n| p/GNUMP3d/ v/$1/
+match http m|^HTTP/1\.0 401 Unauthorized\r\nServer: IP_SHARER WEB ([\d.]+)\r\nWWW-Authenticate: Basic realm=\"NeedPassword\"\r\nContent-type: text/html\r\n\r\n401 Unauthorized| p/Sitecom DC-202/ i/IP_SHARER embedded httpd $1/ d/router/
+match http m|^HTTP/1\.1 200 OK\r\nDate: .*\r\nServer: HTTP/x\.y\.z \(Unix\) PHP/x\.y\.z mod_ssl/x\.y\.z SSL/x\.y\.z\r\nLast-Modified: .*\r\nETag: \".*\"\r\nAccept-Ranges: bytes\r\nContent-Length: .*\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n<HTML>\n<HEAD>\n<TITLE>Loading\.\.\.</TITLE>\n| p/Coldfusion httpd/ i/SSL support/ o/Unix/
+match http m|^HTTP/1\.0 200 OK\r\nContent-Length: \d+\r\nContent-Type: text/html\r\nServer: SIMS/([\w.]+)\r\n\r\n<HTML>\r<HEAD>\r  <TITLE>Stalker Internet Mail Server: Setup Entrance</TITLE>\r</HEAD>\r<BODY BGCOLOR=white>\r\r<H2><TABLE WIDTH=\"100%\" BORDER=0 CELLSPACING=0 CELLPADDING=0>\r<TR>\r<TD><H3><IMG SRC=\"/Icon\.gif\" ALIGN=MIDDLE>([\w-_.]+)</H3>| p/Stalker Mail Server web config/ v/$1/ h/$2/ o/Mac OS/
+match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: Apache  -OOPS Development Organization-\r\n.*X-Powered-By: ([^\r\n]+)\r\n|s p/Apache - OOPS Devel Org/ i/$1/
+match http m|^HTTP/1\.[01] \d\d\d .*\r\nServer: Apache  -OOPS Development Organization-\r\n|s p/Apache - OOPS Devel Org/ i/$1/
+match http m|^HTTP/1\.0 200 OK\nDATE: .*\nPragma: no-cache\nServer: Delta UPSentry\n| p/Sentry Bulldog UPS httpd/
+match http m|^HTTP/1\.0 \d\d\d .*Server: Gatling/([\d.]+)\r\n|s p/Gatling httpd/ v/$1/
 
 
 # While this response looks like a web admin port, I think the same port is used for the primary
@@ -1400,7 +1491,7 @@ match http-proxy m|HTTP/1\.0 \d\d\d .*\r\nServer: EZproxy\r\n|s p/EZproxy web pr
 match http-proxy m|^HTTP/1\.0 400 Bad Request\r\n.*\r\n\r\n<!DOCTYPE html PUBLIC \"-//W3C//DTD HTML 4\.01 Transitional//EN\">\r\n<html>\r\n<head>\r\n  <title>BFilter Error</title>|s p/Bfilter webproxy/
 match http-proxy m|^HTTP/1\.0 \d\d\d .*\r\nServer: tinyproxy/(\d[-.\w]+)\r\n| p/Tinyproxy/ v/$1/
 # MS ISA Server 2000 enterprise edition on windows 2000 advanced server
-match http-proxy m|^HTTP/1\.1 502 Proxy Error \( The Uniform Resource Locator \(URL\) does not use a recognized protocol\. Either the protocol is not supported or the request was not typed correctly\. Confirm that a valid protocol is in use \(for example, HTTP for a Web request\)\.  \)\r\nVia:1\.1| p/Microsoft ISA Server http proxy/
+match http-proxy m|^HTTP/1\.1 502 Proxy Error \( The Uniform Resource Locator \(URL\) does not use a recognized protocol\. Either the protocol is not supported or the request was not typed correctly\. Confirm that a valid protocol is in use \(for example, HTTP for a Web request\)\.  \)\r\nVia:1\.1| p/Microsoft ISA Server http proxy/ o/Windows/
 # Privoxy 3.0.0 Filtering Web Proxy - http://www.privoxy.org
 match http-proxy m|^HTTP/1\.0 400 Invalid header received from browser\r\n\r\n$| p|Junkbuster/Privoxy webproxy|
 match http-proxy m|^HTTP/1\.0 400 Invalid header received from browser\n\n| p/Junkbuster webproxy/
@@ -1411,11 +1502,15 @@ match http-proxy m|^HTTP/1\.0 \d\d\d .*\r\nServer: [sS]quid\r\n| p/Squid webprox
 
 # Blue Coat Port 80 Security Appliance  Model: Blue Coat SG400 Software Version: SGOS 2.1.6044 Software Release id: 19480 Service Pack 4
 match http-proxy m|^HTTP/1\.1 504 Gateway Time-out\r\nConnection: close\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nContent-Length: 2976\r\nContent-Type: text/html\r\n\r\n<DIV class=Section1> \n\t\t<P class=MsoNormal| p/Blue Coat Security Appliance http proxy/
-match http-proxy m|^HTTP/1.0 200 OK\r\nServer: MS-MFC-HttpSvr/1.0\r\nDate: Wed, 13 Aug 2003 01:58:26 GMT\r\n\r\n<html><h1>http://| p/Surfcontrol SuperScout Web Filter/ i/Windows/
-match http-proxy m|^HTTP/1\.0 400 Cache Detected Error\r\nDate: .*\r\nContent-Type: text/html\r\nVia: 1\.0 [-.\w]+ \(NetCache NetApp/([-.\w]+)\)\r\n\r\n| p/NetApp NetCache web proxy/ v/$1/
+match http-proxy m|^HTTP/1.0 200 OK\r\nServer: MS-MFC-HttpSvr/1.0\r\nDate: Wed, 13 Aug 2003 01:58:26 GMT\r\n\r\n<html><h1>http://| p/Surfcontrol SuperScout Web Filter/ o/Windows/
+match http-proxy m|^HTTP/1\.0 400 Cache Detected Error\r\nDate: .*\r\nContent-Type: text/html\r\nVia: 1\.0 ([-.\w]+) \(NetCache NetApp/([-.\w]+)\)\r\n\r\n| p/NetApp NetCache web proxy/ h/$1/ v/$2/
 
 # Novell BorderManager HTTP-Proxy
 match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nContent-Length: \d+\r\n\r\n<html>\n\t<head>\n<title>BorderManager Information Alert</title></head>| p/Novell BorderManager HTTP-Proxy/
+match http-proxy m|^HTTP/1\.0 400 Bad Request\r\nContent-type: text/html\r\n\r\n<html><head><title>InterScan Error</title></head>\r\n<body><h2>InterScan Error</h2>\r\nInterScan HTTP Version ([\w-_.]+) \$Date:| p/InterScan Interscan VirusWall/ v/$1/
+# iPlanet-Web-Proxy-Server 3.6
+match http-proxy m|^HTTP/1\.0 \d\d\d .*\r\nProxy-agent: iPlanet-Web-Proxy-Server/([\d.]+)\r\n|s p/iPlanet web proxy/ v/$1/
+
 
 # gidentd 0.4.5 on Linux 2.4.X
 match ident m|^0, 0 : ERROR : INVALID-PORT\r\n$| p/gidentd/
@@ -1431,11 +1526,11 @@ match ident m|^0, 0 : ERROR : INVALID-AUTH-REQ-INFO : CAPABILITY=USER-INTERACTIO
 match ident m|^0 , 0 : ERROR : UNKNOWN-ERROR\r\n$| p/pidentd/ i/could be fair-identd/
 # identd 1.1 on Linux 2.4.21
 # linux-identd 1.2 - http://www.fukt.bth.se/~per/identd
-match ident m|^GET / HTTP/1\.0 : ERROR : INVALID-PORT\r\n : ERROR : INVALID-PORT\r\n$| p/Linux-identd/
+match ident m|^GET / HTTP/1\.0 : ERROR : INVALID-PORT\r\n : ERROR : INVALID-PORT\r\n$| p/Linux-identd/ o/Linux/
 # uw-imap 2003debian0.0304182231-1
 match imap m|^\* OK \[CAPABILITY IMAP4REV1 X-NETSCAPE LOGIN-REFERRALS STARTTLS LOGINDISABLED\] \[[-.\w]+\] IMAP4rev1 (200[-.\w]+) at .*\r\nGET BAD Command unrecognized/login please: /\r\n\* BAD Null command\r\n| p/UW-Imap/
 match imap m|^\* OK \[[-.+\w]+\] IMAP4rev1 v1(\d[-.\w]+) server ready\r\n| p/UW-Imap/ v/1$1/
-match imap m|^\* OK [-.+\w]+ IMAP4rev1 v1(\d[-.\w]+) server ready\r\n| p/UW-Imap/ v/1$1/
+match imap m|^\* OK ([-.+\w]+) IMAP4rev1 v1(\d[-.\w]+) server ready\r\n| p/UW-Imap/ h/$1/ v/1$2/
 # gnu/mailutils imap4d 0.3.2 on Linux
 match imap m|^\* OK IMAP4rev1\r\nGET BAD  Invalid command\r\n\* BAD  Null command\r\n$| p/GNU Mailutils imapd/
 # Cyrus IMAP 2.1.14
@@ -1444,14 +1539,14 @@ match ssl/imap m|^\* BYE Fatal error: tls_start_servertls\(\) failed\r\n$| p/Cyr
 # Server: CUPS/1.1
 match ipp m|^HTTP/1\.0.*Server: CUPS/(\S+)|s p/CUPS $1/
 match ipp m|^lpd \[@[-.\w]+\]: Host name for your address \([:.\d]+\) is not known\n$| p/CUPS/
-match irc m|^:Default-Chat-Community 421 \* GET :Unknown command\r\n| p/Microsoft Exchange 2000 Server Chat Service/
+match irc m|^:Default-Chat-Community 421 \* GET :Unknown command\r\n| p/Microsoft Exchange 2000 Server Chat Service/ o/Windows/
 
 # Jabber 1.4.2
 match jabber m|^<stream:error>Invalid XML</stream:error>$| p/Jabber instant messaging server/
 match kazaa-http m|^HTTP/1\.0 404 Not Found\r?\nX-Kazaa-Username: ([-.+\w]+)\r\nX-Kazaa-Network: ([-.\w]+)\r\n| p/KaZaA P2P client/ i/username: $1; network: $2/
 match kazaa-peerpoint m|^HTTP/1\.0 404 Not Found\n\r\n$| p/KaZaA P2P client Peer Point Manager/
-match msdtc m|^...\0..$|s p/Microsoft Distributed Transaction Coordinator/
-match msdtc m|^ERROR\n$|s p/Microsoft Distributed Transaction Coordinator/ i/error/
+match msdtc m|^...\0..$|s p/Microsoft Distributed Transaction Coordinator/ o/Windows/
+match msdtc m|^ERROR\n$|s p/Microsoft Distributed Transaction Coordinator/ i/error/ o/Windows/
 
 # MLDonkey 2.5
 match napster m|^1INVALID REQUEST$| p/MLDonkey multi-network P2P client/
@@ -1459,8 +1554,7 @@ match napster m|^1$| p/Lopster Napster P2P client/
 match bittorent-tracker m|HTTP/1\.1 404 Not Found\r\nServer: MLdonkey\r\nConnection: close\r\nContent-Type: application/x-bittorrent\r\nContentlength: 0\r\n\r\n| p/MLDonkey multi-network P2P client/
 
 match netbios-ssn m/^\x83\0\0\x01\x82|\x8f$/
-match netwareip m|^\xfb\xff\xfe\xff\xfb\xff\xfe\xff\xfb\xff\xfe\xff$| p|Novell Netware/IP|
-match ntop-http m|^HTTP/1\.0 401 Unauthorized to access the document\nWWW-Authenticate: Basic realm=\"ntop HTTP server\"\n| p/Ntop web interface/
+match netwareip m|^\xfb\xff\xfe\xff\xfb\xff\xfe\xff\xfb\xff\xfe\xff$| p|Novell Netware/IP| o|NetWare|
 
 match omninames m|^GIOP\x01\0\x01\x06\0\0\0\0$| p/omniORB omniNames/ i/Corba naming service/
 # Oracle MTS Recovery Service 9.2.0.1 on Windows 2000 Professional
@@ -1474,16 +1568,16 @@ match postgresql m|^EFATAL:  invalid length of startup packet\n\0$| p/PostgreSQL
 match rendezvous m|^HTTP/1\.1 400 Bad Request\r\nDate: .*\r\nDAAP-Server: iTunes/(\d[-.\w]+) \((.*)\)\r\n| p/Apple iTunes/ v/$1/ i/on $2/
 
 match rtsp m|^RTSP/1.0 400 Bad Request\r\nServer: DSS/([-.\w]+) \[(v\d+)]-(\w+)\r\n| p/DarwinStreamingServer/ v/$1/ i/$2 on $3/
-match rtsp m|^RTSP/1\.0 400 Bad Request\r\nServer: QTSS/(\d[\d.]+ \[v\d+\]-Win32)\r\nCseq: \r\n| p/Apple QuickTime Streaming Server/ v/$1/ i/Win32/
+match rtsp m|^RTSP/1\.0 400 Bad Request\r\nServer: QTSS/(\d[\d.]+ \[v\d+\]-Win32)\r\nCseq: \r\n| p/Apple QuickTime Streaming Server/ v/$1/ o/Windows/
 match rtsp m|^RTSP/1\.0 400 Bad Request\r\nServer: QTSS/(\d[-.\w]+) \(Build/([\d.]+); Platform/([-.\w]+)\)\r\nCseq: \r\nConnection: Close\r\n\r\n$| p/Apple QuickTime Streaming Server/ v/$1 build $2/ i/$3/
-match rtsp m|^RTSP/1\.0 505 Protocol Version Not Supported\r\nDate: .*\r\nServer: WMServer/(\d[-.\w]+)\r\n\r\n$| p/Microsoft Windows Media Server/ v/$1/
+match rtsp m|^RTSP/1\.0 505 Protocol Version Not Supported\r\nDate: .*\r\nServer: WMServer/(\d[-.\w]+)\r\n\r\n$| p/Microsoft Windows Media Server/ v/$1/ o/Windows/
 
 match slimp3 m|^GET %2f HTTP%2f1\.0\n$| p|SliMP3 MP3 player| i|http://www.slimdevices.com|
 # spamd 2.20-1woody
 match spamd m|^SPAMD/1\.0 76 Bad header line: GET / HTTP/1\.0\r\r?\n| p/SpamAssassin spamd/
 # Windows XP 8/2003
-match upnp m|^HTTP/1.1 400 Bad Request\r\n\r\n$| p/Microsoft Windows UPnP/
-match upnp m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nConnection: close\r\nServer: Microsoft-Windows-NT/(\d[-.\w]+) UPnP/(\d[-.\w]+) UPnP-Device-Host/(\d[-.\w]+)\r\n| p/Microsoft UPnP/ v/$2/ i/WindowsNT Vers: $1; UPnP Device Host: $3/
+match upnp m|^HTTP/1.1 400 Bad Request\r\n\r\n$| p/Microsoft Windows UPnP/ o/Windows/
+match upnp m|^HTTP/1\.0 \d\d\d .*\r\nDate: .*\r\nConnection: close\r\nServer: Microsoft-Windows-NT/(\d[-.\w]+) UPnP/(\d[-.\w]+) UPnP-Device-Host/(\d[-.\w]+)\r\n| p/Microsoft UPnP/ v/$2/ i/UPnP Device Host: $3/ o/Windows NT $1/
 # UUCP 1.06.2 on Linux 2.4.X
 # Taylor UUCP 1.06.2 on Slackware
 match uucp m|^login: Password:$| p/Taylor uucpd/
@@ -1499,7 +1593,7 @@ match vnc-http m|^HTTP/1\.1 200 OK\r\nServer: RealVNC/(\d[-.\w]+)\r\n.*<APPLET C
 # RealVNC Unknown Version
 match vnc-http m|^HTTP/1\.0 200 OK\n\n<HTML><TITLE>VNC desktop</TITLE>\n<APPLET CODE=vncviewer\.class ARCHIVE=vncviewer\.jar WIDTH=(\d+) HEIGHT=(\d+)>\n<param name=PORT value=(\d+)></APPLET></HTML>\n| p/RealVNC/ i/Resolution $1x$2; VNC TCP port: $3/
 # TightVNC Server version 1.2.2 HTTP on Windows 2000 SP2
-match vnc-http m|^HTTP/1\.0 200 OK\n\n<HTML><TITLE>TightVNC desktop \[([-.\w]+)\]</TITLE>\n<APPLET CODE=vncviewer\.class ARCHIVE=vncviewer\.jar WIDTH=(\d+) HEIGHT=(\d+)>\n<param name=PORT value=(\d+)>| p/TightVNC/ v/1.2.2/ i/Host: $1; Resolution $2x$3; VNC TCP port: $4/
+match vnc-http m|^HTTP/1\.0 200 OK\n\n<HTML><TITLE>TightVNC desktop \[([-.\w]+)\]</TITLE>\n<APPLET CODE=vncviewer\.class ARCHIVE=vncviewer\.jar WIDTH=(\d+) HEIGHT=(\d+)>\n<param name=PORT value=(\d+)>| p/TightVNC/ v/1.2.2/ i/Resolution $2x$3; VNC TCP port: $4/ h/$1/
 # Tightvnc-1.2.3
 match vnc-http m|^HTTP/1\.0 404 Not found\n\n<HEAD><TITLE>File Not Found</TITLE></HEAD>\n<BODY><H1>File Not Found</H1></BODY>\n$| p/TightVNC/
 # Tightvnc 1.2.3
@@ -1526,7 +1620,7 @@ match vnc-http m|^HTTP/1\.0 200 OK\n.*<HTML><HEAD><TITLE>(.*)'s desktop</TITLE><
 
 match xml-rpc m|^HTTP/1\.0 400 Bad Request\r\nServer: Apache XML-RPC (\d[-.\w ]+)\r\n\r\nMethod GET not implemented \(try POST\)$| p/Apache XML-RPC/ v/$1/
 
-match wsmserver m|^Language received from client: GET\nSetlocale: C\n$| p/AIX Web-based System Manager/
+match wsmserver m|^Language received from client: GET\nSetlocale: C\n$| p/AIX Web-based System Manager/ o/AIX/
 match http m|^HTTP/1\.0\x20250\x20Ok\r\n.*\r\n\r\n.*<title>PowerMTA monitoring</title>|s p/Port25 PowerMTA web monitor/
 
 # Kerio MailServer 5.7.9, 5.7.10
@@ -1535,7 +1629,7 @@ match http m|^HTTP/1\.0\x20250\x20Ok\r\n.*\r\n\r\n.*<title>PowerMTA monitoring</
 # Dell OpenManage Version 3.5.0 on MS Windows 2000 server / PowerEdge 6400/700
 match http m|^HTTP/1\.1 200 OK\r\nConnection: Close\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n<html>\r\n    <head>\r\n        <script language=\"javascript\">\r\n\t\t\t\t\tif| p/Dell Openmanage Server Administrator/ i/PowerEdge/
 # ASPI server (www.aspi.cz) on Solaris 6666/tcp
-match aspi m|^HTTP/1\.0 404 Not Found\r\nDate: .*\r\nServer: ByllSoftware Gurda/([\d.]+)\r\n| p/ASPI server/ v/$1/
+match aspi m|^HTTP/1\.0 404 Not Found\r\nDate: .*\r\nServer: ByllSoftware Gurda/([\d.]+)\r\n| p/ASPI server/ v/$1/ o/Solaris/
 match sunscreen-adm m|^\x01\0\0\0\0\0\0\0T\x03\0\0\0\0\0\x01\x1e\0\0\0\0\0\0;\0\0\0\0\0\0\0\0Error: incompatible with administration server \(version (\d[-.\w ]*)\)\nc\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0$| p/SunScreen Remote Administration server/ v/$1/
 
 # PopChartServer
@@ -1547,11 +1641,11 @@ match http m|^HTTP/1\.0 200 OK\r\n.*Server: CordaServer \(PopChartServer compati
 
 ##############################NEXT PROBE##############################
 Probe TCP HTTPOptions q|OPTIONS / HTTP/1.0\r\n\r\n|
-ports 80,5232,6000
+ports 80,5232,6000,10000
 # IRIX 6.5.18f Distributed GL Daemon dgld
-match dgld m|^OPTI$| p/IRIX Distributed GL Daemon/
+match dgld m|^OPTI$| p/IRIX Distributed GL Daemon/ o/IRIX/
 # Webmaster Conferenceroom 1.8.9.1 IRC Server
-match irc m|^:[-.\w]+ 421 \* OPTIONS :Unknown command\r\n| p/Webmaster Conferenceroom IRC server/
+match irc m|(^:[-.\w]+) 421 \* OPTIONS :Unknown command\r\n| p/Webmaster Conferenceroom IRC server/ h/$1/
 #  cgi-httpd from shttpd-0.53 on FreeBSD
 match http m|^HTTP/1\.0 501 method not implemented\r\nServer: cgi-httpd\r\n| p/shttpd cgi-httpd/
 match http m|^HTTP/1\.1 \d\d\d .*\r\nServer: WebSphere Application Server/(.+)\r\n| p/IBM WebSphere Application Server/ v/$1/
@@ -1564,19 +1658,25 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nserver: BBC \d[-.\w]+; com\.hp\.openview\.C
 # HP JetDirect Card in a LaserJet printer
 match http-mgmt m|^HTTP/1\.1 501 Unknown or unimplemented http action\r\nMIME-Version: 1\.0\r\nServer: HP-ChaiServer/([\d.]+)\r\nContent-length: \d+\r\nContent-Type: text/html\r\n\r\n<TITLE>Request Not Implemented</TITLE><P><B>Cannot process request, not implemented at server\.</B></P><P>Unknown or unimplemented http action| p/HP JetDirect Card in a LaserJet printer/ i/HP-ChaiServer Embedded VM $1/ d/printer/
 
+# HP JetDirect Card in a LaserJet printer
+match http-mgmt m|^HTTP/1\.1 501 Unknown or unimplemented http action\r\nMIME-Version: 1\.0\r\nServer: HP-ChaiServer/([\d.]+)\r\nContent-length: \d+\r\nContent-Type: text/html\r\n\r\n<TITLE>Request Not Implemented</TITLE><P><B>Cannot process request, not implemented at server\.</B></P><P>Unknown or unimplemented http action| p/HP JetDirect Card in a LaserJet printer/ i/HP-ChaiServer Embedded VM $1/ d/printer/
+
 # Zero One Technology ( http://www.01tech.com/ ) print servers embedded HTTP service
-match http m|^HTTP/1\.\d\x20200\x20OK\r\nDate:\x20.*\r\nMIME-version:\x201\.\d\r\nServer:\x20ZOT-PS-(\d+)/(\d[-.\w]+)\r\n| p/Zero One Technology print server model $1 HTTP server/ v/$2/
+match http m|^HTTP/1\.\d\x20200\x20OK\r\nDate:\x20.*\r\nMIME-version:\x201\.\d\r\nServer:\x20ZOT-PS-(\d+)/(\d[-.\w]+)\r\n| p/Zero One Technology print server model $1 HTTP server/ v/$2/ d/print server/
 
 match kmldonkey m|^HTTP/1\.1 400 Bad Request\r\nServer: KMLDonkey/(\d\S+)| p/KMLDonkey/ v/$1/
 
+# webmin version 1.090 on Mandrake 8.2 - not sure why it's not picked up by the getreq probe
+match http m|^HTTP/1\.0 400 Bad Request\r\nServer: MiniServ/([\d.]+)\r\n.*\r\n<h1>Error - Bad Request</h1>\n|s p/webmin/ i|MiniServer/$1|
+
 ##############################NEXT PROBE##############################
 Probe TCP RTSPRequest q|OPTIONS / RTSP/1.0\r\n\r\n|
-match rtsp m|^RTSP/1\.0 200 OK\r\nCSeq: 0\r\nDate: .*\r\nServer: RealServer Version (\d[-.\w]+) \(win32\)\r\n| p/Realserver RTSP/ v/$1/ i/Win32/
-match rtsp m|^RTSP/1\.0 200 OK\r\n.*Server: RealMedia EncoderServer Version (\d[-.\w]+) \(win32\)\r\n|s p/RealMedia EncoderServer/ v/$1/ i/Win32/
+match rtsp m|^RTSP/1\.0 200 OK\r\nCSeq: 0\r\nDate: .*\r\nServer: RealServer Version (\d[-.\w]+) \(win32\)\r\n| p/Realserver RTSP/ v/$1/ o/Windows/
+match rtsp m|^RTSP/1\.0 200 OK\r\n.*Server: RealMedia EncoderServer Version (\d[-.\w]+) \(win32\)\r\n|s p/RealMedia EncoderServer/ v/$1/ o/Windows/
 match rtsp m|^RTSP/1\.0 200 OK\r\n.*Server: RealServer Version (\d[-.\w]+) \(([-.+\w]+)\)\r\n|s p/RealOne Server/ v/$1/ i/$2/
 # APC PowerChute Business Edition Agent 6.1.0.0 on Windows 2000 Server
-match powerchute m|^RTSP/1\.0 400 Bad request\r\nContent-type: text/html\r\n\r\n| p/APC PowerChute Agent/
-match msdtc m|^ERROR\n$|s p/Microsoft Distributed Transaction Coordinator/ i/error/
+match powerchute m|^RTSP/1\.0 400 Bad request\r\nContent-type: text/html\r\n\r\n| p/APC PowerChute Agent/ d/power device/
+match msdtc m|^ERROR\n$|s p/Microsoft Distributed Transaction Coordinator/ i/error/ o/Windows/
 
 # HP OpenView ITO agent (probably version 7.25) on Windows, port 383
 match http m|^HTTP/1\.1 \d\d\d .*\r\nserver: BBC \d[-.\w]+; com\.hp\.openview\.bbc\.LLBserver \d[-.\w]+\r\n\r\n|s p/HP OpenView ITO agent - LLB server/
@@ -1589,21 +1689,24 @@ match http m|^HTTP/1\.1 \d\d\d .*\r\nserver: BBC \d[-.\w]+; com\.hp\.openview\.b
 # hand, that would make the response a little harder to recognize too.
 ##############################NEXT PROBE##############################
 Probe TCP RPCCheck q|\x80\0\0\x28\x72\xFE\x1D\x13\0\0\0\0\0\0\0\x02\0\x01\x86\xA0\0\x01\x97\x7C\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|
-ports 81,111,199,514,544,1433,4045,32750-32810,38978
+ports 81,111,199,514,544,1433,4045,4999,32750-32810,38978
 # Microsoft SQLServer 6.5 on WinNT 4.0 SP6a
 # Microsoft SQL Server 6.5 on WinNT 4.0
-match ms-sql-s m|^\x04\x01\0C..\0\0\xaa\0\0\0/\x0f\xa2\x01\x0e.. Login failed\r\n\x14Microsoft SQL Server\0\0\0\xfd\0\xfd\0\0\0\0\0\x02$| p/Microsoft SQLServer/ v/6.5/
+match ms-sql-s m|^\x04\x01\0C..\0\0\xaa\0\0\0/\x0f\xa2\x01\x0e.. Login failed\r\n\x14Microsoft SQL Server\0\0\0\xfd\0\xfd\0\0\0\0\0\x02$| p/Microsoft SQLServer/ v/6.5/ o/Windows/
 match rpc m|^\x80\0\0\x18\x72\xFE\x1D\x13\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01|
 match rpc m|^\x80\0\0\x20\x72\xFE\x1D\x13\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x02|
 # Vmware ESX 1.5.x Client Agent for Linux -- WAIT - I think this is erronous and is actually smux
 # HP-UX 11 SNMP Unix Multiplexer (smux)
-match smux m|^A\x01\x02$| p/HP-UX smux/ i/SNMP Unix Multiplexer/
+match smux m|^A\x01\x02$| p/HP-UX smux/ i/SNMP Unix Multiplexer/ o/HP-UX/
 # Network Appliance ONTAP 6.3.3 shell
 match shell m|^\x01Permission denied\.\n$| p/Network Appliance Ontap rshd/
 # HP-UX 11 Kerberized 'rsh' (v5)
-match kshell m|^\x01remshd: connect: Connection refused\n$| p/HP-UX kerberized rsh/
+match kshell m|^\x01remshd: connect: Connection refused\n$| p/HP-UX kerberized rsh/ o/HP-UX/
 # Tumbleweed SecureTransport 4.1.1 Transaction Manager Non-Secure Port on Solaris
 match securetransport m|^\xde\xad\xbe\xef\x04\0\xff\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1fem\.requestparserparser\.InvError| p/Tumbleweed SecureTransport Transaction Manager Non-Secure Port/
+# ED2KLink Server v1.12 (Build 1014 or later)
+match ed2klink m|^\x16\x15\x16\x16\x16\x12XW\]$| p/ED2KLink Server/
+
 
 ##############################NEXT PROBE##############################
 Probe UDP RPCCheck q|\x72\xFE\x1D\x13\0\0\0\0\0\0\0\x02\0\x01\x86\xA0\0\x01\x97\x7C\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|
@@ -1634,12 +1737,16 @@ ports 53,2967
 # Allow 3-12 character version numbers
 match domain m|\x07version\x04bind.*[\x03-\x14]([-\w._ ]{3,20})$|s p/ISC Bind/ v/$1/
 match domain m|\x07version\x04bind.*[\x03-\x14]BIND ([-\w._]{3,20})$|s p/ISC Bind/ v/$1/
+# ISC Bind 9.1.3
+match domain m|\x07version\x04bind\0\0\x10\0\x03\xc0\x0c\0\x10\0\x03\0\0\0\0\0\x01\0| p/ISC Bind/ v/9.X/
 # Tinydns 1.05
 match domain m|^\0\x06\x81\x81\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03$| p/TinyDNS/
 # Microsoft DNS Windows 2000, SP4
-match domain m|^\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03$| p/Microsoft DNS/
+match domain m|^\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03$| p/Microsoft DNS/ o/Windows/
 # MyDNS 0.10.0 on Linux
 match domain m|^\0\x06\x81\x04\0\0\0\0\0\0\0\0$| p/MyDNS/
+# PowerDNS 2.9.11
+match domain m|\x07version\x04bind\0\0\x10\0\x03\xc0\x0c\0\x10\0\x01\0\0\0\x05\0UTServed by POWERDNS ([\d.]+) | p/PowerDNS/ v/$1/
 
 # Symantec Antivirus (rtvscan.exe)
 match symantec-av m|^\0\x06\x01\x01\0\x10..........$| p/Symantec rtvscan antivirus/
@@ -1647,18 +1754,22 @@ match symantec-av m|^\0\x06\x01\x01\0\x10..........$| p/Symantec rtvscan antivir
 # pdnsd 1.1.8b1
 match domain m|^\0\x06\x81\x84\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03$| p/pdnsd/
 
+match domain m|\x07version\x04bind\0\0\x10\0\x03\xc0\x0c\0\x10\0\x03\0\0\0\0\0\x1b\x1arbldnsd ([\d.]+) | p/rbldnsd/ v/$1/
+
 ##############################NEXT PROBE##############################
 Probe TCP DNSVersionBindReq q|\0\x1E\0\x06\x01\0\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03|
 ports 53,512,513,543,544,1521,2105,2967,6543
 match domain m|\x07version\x04bind.*[\x03-\x14]([-\w._ ]{3,20})$|s p/ISC Bind/ v/$1/
 match domain m|\x07version\x04bind.*[\x03-\x14]BIND ([-\w._]{3,20})$|s p/ISC Bind/ v/$1/
 # ISC Bind 9.1.3
-match domain m|\x07version\x04bind\0\0\x10\0\x03\xc0\x0c\0\x10\0\x03\0\0\0\0\0\x01\0| p/ISC Bind/
+match domain m|\x07version\x04bind\0\0\x10\0\x03\xc0\x0c\0\x10\0\x03\0\0\0\0\0\x01\0| p/ISC Bind/ v/9.X/
+# ISC BIND 8.2.7-REL
+match domain m|\x07version\x04bind\0\0\x10\0\x03\x07VERSION\x04BIND\0\0\x10\0\x03\0\0\0\0\0| p/ISC Bind/ v/8.X/
 # pdnsd 1.1.7a, 1.1.8b1
 # http://www.phys.uu.nl/~rombouts/pdnsd.html
 match domain m|^\0\x1e\0\x06\x81\x84\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03$| p/pdnsd/
 # Windows 2000 SP4
-match domain m|^\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03$| p/Microsoft DNS/
+match domain m|^\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03$| p/Microsoft DNS/ o/Windows/
 # Novell 5.1 DNS Server
 # Bind 4.9.7-REL on OpenBSD
 match domain m|^\0\x1e\0\x06\x81\x82\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03$| p/ISC Bind/ v/4.X/
@@ -1669,11 +1780,13 @@ match domain m|^\0.\0\x06\x85\0\0\x01\0\x01\0\0\0\0\x07version\x04bind\0\0\x10\0
 match domain m|^\0\x1e\0\x06\x81\x85\0\x01\0\0\0\0\0\0\x07version\x04bind\0\0\x10\0\x03$| p/Symantec Enterprise Firewall DNS proxy/
 match exec m|^\x01Login incorrect\.\n$|
 # HP-UX B.11.00 A
-match exec m|^\x01rexecd: Login incorrect.\n$| p/HP-UX rexecd/
-match exec m|^\x01rexecd: [-\d]+ The login is not correct\.\n| p/AIX rexecd/
+match exec m|^\x01rexecd: Login incorrect.\n$| p/HP-UX rexecd/ o/HP-UX/
+match exec m|^\x01rexecd: [-\d]+ The login is not correct\.\n| p/AIX rexecd/ o/AIX/
+# MyDNS 0.10.0 on Linux
+match domain m|^\0\x0c\0\x06\x81\x04\0\0\0\0\0\0\0\0$| p/MyDNS/
 
 # Digital UNIX V4.0F login
-match login m|^\x01Permission denied: Error 0$| p/Digital UNIX login/
+match login m|^\x01Permission denied: Error 0$| p/Digital UNIX login/ o/Digital UNIX/
 # RedHat 7.3 - Oracle TNS Listener Oracle 8.1.7
 # Oracle 8.1.6.1.0 on Linux 2.2.X
 match oracle-tns m|^\0\x1c\0\0\x04\x01\0\0\0X\0\0| p/Oracle TNS Listener/
@@ -1682,17 +1795,17 @@ match oracle-tns m|^\0\x1c\0\0\x04\x01\0\0\0X\0\0| p/Oracle TNS Listener/
 # Solaris 9
 match rlogin m|^\x01rlogind: Permission denied\.\r\n$|
 # HP-UX 11 Kerberized rlogin
-match klogin m|^\x01rlogind: Login Incorrect\.\r\n$| p/HP-UX kerberized rlogin/
+match klogin m|^\x01rlogind: Login Incorrect\.\r\n$| p/HP-UX kerberized rlogin/ o/HP-UX/
 # Solaris Kerberos authenticated login
-match klogin m|^\x01rlogind: Kerberos authentication failed\.\r\n| p/Solaris kerberized rlogin/
+match klogin m|^\x01rlogind: Kerberos authentication failed\.\r\n| p/Solaris kerberized rlogin/ o/Solaris/
 # Solaris Kerberos authenticated remote shell
-match kshell m|^\x01rshd: Authentication failed: Bad sendauth version was sent\n| p/Solaris kerberised rsh/
-match ssc-agent m|^\0\x1e\0\x06\0\t\0\0$| p/Novell Netware ssc-agent/
+match kshell m|^\x01rshd: Authentication failed: Bad sendauth version was sent\n| p/Solaris kerberised rsh/ o/Solaris/
+match ssc-agent m|^\0\x1e\0\x06\0\t\0\0$| p/Novell Netware ssc-agent/ o/NetWare/
 # http://www.apcupsd.com/ - apcupsd 3.8.5-1.3 on Linux 2.4.X
 match apcnisd m|^\0\x11Invalid command\n\0\0\0$| p/apcupsd/
 
-match klogin m|^\x01krlogind: Kerberos Authentication Failed\.\r\n\0| p/AIX kerberized rlogin/
-match kshell m|^\x01rshd: [-\d]+ The host name for your address is not known\.\n| p/AIX (kerberized?) rshd/
+match klogin m|^\x01krlogind: Kerberos Authentication Failed\.\r\n\0| p/AIX kerberized rlogin/ o/AIX/
+match kshell m|^\x01rshd: [-\d]+ The host name for your address is not known\.\n| p/AIX (kerberized?) rshd/ o/AIX/
 
 # 13724/tcp
 match vnetd m|^1\0$| p/Veritas Netbackup Network Utility/
@@ -1700,6 +1813,12 @@ match vnetd m|^1\0$| p/Veritas Netbackup Network Utility/
 # Sun Cobalt Adaptive Firewall 1.7-0
 match pafserver m|^\0&\xeb\xefTQM\xee\[B| p/Sun Cobalt Adaptive Firewall/ o/Sun Cobalt Linux/
 
+# RSA SecureID Ace Server 5
+match sdlog m|^\0\0\0\x01\0\x17\0\x14\0\x06\0\0\0\x01\0\0\0\0\0\0$| p/RSA SecureID Ace Server/
+
+# Sun Cobalt Adaptive Firewall 1.7-0
+match pafserver m|^\0&\xeb\xefTQM\xee\[B| p/Sun Cobalt Adaptive Firewall/ o/Sun Cobalt Linux/
+
 # DNS Server status request: http://www.crynwr.com/crynwr/rfc1035/rfc1035.html
 ##############################NEXT PROBE##############################
 Probe UDP DNSStatusRequest q|\0\0\x10\0\0\0\0\0\0\0\0\0|
@@ -1715,8 +1834,10 @@ ports 53,6050,41523
 match domain m|^\0\x0C\0\0\x90\x04\0\0\0\0\0\0\0\0|
 # ARCserve Client Agent v4.0d for Solaris 2.x(Running on SunOS 5.8Generic_108528-13 sun4u)
 match arcserve m|^\0\0s\0\0\0\0\0$| p/ARCserve Client Agent/ i/backup software/
+# ARCServe Win32 Client Agent v4.0
+match arcserve m|^h\0\0\0\0\0\0\0$| p/ARCserve Client Agent/ i/backup software/
 # ARCserver Client Agent Discovery service on W2K3
-match arcserve m|^([\w\d_-]+)\0$| p/ARCserve Discovery/ i/host: $1/
+match arcserve m|^([\w\d_-]+)\0$| p/ARCserve Discovery/ h/$1/
 
 
 ##############################NEXT PROBE##############################
@@ -1741,10 +1862,10 @@ ports 137
 
 # I'm not convinced that these next 4 work on a very wide variety of
 # machines.  I think most of the real matching comes in the next block.
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...(\w{1,15}) *\0\x04\0(\w{1,15}) *\0\x84\0\w{1,15} *\x03\x04\0\w{1,15} *\x04\0\w{1,15} *\x1e\x84\0\w{1,15} *\x1d\x04\0\x01\x02__MSBROWSE__\x02\x01\x84\0(\w{1,15}) *\x03|s p/Microsoft Windows XP netbios-ssn/ i/host: $1 workgroup: $2 user: $3/
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...(\w{1,15}) *\0\x04\0(\w{1,15}) *\0\x84\0\w{1,15} *\x03\x04\0\w{1,15} *\x04\0\w{1,15} *\x1e\x84\0\w{1,15} *\x1d\x04\0\x01\x02__MSBROWSE__\x02\x01\x84\0\0|s p/Microsoft Windows XP netbios-ssn/ i/host: $1 workgroup: $2/
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...(\w{1,15}) *\0\x04\0(\w{1,15}) *\0\x84\0\w{1,15} *\x03\x04\0\w{1,15} *\x04\0(\w{1,15}) *\x03\x04\0\w{1,15} *\x1e\x84\0|s p/Microsoft Windows XP netbios-ssn/ i/host: $1 workgroup: $2 user: $3/
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...(\w{1,15}) *\0\x04\0(\w{1,15}) *\0\x84\0\w{1,15} *\x03\x04\0\w{1,15} *\x04\0\w{1,15} *\x1e\x84\0|s p/Microsoft Windows XP netbios-ssn/ i/host: $1 workgroup: $2/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...(\w{1,15}) *\0\x04\0(\w{1,15}) *\0\x84\0\w{1,15} *\x03\x04\0\w{1,15} *\x04\0\w{1,15} *\x1e\x84\0\w{1,15} *\x1d\x04\0\x01\x02__MSBROWSE__\x02\x01\x84\0(\w{1,15}) *\x03|s p/Microsoft Windows XP netbios-ssn/ i/workgroup: $2 user: $3/ o/Windows XP/ h/$1/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...(\w{1,15}) *\0\x04\0(\w{1,15}) *\0\x84\0\w{1,15} *\x03\x04\0\w{1,15} *\x04\0\w{1,15} *\x1e\x84\0\w{1,15} *\x1d\x04\0\x01\x02__MSBROWSE__\x02\x01\x84\0\0|s p/Microsoft Windows XP netbios-ssn/ i/workgroup: $2/ o/Windows XP/ h/$1/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...(\w{1,15}) *\0\x04\0(\w{1,15}) *\0\x84\0\w{1,15} *\x03\x04\0\w{1,15} *\x04\0(\w{1,15}) *\x03\x04\0\w{1,15} *\x1e\x84\0|s p/Microsoft Windows XP netbios-ssn/ i/workgroup: $2 user: $3/ o/Windows XP/ h/$1/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...(\w{1,15}) *\0\x04\0(\w{1,15}) *\0\x84\0\w{1,15} *\x03\x04\0\w{1,15} *\x04\0\w{1,15} *\x1e\x84\0|s p/Microsoft Windows XP netbios-ssn/ i/workgroup: $2/ o/Windows XP/ h/$1/
 
 # It would be really nice if we could get username and/or OS
 # information from this.  But it is quite hard to parse out the proper
@@ -1753,16 +1874,16 @@ match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAA
 #
 # nbtstat
 #
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0\0..([\w\-]{1,15}) *\0D\0.*\0([\w\-]{1,15}) *\0\xc4\0|s p/Microsoft Windows netbios-ssn/ i/host: $1 workgroup: $2/
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0\0..([\w\-]{1,15}) *\0D\0([\w\-]{1,15}) *\0\xc4\0|s p/Microsoft Windows netbios-ssn/ i/host: $1 workgroup: $2/
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0\0...*\0([\w\-]{1,15}) *\0D\0.*\0([\w\-]{1,15}) *\0\xc4\0|s p/Microsoft Windows netbios-ssn/ i/host: $1 workgroup: $2/
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0\0...*\0([\w\-]{1,15}) *\0D\0([\w\-]{1,15}) *\0\xc4\0|s p/Microsoft Windows netbios-ssn/ i/host: $1 workgroup: $2/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0\0..([\w\-]{1,15}) *\0D\0.*\0([\w\-]{1,15}) *\0\xc4\0|s p/Microsoft Windows netbios-ssn/ i/workgroup: $2/ o/Windows/ h/$1/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0\0..([\w\-]{1,15}) *\0D\0([\w\-]{1,15}) *\0\xc4\0|s p/Microsoft Windows netbios-ssn/ i/workgroup: $2/ o/Windows/ h/$1/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0\0...*\0([\w\-]{1,15}) *\0D\0.*\0([\w\-]{1,15}) *\0\xc4\0|s p/Microsoft Windows netbios-ssn/ i/workgroup: $2/ o/Windows/ h/$1/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0\0...*\0([\w\-]{1,15}) *\0D\0([\w\-]{1,15}) *\0\xc4\0|s p/Microsoft Windows netbios-ssn/ i/workgroup: $2/ o/Windows/ h/$1/
 # Windows NT 4.0 SP6a
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...([\w\-]{1,15}).*\04\0([\w\-]{1,15}) *\0\x84\0|s p/Microsoft Windows NT netbios-ssn/ i/host: $1 workgroup: $2/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...([\w\-]{1,15}).*\04\0([\w\-]{1,15}) *\0\x84\0|s p/Microsoft Windows NT netbios-ssn/ i/workgroup: $2/ o/Windows NT/ h/$1/
 #
 # Samba has a version too
 # nmbd version 2.2.7 on Linux 2.4.20
-match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...([\w\-]{1,15}).*\x04\0([\w\-]{1,15}) *\x1e\x84\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|s p/Samba nmbd/ i/host: $1 workgroup: $2/
+match netbios-ns m|^\x80\xf0\x84\0\0\0\0\x01\0\0\0\0 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01\0\0\0\0...([\w\-]{1,15}).*\x04\0([\w\-]{1,15}) *\x1e\x84\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|s p/Samba nmbd/ i/workgroup: $2/ h/$1/
 
 ##############################NEXT PROBE##############################
 Probe UDP Help q|help\r\n\r\n|
@@ -1770,15 +1891,15 @@ ports 7,13,37
 match chargen m|@ABCDEFGHIJKLMNOPQRSTUVWXYZ|
 match echo m|^help\r\n\r\n$|
 # Solaris 8, 9
-match daytime m|^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} +\d\d:\d\d:\d\d 20\d\d\n\r| p/Sun Solaris daytime/
+match daytime m|^[A-Z][a-z]{2} [A-Z][a-z]{2} +\d{1,2} +\d\d:\d\d:\d\d 20\d\d\n\r| p/Sun Solaris daytime/ o/Solaris/
 # Mandrake Linux 9.2, xinetd daytime
 match daytime m|^[0-3]\d [A-Z][A-Z][A-Z] 20\d\d \d\d:\d\d:\d\d \S+\r\n|
 # Will last until 0xC5FFFFFF, in April 2005 - need to shift in advance.
 match time m|^[\xc0-\xc5]...$|
 # Solaris Internet Name Server (42/udp), see ien116.txt
-match nameserver m|^help\r\n\r\n\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01| p/Solaris Internet Name Server/ i/IEN 116/
-match nameserver m|^\x03\x03\x02$| p/Solaris Internet Name Server/ i/IEN 116/
-match nameserver m|^\0\x06\x01\0\0\x01\0\0\x03\x03\x02$| p/Solaris Internet Name Server/ i/IEN 116/
+match nameserver m|^help\r\n\r\n\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01| p/Solaris Internet Name Server/ i/IEN 116/ o/Solaris/
+match nameserver m|^\x03\x03\x02$| p/Solaris Internet Name Server/ i/IEN 116/ o/Solaris/
+match nameserver m|^\0\x06\x01\0\0\x01\0\0\x03\x03\x02$| p/Solaris Internet Name Server/ i/IEN 116/ o/Solaris/
 
 match http m|^HTTP/1\.0 \d{3} .*\r\nServer: CompaqHTTPServer/([.\w\d]+)\r\n|s p/Compaq Insight Manager HTTP server/ v/$1/
 
@@ -1791,33 +1912,36 @@ totalwaitms 7500
 # CVSD (cvs chrooting service for pserver) cvsd 0.9.18
 # CVS 1.11.5 pserver
 match cvspserver m|^cvs \[pserver aborted\]: bad auth protocol start: HELP\r\n\n$| p/cvs pserver/
+# CVSNT pserver
+match cvspserver m|^cvs \[server aborted\]: bad auth protocol start: HELP\r\n$| p/CVSNT pserver/
+match cvspserver m|^cvs \[server aborted\]: bad auth protocol start: HELP\r\nerror  \n$| p/CVSNT pserver/
 # Concurrent Versions System (CVS) 1.10.7 (client/server)
 match cvspserver m|^cvs-pserver \[pserver aborted\]: bad auth protocol start: HELP\r\n\n| p/cvs pserver/
 match echo m|^HELP\r\n$|
 # ProFTPD 1.2.5
-match ftp m|^220 [-.\w]+ FTP server ready\.\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n QUIT    REIN\*   PORT    PASV    TYPE    STRU    MODE    RETR    \r\n STOR    STOU\*   APPE    ALLO\*   REST    RNFR    RNTO    ABOR    \r\n DELE    MDTM    RMD     XRMD    MKD     XMKD    PWD     XPWD    \r\n SIZE    LIST    | p/ProFTPD/ v/1.2.5/
+match ftp m|^220 ([-.\w]+) FTP server ready\.\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n QUIT    REIN\*   PORT    PASV    TYPE    STRU    MODE    RETR    \r\n STOR    STOU\*   APPE    ALLO\*   REST    RNFR    RNTO    ABOR    \r\n DELE    MDTM    RMD     XRMD    MKD     XMKD    PWD     XPWD    \r\n SIZE    LIST    | p/ProFTPD/ v/1.2.5/ h/$1/ o/Unix/
 # ProFTPD 1.2.6
-match ftp m|^220 [-.\w]+ FTP server ready\.\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n214-USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n214-QUIT    REIN\*   PORT    PASV    EPRT    EPSV    TYPE    STRU    \r\n214-MODE    RETR    STOR    STOU    APPE    ALLO\*   REST    RNFR    \r\n214-RNTO    ABOR    DELE    MDTM    RMD     XRMD    MKD     XMKD| p/ProFTPD/ v/1.2.6/
-match ftp m|^220 ([-.\w]+ )?FTP [sS]erver ready\.?\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n214-USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n214-QUIT    REIN\*   PORT    PASV    EPRT    EPSV    TYPE    STRU    \r\n214-MODE    RETR    STOR    STOU    APPE    ALLO\*   REST    RNFR    \r\n214-RNTO    ABOR    DELE    MDTM    RMD     XRMD    MKD     XMKD| p/ProFTPD/ v/1.2.6/
+match ftp m|^220 ([-.\w]+) FTP server ready\.\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n214-USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n214-QUIT    REIN\*   PORT    PASV    EPRT    EPSV    TYPE    STRU    \r\n214-MODE    RETR    STOR    STOU    APPE    ALLO\*   REST    RNFR    \r\n214-RNTO    ABOR    DELE    MDTM    RMD     XRMD    MKD     XMKD| p/ProFTPD/ v/1.2.6/ h/$1/ o/Unix/
+match ftp m|^220 ([-.\w]+ )?FTP [sS]erver ready\.?\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n214-USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n214-QUIT    REIN\*   PORT    PASV    EPRT    EPSV    TYPE    STRU    \r\n214-MODE    RETR    STOR    STOU    APPE    ALLO\*   REST    RNFR    \r\n214-RNTO    ABOR    DELE    MDTM    RMD     XRMD    MKD     XMKD| p/ProFTPD/ v/1.2.6/ h/$1/ o/Unix/
 # ProFTPD 1.2.8
 # proftpd 1.2.9 rc1
-match ftp m@^220 .*\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n(214-| )USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n(214-| )QUIT    REIN\*   PORT    PASV    TYPE    STRU    MODE    RETR    \r\n(214-| )STOR    STOU    APPE    ALLO\*   REST    RNFR    RNTO    ABOR    \r\n(214-| )DELE    MDTM    RMD     XRMD    MKD     XMKD    PWD     XPWD    \r\n(214-| )SIZE@ p/ProFTPD/ v/1.2.8 - 1.2.9/
+match ftp m@^220 .*\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n(214-| )USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n(214-| )QUIT    REIN\*   PORT    PASV    TYPE    STRU    MODE    RETR    \r\n(214-| )STOR    STOU    APPE    ALLO\*   REST    RNFR    RNTO    ABOR    \r\n(214-| )DELE    MDTM    RMD     XRMD    MKD     XMKD    PWD     XPWD    \r\n(214-| )SIZE@ p/ProFTPD/ v/1.2.8 - 1.2.9/ o/Unix/
 # proftpd 1.2.9rc1 on linux 2.4.19
-match ftp m|220 localhost FTP server ready\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n214-USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n214-QUIT    REIN\*   PORT    PASV    TYPE    STRU    MODE    RETR    \r\n214-STOR    STOU    APPE    ALLO\*   REST    RNFR    RNTO    ABOR    \r\n214-DELE| p/ProFTPD/ v/1.2.9rc1/
+match ftp m|220 localhost FTP server ready\r\n214-The following commands are recognized \(\* =>'s unimplemented\)\.\r\n214-USER    PASS    ACCT\*   CWD     XCWD    CDUP    XCUP    SMNT\*   \r\n214-QUIT    REIN\*   PORT    PASV    TYPE    STRU    MODE    RETR    \r\n214-STOR    STOU    APPE    ALLO\*   REST    RNFR    RNTO    ABOR    \r\n214-DELE| p/ProFTPD/ v/1.2.9rc1/ o/Unix/
 # Solaris 8 ftpd
-match ftp m|^220 [-.+\w]+ FTP server \(.*\) ready\.\r\n214-The following commands are recognized:\r\n   USER    EPRT    STRU    MAIL\*   ALLO    CWD     STAT\*   XRMD \r\n   PASS    LPRT    MODE    MSND\*   REST\*   XCWD    HELP    PWD \r\n   ACCT\*   EPSV    RETR    MSOM\*   RNFR    LIST    NOOP    XPWD \r\n   REIN\*   LPSV    STOR    MSAM\*   RNTO    NLST    MKD     CDUP \r\n| p/Sun Solaris ftpd/
+match ftp m|^220 ([-.+\w]+) FTP server \(.*\) ready\.\r\n214-The following commands are recognized:\r\n   USER    EPRT    STRU    MAIL\*   ALLO    CWD     STAT\*   XRMD \r\n   PASS    LPRT    MODE    MSND\*   REST\*   XCWD    HELP    PWD \r\n   ACCT\*   EPSV    RETR    MSOM\*   RNFR    LIST    NOOP    XPWD \r\n   REIN\*   LPSV    STOR    MSAM\*   RNTO    NLST    MKD     CDUP \r\n| p/Sun Solaris ftpd/ h/$1/ o/Solaris/
 # Phaser860 printer
-match ftp m|^220 FTP server ready\.\r\n214- The following commands are recognized \(\* =>'s unimplemented\)\.\r\n   USER    PORT    STOR    MSAM\*   RNTO\*   NLST\*   MKD\*    CDUP\*   EPLF\*\r\n   PASS    PASV\*   APPE\*   MRSQ\*   ABOR    SITE\*   XMKD\*   XCUP\*\r\n   ACCT\*   TYPE    MLFL\*   MRCP\*   DELE    SYST    RMD\*    STOU \r\n   SMNT\*   STRU    MAIL\*   ALLO\*   CWD\*    STAT    XRMD\*   SIZE\*\r\n   REIN\*   MODE    MSND\*   REST\*   XC| p/Phaser printer ftpd/
+match ftp m|^220 FTP server ready\.\r\n214- The following commands are recognized \(\* =>'s unimplemented\)\.\r\n   USER    PORT    STOR    MSAM\*   RNTO\*   NLST\*   MKD\*    CDUP\*   EPLF\*\r\n   PASS    PASV\*   APPE\*   MRSQ\*   ABOR    SITE\*   XMKD\*   XCUP\*\r\n   ACCT\*   TYPE    MLFL\*   MRCP\*   DELE    SYST    RMD\*    STOU \r\n   SMNT\*   STRU    MAIL\*   ALLO\*   CWD\*    STAT    XRMD\*   SIZE\*\r\n   REIN\*   MODE    MSND\*   REST\*   XC| p/Phaser printer ftpd/ d/printer/
 # bsd-ftpd 0.3.3 (port of OpenBSD ftp server) on Linux 2.4.20
-match ftp m|^220 [-.\w]+ FTP server ready\.\r\n214- The following commands are recognized \(\* =>'s unimplemented\)\.\r\n   USER    PORT    TYPE    MLFL\*   MRCP\*   DELE    SYST    RMD     STOU \r\n   PASS    LPRT    STRU    MAIL\*   ALLO    CWD     STAT    XRMD    SIZE \r\n   ACCT\*   EPRT    MODE    MSND\*   REST    XCWD    HELP    PWD     MDTM \r\n   SMNT\*   PASV    RETR    MSOM\*   RNFR    LIST    NOOP    XPWD \r| p/bsd-ftpd/ i/available on Linux/
+match ftp m|^220 ([-.\w]+) FTP server ready\.\r\n214- The following commands are recognized \(\* =>'s unimplemented\)\.\r\n   USER    PORT    TYPE    MLFL\*   MRCP\*   DELE    SYST    RMD     STOU \r\n   PASS    LPRT    STRU    MAIL\*   ALLO    CWD     STAT    XRMD    SIZE \r\n   ACCT\*   EPRT    MODE    MSND\*   REST    XCWD    HELP    PWD     MDTM \r\n   SMNT\*   PASV    RETR    MSOM\*   RNFR    LIST    NOOP    XPWD \r| p/bsd-ftpd/ o/Linux/ h/$1/
 # Rhinosoft Serv-U FTP v.4.1 build 4.1.0.0 on Windows XP
 match ftp m|^220 .*\r\n214- The following commands are recognized \(\* => unimplemented\)\.\r\n   USER    PORT    RETR    ALLO    DELE    SITE    XMKD    CDUP    FEAT\r\n   PASS    PASV    STOR    REST    CWD     STAT    RMD     XCUP    OPTS\r\n   ACCT    TYPE    APPE    RNFR    XCWD    HELP    XRMD    STOU    AUTH\r\n   REIN    STRU    SMNT    RNTO    LIST    NOOP    PWD     SIZE    PBSZ\r\n| p/Rhinosoft Serv-U FTP/
 # pure-ftpd 1.0.12 on Linux 2.4
 match ftp m|^220[- ]FTP server ready\.\r\n.*214 Pure-FTPd - http://pureftpd\.org/?\r\n|s p/Pure-FTPd/
 # BulletProof FTP server 2.15 on Windows XP
-match ftp m|^220 .*\r\n530 Please login with USER and PASS first\.\r\n$| p/BulletProof FTPd/ i/Windows/
+match ftp m|^220 .*\r\n530 Please login with USER and PASS first\.\r\n$| p/BulletProof FTPd/ o/Windows/
 # SGI IRIX 6.5.18f ftpd
-match ftp m|^220 [-.\w]+ FTP server ready\.\r\n214- The following commands are recognized \(\* =>'s unimplemented\)\.\r\n   USER    PORT    STOR    MSAM\*   RNTO    NLST    MKD     CDUP \r\n   PASS    PASV    APPE    MRSQ\*   ABOR    SITE    XMKD    XCUP \r\n   ACCT\*   TYPE    MLFL\*   MRCP\*   DELE    SYST    RMD     STOU \r\n   SMNT\*   STRU    MAIL\*   ALLO    CWD     STAT    XRMD    SIZE \r\n   REIN\*   MODE    MSND\*   REST    XCWD    HELP    PWD     MDTM \r\n   QUIT    RETR    MSOM\*   RNFR    LIST    NOOP    XPWD \r\n214 Direct comments to | p/SGI IRIX ftpd/
+match ftp m|^220 ([-.\w]+) FTP server ready\.\r\n214- The following commands are recognized \(\* =>'s unimplemented\)\.\r\n   USER    PORT    STOR    MSAM\*   RNTO    NLST    MKD     CDUP \r\n   PASS    PASV    APPE    MRSQ\*   ABOR    SITE    XMKD    XCUP \r\n   ACCT\*   TYPE    MLFL\*   MRCP\*   DELE    SYST    RMD     STOU \r\n   SMNT\*   STRU    MAIL\*   ALLO    CWD     STAT    XRMD    SIZE \r\n   REIN\*   MODE    MSND\*   REST    XCWD    HELP    PWD     MDTM \r\n   QUIT    RETR    MSOM\*   RNFR    LIST    NOOP    XPWD \r\n214 Direct comments to | p/SGI IRIX ftpd/ h/$1/ o/IRIX/
 
 match finger m|^iFinger v(\d[-.\w]+)\n\n| p/IcculusFinger/ v/$1/
 
@@ -1825,33 +1949,37 @@ match ident m|^HELP : USERID : UNIX : trilluser\r\n$| p/Trillian identd/
 # Internet Rex v2.29
 match ident m|^\d+, \d+ : USERID : UNIX : [-.@\w]+\r\n| p/Internet Rex identd/
 # Symantec Enterprise Firewall 6.5.2 SMTP proxy on Windows 2000
-match smtp m|^220 [-.+\w]+ Generic SMTP handler\r\n214 Help not supported by this implementation\r\n$| p/Symantec Enterprise Firewall smtp proxy/
+match smtp m|^220 ([-.+\w]+) Generic SMTP handler\r\n214 Help not supported by this implementation\r\n$| p/Symantec Enterprise Firewall smtp proxy/ h/$1/
 # Lotus Notes Domino 6.1 smtp server on Win2K
-match smtp m|^220 Welcome to [-.+\w]+ ESMTP Server at .*\r\n214-Enter one of the following commands:\r\n214-HELO EHLO MAIL RCPT DATA RSET NOOP QUIT\r\n214 HELP VRFY EXPN STARTTLS \r\n$| p/Lotus Notes Domino smtpd/
+match smtp m|^220 Welcome to ([-.+\w]+) ESMTP Server at .*\r\n214-Enter one of the following commands:\r\n214-HELO EHLO MAIL RCPT DATA RSET NOOP QUIT\r\n214 HELP VRFY EXPN STARTTLS \r\n$| p/Lotus Notes Domino smtpd/ h/$1/
 match smtp m|^220.*?\n214-Commands supported:\r\n214-    HELO EHLO MAIL RCPT DATA(?: ETRN)?(?: AUTH)?\r\n214     NOOP QUIT RSET HELP \r\n$| p/Exim smtpd/ v/3.X/
 match smtp m|^220.*?ESMTP.*\n214-Commands supported:\r\n214 AUTH (?:STARTTLS )?HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP\r\n$| p/Exim smtpd/ v/4.X/
 
-match smtp m|^220[\s-]\S+ ESMTP ?\r\n214[- ]qmail home page: http://pobox.com/~djb/qmail.html| p/qmail smtpd/
-match smtp m|^220[\s-]\S+ ESMTP ?\r\n214[- ]qmail home page: http://pobox\.com/~djb/qmail\.html\r\n214[- ]qmail-ldap patch home page: http://www\.nrg4u\.com\r\n| p/qmail-ldap smtpd/
-match smtp m|^220[\s-].*?ESMTP\r\n214 netqmail home page: http://qmail\.org/netqmail\r\n| p/netqmail smtpd/ v/1.04/
+match smtp m|^220([\s-]\S+) ESMTP ?\r\n214[- ]qmail home page: http://pobox.com/~djb/qmail.html| p/qmail smtpd/ h/$1/ o/Unix/
+match smtp m|^220([\s-]\S+) ESMTP ?\r\n214[- ]qmail home page: http://pobox\.com/~djb/qmail\.html\r\n214[- ]qmail-ldap patch home page: http://www\.nrg4u\.com\r\n| p/qmail-ldap smtpd/ h/$1/ o/Unix/
+match smtp m|^220[\s-].*?ESMTP\r\n214 netqmail home page: http://qmail\.org/netqmail\r\n| p/netqmail smtpd/ v/1.04/ o/Unix/
 # VirusBuster MailShield for SMTP. Version 1.15.030 on Linux 2.4
-match smtp m|^220 [-.\w]+ SMTP version 1\.00;\r\n214 We strongly advise you to study of the RFC821\.\.\.\r\n$| p/VirusBuster MailShield for SMTP/
+match smtp m|^220 ([-.\w]+) SMTP version 1\.00;\r\n214 We strongly advise you to study of the RFC821\.\.\.\r\n$| p/VirusBuster MailShield for SMTP/ o/$1/
 # Postfix 1.1.12, 1.1.13, 2.0.9, 2.0.16
 match smtp m|^220 .*\r\n502 Error: command not implemented\r\n$| p/Postfix smtpd/
 # Courier ESMTP courier-0.42.0-1.7.3
-match smtp m|^220 [-.\w]+ ESMTP\r\n502 ESMTP command error\r\n$| p/Courier smtpd/
-match smtp m|214-2\.0\.0 This is sendmail version (\S+)\r?\n214-2\.0\.0 Topics:|s p/Sendmail/ v/$1/
-match smtp m|^220 \S+ E?SMTP Sendmail;| p/Sendmail/
-match smtp m|^220.* Sendmail (\d[-.\w]+) -- HELP not implemented\r\n|s p/Sendmail/ v/$1/
+match smtp m|^220 ([-.\w]+) ESMTP\r\n502 ESMTP command error\r\n$| p/Courier smtpd/ h/$1/
+match smtp m|214-2\.0\.0 This is sendmail version (\S+)\r?\n214-2\.0\.0 Topics:|s p/Sendmail/ v/$1/ o/Unix/
+match smtp m|^220(\S+) E?SMTP Sendmail;| p/Sendmail/ h/$1/ o/Unix/
+match smtp m|^220.* Sendmail (\d[-.\w]+) -- HELP not implemented\r\n|s p/Sendmail/ v/$1/ o/Unix/
 match smtp m|^220.*214-This is America Online mail version [vV](\S+)|s p/AOL smtpd/ v/$1/
 match smtp m|^220.*214 2\.0\.0 http://www\.google\.com/search.*RFC\+2821\s*\r?\n|s p/Google smtpd/
 match smtp m|^220.*214 SMTP server comments and bug reports to: \<zmhacks\@nic.funet.fi\>|s p/ZMailer smtpd/
 match smtp m|^220.*500 MessageWall: Unrecognized command|s p/MessageWall SMTP proxy/
 match smtp m|^220.*500 Unknown or unimplemented command|s p/MIMEsweeper SMTP proxy/
 match smtp m|^220.*214 See http\:\/\/www\.messagelabs\.com\/support|s p/MessageLabs smtpd/
-match smtp m|^220 \S+ ESMTP Service\r\n502 5\.3\.0 Sendmail Xserve -- HELP not implemented\r\n$| p/Xserve smtpd/
+match smtp m|^220(\S+) ESMTP Service\r\n502 5\.3\.0 Sendmail Xserve -- HELP not implemented\r\n$| p/Xserve smtpd/ h/$1/ o/Unix/
+# Doesn't look like we can always get the host from the following:
+match smtp m|^220 .*\r\n214-Commands Supported:\r\n214-HELO EHLO AUTH HELP QUIT MAIL NOOP RSET RCPT DATA ETRN VRFY STARTTLS\r\n214-Copyright \(c\) 1995-200\d, Stalker Software, Inc\.\r\n| p/Communigate Pro smtpd/
+match smtp m|^220 Jana-Server ESMTP Service ready\r\n214- Jana Server ([\w.]+)\r\n| p/Jana mail server/ v/$1/ o/Windows/
 
-match tcpmux m|^(sgi_[-.\w]+\r\n([-.\w]+\r\n)*)$| p/SGI IRIX tcpmux/ i/Available services: $SUBST(1, "\r\n", ",")/
+
+match tcpmux m|^(sgi_[-.\w]+\r\n([-.\w]+\r\n)*)$| p/SGI IRIX tcpmux/ i/Available services: $SUBST(1, "\r\n", ",")/ o/IRIX/
 # Written in 1986.  More info at 
 # http://ftp.rge.com/pub/X/X11R5/contrib/xwebster.README
 match webster m/^DICTIONARY server protocol:\r\n\r\nContact name is/ p/Webster dictionary server/
@@ -1859,20 +1987,23 @@ match webster m/^DICTIONARY server protocol:\r\n\r\nContact name is/ p/Webster d
 ##############################NEXT PROBE##############################
 Probe TCP SSLSessionReq q|\x16\x03\0\0S\x01\0\0O\x03\0?G\xd7\xf7\xba,\xee\xea\xb2`~\xf3\0\xfd\x82{\xb9\xd5\x96\xc8w\x9b\xe6\xc4\xdb<=\xdbo\xef\x10n\0\0(\0\x16\0\x13\0\x0a\0f\0\x05\0\x04\0e\0d\0c\0b\0a\0`\0\x15\0\x12\0\x09\0\x14\0\x11\0\x08\0\x06\0\x03\x01\0|
 ports 427,443,444,548,636,1241,1311,2000,8009
-# Apple Filing Protocol (AFP) over TCP on Mac OS X 10.1.5
-match afp m|^\x01\x03\0\0\xff\xff\xecQ\0\0\x01.\0\0\0\0\0.\0.\0.\0.\x80\xfb.([-.\w]+)[^-.\w].*\tMacintosh\x05\x06AFPX03\x06AFP2\.2\x0eAFPVersion 2\.1\x0eAFPVersion 2\.0\x0eAFPVersion 1\.1.\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 2.2; Mac OS X 10.1.*/
-match afp m|^\x01\x03\0\0\xff\xff\xecQ\0\0\x01.\0\0\0\0\0.\0.\0.\0.\x83\xfb.([-.\w]+)[^-.\w].*\tMacintosh\x06\x06AFP3\.1\x06AFPX03\x06AFP2\.2\x0eAFPVersion 2\.1\x0eAFPVersion 2\.0\x0eAFPVersion 1\.1\x04\tDHCAST128| p/Apple AFP/ i/name: $1; protocol 3.1; Mac OS X 10.2.*;/
+
+# Apple Filing Protocol (AFP) over TCP on Mac OS X
+match afp m|^\x01\x03\0\0\xff\xff\xecQ\0\0\x01.\0\0\0\0\0.\0.\0.\0.\x80\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x05\x06AFPX03\x06AFP2\.2\x0eAFPVersion 2\.1\x0eAFPVersion 2\.0\x0eAFPVersion 1\.1.\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 2.2; Mac OS X 10.1.*/
+match afp m|^\x01\x03\0\0\xff\xff\xecQ\0\0..\0\0\0\0\0.\0.\0.\0.\x83\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x06\x06AFP3\.1\x06AFPX03\x06AFP2\.2\x0eAFPVersion 2\.1\x0eAFPVersion 2\.0\x0eAFPVersion 1\.1.\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 3.1; Mac OS X 10.2.*;/
+match afp m|^\x01\x03\0\0\xff\xff\xecQ\0\0..\0\0\0\0\0.\0.\0.\0.\x83\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x03\x06AFP3\.1\x06AFPX03\x06AFP2\.2.\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 3.1; Mac OS X 10.3.*;/
+match afp m|^\x01\x03\0\0\xff\xff\xecQ\0\0..\0\0\0\0\0.\0.\0.\0.\x87\xfb.([^\0\x01]+)[\0\x01].*\tMacintosh\x04\x06AFP3\.2\x06AFP3\.1\x06AFPX03\x06AFP2\.2\x04\tDHCAST128|s p/Apple AFP/ i/name: $1; protocol 3.2; Max OS X 10.4.*;/
 # OpenSSL/0.9.7aa
 match ssl m|^\x16\x03\0\0J\x02\0\0F\x03\0| p/OpenSSL/
 # Microsoft-IIS/5.0 - note that OpenSSL must go above this one because this is more general
-match ssl m|^\x16\x03\0..\x02\0\0F\x03\0|s p/Microsoft IIS SSL/
+match ssl m|^\x16\x03\0..\x02\0\0F\x03\0|s p/Microsoft IIS SSL/ o/Windows/
 # Novell Netware 6 Enterprise Web server 5.1 https
 # Novell Netware Ldap over SSL or enterprise web server 5.1 over SSL
-match ssl m|^\x16\x03\0\0:\x02\0\x006\x03\0| p/Novell Netware SSL/
+match ssl m|^\x16\x03\0\0:\x02\0\x006\x03\0| p/Novell Netware SSL/ o/NetWare/
 # Cisco IDS 4.1 Appliance
-match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03\0\xd10:\xbd\\\x8e\xe3\x15\x1c\x0fZ\xe4\x04\x87\x07\xc0\x82\xa9\xd4\x0e\x9c1LXk\xd1\xd2\x0b\x1a\xc6/p\0\0\n\0\x16\x03\0\x026\x0b\0\x022\0| p/Cisco IDS SSL/
+match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03\0\xd10:\xbd\\\x8e\xe3\x15\x1c\x0fZ\xe4\x04\x87\x07\xc0\x82\xa9\xd4\x0e\x9c1LXk\xd1\xd2\x0b\x1a\xc6/p\0\0\n\0\x16\x03\0\x026\x0b\0\x022\0| p/Cisco IDS SSL/ d/fireall/
 # Nessus server sometimes gives this answer
-match ssl m|^\x15\x03\0\0\x02\x02\($| p/Nessus security scanner/
+match ssl m|^\x15\x03\0\0\x02\x02\($| p/Nessus security scanner/ 
 # Other Nessus instances look like this:
 match ssl m|^\x16\x03\x01\0J\x02\0\0F\x03\x01\?| p/Nessus security scanner/
 # PGP Corporation Keyserver Web Console 7.0 - custom Apache 1.3
@@ -1882,7 +2013,7 @@ match ssl m|^\x16\x03\0\0\+\x02\0\0'\x03\0...\?|s p/PGP Corporation product SSL/
 # RemotelyAnywhere
 match ssl m|^\x16\x03\0\0\*\x02\0\0&\x03\0\?|
 # Timbuktu Pro 6.0.3 on Mac OS X 10.2.6
-match svrloc m|^\x02\x02\0\0\x12\0\0\0\0\0\0\0\0\x02en\0\x02$| p/Apple slpd/
+match svrloc m|^\x02\x02\0\0\x12\0\0\0\0\0\0\0\0\x02en\0\x02$| p/Apple slpd/ o/Mac OS/
 # Tumbleweed SecureTransport 4.1.1 Transaction Manager Secure Port on Solaris
 # Dell Openmanage
 match ssl m|^\x15\x03[\x01\x00]\0\x02\x01\0$| p/multi-vendor SSL/
@@ -1892,23 +2023,26 @@ match ssl m|^\x15\x03[\x01\x00]\0\x02\x01\0$| p/multi-vendor SSL/
 Probe TCP SMBProgNeg q|\0\0\0\xa4\xff\x53\x4d\x42\x72\0\0\0\0\x08\x01\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\x06\0\0\x01\0\0\x81\0\x02PC NETWORK PROGRAM 1.0\0\x02MICROSOFT NETWORKS 1.03\0\x02MICROSOFT NETWORKS 3.0\0\x02LANMAN1.0\0\x02LM1.2X002\0\x02Samba\0\x02NT LANMAN 1.0\0\x02NT LM 0.12\0|
 ports 42,88,135,139,445,1031,1112,5555,5600,27000
 
-match flexlm m|^W.-60\0\0\0......\0\0.\0\0\0\0\0\0\0.\0\0\0.\0\0\0...\0...........\0\0\0\0\0\0|s p/FlexLM license manager/
+# I hate making it this general, but it seems like the only pattern
+# that matches everything. -Doug
+match flexlm m|^W.-60\0|s p/FlexLM license manager/
+
 # Windows 2000 Server Kerberos
 # Windows Server 2003 kerberos
-match kerberos-sec m/^\0\0\0\0$/ p/Microsoft Windows kerberos-sec/
+match kerberos-sec m/^\0\0\0\0$/ p/Microsoft Windows kerberos-sec/ o/Windows/
 # Windows XP SP1
-match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\n\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfd\xe3\0\0| p/Microsoft Windows XP microsoft-ds/
-match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\xfd\xf3\0\0| p/Microsoft Windows 2000 microsoft-ds/
+match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.\n\0\x01\0\x04\x11\0\0\0\0\x01\0\0\0\0\0\xfd\xe3\0\0| p/Microsoft Windows XP microsoft-ds/ o/Windows XP/
+match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\xfd\xf3\0\0| p/Microsoft Windows 2000 microsoft-ds/ o/Windows 2000/
 # Microsoft Windows 2003
-match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04.\0\0\0\0\x01\0\0\0\0\0\xfd\xf3\x01\0|s p/Microsoft Windows 2003 microsoft-ds/
+match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.2\0\x01\0\x04.\0\0\0\0\x01\0\0\0\0\0\xfd\xf3\x01\0|s p/Microsoft Windows 2003 microsoft-ds/ o/Windows 2003/
 # Microsoft Windows 2000 Server
 # Microsoft Windows 2000 Server SP4
-match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.[}2]\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\xfd[\xe3\xf3]\0\0|s p/Microsoft Windows 2000 microsoft-ds/
+match microsoft-ds m|^\0\0\0.\xffSMBr\0\0\0\0\x88\x01@\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.[}2]\0\x01\0\x04A\0\0\0\0\x01\0\0\0\0\0\xfd[\xe3\xf3]\0\0|s p/Microsoft Windows 2000 microsoft-ds/ o/Windows 2000/
 # Microsoft Windows XP SP1
 # Windows 2000
-match msrpc m|^\x05\0\r\x03\x10\0\0\0\x18\0\0\0\0\x08\x01@\x04\0\x01\x05\0\0\0\0$| p/Microsoft Windows RPC/
+match msrpc m|^\x05\0\r\x03\x10\0\0\0\x18\0\0\0\0\x08\x01@\x04\0\x01\x05\0\0\0\0$| p/Microsoft Windows RPC/ o/Windows/
 # Windows 2000 Advanced Server c:\winnt\system32\Mstask.exe
-match mstask m|^\x05\0\r\x03\x10\0\0\0\x18\0\0\0\0\x08\x01@\x04\0\x01\x05\0...|s p/Microsoft mstask/ i/task server - c:\winnt\system32\Mstask.exe/
+match mstask m|^\x05\0\r\x03\x10\0\0\0\x18\0\0\0\0\x08\x01@\x04\0\x01\x05\0...|s p/Microsoft mstask/ i/task server - c:\winnt\system32\Mstask.exe/ o/Windows/
 # Microsoft Windows 2000
 # samba-2.2.7-5.8.0 on RedHat 8
 # samba-2.2.7a-8.9.0 on Red Hat Linux 7.x
@@ -1919,23 +2053,23 @@ match netbios-ssn m+^\0\0\0.\xffSMBr\0\0\0\0\x88\x01.\0\0\0\0\0\0\0\0\0\0\0\0\0\
 # Samba 2.2.8a on Linux 2.4.20
 match netbios-ssn m|^\x83\0\0\x01\x81$| p/Samba smbd/
 # DAVE 4.1 enhanced windows networks services for Mac on Mac OS X
-match netbios-ssn m|^\0\0\0.\xffSMBr\x02\0Y\0\x98\x01.\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\0\x07\0|s p/Thursby DAVE Windows filesharing/ i/Runs on Macintosh systems/
+match netbios-ssn m|^\0\0\0.\xffSMBr\x02\0Y\0\x98\x01.\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\0\x07\0|s p/Thursby DAVE Windows filesharing/ i/Runs on Macintosh systems/ o/Mac OS/
 # Windows 98
-match netbios-ssn m|^\x83\0\0\x01\x8f$| p/Microsoft Windows 98 netbios-ssn/
+match netbios-ssn m|^\x83\0\0\x01\x8f$| p/Microsoft Windows 98 netbios-ssn/ o/Windows 98/
 # Netware might just be using Samba?
 match netbios-ssn m|^\0\0\0M\xffSMBr\0\0\0\0\x80\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0\x032\0\x01\0\xff\xff\0\0\0\0\x01\0| p/Netware 6 SMB Services/
 # Network Appliance ONTAP 6.3.3 netbios-ssn
 match netbios-ssn m/^\0\0\0.\xffSMBr\0\0\0\0\x98\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\x06\0\0\x01\0\x11\x07\0.*([^\0]|([^-A-Z0-9]\0))(([-\w]\0){2,50})/s p/Network Appliance Ontap smbd/ i/workgroup: $P(3)/
 # HP OpenView Storage Data Protector A.05.10 on Windows 2000
 # Hewlett Packard Omniback 4.1 on Windows NT
-match omniback m|^\0\0\0.\xff\xfe1\x005\0\0\0 \0\x07\0\x01\0\[\x001\x002\0:\x001\0\]\0\0\0 \0\x07\0\x02\0\[\x002\x000\x000\x003\0\]\0\0\0 |s p/HP OpenView Omniback/ i/Windows version/
+match omniback m|^\0\0\0.\xff\xfe1\x005\0\0\0 \0\x07\0\x01\0\[\x001\x002\0:\x001\0\]\0\0\0 \0\x07\0\x02\0\[\x002\x000\x000\x003\0\]\0\0\0 |s p/HP OpenView Omniback/ o/Windows/
 # HP OpenView Storage Data Protector A.05.10 on Linux
-match omniback m|^\0\0\0.15\0 \x07\x01\[12:1\]\0 \x07\x02\[2003\]\0 \x07\x0510\d+\0 INET\0 |s p|HP OpenView Omniback/Data Protector| i|UNIX version|
-match serversettingsd m|^\0\0\x004main\0\0\x01\0\0\0\0\x0c\0\0\0\0\0\0\0\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0quit\xff\xff\xff\xffcrpt$| p/Apple serversettingsd administration daemon/ i/Mac OS X/
+match omniback m|^\0\0\0.15\0 \x07\x01\[12:1\]\0 \x07\x02\[2003\]\0 \x07\x0510\d+\0 INET\0 |s p|HP OpenView Omniback/Data Protector| o|UNIX|
+match serversettingsd m|^\0\0\x004main\0\0\x01\0\0\0\0\x0c\0\0\0\0\0\0\0\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0quit\xff\xff\xff\xffcrpt$| p/Apple serversettingsd administration daemon/ o/Mac OS X/
 match symantec-esm m|^\0\x01#$| p/Symantec Enterprise Security Manager/
 # Windows 2000 Server Wins name resolution service
 # Windows NT 4.0 Wins
-match wins m|^\0\0\0\x1e\xffS\xad\x80\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\x07\xe9\0\0\0\x01\0\0\x81\0\x02| p/Microsoft Windows Wins/
+match wins m|^\0\0\0\x1e\xffS\xad\x80\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\x07\xe9\0\0\0\x01\0\0\x81\0\x02| p/Microsoft Windows Wins/ o/Windows/
 
 match sap-its m|^\0\0\0\x0c\x01\x03\0\0\0\0\x071\0\0\0\0\0\0\x071Content-Type:\x20\x20text/html;\x20charset=Windows-1250\r\n\r\n<!--\r\n\x20This\x20page\x20was\x20created\x20by\x20the\x20\r\n\x20SAP\x20Internet\x20Transaction\x20Server\x20\(ITS,\x20Version\x20,\x20Build\x20,\x20Virtual\x20Server\x20\)\r\n| p/SAP Internet Transaction Server/
 
@@ -1945,50 +2079,56 @@ Probe TCP X11Probe q|\x6C\0\x0B\0\0\0\0\0\0\0\0\0|
 ports 497,5302,6000-6020,7100,8000
 # retroclient 6.5.108 on Linux
 match dantzretrospect m|^\0\xca\0\0\0\0\0\x04\0\0\0\0\0\0\x02\($| p/Dantz Retrospect backup client/
-match font-service m|^\0\0\x02\0\0\0\0\0\0\0\0\0\x06\0\0\0\0@\x0c\0p\x17\0\0X Consortium\x01\n\x01\0\x05\0\0\0....\0\0..\0\0\0\0$|s p/Sun Solaris fs.auto/
-match font-service m|^\0\0\x02\0\0\0\0\0\0\0\0\0\x0e\0\0\0\0 \*\0.\x19\0\0The XFree86 Project[-.\w() ]+..\x01\n\x01\0\x05\0\0\0....\0\0..\0\0\0|s p/XFree86 X Font Server/
+match font-service m|^\0\0\x02\0\0\0\0\0\0\0\0\0\x06\0\0\0\0@\x0c\0p\x17\0\0X Consortium\x01\n\x01\0\x05\0\0\0....\0\0..\0\0\0\0$|s p/Sun Solaris fs.auto/ o/Solaris/
+match font-service m|^\0\0\x02\0\0\0\0\0\0\0\0\0\x0e\0\0\0\0 \*\0.\x19\0\0The XFree86 Project[-.\w() ]+..\x01\n\x01\0\x05\0\0\0....\0\0..\0\0\0|s p/XFree86 X Font Server/ o/Unix/
 match networkaudio m|^\0\x19\x02\0\x02\0\x07\0Protocol version mismatch\0\0\0\0\0\0\0$| p|Network Audio System|
 match networkaudio m|^\0\x19\x02\0\x02\0\x07\0Protocol version mismatch\0/\0\0\0\0\0$| p|Network Audio System|
 match X11 m|^\x01\0\x0b\0\0\0H\0\n\x19\0\0\0\0..\xff\xff\?\0\0\x01\0\0\x16\0\xff\xff\x01\x04\x01\x01  \x08.\0...Sun Microsystems, Inc\.\0\0\x01\x01|s p/XSun Solaris X11 server/
-match X11 m|^\0\x2D\x0B\0\0\0\x0C\0| i/access denied/
+match X11 m|^\0\x2D\x0B\0\0\0\x0C\0| i/access denied/ o/Solaris/
 # I think the below means access denied (no authentication protocol 
 # specified?) or is it a problem w/my probe that I should fix?
-match X11 m|^\0\x16\x0b\0\0\0\x06\0No protocol specified\x0a..$|s i/access denied/
-match X11 m|^\x01\0\x0b\0\0\0.\0...\x02\0\0.*The XFree86 Project, Inc|s p/XFree86/ i/open/
-match X11 m|^\x01\0\x0b\0\0\0.....\x02\0\0..\xff\xff\x1f\0\0\x01\0\0.\0\xff\xff\x01\x07\0\0  \x08\xff....Gentoo Linux \(XFree86 (\d[^)]+)\)\0\0|s p/XFree86/ v/$1/ i/Gentoo Linux/
-match X11 m|^\x01\0\x0b\0\0\0.....\x02\0\0..\xff\xff\x1f\0\0\x01\0\0\.\0\xff\xff\x01.*Mandrake Linux \(XFree86 (\d[^\)]+)\)\0\0|s p/XFree86/ v/$1/ i/Mandrake Linux/
-match X11 m|^\x01\0\x0b\0\0\0.....\x02\0\0..\xff\xff\x1f\0\0\x01\0\0.\0\xff\xff\x01.*Mandrake Linux \(XFree86 (\d[^\)]+)\)\0?\x01\x01|s p/XFree86/ v/$1/ i/Mandrake Linux/
+match X11 m|^\0\x16\x0b\0\0\0\x06\0No protocol specified\x0a..$|s i/access denied/ o/Unix/
+match X11 m|^\x01\0\x0b\0\0\0.\0....\0\0.*The XFree86 Project, Inc|s p/XFree86/ i/open/ o/Unix/
+match X11 m|^\x01\0\x0b\0\0\0.....\x02\0\0..\xff\xff\x1f\0\0\x01\0\0.\0\xff\xff\x01\x07\0\0  \x08\xff....Gentoo Linux \(XFree86 (\d[^)]+)\)\0\0|s p/XFree86/ v/$1/ i/Gentoo Linux/ o/Linux/
+match X11 m|^\x01\0\x0b\0\0\0.....\x02\0\0..\xff\xff\x1f\0\0\x01\0\0\.\0\xff\xff\x01.*Mandrake Linux \(XFree86 (\d[^\)]+)\)\0\0|s p/XFree86/ v/$1/ i/Mandrake Linux/ o/Linux/
+match X11 m|^\x01\0\x0b\0\0\0.....\x02\0\0..\xff\xff\x1f\0\0\x01\0\0.\0\xff\xff\x01.*Mandrake Linux \(XFree86 (\d[^\)]+)\)\0?\x01\x01|s p/XFree86/ v/$1/ i/Mandrake Linux/ o/Linux/
 match X11 m|^\x01\0\x0b\0\0\0\x4C\0\xA0\xE0\x63\x02\0\0| i/open/
 # StarNet X-Win32 v5.4 on Windows XP
-match X11 m|^\x01\0\x0b\0\0\x009\0..\0\0\0\0.\0\xff\xff\?\0\0\x01\0\0\x1c\0\xff\xff\x01\x07\x01\x01\x08\x10\x08....\0StarNet Communications Corp\.\x01\x01|s p/StarNet X-Win32/
-match X11 m|^\x01\0\x0b\0\0\0=\0\x01\0\0\0\0\0\xc0\x06\xff\xff\?.*\0DECWINDOWS Digital Equipment Corporation Digital UNIX V(\d[-.\w]+)\0\0\x01\x01|s p/Digital UNIX X-Window/ v/$1/ i/Version is X Server and not of Digital UNIX/
+match X11 m|^\x01\0\x0b\0\0\x009\0..\0\0\0\0.\0\xff\xff\?\0\0\x01\0\0\x1c\0\xff\xff\x01\x07\x01\x01\x08\x10\x08....\0StarNet Communications Corp\.\x01\x01|s p/StarNet X-Win32/ o/Windows/
+match X11 m|^\x01\0\x0b\0\0\0=\0\x01\0\0\0\0\0\xc0\x06\xff\xff\?.*\0DECWINDOWS Digital Equipment Corporation Digital UNIX V(\d[-.\w]+)\0\0\x01\x01|s p/Digital UNIX X-Window/ v/$1/ i/Version is X Server and not of Digital UNIX/ o/DIGITAL UNIX/
 # tightvnc 1.2.3 Xvnc
 # Tightvnc 3.3.3 Xvnc
 match X11 m|^\x01\0\x0b\0\0\0%\0\x04\r\0\0\0\0\x80.\xff\xff\?\0\0\x01\0\0\x1b\0\xff\xff\x01\x02\0\0  \x08\xff...\x08AT&T Laboratories Cambridge\0| p/Xvnc/
-# Exceed X server for Win32 8.0.0.0
-match X11 m|^\x01\0\x0b\0\0\x00.\0..\0\0\0\0@.\xff\xff\?\0\x01\0\0\0.\0\xff\xff\x01\x04\x01\x01\x08 \x08\xfe..A\0Hummingbird Ltd\.\x01\x01 \0.\x07\0\0\x08\x08 \0.\x07\0\0\x0c\x0c \0.\x07\0\0\x18  \0.\x07\0\0.\0\0\0 \0\0\0\xff\xff\xff\0\0\0\0| p/Hummingbird Exceed X server/ v/8.X/
-match X11 m|^\x01\0\x0b\0\0\0.\0..\0\0\0\0..\xff\xff\?\0\x01\0\0\0.\0\xff\xff\x01\x04\x01\x01\x08 \x08\xfe..A\0Hummingbird Communications Ltd\.\0\x01\x01 ...\0\0\x08\x08 ...\0\0\x0c\x0c ...\0\0\x18  ...\0\0.\0\0\0 \0\0\0\xff\xff\xff\0\0\0\0\0|s p/Hummingbird Exceed X server/ v/7.X/
+
+# Exceed X server for Win32
+match X11 m|^\x01\0\x0b\0\0\0.\0..\0\0\0\0..\xff\xff\?\0\x01\0\0\0.\0\xff\xff.\x04\x01\x01\x08 \x08\xfe...\0Hummingbird Ltd\.\x01\x01 \0..\0\0\x08\x08 \0..\0\0\x0c\x0c \0..\0\0\x18  \0..\0\0.\0\0\0|s p/Hummingbird Exceed X server/ v/8.X or 9.X/ o/Windows/
+match X11 m|^\x01\0\x0b\0\0\0.\0..\0\0\0\0..\xff\xff\?\0\x01\0\0\0.\0\xff\xff\x01\x04\x01\x01\x08 \x08\xfe...\0Hummingbird Communications Ltd\.\0\x01\x01 ...\0\0\x08\x08 ...\0\0\x0c\x0c ...\0\0\x18  ...\0\0.\0\0\0 \0\0\0\xff\xff\xff\0\0\0\0\0|s p/Hummingbird Exceed X server/ v/7.X/ o/Windows/
+match X11 m|^\x01\0\x0b\0\0.....\0\0\0\0..\xff\xff\?\0\x01\0\0\0.\0\xff\xff\x01.\x01\x01\x08 \x08\xfe...\0Hummingbird Communications Ltd\..\x01\x01|s p/Hummingbird Exceed X server/ v/6.X/ o/Windows/
+# General catch-alls
+match X11 m|^\x01\0\x0b\0\0.....\0\0\0\0..\xff\xff\?\0\x01\0\0..\0\xff\xff......\x08\xfe...\0Hummingbird Communications Ltd\.|s p/Hummingbird Exceed X server/ o/Windows/
+match X11 m|^\x01\0\x0b\0\0.....\0\0\0\0..\xff\xff\?\0\x01\0\0..\0\xff\xff......\x08\xfe...\0DECWINDOWS compatibility\. Hummingbird Communications Ltd\.|s p/Hummingbird Exceed X server/ i/DECWINDOWS compatibility/ o/Windows/
+
 # HP MC/ServiceGuard for Linux A.11.14.02
 match X11 m|^\0\0\0\x01\0\0\0\x0c\0\0\0\0$| p|HP MC/ServiceGuard|
 match X11 m|^\x01\0\x0b\0\0\0%\0\0\x19\0\0\0\0\0\x01\xff\xff\?\0\0\x01\0\0\x12\0\xff\xff\x01\x02\0\0  \x08\xfe\xba\x1dF\0Labtam Europe Ltd\.\0\0\x01\x01| p/Labtam X-WinPro/
 match omninames m|^GIOP\x01\0\x01\x06\0\0\0\0$| p/omniORB omniNames/ i/Corba naming service/
 
-match domain m|^\x80\xf0\x80\x12\0\x01\0\0\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01| p/Microsoft DNS/
+match domain m|^\x80\xf0\x80\x12\0\x01\0\0\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01| p/Microsoft DNS/ o/Windows/
 ##############################NEXT PROBE##############################
 # ftp://ftp.rfc-editor.org/in-notes/rfc1179.txt
 Probe TCP LPDString q|\x01default\n|
 ports 515
-match printer m|^\0$|
-match printer m|^default: unknown printer\n$| p/Solaris lpd/
+match printer m|^\0$| d/printer/
+match printer m|^default: unknown printer\n$| p/Solaris lpd/ d/printer/ o/Solaris/
 # Redhat Linux 7.3 LPRng-3.8.9
-match printer m|^\x01no connect permissions\n$| p/LPRng/
+match printer m|^\x01no connect permissions\n$| p/LPRng/ d/printer/
 # Microsoft Windows 2000 serverr LPD
-match printer m|^\x01\x01$| p/Microsoft lpd/
+match printer m|^\x01\x01$| p/Microsoft lpd/ d/printer/
 # Blackbox Terminal Server (IOLAN v4.03.00 a CDi)
 # Chase IOLAN terminal server lpd
 # Bay Networks MicroAnnex XL  Comm. Server R10.0
-match printer m|^\x01$|
-match printer m|^[-.\w]+: lpsched: unknown printer\n$| p/SGI IRIX lprsrv/
+match printer m|^\x01$| d/printer/
+match printer m|^[-.\w]+: lpsched: unknown printer\n$| p/SGI IRIX lprsrv/ d/printer/ o/IRIX/
 
 # Ldap bind request, version 2, null DN, AUTH_TYPE simple, null password
 ##############################NEXT PROBE##############################
@@ -1996,8 +2136,8 @@ Probe TCP LDAPBindReq q|\x30\x0c\x02\x01\x01\x60\x07\x02\x01\x02\x04\0\x80\0|
 ports 256,257,389,3892
 sslports 636,637
 
-match fw1-secureremote m|^[AQ]\0\0\0\0\0\0[^\0]| p/Checkpoint Firewall1 SecureRemote/
-match fw1-log m|^\0\0\0\t51000000\0\0\0\0[^\0]| p/Checkpoint Firewall1 logging service/
+match fw1-secureremote m|^[AQ]\0\0\0\0\0\0[^\0]| p/Checkpoint Firewall1 SecureRemote/ d/firewall/
+match fw1-log m|^\0\0\0\t51000000\0\0\0\0[^\0]| p/Checkpoint Firewall1 logging service/ d/firewall/
 # OpenLDAP 2.0.15 on RH Linux 7.3
 match ldap m|^0%\x02\x01\x01a \n\x010\x04\0\x04\x19anonymous bind disallowed$| p/OpenLDAP/ i/access denied/
 # OpenLDAP 2.1.22 - doesn't by default allow LDAPv2 request
@@ -2007,7 +2147,7 @@ match ldap m|^02\x02\x01\x01a-\n\x01\x02\x04\0\x04&requested protocol version no
 # Win 2000 Advanced server.
 match ldap m|^0\x0c\x02\x01\x01a\x07\n\x01\0\x04\0\x04\0| i/Anonymous bind OK/
 # MS Windows Win2K SP4 AD server
-match ldap m|^0\x84\0\0\0\x10\x02\x01\x01a\x84\0\0\0\x07\n\x01\0\x04\0\x04\0$| p/Microsoft LDAP server/
+match ldap m|^0\x84\0\0\0\x10\x02\x01\x01a\x84\0\0\0\x07\n\x01\0\x04\0\x04\0$| p/Microsoft LDAP server/ o/Windows/
 # PGP Corporation PGP Keyserver 7.0 (relabeled Freeware PGP Keyserver 2.5.8)
 #  PGP LDAP Server 8.x
 match ldap m|^0\x17\x02\x01\x01a\x12\n\x01\0\x04\0\x04\x0bPGPError #0$| p/PGP Corp. PGP Keyserver/
@@ -2018,32 +2158,38 @@ match ldap m|^0\.\x02\x01\x01a\)\n\x010\x04\0\x04\"Failed, anonymous bind not al
 
 ##############################NEXT PROBE##############################
 Probe TCP LANDesk-RC q|\x54\x4e\x4d\x50\x04\0\0\0\x54\x4e\x4d\x45\0\0\x04\0|
-ports 1761
+ports 1761-1763
 # With Host and User currently logged in
-match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x08\x04\0\x08\0.{9}\0R\0\x03\0W\0\xff\xff\0.\0\xfd..\0\0\0\0\x02\0\0\0\0\x01\x04\0\0\0\0\0...\0\xb5\x01\xbb\0Desktop Manager (\d\.\d)\0\x02\x04\x01\x02\x01\0\0\W+([-\w]+)\0([-\w]+)\0\0$| p/LANDesk RC/ v/$1/ i/Host: $2 User: $3)/
+match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x08\x04\0\x08\0.{9}\0R\0\x03\0W\0\xff\xff\0.\0\xfd..\0\0\0\0\x02\0\0\0\0\x01\x04\0\0\0\0\0...\0\xb5\x01\xbb\0Desktop Manager (\d\.\d)\0\x02\x04\x01\x02\x01\0\0\W+([-\w]+)\0([-\w]+)\0\0$| p/LANDesk RC/ v/$1/ i/User: $3)/ h/$2/
 # With just hostname
-match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x08\x04\0\x08\0.{9}\0R\0\x03\0W\0\xff\xff\0.\0\xfd..\0\0\0\0\x02\0\0\0\0\x01\x04\0\0\0\0\0...\0\xb5\x01\xbb\0Desktop Manager (\d\.\d)\0\x02\x04\x01\x02\x01\0\0\W+(\w+)\0\0\0$| p/LANDesk RC/ v/$1/ i/Host: $2/
+match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x08\x04\0\x08\0.{9}\0R\0\x03\0W\0\xff\xff\0.\0\xfd..\0\0\0\0\x02\0\0\0\0\x01\x04\0\0\0\0\0...\0\xb5\x01\xbb\0Desktop Manager (\d\.\d)\0\x02\x04\x01\x02\x01\0\0\W+(\w+)\0\0\0$| p/LANDesk RC/ v/$1/ h/$2/
 # Being Controled w/ User
-match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x08\x04\0\x08\0.{9}\0R\0\x03\0W\0\xff\xff\0.\0\xfd..\0\0\0\0\x02\0\0\0\0\x01\x04\0\0\0\0\0...\0\xb5\x01\xbb\0Desktop Manager (\d\.\d)\0\x02\x04\x01\x02\x01\0\0\W+([\w.:]+)\W+(\w+)\0(\w+)\0\0$| p/LANDesk RC/ v/$1/ i/Host: $3 User: $4 Controler: $2/
+match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x08\x04\0\x08\0.{9}\0R\0\x03\0W\0\xff\xff\0.\0\xfd..\0\0\0\0\x02\0\0\0\0\x01\x04\0\0\0\0\0...\0\xb5\x01\xbb\0Desktop Manager (\d\.\d)\0\x02\x04\x01\x02\x01\0\0\W+([\w.:]+)\W+(\w+)\0(\w+)\0\0$| p/LANDesk RC/ v/$1/ i/User: $4 Controler: $2/ h/$3/
 # Being Controled w/o User
 #match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x08\x04\0\x08\0.{9}\0R\0\x03\0W\0\xff\xff\0.\0\xfd..\0\0\0\0\x02\0\0\0\0\x01\x04\0\0\0\0\0...\0\xb5\x01\xbb\0Desktop Manager (\d\.\d)\0\x02\x04\x01\x02\x01\0\0\W+([\w.:]+)\W+(\w+)\0(\w+)\0{2,3}$| v/LANDesk RC/$1/Host: $3 Controler: $2/
-match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x08\x04\0\x08\0.{9}\0R\0\x03\0W\0\xff\xff\0.\0\xfd..\0\0\0\0\x02\0\0\0\0\x01\x04\0\0\0\0\0...\0\xb5\x01\xbb\0Desktop Manager (\d\.\d)\0\x02\x04\x01\x02\x01\0\0\W+([\w.:]+)\W+(\w+)\0|s p/LANDesk RC/ v/$1/ i/Host: $3 Controler: $2/
+match landesk-rc m|^TNMP.\0\0\0TNME.\0\0\0USER.\x08\x04\0\x08\0.{9}\0R\0\x03\0W\0\xff\xff\0.\0\xfd..\0\0\0\0\x02\0\0\0\0\x01\x04\0\0\0\0\0...\0\xb5\x01\xbb\0Desktop Manager (\d\.\d)\0\x02\x04\x01\x02\x01\0\0\W+([\w.:]+)\W+(\w+)\0|s p/LANDesk RC/ v/$1/ i/Controler: $2/ h/$3/
 
 match landesk-rc m|^TNMP\x16\0\0\0TNME\x80\0\xfe\xff..([\w.]+):(\d)$| p/LANDesk RC/ i/Busy, From $1 on port 176$2/
 
+# Novell Zen Remote Desktop Several 4.0.X submissions
+match landesk-rc m|^\0\x04\0| p/Novell Zen Remote Desktop/ v/4.0.X/
+# 6.5.14
+match landesk-rc m|^\0\x06\x05| p/Novell Zen Remote Desktop/ v/6.5.X/
+
+
 ##############################NEXT PROBE##############################
 Probe TCP TerminalServer q|\x03\0\0\x0b\x06\xe0\0\0\0\0\0|
 ports 515,3389
 # \x03 is queue status command for LPD service.  Should be terminated
 # by \n, but apparently some dumb lpds allow \0.  For now I will keep
 # 515 in the common ports line, I suppose
-match printer m/^no entries\n$/ p/Xerox LPD/
+match printer m/^no entries\n$/ p/Xerox LPD/ d/printer/
 # Windows 2000 Server
 # Windows 2000 Advanced Server
 # Windows XP Professional
-match microsoft-rdp m|^\x03\0\0\x0b\x06\xd0\0\0\x12.\0$|s p|Microsoft Terminal Service|
-match microsoft-rdp m|^\x03\0\0\x17\x08\x02\0\0Z~\0\x0b\x05\x05@\x06\0\x08\x91J\0\x02X$| p/Microsoft Terminal Service/ i/Used with Netmeeting, Remote Desktop, Remote Assistance/
-match teleconference m|^\x03\0\0\x11\x08\x02..}\x08\x03\0\0\xdf\x14\x01\x01$|s p/Microsoft NetMeeting Remote Desktop Service/
+match microsoft-rdp m|^\x03\0\0\x0b\x06\xd0\0\0\x12.\0$|s p|Microsoft Terminal Service| o|Windows|
+match microsoft-rdp m|^\x03\0\0\x17\x08\x02\0\0Z~\0\x0b\x05\x05@\x06\0\x08\x91J\0\x02X$| p/Microsoft Terminal Service/ i/Used with Netmeeting, Remote Desktop, Remote Assistance/ o/Windows/
+match teleconference m|^\x03\0\0\x11\x08\x02..}\x08\x03\0\0\xdf\x14\x01\x01$|s p/Microsoft NetMeeting Remote Desktop Service/ o/Windows/
 
 # Netware Create Connection Service request
 ##############################NEXT PROBE##############################
@@ -2051,7 +2197,7 @@ Probe TCP NCP q|\x44\x6d\x64\x54\0\0\0\x17\0\0\0\x01\0\0\0\0\x11\x11\0\xff\x01\x
 ports 524
 # Netware 5 and 6
 # NCP "OK" reply
-match ncp m|^\x74\x4e\x63\x50\0\0\0\x10\x33\x33| p/Novell Netware NCP/
+match ncp m|^\x74\x4e\x63\x50\0\0\0\x10\x33\x33| p/Novell Netware NCP/ o/NetWare/
 
 ##############################NEXT PROBE##############################
 Probe TCP NotesRPC q|\x3A\x00\x00\x00\x2F\x00\x00\x00\x02\x00\x00\x40\x02\x0F\x00\x01\x00\x3D\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2F\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x1F\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00|
@@ -2078,8 +2224,8 @@ match jrmi m|^N..[0-9.]+\0\0..$| p/Java RMI/
 ##############################NEXT PROBE##############################
 Probe UDP Sqlping q|\x02|
 ports 1434
-match ms-sql-m m|^\x05..ServerName;([\w\-]+);InstanceName;[\w\-]+;IsClustered;\w{2,3};Version;([\d\.]+);np;.+;tcp;(\d{1,5});| p/Microsoft SQL Server/ v/$2/ i/ServerName: $1; TCPPort: $3/
-match ms-sql-m m|^\x05..ServerName;([\w\-]+);InstanceName;[\w\-]+;IsClustered;\w{2,3};Version;([\d\.]+);tcp;(\d{1,5});np;(.+);$| p/Microsoft SQL Server/ v/$2/ i/ServerName: $1; TCPPort: $3/
+match ms-sql-m m|^\x05..ServerName;([\w\-]+);InstanceName;[\w\-]+;IsClustered;\w{2,3};Version;([\d\.]+);np;.+;tcp;(\d{1,5});| p/Microsoft SQL Server/ v/$2/ i/ServerName: $1; TCPPort: $3/ o/Windows/
+match ms-sql-m m|^\x05..ServerName;([\w\-]+);InstanceName;[\w\-]+;IsClustered;\w{2,3};Version;([\d\.]+);tcp;(\d{1,5});np;(.+);$| p/Microsoft SQL Server/ v/$2/ i/ServerName: $1; TCPPort: $3/ o/Windows/
 
 ##############################NEXT PROBE##############################
 Probe UDP NTPRequest q|\xe3\x00\x04\xfa\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc5\x4f\x23\x4b\x71\xb1\x52\xf3|
@@ -2088,7 +2234,7 @@ match ntp m|^\$[\x01-\x0f]..............................................$|s p/NT
 match ntp m|^\xe4\0..............................................$|s p/NTP/ v/v4/ i/unsynchronized/
 match ntp m|^\x1c[\x01-\x0f]..............................................$|s p/NTP/ v/v3/
 # Solaris Internet Name Server (42/udp), see ien116.txt
-match nameserver m|^help\r\n\r\n\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01| p/Solaris Internet Name Server/ i/IEN 116/
+match nameserver m|^help\r\n\r\n\0\0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01| p/Solaris Internet Name Server/ i/IEN 116/ o/Solaris/
 
 ##############################NEXT PROBE##############################
 Probe UDP SNMPv1public q|0\x82\0/\x02\x01\0\x04\x06public\xa0\x82\0\x20\x02\x04\x4c\x33\xa7\x56\x02\x01\0\x02\x01\0\x30\x82\0\x10\x30\x82\0\x0c\x06\x08\x2b\x06\x01\x02\x01\x01\x05\0\x05\0|
@@ -2100,8 +2246,8 @@ Probe TCP WMSRequest q|\x01\0\0\xfd\xce\xfa\x0b\xb0\xa0\0\0\0MMS\x14\0\0\0\0\0\0
 ports 1549,1755
 match shivahose m|^\x02\x06$| i/Shiva network modem access/
 #WMS 4.1.0.3927
-match wms m|^\x01\0\0.\xce\xfa\x0b\xb0.\0\0\0MMS .\0{7}.{9}\0\0\0\x01\0\x04\0\0\0\0\0\xf0\xf0\xf0\xf0\x0b\0\x04\0\x1c\0\x03\0\0\0\0\0\0\0\xf0\?\x01\0\0\0\x01\0\0\0\0\x80\0\0...\0.\0\0\0\0\0\0\0\0\0\0\0.\0\0\x00(\d)\0\.\x00(\d)\0\.\x00(\d)\0\.\x00(\d)\x00(\d)\x00(\d)\x00(\d)\0\0\0|s p/Microsoft Windows Media Service/ v/$1.$2.$3.$4$5$6$7/
-match wms m|^\x01\0\0.\xce\xfa\x0b\xb0.\0\0\0MMS .\0{7}.{9}\0\0\0\x01\0\x04\0\0\0\0\0\xf0\xf0\xf0\xf0\x0b\0\x04\0\x1c\0\x03\0\0\0\0\0\0\0\xf0\?\x01\0\0\0\x01\0\0\0\0\x80\0\0...\0.\0\0\0\0\0\0\0\0\0\0\0.\0\0\x00(\d)\0\.\x00(\d)\x00(\d)\0\.\x00(\d)\x00(\d)\0\.\x00(\d)\x00(\d)\x00(\d)\x00(\d)\0\0\0|s p/Microsoft Windows Media Service/ v/$1.$2$3.$4$5.$6$7$8$9/
+match wms m|^\x01\0\0.\xce\xfa\x0b\xb0.\0\0\0MMS .\0{7}.{9}\0\0\0\x01\0\x04\0\0\0\0\0\xf0\xf0\xf0\xf0\x0b\0\x04\0\x1c\0\x03\0\0\0\0\0\0\0\xf0\?\x01\0\0\0\x01\0\0\0\0\x80\0\0...\0.\0\0\0\0\0\0\0\0\0\0\0.\0\0\x00(\d)\0\.\x00(\d)\0\.\x00(\d)\0\.\x00(\d)\x00(\d)\x00(\d)\x00(\d)\0\0\0|s p/Microsoft Windows Media Service/ v/$1.$2.$3.$4$5$6$7/ o/Windows/
+match wms m|^\x01\0\0.\xce\xfa\x0b\xb0.\0\0\0MMS .\0{7}.{9}\0\0\0\x01\0\x04\0\0\0\0\0\xf0\xf0\xf0\xf0\x0b\0\x04\0\x1c\0\x03\0\0\0\0\0\0\0\xf0\?\x01\0\0\0\x01\0\0\0\0\x80\0\0...\0.\0\0\0\0\0\0\0\0\0\0\0.\0\0\x00(\d)\0\.\x00(\d)\x00(\d)\0\.\x00(\d)\x00(\d)\0\.\x00(\d)\x00(\d)\x00(\d)\x00(\d)\0\0\0|s p/Microsoft Windows Media Service/ v/$1.$2$3.$4$5.$6$7$8$9/ o/Windows/
 
 ##############################NEXT PROBE##############################
 Probe TCP oracle-tns q|\0Z\0\0\x01\0\0\0\x016\x01,\0\0\x08\0\x7F\xFF\x7F\x08\0\0\0\x01\0 \0:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\04\xE6\0\0\0\x01\0\0\0\0\0\0\0\0(CONNECT_DATA=(COMMAND=version))|
@@ -2111,8 +2257,8 @@ match oracle-tns m|^\0.\0\0\x02\0\0\0.*TNSLSNR for ([-.+/ \w]{2,20}): Version ([
 ##############################NEXT PROBE##############################
 Probe UDP xdmcp q|\0\x01\0\x02\0\x01\0\0|
 ports 177
-match xdmcp m/^\0\x01\0\x05..\0\0\0.(.+)\0.(.+)/ p/XDMCP/ v/host $1 willing/ i/Status: $2/
-match xdmcp m/^\0\x01\0\x06..\0.(.+)\0.(.+)/ p/XDMCP/ v/host $1 unwilling/ i/Status: $2/
+match xdmcp m/^\0\x01\0\x05..\0\0\0.(.+)\0.(.+)/ p/XDMCP/ v/host $1 willing/ i/Status: $2/ o/Unix/
+match xdmcp m/^\0\x01\0\x06..\0.(.+)\0.(.+)/ p/XDMCP/ v/host $1 unwilling/ i/Status: $2/ o/Unix/
 
 ##############################NEXT PROBE##############################
 # AFS version probing
diff --git a/nmap.cc b/nmap.cc
index 581675456..fa3acaa9d 100644
--- a/nmap.cc
+++ b/nmap.cc
@@ -275,6 +275,8 @@ int nmap_main(int argc, char *argv[]) {
       {"version_trace", no_argument, 0, 0}, /* Display -sV related activity */
       {"fuzzy", no_argument, 0, 0}, /* Alias for osscan_guess */
       {"data_length", required_argument, 0, 0},
+      {"send_eth", no_argument, 0, 0},
+      {"send_ip", no_argument, 0, 0},
       {"stylesheet", required_argument, 0, 0},
       {"no-stylesheet", no_argument, 0, 0},
       {"rH", no_argument, 0, 0},
@@ -444,6 +446,10 @@ int nmap_main(int argc, char *argv[]) {
 	  o.extra_payload = (char *) safe_malloc(o.extra_payload_length);
 	  get_random_bytes(o.extra_payload, o.extra_payload_length);
 	}
+      } else if (strcmp(long_options[option_index].name, "send_eth") == 0) {
+	o.sendpref = PACKET_SEND_ETH_STRONG;
+      } else if (strcmp(long_options[option_index].name, "send_ip") == 0) {
+	o.sendpref = PACKET_SEND_IP_STRONG;
       } else if (strcmp(long_options[option_index].name, "stylesheet") == 0) {
 	o.setXSLStyleSheet(optarg);
       } else if (strcmp(long_options[option_index].name, "no-stylesheet") == 0) {
@@ -1085,16 +1091,16 @@ int nmap_main(int argc, char *argv[]) {
 	    }
 	  }
 	}
-	if (!*currenths->device)
-	  if (ipaddr2devname( currenths->device, currenths->v4sourceip()) != 0)
-	    fatal("Could not figure out what device to send the packet out on!  You might possibly want to try -S (but this is probably a bigger problem).  If you are trying to sp00f the source of a SYN/FIN scan with -S <fakeip>, then you must use -e eth0 (or other devicename) to tell us what interface to use.\n");
+	if (!currenths->deviceName())
+	  fatal("Do not have appropriate device name for target");
 	
 	/* Groups should generally use the same device as properties
 	   change quite a bit between devices.  Plus dealing with a
 	   multi-device group can be a pain programmatically. So if
 	   this Target has a different device the rest, we give it
 	   back. */
-	if (Targets.size() > 0 && strcmp(Targets[Targets.size() - 1]->device, currenths->device)) {
+	if (Targets.size() > 0 && 
+	    strcmp(Targets[Targets.size() - 1]->deviceName(), currenths->deviceName())) {
 	  returnhost(hstate);
 	  numhosts_scanned--; numhosts_up--;
 	  break;
@@ -1183,6 +1189,7 @@ int nmap_main(int argc, char *argv[]) {
 	printportoutput(currenths, &currenths->ports);
 	printmacinfo(currenths);
 	printosscanoutput(currenths);
+	printserviceinfooutput(currenths);
       }
     
       if (o.debugging) 
diff --git a/nmap.h b/nmap.h
index e78e65443..5c6678128 100644
--- a/nmap.h
+++ b/nmap.h
@@ -218,15 +218,15 @@ void *realloc();
 #include <pwd.h>
 #endif
 
-#ifndef NETINET_IN_SYSTEM_H  /* why the HELL does OpenBSD not do this? */
+#ifndef NETINET_IN_SYSTEM_H  /* why does OpenBSD not do this? */
 #include <netinet/in_systm.h> /* defines n_long needed for netinet/ip.h */
 #define NETINET_IN_SYSTEM_H
 #endif
-#ifndef NETINET_IP_H  /* why the HELL does OpenBSD not do this? */
+#ifndef NETINET_IP_H  /* why does OpenBSD not do this? */
 #include <netinet/ip.h> 
 #define NETINET_IP_H
 #endif
-#include <netinet/ip_icmp.h> 
+// #include <netinet/ip_icmp.h> 
 
 #if HAVE_ARPA_INET_H
 #include <arpa/inet.h>
@@ -237,7 +237,7 @@ void *realloc();
 #ifndef __FAVOR_BSD
 #define __FAVOR_BSD
 #endif
-#ifndef NETINET_TCP_H  /* why the HELL does OpenBSD not do this? */
+#ifndef NETINET_TCP_H  /* why does OpenBSD not do this? */
 #include <netinet/tcp.h>          /*#include <netinet/ip_tcp.h>*/
 #define NETINET_TCP_H
 #endif
@@ -314,6 +314,10 @@ void *realloc();
 #define MAX_UDP_SCAN_DELAY 1000
 #endif
 
+/* Maximum number of extra hostnames, OSs, and devices, we
+   consider when outputing the extra service info fields */
+#define MAX_SERVICE_INFO_FIELDS 5
+
 /* We wait at least 100 ms for a response by default - while that
    seems aggressive, waiting too long can cause us to fail to detect
    drops until many probes later on extremely low-latency
@@ -431,8 +435,6 @@ void printusage(char *name, int rc);
 /* print Interactive usage information */
 void printinteractiveusage();
 
-/* Scan helper functions */
-unsigned long calculate_sleep(struct in_addr target);
 int check_ident_port(struct in_addr target);
 
 int ftp_anon_connect(struct ftpinfo *ftp);
diff --git a/nmap_error.cc b/nmap_error.cc
index 46fc964ab..42fe3ced9 100644
--- a/nmap_error.cc
+++ b/nmap_error.cc
@@ -108,7 +108,7 @@
 extern void CloseLibs(void);
 #endif
 
-void fatal(char *fmt, ...) {
+void fatal(const char *fmt, ...) {
 va_list  ap;
 va_start(ap, fmt);
 fflush(stdout);
@@ -119,7 +119,7 @@ va_end(ap);
 exit(1);
 }
 
-void error(char *fmt, ...) {
+void error(const char *fmt, ...) {
 va_list  ap;
 va_start(ap, fmt);
 fflush(stdout);
@@ -130,7 +130,7 @@ va_end(ap);
 return;
 }
 
-void pfatal(char *err, ...) {
+void pfatal(const char *err, ...) {
 #ifdef WIN32
 	int lasterror =0;
 	char *errstr = NULL;
@@ -152,7 +152,7 @@ void pfatal(char *err, ...) {
 	exit(1);
 }
 
-void gh_perror(char *err, ...) {
+void gh_perror(const char *err, ...) {
 va_list  ap;va_start(ap, err);
 fflush(stdout);
 vfprintf(stderr, err, ap);
diff --git a/nmap_error.h b/nmap_error.h
index d3793d2a1..38569d2b9 100644
--- a/nmap_error.h
+++ b/nmap_error.h
@@ -126,13 +126,13 @@
 #include <unistd.h>
 #endif
 
-void fatal(char *fmt, ...)
+void fatal(const char *fmt, ...)
      __attribute__ ((format (printf, 1, 2)));
-void error(char *fmt, ...)
+void error(const char *fmt, ...)
      __attribute__ ((format (printf, 1, 2)));
-void pfatal(char *err, ...)
+void pfatal(const char *err, ...)
      __attribute__ ((format (printf, 1, 2)));
-void gh_perror(char *err, ...)
+void gh_perror(const char *err, ...)
      __attribute__ ((format (printf, 1, 2)));
 #endif /* NMAP_ERROR_H */
 
diff --git a/osscan.cc b/osscan.cc
index 15a9949f0..420391892 100644
--- a/osscan.cc
+++ b/osscan.cc
@@ -162,6 +162,8 @@ int seq_packets_sent = 0;
 int seq_response_num; /* response # for sequencing */
 double avg_ts_hz = 0.0; /* Avg. amount that timestamps incr. each second */
 struct link_header linkhdr;
+struct eth_nfo eth;
+ struct eth_nfo *ethptr; // for passing to send_ functions 
 
 if (target->timedOut(NULL))
   return NULL;
@@ -175,14 +177,24 @@ si->lastboot = 0;
 /* Init our fingerprint tests to each be NULL */
 memset(FPtests, 0, sizeof(FPtests)); 
 get_random_bytes(&sequence_base, sizeof(unsigned int));
-/* Init our raw socket */
- if ((rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 )
-   pfatal("socket trobles in get_fingerprint");
- unblock_socket(rawsd);
- broadcast_socket(rawsd);
+ if ((o.sendpref & PACKET_SEND_ETH) &&  target->ifType() == devt_ethernet) {
+   memcpy(eth.srcmac, target->SrcMACAddress(), 6);
+   memcpy(eth.dstmac, target->NextHopMACAddress(), 6);
+   eth.ethsd = eth_open(target->deviceName());
+   rawsd = -1;
+   ethptr = &eth;
+  } else {
+    /* Init our raw socket */
+    if ((rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 )
+      pfatal("socket trobles in get_fingerprint");
+    unblock_socket(rawsd);
+    broadcast_socket(rawsd);
 #ifndef WIN32
- sethdrinclude(rawsd);
+    sethdrinclude(rawsd);
 #endif
+    ethptr = NULL;
+    eth.ethsd = NULL;
+  }
 
  /* Now for the pcap opening nonsense ... */
  /* Note that the snaplen is 152 = 64 byte max IPhdr + 24 byte max link_layer
@@ -192,7 +204,7 @@ get_random_bytes(&sequence_base, sizeof(unsigned int));
 ossofttimeout = MAX(200000, target->to.timeout);
 oshardtimeout = MAX(500000, 5 * target->to.timeout);
 
- pd = my_pcap_open_live(target->device, /*650*/ 8192,  (o.spoofsource)? 1 : 0, (ossofttimeout + 500)/ 1000);
+ pd = my_pcap_open_live(target->deviceName(), /*650*/ 8192,  (o.spoofsource)? 1 : 0, (ossofttimeout + 500)/ 1000);
 
 if (o.debugging > 1)
    log_write(LOG_STDOUT, "Wait time is %dms\n", (ossofttimeout +500)/1000);
@@ -202,7 +214,7 @@ if (o.debugging > 1)
 
 snprintf(filter, sizeof(filter), "dst host %s and (icmp or (tcp and src host %s))", inet_ntoa(target->v4source()), target->targetipstr());
  
- set_pcap_filter(target, pd, flt_icmptcp, filter);
+ set_pcap_filter(target->deviceName(), pd, flt_icmptcp, filter);
  target->osscan_performed = 1; /* Let Nmap know that we did try an OS scan */
 
  /* Lets find an open port to use */
@@ -241,28 +253,31 @@ if (o.verbose && openport != (unsigned long) -1)
      /* Test 1 */
      if (!FPtests[1]) {     
        if (o.scan_delay) enforce_scan_delay(NULL);
-       send_tcp_raw_decoys(rawsd, target->v4hostip(), o.ttl, current_port, 
-			   openport, sequence_base, 0,TH_ECE|TH_SYN, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0);
+       send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, 
+			   current_port, openport, sequence_base, 0, 
+			   TH_ECE|TH_SYN, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0);
      }
      
      /* Test 2 */
      if (!FPtests[2]) {     
        if (o.scan_delay) enforce_scan_delay(NULL);
-       send_tcp_raw_decoys(rawsd, target->v4hostip(), o.ttl, current_port +1, 
+       send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, 
+			   current_port +1, 
 			   openport, sequence_base, 0,0, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0);
      }
 
      /* Test 3 */
      if (!FPtests[3]) {     
        if (o.scan_delay) enforce_scan_delay(NULL);
-       send_tcp_raw_decoys(rawsd, target->v4hostip(), o.ttl, current_port +2, 
+       send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, current_port +2, 
 			   openport, sequence_base, 0,TH_SYN|TH_FIN|TH_URG|TH_PUSH, 0,(u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0);
      }
 
      /* Test 4 */
      if (!FPtests[4]) {     
        if (o.scan_delay) enforce_scan_delay(NULL);
-       send_tcp_raw_decoys(rawsd, target->v4hostip(), o.ttl, current_port +3, 
+       send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, 
+			   current_port +3, 
 			   openport, sequence_base, 0,TH_ACK, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0);
      }
    }
@@ -270,21 +285,24 @@ if (o.verbose && openport != (unsigned long) -1)
    /* Test 5 */
    if (!FPtests[5]) {   
      if (o.scan_delay) enforce_scan_delay(NULL);
-     send_tcp_raw_decoys(rawsd, target->v4hostip(), o.ttl, current_port +4,
+     send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, 
+			 current_port +4,
 			 closedport, sequence_base, 0,TH_SYN, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0);
    }
 
      /* Test 6 */
    if (!FPtests[6]) {   
      if (o.scan_delay) enforce_scan_delay(NULL);
-     send_tcp_raw_decoys(rawsd, target->v4hostip(), o.ttl, current_port +5, 
+     send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, 
+			 current_port +5, 
 			 closedport, sequence_base, 0,TH_ACK, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0);
    }
 
      /* Test 7 */
    if (!FPtests[7]) {
      if (o.scan_delay) enforce_scan_delay(NULL);   
-     send_tcp_raw_decoys(rawsd, target->v4hostip(), o.ttl, current_port +6, 
+     send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, 
+			 current_port +6, 
 			 closedport, sequence_base, 0,TH_FIN|TH_PUSH|TH_URG, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0);
    }
 
@@ -370,7 +388,7 @@ if (o.verbose && openport != (unsigned long) -1)
 	 usleep(remaining_us);
        }
      }
-     send_tcp_raw_decoys(rawsd, target->v4hostip(), o.ttl, 
+     send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, 
 			 o.magic_port + seq_packets_sent + 1, 
 			 openport, 
 			 sequence_base + seq_packets_sent + 1, 0, 
@@ -738,7 +756,11 @@ for(i=0; i < 9; i++) {
  osscan_timedout:
  if (target->timedOut(NULL))
    FP = NULL;
- close(rawsd);
+ if (rawsd >= 0)
+   close(rawsd);
+ if (ethptr) {
+   eth_close(ethptr->ethsd);
+ }
  pcap_close(pd);
  return FP;
 }
diff --git a/output.cc b/output.cc
index 640ef1487..23459e49b 100644
--- a/output.cc
+++ b/output.cc
@@ -127,6 +127,7 @@ static int getServiceXMLBuf(struct serviceDeductions *sd, char *xmlbuf,
   string versionxmlstring;
   char rpcbuf[128];
   char *xml_product = NULL, *xml_version = NULL, *xml_extrainfo = NULL;
+  char *xml_hostname = NULL, *xml_ostype = NULL, *xml_devicetype = NULL;
 
   if (xmlbuflen < 1) return -1;
   xmlbuf[0] = '\0';
@@ -156,6 +157,30 @@ static int getServiceXMLBuf(struct serviceDeductions *sd, char *xmlbuf,
     versionxmlstring += '\"';
   }
 
+  if (sd->hostname) {
+    xml_hostname = xml_convert(sd->hostname);
+    versionxmlstring += " hostname=\"";
+    versionxmlstring += xml_hostname;
+    free(xml_hostname); xml_hostname = NULL;
+    versionxmlstring += '\"';
+  }
+
+  if (sd->ostype) {
+    xml_ostype = xml_convert(sd->ostype);
+    versionxmlstring += " ostype=\"";
+    versionxmlstring += xml_ostype;
+    free(xml_ostype); xml_ostype = NULL;
+    versionxmlstring += '\"';
+  }
+
+  if (sd->devicetype) {
+    xml_devicetype = xml_convert(sd->devicetype);
+    versionxmlstring += " devicetype=\"";
+    versionxmlstring += xml_devicetype;
+    free(xml_devicetype); xml_devicetype = NULL;
+    versionxmlstring += '\"';
+  }
+
   if (o.rpcscan && sd->rpc_status == RPC_STATUS_GOOD_PROG) {
     snprintf(rpcbuf, sizeof(rpcbuf), 
 	     " rpcnum=\"%li\" lowver=\"%i\" highver=\"%i\" proto=\"rpc\"", 
@@ -234,8 +259,7 @@ void printportoutput(Target *currenths, PortList *plist) {
   struct protoent *proto;
   Port *current;
   int numignoredports;
-  int portno, protocount;
-  map<u16, Port*> protoarrays[2];
+  int portno;
   char hostname[1200];
   int istate = plist->getIgnoredPortState();
   numignoredports = plist->state_counts[istate];
@@ -318,14 +342,12 @@ void printportoutput(Target *currenths, PortList *plist) {
 
   log_write(LOG_MACHINE,"\t%s: ", (o.ipprotscan)? "Protocols" : "Ports" );
   
-  protoarrays[0] = plist->tcp_ports;
-  protoarrays[1] = plist->udp_ports;
   current = NULL;
   rowno = 1;
   if (o.ipprotscan) {
     for (portno = 0; portno < 256; portno++) {
-      if (!plist->ip_ports[portno]) continue;
-      current = plist->ip_ports[portno];
+      if (!plist->ip_prots[portno]) continue;
+      current = plist->ip_prots[portno];
       if (current->state != istate) {
 	if (!first) log_write(LOG_MACHINE,", ");
 	else first = 0;
@@ -346,10 +368,20 @@ void printportoutput(Target *currenths, PortList *plist) {
       }
     }
   } else {
-    for(protocount = 0; protocount < 2; protocount++) {
-       for(map<u16,Port*>::iterator iter = protoarrays[protocount].begin(); iter != protoarrays[protocount].end(); iter++) {
-          current = (*iter).second;
-          
+    map<u16,Port*>::iterator tcpIter = plist->tcp_ports.begin();
+    map<u16,Port*>::iterator udpIter = plist->udp_ports.begin();
+
+    while (tcpIter != plist->tcp_ports.end() || udpIter != plist->udp_ports.end()) {
+
+      // If the udp iterator is at the end, then we always read from tcp and vica-versa
+      if (tcpIter != plist->tcp_ports.end() && (udpIter == plist->udp_ports.end() || tcpIter->first <= udpIter->first)) {
+	current = tcpIter->second;
+	tcpIter++;
+      } else {
+	current = udpIter->second;
+	udpIter++;
+      }
+
       if (current->state != istate) {    
 	if (!first) log_write(LOG_MACHINE,", ");
 	else first = 0;
@@ -449,7 +481,7 @@ void printportoutput(Target *currenths, PortList *plist) {
 	rowno++;
       }
     }
-   }
+    
   }
   /*  log_write(LOG_NORMAL|LOG_SKID|LOG_STDOUT,"\n"); */
   if (plist->state_counts[istate] > 0)
@@ -1089,7 +1121,7 @@ void printosscanoutput(Target *currenths) {
 	}
       } else { assert(0); }
    
-    if (o.debugging || o.verbose > 1) {
+    if (o.debugging || o.verbose) {
 
       log_write(LOG_XML,"<osfingerprint fingerprint=\"\n%s\" />\n", 
 		mergeFPs(currenths->FPR->FPs, currenths->FPR->numFPs, 
@@ -1159,6 +1191,107 @@ void printosscanoutput(Target *currenths) {
   }
 }
 
+
+
+/* An auxillary function for printserviceinfooutput(). Returns
+   non-zero if a and b are considered the same hostnames. */
+static int hostcmp(const char *a, const char *b) {
+  return strcasestr(a, b)? 1 : 0;
+}
+
+
+/* Prints the alternate hostname/OS/device information we got from the
+ *    service scan (if it was performed) */
+void printserviceinfooutput(Target *currenths) {
+
+  Port *p = NULL;
+  struct serviceDeductions sd;
+  int i, numhostnames=0, numostypes=0, numdevicetypes=0;
+  char hostname_tbl[MAX_SERVICE_INFO_FIELDS][MAXHOSTNAMELEN];
+  char ostype_tbl[MAX_SERVICE_INFO_FIELDS][64];
+  char devicetype_tbl[MAX_SERVICE_INFO_FIELDS][64];
+
+  for (i=0; i<MAX_SERVICE_INFO_FIELDS; i++)
+    hostname_tbl[i][0] = ostype_tbl[i][0] = devicetype_tbl[i][0] = '\0';
+
+  while ((p = currenths->ports.nextPort(p, 0, PORT_OPEN, false))) {
+    // The following 2 lines (from portlist.h) tell us that we don't
+    // need to worry about free()ing anything in the serviceDeductions struct.
+      // pass in an allocated struct serviceDeductions (don't wory about initializing, and
+      // you don't have to free any internal ptrs.
+    p->getServiceDeductions(&sd);
+
+    if (sd.hostname && !hostcmp(currenths->HostName(), sd.hostname)) {
+      for (i=0; i<MAX_SERVICE_INFO_FIELDS; i++) {
+        if (hostname_tbl[i][0] && hostcmp(&hostname_tbl[i][0], sd.hostname))
+          break;
+
+        if (!hostname_tbl[i][0]) {
+          numhostnames++;
+          strncpy(&hostname_tbl[i][0], sd.hostname, sizeof(hostname_tbl[i]));
+          break;
+        }
+      }
+    }
+
+    if (sd.ostype) {
+      for (i=0; i<MAX_SERVICE_INFO_FIELDS; i++) {
+        if (ostype_tbl[i][0] && !strcmp(&ostype_tbl[i][0], sd.ostype))
+          break;
+
+        if (!ostype_tbl[i][0]) {
+          numostypes++;
+          strncpy(&ostype_tbl[i][0], sd.ostype, sizeof(ostype_tbl[i]));
+          break;
+        }
+      }
+    }
+
+    if (sd.devicetype) {
+      for (i=0; i<MAX_SERVICE_INFO_FIELDS; i++) {
+        if (devicetype_tbl[i][0] && !strcmp(&devicetype_tbl[i][0], sd.devicetype))
+          break;
+
+        if (!devicetype_tbl[i][0]) {
+          numdevicetypes++;
+          strncpy(&devicetype_tbl[i][0], sd.devicetype, sizeof(devicetype_tbl[i]));
+          break;
+        }
+      }
+    }
+
+  }
+
+  if (!numhostnames && !numostypes && !numdevicetypes) return;
+
+  log_write(LOG_NORMAL|LOG_SKID|LOG_STDOUT, "Service Info:");
+
+  if (numhostnames) {
+    log_write(LOG_NORMAL|LOG_SKID|LOG_STDOUT, " Host%s: %s", numhostnames==1? "" : "s", &hostname_tbl[0][0]);
+    for (i=1; i<MAX_SERVICE_INFO_FIELDS; i++)
+      if (hostname_tbl[i][0])
+        log_write(LOG_NORMAL|LOG_SKID|LOG_STDOUT, ", %s", &hostname_tbl[i][0]);
+  }
+
+  if (numostypes) {
+    log_write(LOG_NORMAL|LOG_SKID|LOG_STDOUT, "  OS%s: %s", numostypes==1? "" : "s", &ostype_tbl[0][0]);
+    for (i=1; i<MAX_SERVICE_INFO_FIELDS; i++)
+      if (ostype_tbl[i][0])
+        log_write(LOG_NORMAL|LOG_SKID|LOG_STDOUT, ", %s", &ostype_tbl[i][0]);
+  }
+
+  if (numdevicetypes) {
+    log_write(LOG_NORMAL|LOG_SKID|LOG_STDOUT, "  Device%s: %s", numdevicetypes==1? "" : "s", &devicetype_tbl[0][0]);
+    for (i=1; i<MAX_SERVICE_INFO_FIELDS; i++)
+      if (devicetype_tbl[i][0])
+        log_write(LOG_NORMAL|LOG_SKID|LOG_STDOUT, ", %s", &devicetype_tbl[i][0]);
+  }
+
+  log_write(LOG_NORMAL|LOG_SKID|LOG_STDOUT, "\n");
+
+}
+
+
 /* Prints the statistics and other information that goes at the very end
    of an Nmap run */
 void printfinaloutput(int numhosts_scanned, int numhosts_up, 
diff --git a/output.h b/output.h
index 3c769c7ac..79ac61cab 100644
--- a/output.h
+++ b/output.h
@@ -191,6 +191,10 @@ void write_host_status(Target *currenths, int resolve_all);
    if an OS Scan was performed */
 void printosscanoutput(Target *currenths);
 
+/* Prints the alternate hostname/OS/device information we got from the
+   service scan (if it was performed) */
+void printserviceinfooutput(Target *currenths);
+
 /* Prints the statistics and other information that goes at the very end
    of an Nmap run */
 void printfinaloutput(int numhosts_scanned, int numhosts_up, 
diff --git a/portlist.cc b/portlist.cc
index 2ebe22657..d27abf108 100644
--- a/portlist.cc
+++ b/portlist.cc
@@ -173,24 +173,6 @@ static void populateFullVersionString(struct serviceDeductions *sd) {
     spaceleft -= strlen(sd->extrainfo) + 3;
   }
 
-  if (sd->hostname && spaceleft >= (strlen(sd->hostname) + 7)) {
-    strncat(dst, " Host: ", spaceleft);
-    strncat(dst, sd->hostname, spaceleft);
-    spaceleft -= strlen(sd->hostname) + 7;
-  }
-
-  if (sd->ostype && spaceleft >= (strlen(sd->ostype) + 5)) {
-    strncat(dst, " OS: ", spaceleft);
-    strncat(dst, sd->ostype, spaceleft);
-    spaceleft -= strlen(sd->ostype) + 5;
-    }
-
-  if (sd->devicetype && spaceleft >= (strlen(sd->devicetype) + 9)) {
-    strncat(dst, " Device: ", spaceleft);
-    strncat(dst, sd->devicetype, spaceleft);
-    spaceleft -= strlen(sd->devicetype) + 9;
-  }
-
 }
 
 
@@ -425,18 +407,18 @@ PortList::~PortList() {
 
   for(map<u16,Port*>::iterator iter = tcp_ports.begin(); iter != tcp_ports.end(); iter++)
      {
-        delete (*iter).second;
+        delete iter->second;
      }
   
 
   for(map<u16,Port*>::iterator iter = udp_ports.begin(); iter != udp_ports.end(); iter++)
      {
-        delete (*iter).second;
+        delete iter->second;
      }
 
-  for(map<u16,Port*>::iterator iter = ip_ports.begin(); iter != ip_ports.end(); iter++)
+  for(map<u16,Port*>::iterator iter = ip_prots.begin(); iter != ip_prots.end(); iter++)
      {
-        delete (*iter).second;
+        delete iter->second;
      }
 
   if (idstr) { 
@@ -478,10 +460,10 @@ int PortList::addPort(u16 portno, u8 protocol, char *owner, int state) {
     portarray = &udp_ports;
   } else if (protocol == IPPROTO_IP) {
     assert(portno < 256);
-    portarray = &ip_ports;
+    portarray = &ip_prots;
   } else fatal("addPort: attempted port insertion with invalid protocol");
 
-  if ((*portarray)[portno]) {
+  if (portarray->find(portno) == portarray->end()) {
     /* We must discount our statistics from the old values.  Also warn
        if a complete duplicate */
     current = (*portarray)[portno];    
@@ -496,8 +478,8 @@ int PortList::addPort(u16 portno, u8 protocol, char *owner, int state) {
     } else
       state_counts_ip[current->state]--;
   } else {
-    (*portarray)[portno] = new Port();
-    current = (*portarray)[portno];
+    current = new Port();
+    (*portarray)[portno] = current;
     numports++;
     current->portno = portno;
   }
@@ -517,10 +499,13 @@ int PortList::addPort(u16 portno, u8 protocol, char *owner, int state) {
       free(current->owner);
     current->owner = strdup(owner);
   }
-
-  /*  printf("\nCurrent Port List\n");
+  
+  /*
+  printf("\nCurrent Port List\n");
+  
   for(map<u16,Port*>::iterator iter = (*portarray).begin(); iter != (*portarray).end(); iter++)
-     printf("%d %d\n", (*iter).first, (*iter).second);
+    printf("(%d %d) ", iter->first, iter->second->portno);
+  printf("\n");
   */
   
 
@@ -541,8 +526,8 @@ int PortList::removePort(u16 portno, u8 protocol) {
     answer = udp_ports[portno];
     udp_ports.erase(portno);
   } else if (protocol == IPPROTO_IP) {
-    answer = ip_ports[portno];
-    ip_ports.erase(portno);
+    answer = ip_prots[portno];
+    ip_prots.erase(portno);
   }
 
   if (!answer)
@@ -582,7 +567,7 @@ Port *PortList::lookupPort(u16 portno, u8 protocol) {
     return udp_ports[portno];
 
   if (protocol == IPPROTO_IP)
-    return ip_ports[portno];
+    return ip_prots[portno];
 
   return NULL;
 }
@@ -620,40 +605,52 @@ int PortList::getIgnoredPortState() {
 Port *PortList::nextPort(Port *afterthisport, 
 			 u8 allowed_protocol, int allowed_state, 
 			 bool allow_portzero) {
-
+  
   /* These two are chosen because they come right "before" port 1/tcp */
-unsigned int current_portno = 0;
-unsigned int current_proto = IPPROTO_TCP;
+  unsigned int current_proto = IPPROTO_TCP;
+  map<u16,Port*>::iterator iter = tcp_ports.begin();
 
 if (afterthisport) {
-  current_portno = afterthisport->portno;
-  current_proto = afterthisport->proto;  /* (afterthisport->proto == IPPROTO_TCP)? IPPROTO_TCP : IPPROTO_UDP; */
-  current_portno++; /* Start on the port after the one we were given */ 
+  current_proto = afterthisport->proto;
+  
+  // This will advacne to one after the current
+  while (iter != tcp_ports.end() && iter->second->portno <= afterthisport->portno) {
+    iter++;
+  }
 } 
 
- if (!allow_portzero && current_portno == 0) current_portno++;
+/* if (afterthisport) 
+   printf("Next Port After %d, %d\n", afterthisport->portno, iter->second->portno); fflush(0);
+*/
+
+ if (!allow_portzero && iter->second->portno == 0) iter++;
+ 
 
 /* First we look for TCP ports ... */
 if (current_proto == IPPROTO_TCP) {
- if ((allowed_protocol == 0 || allowed_protocol == IPPROTO_TCP) && 
-    current_proto == IPPROTO_TCP)
-  for(; current_portno < 65536; current_portno++) {
-    if (tcp_ports[current_portno] &&
-	(!allowed_state || tcp_ports[current_portno]->state == allowed_state))
-      return tcp_ports[current_portno];
-  }
-
+  if ((allowed_protocol == 0 || allowed_protocol == IPPROTO_TCP) && 
+      current_proto == IPPROTO_TCP)
+    while (iter != tcp_ports.end()) {
+      if (!allowed_state || iter->second->state == allowed_state) {
+	//printf("Returning %d\n", iter->second->portno);
+	return iter->second;
+      }
+      iter++;
+    }
+  
   /*  Uh-oh.  We have tried all tcp ports, lets move to udp */
-  current_portno = 0;
   current_proto = IPPROTO_UDP;
+  iter = udp_ports.begin();
 }
 
 if ((allowed_protocol == 0 || allowed_protocol == IPPROTO_UDP) && 
     current_proto == IPPROTO_UDP) {
-  for(; current_portno < 65536; current_portno++) {
-    if (udp_ports[current_portno] &&
-	(!allowed_state || udp_ports[current_portno]->state == allowed_state))
-      return udp_ports[current_portno];
+  while (iter != udp_ports.end()) {
+    if (!allowed_state || iter->second->state == allowed_state) {
+      //printf("Returning %d\n", iter->second->portno);
+      return iter->second;
+    }
+    iter++;
   }
 }
 
diff --git a/portlist.h b/portlist.h
index 9616f6736..6114b6e58 100644
--- a/portlist.h
+++ b/portlist.h
@@ -187,7 +187,7 @@ class Port {
   ~Port();
 
   // pass in an allocated struct serviceDeductions (don't wory about initializing, and
-  // you don't have to free any inernal ptrs.  See the serviceDeductions definition for
+  // you don't have to free any internal ptrs.  See the serviceDeductions definition for
   // the fields that are populated.  Returns 0 if at least a name is available.
   int getServiceDeductions(struct serviceDeductions *sd);
 
@@ -279,7 +279,7 @@ class PortList {
   Port *lookupPort(u16 portno, u8 protocol);
   map < u16, Port* > udp_ports;
   map < u16, Port* > tcp_ports;
-  map < u16, Port* > ip_ports;
+  map < u16, Port* > ip_prots;
 
   int state_counts[PORT_HIGHEST_STATE]; /* How many ports in list are in each
 					   state */
diff --git a/scan_engine.cc b/scan_engine.cc
index 68108baa6..b20dfedbe 100644
--- a/scan_engine.cc
+++ b/scan_engine.cc
@@ -1061,24 +1061,30 @@ void UltraScanInfo::Init(vector<Target *> &Targets, struct scan_lists *pts, styp
   rawsd = -1;
   ethsd = NULL;
 
-  if ((tcp_scan || udp_scan || prot_scan) && scantype != CONNECT_SCAN) {
-    /* Initialize a raw socket */
-    if ((rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 )
-      pfatal("socket troubles in UltraScanInfo::Init");
-    /* We do not wan't to unblock the socket since we want to wait 
-       if kernel send buffers fill up rather than get ENOBUF, and
-       we won't be receiving on the socket anyway 
-       unblock_socket(rawsd);*/
-    broadcast_socket(rawsd);
+  if ((tcp_scan || udp_scan || prot_scan || ping_scan_arp) && 
+      scantype != CONNECT_SCAN) {
+    if (ping_scan_arp || ((o.sendpref & PACKET_SEND_ETH) && 
+			  Targets[0]->ifType() == devt_ethernet)) {
+      /* We'll send ethernet packets with dnet */
+      ethsd = eth_open(Targets[0]->deviceName());
+      if (ethsd == NULL)
+	fatal("dnet: Failed to open device %s", Targets[0]->deviceName());
+      rawsd = -1;
+    } else {
+      /* Initialize a raw socket */
+      if ((rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 )
+	pfatal("socket troubles in UltraScanInfo::Init");
+      /* We do not wan't to unblock the socket since we want to wait 
+	 if kernel send buffers fill up rather than get ENOBUF, and
+	 we won't be receiving on the socket anyway 
+	 unblock_socket(rawsd);*/
+      broadcast_socket(rawsd);
 #ifndef WIN32
-    sethdrinclude(rawsd); 
+      sethdrinclude(rawsd); 
 #endif
-  } else if (ping_scan_arp) {
-    ethsd = eth_open(Targets[0]->device);
-    if (ethsd == NULL)
-      fatal("dnet: Failed to open device %s", o.device);
-  } 
-
+      ethsd = NULL;
+    }
+  }
 }
 
   /* Consults with the group stats, and the hstats for every
@@ -1918,7 +1924,16 @@ static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
   u32 ack = 0;
   u16 sport;
   u16 ipid = get_random_u16();
+  struct eth_nfo eth;
+  struct eth_nfo *ethptr = NULL;
 
+  if (USI->ethsd) {
+    memcpy(eth.srcmac, hss->target->SrcMACAddress(), 6);
+    memcpy(eth.dstmac, hss->target->MACAddress(), 6);
+    eth.ethsd = USI->ethsd;
+    eth.devname[0] = '\0';
+    ethptr = &eth;
+  }
   if (pingseq > 0) {
     if (tryno > 0) assert(0); /* tryno + pingseq not currently supported */
     sport = o.magic_port_set? o.magic_port : o.magic_port + USI->perf.tryno_cap + pingseq;
@@ -1946,7 +1961,7 @@ static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
 	probe->setIP(packet, packetlen, pspec);
 	hss->lastprobe_sent = probe->sent = USI->now;
       }
-      send_ip_packet(USI->rawsd, packet, packetlen);
+      send_ip_packet(USI->rawsd, ethptr, packet, packetlen);
       free(packet);
     }
   } else if (USI->udp_scan) {
@@ -1959,7 +1974,7 @@ static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
 	probe->setIP(packet, packetlen, pspec);
 	hss->lastprobe_sent = probe->sent = USI->now;
       }
-      send_ip_packet(USI->rawsd, packet, packetlen);
+      send_ip_packet(USI->rawsd, ethptr, packet, packetlen);
       free(packet);
     }
   } else if (USI->prot_scan) {
@@ -1996,7 +2011,7 @@ static UltraProbe *sendIPScanProbe(UltraScanInfo *USI, HostScanStats *hss,
 	probe->setIP(packet, packetlen, pspec);
 	hss->lastprobe_sent = probe->sent = USI->now;
       }
-      send_ip_packet(USI->rawsd, packet, packetlen);
+      send_ip_packet(USI->rawsd, ethptr, packet, packetlen);
       free(packet);
     }
 
@@ -2942,7 +2957,7 @@ static void begin_sniffer(UltraScanInfo *USI, vector<Target *> &Targets) {
   }
   filterlen = 0;
 
-  USI->pd = my_pcap_open_live(Targets[0]->device, 100,  (o.spoofsource)? 1 : 0, 2);
+  USI->pd = my_pcap_open_live(Targets[0]->deviceName(), 100,  (o.spoofsource)? 1 : 0, 2);
   /* Windows nonsense */
   flt_srchost = Targets[0]->v4host().s_addr;
   flt_dsthost = Targets[0]->v4source().s_addr;
@@ -2982,7 +2997,7 @@ static void begin_sniffer(UltraScanInfo *USI, vector<Target *> &Targets) {
     filterlen = len;
   } else assert(0); /* Other scan types? */
   if (o.debugging > 2) printf("Pcap filter: %s\n", pcap_filter);
-  set_pcap_filter(Targets[0], USI->pd, flt_all, pcap_filter);
+  set_pcap_filter(Targets[0]->deviceName(), USI->pd, flt_all, pcap_filter);
   /* pcap_setnonblock(USI->pd, 1, NULL); */
   
   return;
diff --git a/targets.cc b/targets.cc
index ce1bb10c0..817dde9c3 100644
--- a/targets.cc
+++ b/targets.cc
@@ -260,13 +260,14 @@ static void arpping(Target *hostbatch[], int num_hosts,
       if (islocal) {
 	log_write(LOG_STDOUT|LOG_NORMAL, 
 		  "ARP ping: Considering %s UP because it is a local IP, despite no MAC address for device %s\n",
-		  hostbatch[targetno]->NameIP(), hostbatch[targetno]->device);
+		  hostbatch[targetno]->NameIP(), hostbatch[targetno]->deviceName());
 	hostbatch[targetno]->flags &= ~(HOST_DOWN|HOST_FIREWALLED);
 	hostbatch[targetno]->flags |= HOST_UP;
       } else {
 	log_write(LOG_STDOUT|LOG_NORMAL, 
 		  "ARP ping: Considering %s DOWN because no MAC address found for device %s.\n",
-		  hostbatch[targetno]->NameIP(), hostbatch[targetno]->device);
+		  hostbatch[targetno]->NameIP(), 
+		  hostbatch[targetno]->deviceName());
 	hostbatch[targetno]->flags &= ~HOST_FIREWALLED;
 	hostbatch[targetno]->flags |= HOST_DOWN;
       }
@@ -294,11 +295,16 @@ void returnhost(HostGroupState *hs) {
 Target *nexthost(HostGroupState *hs, TargetGroup *exclude_group,
 			    struct scan_lists *ports, int *pingtype) {
 int hidx;
-char *device;
 int i;
 struct sockaddr_storage ss;
 size_t sslen;
+struct intf_entry *ifentry;
+ u32 ifbuf[200] ;
+ struct route_nfo rnfo;
+ bool arpping_done = false;
 
+ ifentry = (struct intf_entry *) ifbuf; 
+ ifentry->intf_len = sizeof(ifbuf); // TODO: May want to use a larger buffer if interface aliases prove important.
 if (hs->next_batch_no < hs->current_batch_sz) {
   /* Woop!  This is easy -- we just pass back the next host struct */
   return hs->hostbatch[hs->next_batch_no++];
@@ -323,7 +329,7 @@ do {
       if (o.spoofsource) {
 	o.SourceSockAddr(&ss, &sslen);
 	hs->hostbatch[hidx]->setSourceSockAddr(&ss, sslen);
-	Strncpy(hs->hostbatch[hidx]->device, o.device, 64);
+	hs->hostbatch[hidx]->setDeviceNames(o.device, o.device);
       } else {
 	/* We figure out the source IP/device IFF
 	   1) We are r00t AND
@@ -336,44 +342,38 @@ do {
          || (*pingtype & (PINGTYPE_ICMP_PING|PINGTYPE_ICMP_MASK|PINGTYPE_ICMP_TS))
 #endif // WIN32
 		 )) {
-	  struct sockaddr_in *sin = (struct sockaddr_in *) &ss;
-	  sslen = sizeof(*sin);
-	  sin->sin_family = AF_INET;
-#if HAVE_SOCKADDR_SA_LEN
-	  sin->sin_len = sslen;
-#endif
-	  device = routethrough(hs->hostbatch[hidx]->v4hostip(), 
-				&(sin->sin_addr));
-	  hs->hostbatch[hidx]->setSourceSockAddr(&ss, sslen);
+	  hs->hostbatch[hidx]->TargetSockAddr(&ss, &sslen);
+	  if (!route_dst(&ss, &rnfo)) {
+	    fatal("%s: failed to determine route to %s", __FUNCTION__, hs->hostbatch[hidx]->NameIP());
+	  }
+	  if (rnfo.direct_connect) {
+	    hs->hostbatch[hidx]->setDirectlyConnected(true);
+	  } else {
+	    hs->hostbatch[hidx]->setDirectlyConnected(false);
+	    hs->hostbatch[hidx]->setNextHop(&rnfo.nexthop, 
+					    sizeof(rnfo.nexthop));
+	  }
+	  hs->hostbatch[hidx]->setIfType(rnfo.ii.device_type);
+	  if (rnfo.ii.device_type == devt_ethernet) {
+	    hs->hostbatch[hidx]->setSrcMACAddress(rnfo.ii.mac);
+	  }
+	  hs->hostbatch[hidx]->setSourceSockAddr(&rnfo.srcaddr, sizeof(rnfo.srcaddr));
 	  if (hidx == 0) /* Because later ones can have different src addy and be cut off group */
 	    o.decoys[o.decoyturn] = hs->hostbatch[hidx]->v4source();
-	  if (!device) {
-	    if (*pingtype == PINGTYPE_NONE) {
-	      fatal("Could not determine what interface to route packets through, run again with -e <device>");
-	    } else {
-#if WIN32
-          fatal("Unable to determine what interface to route packets through to %s", hs->hostbatch[hidx]->targetipstr());
-#endif
-	      error("WARNING:  Could not determine what interface to route packets through to %s, changing ping scantype to ICMP ping only", hs->hostbatch[hidx]->targetipstr());
-	      *pingtype = PINGTYPE_ICMP_PING;
-	    }
-	  } else {
-	    Strncpy(hs->hostbatch[hidx]->device, device, 64);
-	  }
+	  hs->hostbatch[hidx]->setDeviceNames(rnfo.ii.devname, rnfo.ii.devfullname);
+	  //	  printf("Target %s %s directly connected, goes through local iface %s, which %s ethernet\n", hs->hostbatch[hidx]->NameIP(), hs->hostbatch[hidx]->directlyConnected()? "IS" : "IS NOT", hs->hostbatch[hidx]->deviceName(), (hs->hostbatch[hidx]->ifType() == devt_ethernet)? "IS" : "IS NOT");
 	}
       }
 
-      /* If this is an ARP scan, we must determine the device's MAC address */
-      if (*pingtype & PINGTYPE_ARP) {
-	setTargetSrcMACAddressFromDevName(hs->hostbatch[hidx]);
-      }
-      
-      /* In some cases, we can only allow hosts that use the same device
-	 in a group. */
+      /* In some cases, we can only allow hosts that use the same
+	 device in a group.  Similarly, we don't mix
+	 directly-connected boxes with those that aren't */
       if (o.af() == AF_INET && o.isr00t && hidx > 0 && 
-	  *hs->hostbatch[hidx]->device && 
+	  hs->hostbatch[hidx]->deviceName() && 
 	  (hs->hostbatch[hidx]->v4source().s_addr != hs->hostbatch[0]->v4source().s_addr || 
-	   strcmp(hs->hostbatch[0]->device, hs->hostbatch[hidx]->device) != 0)) {
+	   strcmp(hs->hostbatch[0]->deviceName(), 
+		  hs->hostbatch[hidx]->deviceName()) != 0) 
+	  || hs->hostbatch[hidx]->directlyConnected() != hs->hostbatch[0]->directlyConnected()) {
 	/* Cancel everything!  This guy must go in the next group and we are
 	   outtof here */
 	hs->current_expression.return_last_host();
@@ -403,23 +403,34 @@ if (hs->randomize) {
   hoststructfry(hs->hostbatch, hs->current_batch_sz);
 }
 
-/* First I'll do the ARP ping if necessary */
- if (*pingtype & PINGTYPE_ARP) {
+/* First I'll do the ARP ping if all of the machines in the group are
+   directly connected over ethernet.  I may need the MAC addresses
+   later anyway. */
+ if (hs->hostbatch[0]->ifType() == devt_ethernet && 
+     hs->hostbatch[0]->directlyConnected() && 
+     o.sendpref != PACKET_SEND_IP_STRONG) {
    arpping(hs->hostbatch, hs->current_batch_sz, ports);
- } 
- /* TODO: For efficiency, at some point it might be nice to usually do ARP 
-    ping before mass ping (and so get rid of else below) */
- /* Then we do the mass ping (if required - IP-level pings) */
- else if ((*pingtype & 
-      (PINGTYPE_ICMP_PING|PINGTYPE_ICMP_MASK|PINGTYPE_ICMP_TS) ) || 
-     ((!o.isr00t || o.af() == AF_INET6 || hs->hostbatch[0]->v4host().s_addr) && 
-      (*pingtype != PINGTYPE_NONE))) 
-   massping(hs->hostbatch, hs->current_batch_sz, ports, *pingtype);
- /* Otherwise -P0 so we just consider every host up */
- else for(i=0; i < hs->current_batch_sz; i++)  {
-   initialize_timeout_info(&hs->hostbatch[i]->to);
-   hs->hostbatch[i]->flags |= HOST_UP; /*hostbatch[i].up = 1;*/
+   arpping_done = true;
  }
+ 
+ if ((o.sendpref & PACKET_SEND_ETH) && 
+     hs->hostbatch[0]->ifType() == devt_ethernet) {
+   if (!setTargetNextHopMAC(hs->hostbatch[hidx]))
+     fatal("%s: Failed to determine dst MAC address for target %s", 
+	   __FUNCTION__, hs->hostbatch[hidx]->NameIP());
+ }
+
+ /* TODO: Maybe I should allow real ping scan of directly connected
+    ethernet hosts? */
+ /* Then we do the mass ping (if required - IP-level pings) */
+ if (*pingtype == PINGTYPE_NONE) {
+   for(i=0; i < hs->current_batch_sz; i++)  {
+     initialize_timeout_info(&hs->hostbatch[i]->to);
+     hs->hostbatch[i]->flags |= HOST_UP; /*hostbatch[i].up = 1;*/
+   }
+ } else if (!arpping_done) 
+   massping(hs->hostbatch, hs->current_batch_sz, ports, *pingtype);
+ 
  return hs->hostbatch[hs->next_batch_no++];
 }
 
@@ -595,7 +606,7 @@ if (ptech.rawicmpscan || ptech.rawtcpscan || ptech.rawudpscan) {
      16 bytes of the TCP header
      ---
    = 104 byte snaplen */
-  pd = my_pcap_open_live(hostbatch[0]->device, 104, o.spoofsource, 20);
+  pd = my_pcap_open_live(hostbatch[0]->deviceName(), 104, o.spoofsource, 20);
 
   flt_dsthost = hostbatch[0]->v4source().s_addr;
   flt_baseport = sportbase;
@@ -606,7 +617,7 @@ if (ptech.rawicmpscan || ptech.rawtcpscan || ptech.rawudpscan) {
 	   sportbase , sportbase + 1, sportbase + 2, sportbase + 3, 
 	   sportbase + 4);
 
-  set_pcap_filter(hostbatch[0], pd, flt_icmptcp_5port, filter); 
+  set_pcap_filter(hostbatch[0]->deviceName(), pd, flt_icmptcp_5port, filter); 
 }
 
  blockinc = (int) (0.9999 + 8.0 / probes_per_host);
@@ -840,7 +851,7 @@ else {
 
  o.decoys[o.decoyturn].s_addr = target->v4source().s_addr;
  
- send_udp_raw_decoys( rawsd, target->v4hostip(), o.ttl, sportbase + trynum, probe_port, seq, o.extra_payload, o.extra_payload_length);
+ send_udp_raw_decoys( rawsd, NULL, target->v4hostip(), o.ttl, sportbase + trynum, probe_port, seq, o.extra_payload, o.extra_payload_length);
 
 
  return 0;
@@ -864,10 +875,10 @@ else {
  o.decoys[o.decoyturn].s_addr = target->v4source().s_addr;
 
  if (pingtype & PINGTYPE_TCP_USE_SYN) {   
-   send_tcp_raw_decoys( rawsd, target->v4hostip(), o.ttl, sportbase + trynum, probe_port, myseq, myack, TH_SYN, 0, NULL, 0, o.extra_payload, 
+   send_tcp_raw_decoys( rawsd, NULL, target->v4hostip(), o.ttl, sportbase + trynum, probe_port, myseq, myack, TH_SYN, 0, NULL, 0, o.extra_payload, 
 			o.extra_payload_length);
  } else {
-   send_tcp_raw_decoys( rawsd, target->v4hostip(), o.ttl, sportbase + trynum, probe_port, myseq, myack, TH_ACK, 0, NULL, 0, o.extra_payload, 
+   send_tcp_raw_decoys( rawsd, NULL, target->v4hostip(), o.ttl, sportbase + trynum, probe_port, myseq, myack, TH_ACK, 0, NULL, 0, o.extra_payload, 
 			o.extra_payload_length);
  }
 
@@ -976,7 +987,7 @@ if (ptech.icmpscan) {
        fprintf(stderr, "sendto: %s\n", strerror(sock_err));
      }
    } else {
-     send_ip_raw( rawsd, &o.decoys[decoy], target->v4hostip(), o.ttl, IPPROTO_ICMP, ping, icmplen);
+     send_ip_raw( rawsd, NULL, &o.decoys[decoy], target->v4hostip(), o.ttl, IPPROTO_ICMP, ping, icmplen);
    }
  }
 
diff --git a/tcpip.cc b/tcpip.cc
index d73f9a512..7f4737263 100644
--- a/tcpip.cc
+++ b/tcpip.cc
@@ -637,13 +637,13 @@ char dev[128];
 }
 
 /* Calls pcap_open_live and spits out an error (and quits) if the call
-   faile.  So a valid pcap_t will always be returned.  Note that the
+   fails.  So a valid pcap_t will always be returned.  Note that the
    Windows/UNIX versions are separate since they differ so much.
    Also, the actual my_pcap_open_live() for Windows is in
    mswin32/winip/winip.c.  It calls the function below if pcap is
    being used, otherwise it uses Windows raw sockets. */
 #ifdef WIN32
-pcap_t *my_real_pcap_open_live(char *device, int snaplen, int promisc, int to_ms) 
+pcap_t *my_real_pcap_open_live(const char *device, int snaplen, int promisc, int to_ms) 
 {
   char err0r[PCAP_ERRBUF_SIZE];
   pcap_t *pt;
@@ -676,7 +676,8 @@ pcap_t *my_real_pcap_open_live(char *device, int snaplen, int promisc, int to_ms
 }
 
 #else // !WIN32
-pcap_t *my_pcap_open_live(char *device, int snaplen, int promisc, int to_ms) 
+pcap_t *my_pcap_open_live(const char *device, int snaplen, int promisc, 
+			  int to_ms) 
 {
   char err0r[PCAP_ERRBUF_SIZE];
   pcap_t *pt;
@@ -745,7 +746,8 @@ int resolve(char *hostname, struct in_addr *ip) {
   return 0;
 }
 
-int send_tcp_raw_decoys( int sd, const struct in_addr *victim, int ttl,
+int send_tcp_raw_decoys( int sd, struct eth_nfo *eth, 
+			 const struct in_addr *victim, int ttl,
 			 u16 sport, u16 dport, u32 seq, u32 ack, u8 flags,
 			 u16 window, u8 *options, int optlen, char *data,
 			 u16 datalen) 
@@ -753,8 +755,9 @@ int send_tcp_raw_decoys( int sd, const struct in_addr *victim, int ttl,
   int decoy;
 
   for(decoy = 0; decoy < o.numdecoys; decoy++) 
-    if (send_tcp_raw(sd, &o.decoys[decoy], victim, ttl, sport, dport, seq, ack,
-		     flags, window, options, optlen, data, datalen) == -1)
+    if (send_tcp_raw(sd, eth, &o.decoys[decoy], victim, ttl, sport, dport, 
+		     seq, ack, flags, window, options, optlen, data, 
+		     datalen) == -1)
       return -1;
 
   return 0;
@@ -874,7 +877,7 @@ if (TCPIP_DEBUGGING > 1) {
 }
 
 /* You need to call sethdrinclude(sd) on the sending sd before calling this */
-int send_tcp_raw( int sd, const struct in_addr *source, 
+int send_tcp_raw( int sd, struct eth_nfo *eth, const struct in_addr *source, 
 		  const struct in_addr *victim, int ttl, 
 		  u16 sport, u16 dport, u32 seq, u32 ack, u8 flags,
 		  u16 window, u8 *options, int optlen, char *data, 
@@ -887,28 +890,47 @@ int send_tcp_raw( int sd, const struct in_addr *source,
 			     dport, seq, ack, flags, window, options, optlen, 
 			     data, datalen, &packetlen);
   if (!packet) return -1;
-  res = send_ip_packet(sd, packet, packetlen);
+  res = send_ip_packet(sd, eth, packet, packetlen);
 
   free(packet);
   return res;
 }
 
 /* Send a pre-built IPv4 packet */
-int send_ip_packet(int sd, u8 *packet, unsigned int packetlen) {
+int send_ip_packet(int sd, struct eth_nfo *eth, u8 *packet, unsigned int packetlen) {
   struct sockaddr_in sock;
   int res;
   struct ip *ip = (struct ip *) packet;
   struct tcphdr *tcp = NULL;
   udphdr_bsd *udp;
-
-  assert(sd >= 0);
+  u8 *eth_frame;
+  eth_t *ethsd;
+  bool ethsd_opened = false;
   assert(packet);
   assert( (int) packetlen > 0);
 
   // fragmentation requested && packet is bigger than MTU
   if (o.fragscan && ( packetlen - ip->ip_hl * 4 > (unsigned int) o.fragscan ))
-      return send_frag_ip_packet(sd, packet, packetlen, o.fragscan);
+      return send_frag_ip_packet(sd, eth, packet, packetlen, o.fragscan);
 
+  if (eth) {
+    eth_frame = (u8 *) safe_malloc(14 + packetlen);
+    memcpy(eth_frame + 14, packet, packetlen);
+    eth_pack_hdr(eth_frame, eth->dstmac, eth->srcmac, ETH_TYPE_IP);
+    if (!eth->ethsd) {
+      ethsd = eth_open(eth->devname);
+      if (!ethsd) 
+	fatal("send_ip_packet: Failed to open ethernet device (%s)", eth->devname);
+      ethsd_opened = true;
+    } else ethsd = eth->ethsd;
+    res = eth_send(ethsd, eth_frame, 14 + packetlen);
+    PacketTrace::trace(PacketTrace::SENT, packet, packetlen); 
+    if (ethsd_opened)
+      eth_close(ethsd);
+    return res;
+  }
+
+  assert(sd >= 0);
   memset(&sock, 0, sizeof(sock));
   sock.sin_family = AF_INET;
 #if HAVE_SOCKADDR_SA_LEN
@@ -926,9 +948,6 @@ int send_ip_packet(int sd, u8 *packet, unsigned int packetlen) {
       sock.sin_port = udp->uh_dport;
     }
   }
-  /* I'll try leaving out dest port and address and see what happens */
-  /* sock.sin_port = htons(dport);
-     sock.sin_addr.s_addr = victim->s_addr; */
   
   res = Sendto("send_ip_packet", sd, packet, BSDUFIX(ip->ip_len), 0,
 	       (struct sockaddr *)&sock,  (int)sizeof(struct sockaddr_in));
@@ -939,7 +958,7 @@ int send_ip_packet(int sd, u8 *packet, unsigned int packetlen) {
  * Minimal MTU for IPv4 is 68 and maximal IPv4 header size is 60
  * which gives us a right to cut TCP header after 8th byte
  * (shouldn't we inflate the header to 60 bytes too?) */
-int send_frag_ip_packet(int sd, u8 *packet, unsigned int packetlen, unsigned int mtu)
+int send_frag_ip_packet(int sd, struct eth_nfo *eth, u8 *packet, unsigned int packetlen, unsigned int mtu)
 {
     struct ip *ip = (struct ip *) packet;
     int headerlen = ip->ip_hl * 4; // better than sizeof(struct ip)
@@ -952,7 +971,7 @@ int send_frag_ip_packet(int sd, u8 *packet, unsigned int packetlen, unsigned int
 
     if (datalen <= mtu) {
         error("Warning: fragmentation (mtu=%i) requested but the payload is too small already (%i)", mtu, datalen);
-        return send_ip_packet(sd, packet, packetlen);
+        return send_ip_packet(sd, eth, packet, packetlen);
     }
 
     u8 *fpacket = (u8 *) safe_malloc(headerlen + mtu);
@@ -971,7 +990,7 @@ int send_frag_ip_packet(int sd, u8 *packet, unsigned int packetlen, unsigned int
 #endif
         if (fragment > 1) // copy data payload
             memcpy(fpacket + headerlen, packet + headerlen + (fragment - 1) * mtu, fdatalen);
-        res = send_ip_packet(sd, fpacket, headerlen + fdatalen);
+        res = send_ip_packet(sd, eth, fpacket, headerlen + fdatalen);
         if (res == -1)
             break;
     }
@@ -1157,13 +1176,14 @@ if (ip->ip_p== IPPROTO_UDP) {
  return 0;
 }
 
-int send_udp_raw_decoys( int sd, const struct in_addr *victim, int ttl, 
+int send_udp_raw_decoys( int sd, struct eth_nfo *eth, 
+			 const struct in_addr *victim, int ttl, 
 			 u16 sport, u16 dport, u16 ipid, char *data, 
 			 u16 datalen) {
   int decoy;
   
   for(decoy = 0; decoy < o.numdecoys; decoy++) 
-    if (send_udp_raw(sd, &o.decoys[decoy], victim, ttl, sport, dport, ipid,
+    if (send_udp_raw(sd, eth, &o.decoys[decoy], victim, ttl, sport, dport, ipid,
 		     data, datalen) == -1)
       return -1;
 
@@ -1262,7 +1282,8 @@ u8 *build_udp_raw(struct in_addr *source, const struct in_addr *victim,
   return packet;
 }
 
-int send_udp_raw( int sd, struct in_addr *source, const struct in_addr *victim,
+int send_udp_raw( int sd, struct eth_nfo *eth, struct in_addr *source, 
+		  const struct in_addr *victim,
  		  int ttl, u16 sport, u16 dport, u16 ipid, char *data, 
 		  u16 datalen) 
 {
@@ -1271,7 +1292,7 @@ int send_udp_raw( int sd, struct in_addr *source, const struct in_addr *victim,
   u8 *packet = build_udp_raw(source, victim, ttl, sport, dport, ipid, data, 
 			     datalen, &packetlen);
   if (!packet) return -1;
-  res = send_ip_packet(sd, packet, packetlen);
+  res = send_ip_packet(sd, eth, packet, packetlen);
 
   free(packet);
   return res;
@@ -1341,8 +1362,9 @@ if (TCPIP_DEBUGGING > 1) {
 
 
 /* You need to call sethdrinclude(sd) on the sending sd before calling this */
-int send_ip_raw( int sd, struct in_addr *source, const struct in_addr *victim, 
-		 int ttl, u8 proto, char *data, u16 datalen) 
+int send_ip_raw( int sd, struct eth_nfo *eth, struct in_addr *source, 
+		 const struct in_addr *victim, int ttl, u8 proto, 
+		 char *data, u16 datalen) 
 {
   unsigned int packetlen;
   int res = -1;
@@ -1351,7 +1373,7 @@ int send_ip_raw( int sd, struct in_addr *source, const struct in_addr *victim,
 			    data, datalen, &packetlen);
   if (!packet) return -1;
 
-  res = send_ip_packet(sd, packet, packetlen);
+  res = send_ip_packet(sd, eth, packet, packetlen);
 
   free(packet);
   return res;
@@ -1372,37 +1394,6 @@ fcntl(sd, F_SETFL, options);
 return 1;
 }
 
-int getsourceip(struct in_addr *src, const struct in_addr * const dst) {
-  int sd;
-  struct sockaddr_in sock;
-  recvfrom6_t socklen = sizeof(struct sockaddr_in);
-  u16 p1;
-
-  get_random_bytes(&p1, sizeof(p1));
-  if (p1 < 5000) p1 += 5000;
-
-  if ((sd = socket(AF_INET, SOCK_DGRAM, 0)) == -1)
-    {perror("Socket troubles"); return 0;}
-  sock.sin_family = AF_INET;
-  sock.sin_addr = *dst;
-  sock.sin_port = htons(p1);
-  if (connect(sd, (struct sockaddr *) &sock, sizeof(struct sockaddr_in)) == -1)
-    { perror("UDP connect()");
-    close(sd);
-    return 0;
-    }
-  memset(&sock, 0, sizeof(sock));
-  if (getsockname(sd, (SA *)&sock, &socklen) == -1) {
-    perror("getsockname");
-    close(sd);
-    return 0;
-  }
-
-  src->s_addr = sock.sin_addr.s_addr;
-  close(sd);
-  return 1; /* Calling function responsible for checking validity */
-}
-
 /* Read an IP packet using libpcap .  We return the packet and take
    a pcap descripter and a pointer to the packet length (which we set
    in the function. If you want a maximum length returned, you
@@ -1605,6 +1596,60 @@ bool pcap_recv_timeval_valid() {
 #endif
 }
 
+
+/* A trivial functon that maintains a cache of IP to MAC Address
+   entries.  If the command is ARPCACHE_GEt, this func looks for the
+   IPv4 address in ss and fills in the 'mac' parameter and returns
+   true if it is found.  Otherwise (not found), the function returns
+   false.  If the command is ARPCACHE_SET, the function adds an entry
+   with the given ip (ss) and mac address.  An existing entry for the
+   IP ss will be overwritten with the new MAC address.  true is always
+   returned for the set command. */
+bool NmapArpCache(int command, struct sockaddr_storage *ss, u8 *mac) {
+  struct sockaddr_in *sin = (struct sockaddr_in *) ss;
+  struct ArpCache { 
+    u32 ip; /* Network byte order */
+    u8 mac[6];
+  };
+  static struct ArpCache *Cache = NULL;
+  static int ArpCapacity = 0;
+  static int ArpCacheSz = 0;
+  int i;
+
+  if (sin->sin_family != AF_INET) 
+    fatal("NmapArpCache() can only take IPv4 addresses.  Sorry");
+  
+  if (command == ARPCACHE_GET) {
+    for(i=0; i < ArpCacheSz; i++) {
+      if (Cache[i].ip == sin->sin_addr.s_addr) {
+	memcpy(mac, Cache[i].mac, 6);
+	return true;
+      }
+    }
+    return false;
+  }
+  assert(command == ARPCACHE_SET);
+  if (ArpCacheSz == ArpCapacity) {
+    if (ArpCapacity == 0) ArpCapacity = 32;
+    else ArpCapacity <<= 2;
+  }
+  Cache = (struct ArpCache *) safe_realloc(Cache, 
+					   ArpCapacity * sizeof(struct ArpCache));
+
+  /* Ensure that it isn't already there ... */
+  for(i=0; i < ArpCacheSz; i++) {
+    if (Cache[i].ip == sin->sin_addr.s_addr) {
+      memcpy(Cache[i].mac, mac, 6);
+      return true;
+    }
+  }
+
+  /* Add it to the end of the list */
+  Cache[i].ip = sin->sin_addr.s_addr;
+  memcpy(Cache[i].mac, mac, 6);
+  return true;
+}
+
 /* Attempts to read one IPv4/Ethernet ARP reply packet from the pcap
    descriptor pd.  If it receives one, fills in sendermac (must pass
    in 6 bytes), senderIP, and rcvdtime (can be NULL if you don't care)
@@ -1722,9 +1767,6 @@ int read_arp_reply_pcap(pcap_t *pd, u8 *sendermac, struct in_addr *senderIP,
 
 int setTargetMACIfAvailable(Target *target, struct link_header *linkhdr,
 			      struct ip *ip, int overwrite) {
-  struct sockaddr_storage ss;
-  size_t sslen;
-
   if (!linkhdr || !target || !ip)
     return 1;
 
@@ -1741,8 +1783,7 @@ int setTargetMACIfAvailable(Target *target, struct link_header *linkhdr,
   if (memcmp(linkhdr->header+6, "\0\0\0\0\0\0", 6) == 0)
     return 5;
 
-  target->TargetSockAddr(&ss, &sslen);
-  if (IPisDirectlyConnected(&ss, sslen) == 1) {
+  if (target->ifType() == devt_ethernet && target->directlyConnected()) {
     /* Yay!  This MAC address seems valid */
     target->setMACAddress(linkhdr->header + 6);
     return 0;
@@ -1750,12 +1791,155 @@ int setTargetMACIfAvailable(Target *target, struct link_header *linkhdr,
 
   return 5;
 }
- 
+
+/* Issues an ARP request for the MAC of targetss (which will be placed
+   in targetmac if obtained) from the source IP (srcip) and source mac
+   (srcmac) given.  "The request is ussued using device dev to the
+   broadcast MAC address.  The transmission is attempted up to 3
+   times.  If none of these elicit a response, false will be returned.
+   If the mac is determined, true is returned. */
+bool doArp(const char *dev, const u8 *srcmac, 
+	   const struct sockaddr_storage *srcip, 
+	   const struct sockaddr_storage *targetip, u8 *targetmac) {
+  /* timeouts in microseconds ... the first ones are retransmit times, while 
+     the final one is when we give up */
+  int timeouts[] = { 100000, 400000, 800000 }; 
+  int max_sends = 3;
+  int num_sends = 0; // How many we have sent so far 
+  eth_t *ethsd;
+  u8 frame[ETH_HDR_LEN + ARP_HDR_LEN + ARP_ETHIP_LEN];
+  const struct sockaddr_in *targetsin = (struct sockaddr_in *) targetip;
+  const struct sockaddr_in *srcsin = (struct sockaddr_in *) srcip;
+  struct timeval start, now, rcvdtime;
+  int timeleft;
+  int listenrounds;
+  int rc;
+  pcap_t *pd;
+  struct in_addr rcvdIP;
+  bool foundit = false;
+
+  if (targetsin->sin_family != AF_INET || srcsin->sin_family != AF_INET)
+    fatal("%s can only handle IPv4 addresses", __FUNCTION__);
+
+  /* Start listening */
+  pd = my_pcap_open_live(dev, 50, 1, 25);
+  set_pcap_filter(dev, pd, flt_all, "arp and ether dst host %02X:%02X:%02X:%02X:%02X:%02X", srcmac[0], srcmac[1], srcmac[2], srcmac[3], srcmac[4], srcmac[5]);
+
+  /* Prepare probe and sending stuff */
+  ethsd = eth_open(dev);
+  if (!ethsd) fatal("%s: failed to open device %s", __FUNCTION__, dev);
+  eth_pack_hdr(frame, ETH_ADDR_BROADCAST, srcmac, ETH_TYPE_ARP);
+  arp_pack_hdr_ethip(frame + ETH_HDR_LEN, ARP_OP_REQUEST, srcmac, 
+		     srcsin->sin_addr, ETH_ADDR_BROADCAST, 
+		     targetsin->sin_addr);
+  gettimeofday(&start, NULL);
+  gettimeofday(&now, NULL);
+
+  while(!foundit && num_sends < max_sends) {
+    /* Send the sucker */
+    rc = eth_send(ethsd, frame, sizeof(frame));
+    if (rc != sizeof(frame)) {
+      error("WARNING: %s: eth_send of ARP packet returned %u rather than expected %d bytes\n", __FUNCTION__, rc, (int) sizeof(frame));
+    }
+    PacketTrace::traceArp(PacketTrace::SENT, (u8 *) frame, sizeof(frame), &now);
+    num_sends++;
+    
+    listenrounds = 0;
+    while(!foundit) {
+      gettimeofday(&now, NULL);
+      timeleft = timeouts[num_sends - 1] - TIMEVAL_SUBTRACT(now, start);
+      if (timeleft < 0) {
+	if (listenrounds > 0) break;
+	else timeleft = 25000;
+      }
+      /* Now listen until we reach our next timeout or get an answer */
+      rc = read_arp_reply_pcap(pd, targetmac, &rcvdIP, timeleft, &rcvdtime);
+      if (rc == -1) fatal("%s: Received -1 response from readarp_reply_pcap", 
+			  __FUNCTION__);
+      if (rc == 1) {
+	/* Yay, I got one! But is it the right one? */
+	if (rcvdIP.s_addr != targetsin->sin_addr.s_addr)
+	  continue;  /* D'oh! */
+	foundit = true;  /* WOOHOO! */
+      }
+    }
+  }
+
+  /* OK - let's close up shop ... */
+  pcap_close(pd);
+  eth_close(ethsd);
+  return foundit;
+}
+
+
+/* This function ensures that the next hop MAC address for a target is
+   filled in.  This address is the target's own MAC if it is directly
+   connected, and the next hop mac otherwise.  Returns true if the
+   address is set when the function ends, false if not.  This function
+   firt checks if it is already set, if not it tries the arp cache,
+   and if that fails it sends an ARP request itself.  This should be
+   called after an ARP scan if many directly connected machines are
+   involved. setDirectlyConnected() (whether true or false) should
+   have already been called on target before this.  The target device
+   and src mac address should also already be set.  */
+bool setTargetNextHopMAC(Target *target) {
+  struct sockaddr_storage targetss, srcss;
+  size_t sslen;
+  arp_t *a;
+  u8 mac[6];
+  struct arp_entry ae;
+
+  if (target->ifType() != devt_ethernet)
+    return false; /* Duh. */
+
+  /* First check if we alread have it, duh. */
+  if (target->NextHopMACAddress())
+    return true;
+
+  /* For connected machines, it is the same as the target addy */
+  if (target->directlyConnected() && target->MACAddress()) {
+    target->setNextHopMACAddress(target->MACAddress());
+    return true;
+  }
+
+  if (target->directlyConnected()) {
+    target->TargetSockAddr(&targetss, &sslen);
+  } else {
+    if (!target->nextHop(&targetss, &sslen))
+      fatal("%s: Failed to determine nextHop to target", __FUNCTION__);
+  }
+
+  /* First, let us check the Nmap arp cache ... */
+  if (NmapArpCache(ARPCACHE_GET, &targetss, mac)) {
+    target->setNextHopMACAddress(mac);
+    return true;
+  }
+  
+  /* Maybe the system ARP cache will be more helpful */
+  a = arp_open();
+  addr_ston((sockaddr *)&targetss, &ae.arp_pa);
+  if (arp_get(a, &ae)) {
+    NmapArpCache(ARPCACHE_SET, &targetss, ae.arp_ha.addr_eth.data);
+    target->setNextHopMACAddress(ae.arp_ha.addr_eth.data);
+  }
+
+  /* OK, the last choice is to send our own damn ARP request (and
+     retransmissions if necessary) to determine the MAC */
+  target->SourceSockAddr(&srcss, NULL);
+  if (doArp(target->deviceName(), target->SrcMACAddress(), &srcss, &targetss, 
+	    mac)) {
+    NmapArpCache(ARPCACHE_SET, &targetss, mac);
+    target->setNextHopMACAddress(mac);
+  }
+  
+  /* I'm afraid that we couldn't find it!  Maybe it doesn't exist?*/
+  return false;
+} 
 
 #ifndef WIN32 /* Windows version of next few functions is currently 
                  in wintcpip.c.  Should be merged at some point. */
 /* Set a pcap filter */
-void set_pcap_filter(Target *target,
+void set_pcap_filter(const char *device,
 		     pcap_t *pd, PFILTERFN filter, char *bpf, ...)
 {
   va_list ap;
@@ -1768,8 +1952,8 @@ void set_pcap_filter(Target *target,
 #endif
   char err0r[256];
   
-  if (pcap_lookupnet(target->device, &localnet, &netmask, err0r) < 0)
-    fatal("Failed to lookup device subnet/netmask: %s", err0r);
+  if (pcap_lookupnet(device, &localnet, &netmask, err0r) < 0)
+    fatal("Failed to lookup subnet/netmask for device (%s): %s", device, err0r);
   
   va_start(ap, bpf);
   if (vsnprintf(buf, sizeof(buf), bpf, ap) >= (int) sizeof(buf))
@@ -1777,11 +1961,12 @@ void set_pcap_filter(Target *target,
   va_end(ap);
 
   /* Due to apparent bug in libpcap */
-  if (islocalhost(target->v4hostip()))
-    buf[0] = '\0';
+  /* Maybe this bug no longer exists ... I'll comment out for now 
+   *      if (islocalhost(target->v4hostip()))
+   *      buf[0] = '\0'; */
 
   if (o.debugging)
-    log_write(LOG_STDOUT, "Packet capture filter (device %s): %s\n", target->device, buf);
+    log_write(LOG_STDOUT, "Packet capture filter (device %s): %s\n", device, buf);
   
   if (pcap_compile(pd, &fcode, buf, 0, netmask) < 0)
     fatal("Error compiling our pcap filter: %s\n", pcap_geterr(pd));
@@ -1850,18 +2035,25 @@ int flt_icmptcp_5port(const char *packet, unsigned int len)
 
 #ifndef WIN32 /* Currently the Windows code for next few functions is 
                  in wintcpip.c -- should probably be merged at some
-				 point */
+				 point.  The dev passed in must be at least 
+				 16 bytes long */
+
 int ipaddr2devname( char *dev, const struct in_addr *addr ) {
 struct interface_info *mydevs;
 int numdevs;
 int i;
+struct sockaddr_in *sin;
+
 mydevs = getinterfaces(&numdevs);
 
 if (!mydevs) return -1;
 
 for(i=0; i < numdevs; i++) {
-  if (addr->s_addr == mydevs[i].addr.s_addr) {
-    strcpy(dev, mydevs[i].name);
+  sin = (struct sockaddr_in *) &mydevs[i].addr;
+  if (sin->sin_family != AF_INET)
+    continue;
+  if (addr->s_addr == sin->sin_addr.s_addr) {
+    Strncpy(dev, mydevs[i].devname, 16);
     return 0;
   }
 }
@@ -1877,7 +2069,7 @@ mydevs = getinterfaces(&numdevs);
 if (!mydevs) return -1;
 
 for(i=0; i < numdevs; i++) {
-  if (!strcmp(dev, mydevs[i].name)) {  
+  if (!strcmp(dev, mydevs[i].devfullname)) {  
     memcpy(addr, (char *) &mydevs[i].addr, sizeof(struct in_addr));
     return 0;
   }
@@ -1889,30 +2081,32 @@ return -1;
 #ifndef WIN32 /* ifdef'd out for now because 'doze apparently doesn't
 		         support ioctl() */
 struct interface_info *getinterfaces(int *howmany) {
-  static int initialized = 0;
+  static bool initialized = 0;
   static struct interface_info *mydevs;
-  static int numinterfaces = 0;
+  static int numifaces = 0;
   int ii_capacity = 0;
   int sd, len, rc;
   char *p;
-  char buf[10240];
+  u8 *buf;
+  int bufsz;
   struct ifconf ifc;
   struct ifreq *ifr;
   struct ifreq tmpifr;
   struct sockaddr_in *sin;
-
+  u16 ifflags;
   if (!initialized) {
     initialized = 1;
 
-    ii_capacity = 32;
-    mydevs = (struct interface_info *) safe_malloc(sizeof(struct interface_info) * ii_capacity);
+    ii_capacity = 16;
+    mydevs = (struct interface_info *) safe_zalloc(sizeof(struct interface_info) * ii_capacity);
 
     /* Dummy socket for ioctl */
     sd = socket(AF_INET, SOCK_DGRAM, 0);
     if (sd < 0) pfatal("socket in getinterfaces");
-    memset(buf, 0, sizeof(buf));
-    ifc.ifc_len = sizeof(buf);
-    ifc.ifc_buf = buf;
+    bufsz = 20480;
+    buf = (u8 *) safe_zalloc(bufsz);
+    ifc.ifc_len = bufsz;
+    ifc.ifc_buf = (char *) buf;
     if (ioctl(sd, SIOCGIFCONF, &ifc) < 0) {
       fatal("Failed to determine your configured interfaces!\n");
     }
@@ -1935,7 +2129,7 @@ struct interface_info *getinterfaces(int *howmany) {
     printf("Size of struct ifreq: %d\n", sizeof(struct ifreq));
 #endif
 
-    for(; ifr && *((char *)ifr) && ((char *)ifr) < buf + ifc.ifc_len; 
+    for(; ifr && *((u8 *)ifr) && ((u8 *)ifr) < buf + ifc.ifc_len; 
 	((*(char **)&ifr) += len )) {
 #if TCPIP_DEBUGGING
       printf("ifr_name size = %d\n", sizeof(ifr->ifr_name));
@@ -1946,32 +2140,62 @@ struct interface_info *getinterfaces(int *howmany) {
       if (!*((char *)ifr))
         continue;
 
+      /* We currently only handle IPv4 */
       sin = (struct sockaddr_in *) &ifr->ifr_addr;
-      memcpy(&(mydevs[numinterfaces].addr), (char *) &(sin->sin_addr), sizeof(struct in_addr));
+      if (sin->sin_family != AF_INET)
+	continue;
+      memcpy(&(mydevs[numifaces].addr), sin, min(sizeof(mydevs[numifaces].addr), sizeof(sin)));
+      Strncpy(mydevs[numifaces].devname, ifr->ifr_name, sizeof(mydevs[numifaces].devname));
+      /* devname isn't allowed to have alias qualification */
+      if ((p = strchr(mydevs[numifaces].devname, ':')))
+	*p = '\0';
+      Strncpy(mydevs[numifaces].devfullname, ifr->ifr_name, sizeof(mydevs[numifaces].devfullname));
 
-      Strncpy(tmpifr.ifr_name, ifr->ifr_name, IFNAMSIZ);
-      memcpy(&(tmpifr.ifr_addr), &(sin->sin_addr), sizeof(tmpifr.ifr_addr));
+      Strncpy(tmpifr.ifr_name, ifr->ifr_name, sizeof(tmpifr.ifr_name));
+      memcpy(&(tmpifr.ifr_addr), sin, MIN(sizeof(tmpifr.ifr_addr), sizeof(sin)));
       rc = ioctl(sd, SIOCGIFNETMASK, &tmpifr);
       if (rc < 0 && errno != EADDRNOTAVAIL)
-	pfatal("Failed to determine the netmask of %s!", ifr->ifr_name);
+	pfatal("Failed to determine the netmask of %s!", tmpifr.ifr_name);
       else if (rc < 0)
-	mydevs[numinterfaces].netmask.s_addr = (unsigned) -1;
+	mydevs[numifaces].netmask_bits = 32;
       else {
 	sin = (struct sockaddr_in *) &(tmpifr.ifr_addr); /* ifr_netmask only on Linux */
-	memcpy(&(mydevs[numinterfaces].netmask), (char *) &(sin->sin_addr), sizeof(struct in_addr));
+	addr_stob(&(tmpifr.ifr_addr), &mydevs[numifaces].netmask_bits);
       }
-      /* In case it is a stinkin' alias */
-      if ((p = strchr(ifr->ifr_name, ':')))
-	*p = '\0';
-      Strncpy(mydevs[numinterfaces].name, ifr->ifr_name, IFNAMSIZ);
 
-      //  printf("ifr name=%s addr=%s, mask=%X\n", mydevs[numinterfaces].name, inet_ntoa(mydevs[numinterfaces].addr), mydevs[numinterfaces].netmask.s_addr); 
-#if TCPIP_DEBUGGING
-      printf("Interface %d is %s\n",numinterfaces,mydevs[numinterfaces].name);
-#endif
+      //  printf("ifr name=%s addr=%s, mask=%X\n", mydevs[numifaces].name, inet_ntoa(mydevs[numifaces].addr), mydevs[numifaces].netmask.s_addr); 
 
-      numinterfaces++;
-      if (numinterfaces == ii_capacity)  {      
+      /* Now we need to determine the device type ... this technique
+	 is kinda iffy ... may not be portable. */
+      /* First we get the flags */
+      Strncpy(tmpifr.ifr_name, ifr->ifr_name, sizeof(tmpifr.ifr_name));
+      memcpy(&(tmpifr.ifr_addr), sin, MIN(sizeof(tmpifr.ifr_addr), sizeof(sin)));
+      rc = ioctl(sd, SIOCGIFFLAGS, &tmpifr);
+      if (rc < 0) fatal("Failed to get IF Flags for device %s", ifr->ifr_name);
+      ifflags = tmpifr.ifr_flags;
+
+      if (ifflags & IFF_LOOPBACK)
+	mydevs[numifaces].device_type = devt_loopback;
+      else if (ifflags & IFF_BROADCAST) {
+	mydevs[numifaces].device_type = devt_ethernet;
+	/* Get the MAC Address ... */
+	Strncpy(tmpifr.ifr_name, mydevs[numifaces].devname, sizeof(tmpifr.ifr_name));
+	memcpy(&(tmpifr.ifr_addr), sin, MIN(sizeof(tmpifr.ifr_addr), MIN(sizeof(tmpifr.ifr_addr), sizeof(sin))));
+	rc = ioctl(sd, SIOCGIFHWADDR, &tmpifr);
+	if (rc < 0 && errno != EADDRNOTAVAIL)
+	  pfatal("Failed to determine the MAC address of %s!", tmpifr.ifr_name);
+	else if (rc >= 0)
+	  memcpy(mydevs[numifaces].mac, &tmpifr.ifr_addr.sa_data, 6);
+      }
+      else if (ifflags & IFF_POINTOPOINT)
+	mydevs[numifaces].device_type = devt_p2p;
+      else mydevs[numifaces].device_type = devt_other;
+
+      if (ifflags & IFF_UP)
+	mydevs[numifaces].device_up = true;
+      else mydevs[numifaces].device_up = false;
+      numifaces++;
+      if (numifaces == ii_capacity)  {      
 	ii_capacity <<= 2;
 	mydevs = (struct interface_info *) realloc(mydevs, sizeof(struct interface_info) * ii_capacity);
 	assert(mydevs);
@@ -1980,92 +2204,42 @@ struct interface_info *getinterfaces(int *howmany) {
       /* len = MAX(sizeof(struct sockaddr), ifr->ifr_addr.sa_len);*/
       len = ifr->ifr_addr.sa_len + sizeof(ifr->ifr_name);
 #endif 
-      mydevs[numinterfaces].name[0] = '\0';
+      mydevs[numifaces].devname[0] = mydevs[numifaces].devfullname[0] = '\0';
     }
+    free(buf);
     close(sd);
   }
-  if (howmany) *howmany = numinterfaces;
+  if (howmany) *howmany = numifaces;
   return mydevs;
 }
 #endif
 
-/* Check whether an IP address appears to be directly connected to an
-   interface on the computer (e.g. on the same ethernet network rather
-   than having to route).  Returns 1 if yes, -1 if maybe, 0 if not.
-   The Windows version tries to give an accurate answer, which I'm
-   not sure is the right thing to do in rawsock mode... */
-int IPisDirectlyConnected(struct sockaddr_storage *ss, size_t ss_len) {
-#if WIN32
-  struct sockaddr_in *sin = (struct sockaddr_in *) ss;
-  MIB_IPFORWARDROW route;
-  if(get_best_route(sin->sin_addr.s_addr, &route) < 0)
-         return -1;
-  return route.dwForwardType == 3 ? 1 : 0;
-#else
-  struct interface_info *interfaces;
-  int numinterfaces;
-  int i;
-  struct sockaddr_in *sin = (struct sockaddr_in *) ss;
-
-  if (sin->sin_family != AF_INET)
-    fatal("IPisDirectlyConnected passed a non IPv4 address");
-
-  interfaces =  getinterfaces(&numinterfaces);
-
-  for(i=0; i < numinterfaces; i++) {
-    if ((interfaces[i].addr.s_addr & interfaces[i].netmask.s_addr) == (sin->sin_addr.s_addr & interfaces[i].netmask.s_addr))
-      return 1;
-  }
-  return 0;
-#endif /* !WIN32 */
-}
-
-
-/* An awesome function to determine what interface a packet to a given
-   destination should be routed through.  It returns NULL if no appropriate
-   interface is found, oterwise it returns the device name and fills in the
-   source parameter.   Some of the stuff is
-   from Stevens' Unix Network Programming V2.  He had an easier suggestion
-   for doing this (in the book), but it isn't portable :( */
-#ifndef WIN32 /* Windows functionality is currently in wintcpip.c --
-                 should probably be merged at some point */
-
-char *routethrough(const struct in_addr * const dest, struct in_addr *source) {
-  static int initialized = 0;
-  int i;
-  struct in_addr addy;
-  static enum { procroutetechnique, connectsockettechnique, guesstechnique } technique = procroutetechnique;
-  char buf[10240];
-  struct interface_info *mydevs;
-  static struct myroute {
-    struct interface_info *dev;
-    u32 mask;
-    u32 dest;
-  } *myroutes;
-  int myroutes_capacity = 0;
-  int numinterfaces = 0;
-  char *p, *endptr;
-  char iface[64];
+/* Parse the system routing table, converting each route into a
+   sys_route entry.  Returns an array of sys_routes.  numroutes is set
+   to the number of routes in the array.  The routing table is only
+   read the first time this is called -- later results are cached.
+   The returned route array is sorted by netmask with the most
+   specific matches first. */
+struct sys_route *getsysroutes(int *howmany) {
+  int route_capacity = 128;
+  static struct sys_route *routes = NULL;
   static int numroutes = 0;
-  FILE *routez;
+  FILE *routefp;
+  char buf[1024];
+  char iface[16];
+  char *p, *endptr;
+  struct interface_info *ifaces;
+  int numifaces = 0;
+  int i;
 
-  if (!dest) fatal("routethrough passed a NULL dest address");
-
-  if (!initialized) {  
-    /* Dummy socket for ioctl */
-    initialized = 1;
-    mydevs = getinterfaces(&numinterfaces);
-    myroutes_capacity = 64;
-    myroutes = (struct myroute *) safe_malloc((sizeof(struct myroute) * myroutes_capacity));
-    /* Now we must go through several techniques to determine info */
-    routez = fopen("/proc/net/route", "r");
-
-    if (routez) {
-      /* OK, linux style /proc/net/route ... we can handle this ... */
-      /* Now that we've got the interfaces, we g0 after the r0ut3Z */
-      
-      fgets(buf, sizeof(buf), routez); /* Kill the first line */
-      while(fgets(buf,sizeof(buf), routez)) {
+  if (!routes) {
+    routes = (struct sys_route *) safe_zalloc(route_capacity * sizeof(struct sys_route));
+    ifaces = getinterfaces(&numifaces);
+    /* First let us try Linux-style /proc/net/route */
+    routefp = fopen("/proc/net/route", "r");
+    if (routefp) {
+      fgets(buf, sizeof(buf), routefp); /* Kill the first line (column headers) */
+      while(fgets(buf,sizeof(buf), routefp)) {
 	p = strtok(buf, " \t\n");
 	if (!p) {
 	  error("Could not find interface in /proc/net/route line");
@@ -2075,17 +2249,23 @@ char *routethrough(const struct in_addr * const dest, struct in_addr *source) {
 	  continue; /* Deleted route -- any other valid reason for
 		       a route to start with an asterict? */
 	Strncpy(iface, p, sizeof(iface));
-	if ((p = strchr(iface, ':'))) {
-	  *p = '\0'; /* To support IP aliasing */
-	}
 	p = strtok(NULL, " \t\n");
 	endptr = NULL;
-	myroutes[numroutes].dest = strtoul(p, &endptr, 16);
+	routes[numroutes].dest = strtoul(p, &endptr, 16);
 	if (!endptr || *endptr) {
 	  error("Failed to determine Destination from /proc/net/route");
 	  continue;
 	}
-	for(i=0; i < 6; i++) {
+
+	/* Now for the gateway */
+	p = strtok(NULL, " \t\n");
+	if (!p) break;
+	endptr = NULL;
+	routes[numroutes].gw.s_addr = strtoul(p, &endptr, 16);
+	if (!endptr || *endptr) {
+	  error("Failed to determine gw for %s from /proc/net/route\n", iface);
+	}
+	for(i=0; i < 5; i++) {
 	  p = strtok(NULL, " \t\n");
 	  if (!p) break;
 	}
@@ -2094,101 +2274,111 @@ char *routethrough(const struct in_addr * const dest, struct in_addr *source) {
 	  continue;
 	}
 	endptr = NULL;
-	myroutes[numroutes].mask = strtoul(p, &endptr, 16);
+	routes[numroutes].netmask = strtoul(p, &endptr, 16);
 	if (!endptr || *endptr) {
 	  error("Failed to determine mask from /proc/net/route");
 	  continue;
 	}
-
-
-#if TCPIP_DEBUGGING
-	  printf("#%d: for dev %s, The dest is %X and the mask is %X\n", numroutes, iface, myroutes[numroutes].dest, myroutes[numroutes].mask);
-#endif
-	  for(i=0; i < numinterfaces; i++)
-	    if (!strcmp(iface, mydevs[i].name)) {
-	      myroutes[numroutes].dev = &mydevs[i];
-	      break;
-	    }
-	  if (i == numinterfaces) 
-	    fatal("Failed to find interface %s mentioned in /proc/net/route\n", iface);
-	  numroutes++;
-	  if (numroutes == myroutes_capacity) {
-	    // Gotta grow it
-	    myroutes_capacity <<= 3;
-	    myroutes = (struct myroute *) realloc(myroutes, myroutes_capacity * (sizeof(struct myroute)));
-	    assert(myroutes);
+	for(i=0; i < numifaces; i++) {
+	  if (!strcmp(iface, ifaces[i].devfullname)) {
+	    routes[numroutes].device = &ifaces[i];
+	    break;
 	  }
-      }
-      fclose(routez);
-    } else {
-      technique = connectsockettechnique;
-    }
-  } else {  
-    mydevs = getinterfaces(&numinterfaces);
-  }
-  /* WHEW, that takes care of initializing, now we have the easy job of 
-     finding which route matches */
-  if (islocalhost(dest)) {
-
-    /* I used to set the source to 127.0.0.1 in this case, but that
-       seems to cause problems on Linux, where the dang system will
-       reply from another addy:
-         0.160995    127.0.0.1 -> 192.168.0.42 TCP 63331 > 1 [SYN] Seq=1321326640 Ack=0 Win=1024 Len=0
-         0.161027 192.168.0.42 -> 192.168.0.42 TCP 1 > 63331 [RST, ACK] Seq=0 Ack=1321326641 Win=0 Len=0
-         So I'll try just using the localhost device, but keeping the
-         more proper source 
-    //    if (source)
-    //      source->s_addr = htonl(0x7F000001);
-    */
-    /* Now we find the localhost interface name, assuming 127.0.0.1 is
-       localhost (it damn well better be!)... */
-    for(i=0; i < numinterfaces; i++) {    
-      if (mydevs[i].addr.s_addr == htonl(0x7F000001)) {
-	return mydevs[i].name;
-      }
-    }
-    return NULL;
-  }
-
-  if (technique == procroutetechnique) {    
-    for(i=0; i < numroutes; i++) {  
-      if ((dest->s_addr & myroutes[i].mask) == myroutes[i].dest) {
-	if (source) {
-	  source->s_addr = myroutes[i].dev->addr.s_addr;
 	}
-	return myroutes[i].dev->name;      
-      }
-    }
-  } else if (technique == connectsockettechnique) {
-      if (!getsourceip(&addy, dest))
-	return NULL;
-      if (!addy.s_addr)  {  /* Solaris 2.4 */
-        struct hostent *myhostent = NULL;
-        char myname[MAXHOSTNAMELEN + 1];
-        if (gethostname(myname, MAXHOSTNAMELEN) || 
-           !(myhostent = gethostbyname(myname)))
-	  fatal("Cannot get hostname!  Try using -S <my_IP_address> or -e <interface to scan through>\n");
-        memcpy(&(addy.s_addr), myhostent->h_addr_list[0], sizeof(struct in_addr));
-#if ( TCPIP_DEBUGGING )
-      printf("We skillfully deduced that your address is %s\n", 
-        inet_ntoa(*source));
-#endif
+	if (i == numifaces) {
+	  error("Failed to find device %s which was referenced in /proc/net/route", iface);
+	  continue;
+	}
+	numroutes++;
+	if (numroutes >= route_capacity) {
+	  route_capacity <<= 2;
+	  routes = (struct sys_route *) realloc(routes, route_capacity * sizeof(struct sys_route));
+	}
       }
+    } else fatal("Need to write portable route gathering code");
 
-      /* Now we insure this claimed address is a real interface ... */
-      for(i=0; i < numinterfaces; i++)
-	if (mydevs[i].addr.s_addr == addy.s_addr) {
-	  if (source) {
-	    source->s_addr = addy.s_addr;	  
-	  }
-	  return mydevs[i].name;
-	}  
-      return NULL;
-    } else 
-      fatal("I know sendmail technique ... I know rdist technique ... but I don't know what the hell kindof technique you are attempting!!!");
-    return NULL;
+    /* Ensure that the route array is sorted by netmask */
+    for(i=1; i < numroutes; i++) {
+      if (ntohl(routes[i].netmask) > ntohl(routes[i-1].netmask))
+	fatal("Uh-oh -- your route list isn't sorted by Netmask. Please notify fyodor@insecure.org\n");
+    }
+  }
+  if (!howmany) fatal("NULL howmany ptr passed to getsysroutes()");
+  *howmany = numroutes;
+  return routes;
 }
-#endif /* WIN32 */
+
+/* Takes a destination address (dst) and tries to determine the
+   source address and interface necessary to route to this address.
+   If no route is found, false is returned and rnfo is undefined.  If
+   a route is found, true is returned and rnfo is filled in with all
+   of the routing details */
+bool route_dst(const struct sockaddr_storage *const dst, struct route_nfo *rnfo) {
+  struct interface_info *ifaces;
+  int numifaces = 0;
+  struct sys_route *routes;
+  int numroutes = 0;
+  int ifnum;
+  int i;
+  u32 mask;
+  struct sockaddr_in *ifsin, *dstsin;
+  if (!dst) fatal("route_nfo passed a NULL dst address");
+  dstsin = (struct sockaddr_in *)dst;
+
+  if (dstsin->sin_family != AF_INET)
+    fatal("Sorry -- route_dst currently only supports IPv4");
+
+  ifaces = getinterfaces(&numifaces);
+  /* I suppose that I'll first determine whether it is a direct connect instance */
+  for(ifnum=0; ifnum < numifaces; ifnum++) {
+    ifsin = (struct sockaddr_in *) &ifaces[ifnum].addr;
+    if (ifsin->sin_family != AF_INET) continue;
+    if (dstsin->sin_addr.s_addr == ifsin->sin_addr.s_addr && 
+	ifaces[ifnum].device_type != devt_loopback) {
+      /* Trying to scan one of the machine's own interfaces -- we need
+	 to use the localhost device for this */
+      for(i=0; i < numifaces; i++)
+	if (ifaces[i].device_type == devt_loopback)
+	  break;
+      if (i < numifaces) {
+	rnfo->direct_connect = true;
+	memcpy(&rnfo->ii, &ifaces[i], sizeof(rnfo->ii));
+	/* But the source address we want to use is the target addy */
+	memcpy(&rnfo->srcaddr, &ifaces[ifnum].addr, sizeof(rnfo->srcaddr));
+	return true;
+      }
+      /* Hmmm ... no localhost -- I guess I'll just try using the device 
+	 itself */
+    }
+    mask = htonl((unsigned long) (0-1) << (32 - ifaces[ifnum].netmask_bits));
+    if ((ifsin->sin_addr.s_addr & mask) == (dstsin->sin_addr.s_addr & mask)) {
+      rnfo->direct_connect = 1;
+      memcpy(&rnfo->ii, &ifaces[ifnum], sizeof(rnfo->ii));
+      memcpy(&rnfo->srcaddr, &ifaces[ifnum].addr, sizeof(rnfo->srcaddr));
+      return true;
+    }
+  }
+
+  /* OK, so it isn't directly connected.  Let's do some routing! */
+  rnfo->direct_connect = false;
+
+  routes = getsysroutes(&numroutes);
+  /* Now we simply go through the list and take the first match */
+  for(i=0; i < numroutes; i++) {
+    if ((routes[i].dest & routes[i].netmask) == 
+	(dstsin->sin_addr.s_addr & routes[i].netmask)) {
+      /* Yay, found a matching route. */
+      memcpy(&rnfo->ii, routes[i].device, sizeof(rnfo->ii));
+      memcpy(&rnfo->srcaddr, &routes[i].device->addr, sizeof(rnfo->srcaddr));
+      ifsin = (struct sockaddr_in *) &rnfo->nexthop;
+      ifsin->sin_family = AF_INET;
+      ifsin->sin_addr.s_addr = routes[i].gw.s_addr;
+      return true;
+    }
+  }
+  return false;
+}
+
 
 /* Maximize the receive buffer of a socket descriptor (up to 500K) */
 void max_rcvbuf(int sd) {
@@ -2301,36 +2491,6 @@ int recvtime(int sd, char *buf, int len, int seconds, int *timedout) {
   return -1;
 }
 
-/* This attempts to calculate the round trip time (rtt) to a host by timing a
-   connect() to a port which isn't listening.  A better approach is to time a
-   ping (since it is more likely to get through firewalls (note, this isn't
-   always true nowadays --fyodor).  This is now 
-   implemented in isup() for users who are root.  */
-unsigned long calculate_sleep(struct in_addr target) {
-  struct timeval begin, end;
-  int sd;
-  struct sockaddr_in sock;
-  int res;
-
-  if ((sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1)
-    {perror("Socket troubles"); exit(1);}
-
-  sock.sin_family = AF_INET;
-  sock.sin_addr.s_addr = target.s_addr;
-  sock.sin_port = htons(o.magic_port);
-
-  gettimeofday(&begin, NULL);
-  if ((res = connect(sd, (struct sockaddr *) &sock, 
-		     sizeof(struct sockaddr_in))) != -1)
-    fprintf(stderr, "WARNING: You might want to use a different value of -g (or change o.magic_port in the include file), as it seems to be listening on the target host!\n");
-  close(sd);
-  gettimeofday(&end, NULL);
-  if (end.tv_sec - begin.tv_sec > 5 ) /*uh-oh!*/
-    return 0;
-  return (end.tv_sec - begin.tv_sec) * 1000000 + (end.tv_usec - begin.tv_usec);
-}
-
-
 /* Examines the given tcp packet and obtains the TCP timestamp option
    information if available.  Note that the CALLER must ensure that
    "tcp" contains a valid header (in particular the th_off must be the
@@ -2392,10 +2552,6 @@ int retries = 0;
 int sleeptime = 0;
 
 do {
-  if (TCPIP_DEBUGGING > 1) {  
-    log_write(LOG_STDOUT, "trying sendto(%d, packet, %d, 0, %s, %d)",
-	   sd, len, inet_ntoa(sin->sin_addr), tolen);
-  }
   if ((res = sendto(sd, (const char *) packet, len, flags, to, tolen)) == -1) {
     int err = socket_errno();
 
@@ -2414,9 +2570,6 @@ do {
 
  PacketTrace::trace(PacketTrace::SENT, packet, len); 
 
-if (TCPIP_DEBUGGING > 1)
-  log_write(LOG_STDOUT, "successfully sent %d bytes of raw_tcp!\n", res);
-
 return res;
 }
 #endif
@@ -2502,37 +2655,3 @@ int ArpProbe::storePacket(u8 *arppacket, u32 len) {
   ipquery = (struct in_addr *) ((u8 *)arppacket + 38);
   return 0;
 }
-
-
-
-/* Finds MAC address of target->device and sets into target.  Caches
- the results so that it will be really quick if you have many targets
- that send out with the same device, and you pass them roughly in
- order (only caches one).  Returns -1 if cannot find the MAC address
- (often meaning this is localhost, or some other non-ethernet device.
- Returns 0 upon success. */
-int setTargetSrcMACAddressFromDevName(Target *target) {
-  static u8 MAC_Cache[6];
-  static char MAC_Cache_Dev[64] = {0};
-
-  assert(*target->device);
-  if (strcmp(target->device, MAC_Cache_Dev) == 0)
-    target->setSrcMACAddress(MAC_Cache);
-  else {
-    eth_t *e;
-    eth_addr_t et;
-
-    assert(sizeof(et) >= 6);
-    e = eth_open(target->device);
-    if (!e) 
-      fatal("dnet: Failed to open ethernet device %s\n", target->device);
-    if (eth_get(e, &et) == -1)
-      return -1;
-      //      fatal("dnet: Failed to obtain HW MAC address for ethernet device %s\n", target->device);
-    eth_close(e);
-    Strncpy(MAC_Cache_Dev, target->device, sizeof(MAC_Cache_Dev));
-    memcpy(MAC_Cache, (const char *) &et, 6);
-    target->setSrcMACAddress(MAC_Cache);
-  }
-  return 0;
-}
diff --git a/tcpip.h b/tcpip.h
index 0d4dc1aee..dde2f56ab 100644
--- a/tcpip.h
+++ b/tcpip.h
@@ -241,12 +241,17 @@ extern "C" {
 #include <setjmp.h>
 #include <errno.h>
 #include <signal.h>
+#include <dnet.h>
+#include <netinet/ip_icmp.h> 
+
+typedef enum { devt_ethernet, devt_loopback, devt_p2p, devt_other  } devtype;
 
 #include "nmap_error.h"
 #include "utils.h"
 #include "nmap.h"
 #include "global_structures.h"
 
+
 #ifndef DEBUGGING
 #define DEBUGGING 0
 #endif
@@ -323,10 +328,46 @@ struct link_header {
   u8 header[MAX_LINK_HEADERSZ];
 };
 
+/* Relevant (to Nmap) information about an interface */
 struct interface_info {
-  char name[64];
-  struct in_addr addr;
-  struct in_addr netmask;
+  char devname[16];
+  char devfullname[16]; /* can include alias info, such as eth0:2. */
+  struct sockaddr_storage addr;
+  u16 netmask_bits; /* CIDR-style.  So 24 means class C (255.255.255.0)*/
+  devtype device_type; /* devt_ethernet, devt_loopback, devt_p2p, devt_other */
+  bool device_up; /* True if the device is up (enabled) */
+  u8 mac[6]; /* Interface MAC address if device_type is devt_ethernet */
+};
+
+struct route_nfo {
+  struct interface_info ii;
+
+/* true if the target is directly connected on the network (no routing
+   required. */
+  bool direct_connect; 
+
+/* This is the source address that should be used by the packets.  It
+   may be different than ii.addr if you are using localhost interface
+   to scan the IP of another interface on the machine */
+  struct sockaddr_storage srcaddr; 
+
+  /* If direct_connect is 0, this is filled in with the next hop
+     required to route to the target */
+  struct sockaddr_storage nexthop;
+};
+
+struct sys_route {
+  struct interface_info *device;
+  u32 dest;
+  u32 netmask;
+  struct in_addr gw; /* gateway - 0 if none */
+};
+
+struct eth_nfo {
+  char srcmac[6];
+  char dstmac[6];
+  eth_t *ethsd; // Optional, but improves performance.  Set to NULL if unavail
+  char devname[16]; // Only needed if ethsd is NULL.
 };
 
 #ifndef HAVE_STRUCT_IP
@@ -522,26 +563,41 @@ int resolve(char *hostname, struct sockaddr_storage *ss, size_t *sslen,
    result in ip .  returns 0 if hostname cannot
    be resolved */
 int resolve(char *hostname, struct in_addr *ip);
-/* An awesome function to determine what interface a packet to a given
-   destination should be routed through.  It returns NULL if no appropriate
-   interface is found, oterwise it returns the device name and fills in the
-   source parameter */
-char *routethrough(const struct in_addr * const dest, struct in_addr *source);
+
+/* Takes a destination address (dst) and tries to determine the
+   source address and interface necessary to route to this address.
+   If no route is found, false is returned and rnfo is undefined.  If
+   a route is found, true is returned and rnfo is filled in with all
+   of the routing details */
+bool route_dst(const struct sockaddr_storage *const dst, struct route_nfo *rnfo);
+/* Determines what interface packets destined to 'dest' should be
+   routed through.  It can also discover the appropriate next hop (if
+   any) for ethernet routing.  If direct_connect is passed in, it will
+   be set to 1 if dst is directly connected on the ifentry network and
+   0 if it requires routing.  If nexthop_ip is not NULL, and routing
+   is required, the next hop is filled into nexthop_ip.  This function
+   returns false if no apporpiate interface or route was found and
+   true if it succeeds. */
+bool routethrough(const struct sockaddr_storage * const dest, 
+		  struct intf_entry *ifentry, 
+		  int *direct_connect, struct sockaddr_storage *nexthop_ip);
+
 unsigned short in_cksum(u16 *ptr,int nbytes);
 
 /* Build and send a raw tcp packet.  If TTL is -1, a partially random
    (but likely large enough) one is chosen */
-int send_tcp_raw( int sd, const struct in_addr *source, 
+int send_tcp_raw( int sd, struct eth_nfo *eth, const struct in_addr *source, 
 		  const struct in_addr *victim, int ttl, 
 		  u16 sport, u16 dport, u32 seq, u32 ack, u8 flags,
 		  u16 window, u8 *options, int optlen, char *data, 
 		  u16 datalen);
-int send_udp_raw( int sd, struct in_addr *source, const struct in_addr *victim,
- 		  int ttl, u16 sport, u16 dport, u16 ipid, char *data, 
-		  u16 datalen);
+int send_udp_raw( int sd, struct eth_nfo *eth, struct in_addr *source, 
+		  const struct in_addr *victim, int ttl, u16 sport, 
+		  u16 dport, u16 ipid, char *data, u16 datalen);
 
-int send_ip_raw( int sd, struct in_addr *source, const struct in_addr *victim, 
-		 int ttl, u8 proto, char *data, u16 datalen);
+int send_ip_raw( int sd, struct eth_nfo *eth, struct in_addr *source, 
+		 const struct in_addr *victim, int ttl, u8 proto, 
+		 char *data, u16 datalen);
 
 /* Builds a TCP packet (including an IP header) by packing the fields
    with the given information.  It allocates a new buffer to store the
@@ -586,26 +642,31 @@ u8 *build_ip_raw(const struct in_addr *source, const struct in_addr *victim,
 		 u32 *packetlen);
 
 /* Send a pre-built IPv4 packet */
-int send_ip_packet(int sd, u8 *packet, unsigned int packetlen);
+int send_ip_packet(int sd, struct eth_nfo *eth, u8 *packet, 
+		   unsigned int packetlen);
 
 /* Create and send all fragments of the pre-built packet */
 /* mtu = MTU - ipv4_headerlen */
-int send_frag_ip_packet(int sd, u8 *packet, unsigned int packetlen, unsigned int mtu);
+int send_frag_ip_packet(int sd, struct eth_nfo *eth, u8 *packet, 
+			unsigned int packetlen, unsigned int mtu);
 
 /* Decoy versions of the raw packet sending functions ... */
-int send_tcp_raw_decoys( int sd, const struct in_addr *victim, int ttl,
+int send_tcp_raw_decoys( int sd, struct eth_nfo *eth, 
+			 const struct in_addr *victim, int ttl,
 			 u16 sport, u16 dport, u32 seq, u32 ack, u8 flags,
 			 u16 window, u8 *options, int optlen, char *data,
 			 u16 datalen);
 
-int send_udp_raw_decoys( int sd, const struct in_addr *victim, int ttl, 
+int send_udp_raw_decoys( int sd, struct eth_nfo *eth, 
+			 const struct in_addr *victim, int ttl, 
 			 u16 sport, u16 dport, u16 ipid, char *data, 
 			 u16 datalen);
 
 
 /* Calls pcap_open_live and spits out an error (and quits) if the call fails.
    So a valid pcap_t will always be returned. */
-pcap_t *my_pcap_open_live(char *device, int snaplen, int promisc, int to_ms);
+pcap_t *my_pcap_open_live(const char *device, int snaplen, int promisc, 
+			  int to_ms);
 // Returns whether the packet receive time value obtaned from libpcap
 // (and thus by readip_pcap()) should be considered valid.  When
 // invalid (Windows and Amiga), readip_pcap returns the time you called it.
@@ -633,13 +694,7 @@ struct interface_info *getinterfaces(int *howmany);
 /* Check whether an IP address appears to be directly connected to an
    interface on the computer (e.g. on the same ethernet network rather
    than having to route).  Returns 1 if yes, -1 if maybe, 0 if not. */
-int IPisDirectlyConnected(struct sockaddr_storage *ss, size_t ss_len);
 void sethdrinclude(int sd);
-int getsourceip(struct in_addr *src, const struct in_addr * const dst);
-/* Get the source IP and interface name that a packet
-   to dst should be sent to.  Interface name is dynamically
-   assigned and thus should be freed */
-char *getsourceif(struct in_addr *src, struct in_addr *dst);
 
 /* Fill buf (up to buflen -- truncate if necessary but always
    terminate) with a short representation of the packet stats.
@@ -663,13 +718,14 @@ char *getFinalPacketStats(char *buf, int buflen);
 int setTargetMACIfAvailable(Target *target, struct link_header *linkhdr,
 			    struct ip *ip, int overwrite);
 
-/* Finds MAC address of target->device and sets into target.  Caches
- the results so that it will be really quick if you have many targets
- that send out with the same device, and you pass them roughly in
- order (only caches one).  Returns -1 if cannot find the MAC address
- (often meaning this is localhost, or some other non-ethernet device.
- Returns 0 upon success. */
-int setTargetSrcMACAddressFromDevName(Target *target);
+/* This function ensures that the next hop MAC address for a target is
+   filled in.  This address is the target's own MAC if it is directly
+   connected, and the next hop mac otherwise.  Returns true if the
+   address is set when the function ends, false if not.  This function
+   firt checks if it is already set, if not it tries the arp cache,
+   and if that fails it sends an ARP request itself.  This should be called
+   after an ARP scan if many directly connected machines are involved. */
+bool setTargetNextHopMAC(Target *target);
 
 int islocalhost(const struct in_addr * const addr);
 int unblock_socket(int sd);
@@ -690,6 +746,20 @@ int get_link_offset(char *device);
    lnkinfo->header will be filled with the appropriate values. */
 char *readip_pcap(pcap_t *pd, unsigned int *len, long to_usec, 
 		  struct timeval *rcvdtime, struct link_header *linknfo);
+
+/* A trivial functon that maintains a cache of IP to MAC Address
+   entries.  If the command is ARPCACHE_GEt, this func looks for the
+   IPv4 address in ss and fills in the 'mac' parameter and returns
+   true if it is found.  Otherwise (not found), the function returns
+   false.  If the command is ARPCACHE_SET, the function adds an entry
+   with the given ip (ss) and mac address.  An existing entry for the
+   IP ss will be overwritten with the new MAC address.  true is always
+   returned for the set command. */
+#define ARPCACHE_GET 1
+#define ARPCACHE_SET 2
+bool NmapArpCache(int command, struct sockaddr_storage *ss, u8 *mac);
+
+
 /* Attempts to read one IPv4/Ethernet ARP reply packet from the pcap
    descriptor pd.  If it receives one, fills in sendermac (must pass
    in 6 bytes), senderIP, and rcvdtime (can be NULL if you don't care)
@@ -700,6 +770,15 @@ char *readip_pcap(pcap_t *pd, unsigned int *len, long to_usec,
 int read_arp_reply_pcap(pcap_t *pd, u8 *sendermac, struct in_addr *senderIP,
 		       long to_usec, struct timeval *rcvdtime);
 
+/* Issues an ARP request for the MAC of targetss (which will be placed
+   in targetmac if obtained) from the source IP (srcip) and source mac
+   (srcmac) given.  "The request is ussued using device dev to the
+   broadcast MAC address.  The transmission is attempted up to 3
+   times.  If none of these elicit a response, false will be returned.
+   If the mac is determined, true is returned. */
+bool doArp(const char *dev, u8 *srcmac, struct sockaddr_storage *srcip, 
+	   struct sockaddr_storage *targetip, u8 *targetmac);
+
 #ifndef HAVE_INET_ATON
 int inet_aton(register const char *, struct in_addr *);
 #endif
@@ -737,17 +816,10 @@ void broadcast_socket(int sd);
    did). */
 int recvtime(int sd, char *buf, int len, int seconds, int *timedout);
 
-/* This attempts to calculate the round trip time (rtt) to a host by timing a
-   connect() to a port which isn't listening.  A better approach is to time a
-   ping (since it is more likely to get through firewalls (note, this isn't
-   always true nowadays --fyodor).  This is now 
-   implemented in isup() for users who are root.  */
-unsigned long calculate_sleep(struct in_addr target);
-
 /* Sets a pcap filter function -- makes SOCK_RAW reads easier */
 #ifndef WINIP_H
 typedef int (*PFILTERFN)(const char *packet, unsigned int len); /* 1 to keep */
-void set_pcap_filter(Target *target, pcap_t *pd, PFILTERFN filter, char *bpf, ...);
+void set_pcap_filter(const char *device, pcap_t *pd, PFILTERFN filter, char *bpf, ...);
 #endif
 
 /* Just accept everything ... TODO: Need a better approach than this flt_