sort ALPHA2 changes, considering incorporating traceroute next

CHANGELOG

@@ -1,9 +1,12 @@
 # Nmap Changelog ($Id$); -*-text-*-
+
 4.21ALPHA2
 
-o Improved the algorithm for classifying the TCP timestamp frequency
-for OS detection.  The new algorithm is described at
-http://insecure.org/nmap/osdetect/osdetect-methods.html#osdetect-ts .
+o Performed a huge OS detection submission integration marathon.  More
+  than 500 submissions were processed, increasing the 2nd generation
+  OS DB size 65% to 381 fingerprints.  And many of the existing ones
+  were improved.  We still have a bit more than 500 submissions (sent
+  after January 16) to process.  Please keep those submissions coming!
 
 o Integrated all of your Q32006 service fingerprint submissions.  The
   nmap-service-probe DB grew from 3,671 signatures representing 415
@@ -12,7 +15,17 @@ o Integrated all of your Q32006 service fingerprint submissions.  The
   changes are described at http://hcsw.org/blog.pl?a=20&b=20 .
 
 o Nmap now has a public Subversion (SVN) source code repository.  See
-  the announcement at http://seclists.org/nmap-dev/2006/q4/0253.html .
+  the announcement at http://seclists.org/nmap-dev/2006/q4/0253.html
+  and then the updated usage instructions at
+  http://seclists.org/nmap-dev/2006/q4/0281.html .
+
+o Changed the IP protocol scan so that it sends proper IGMP headers when
+  scanning that protocol.  This makes it much more likely that the host
+  will respond, proving that it's "open".  [Kris]
+
+o Improved the algorithm for classifying the TCP timestamp frequency
+  for OS detection.  The new algorithm is described at
+  http://insecure.org/nmap/osdetect/osdetect-methods.html#osdetect-ts .
 
 o Fixed the way Nmap detects whether one of its data files (such as
   nmap-services) exists and has permissions which allow it to be read.
@@ -35,10 +48,6 @@ o Fixed a bug which caused nmap --iflist to crash (and might have
 
 o Applied a bunch of code cleanup patches from Kris Katterjohn.
 
-o Changed the IP protocol scan so that it sends actual IGMP headers when
-  scanning protocol number 2.  This makes it much more likely that the host
-  will respond, proving that it's "open".  [Kris]
-
 o Some scan types were fixed when used against localhost. The UDP Scan
   doesn't find it's own port, the TCP Scan won't print a message (with -d)
   about an unexpected packet (for the same reason), and the IPProto Scan

docs/nmap.1

@@ -2,7 +2,7 @@
 .\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
 .\" Instead of manually editing it, you probably should edit the DocBook XML
 .\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
-.TH "NMAP" "1" "01/16/2007" "" "Nmap Reference Guide"
+.TH "NMAP" "1" "03/11/2007" "" "Nmap Reference Guide"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -91,7 +91,7 @@ This options summary is printed when Nmap is run with no arguments, and the late
 \fI\%http://insecure.org/nmap/data/nmap.usage.txt\fR. It helps people remember the most common options, but is no substitute for the in\-depth documentation in the rest of this manual. Some obscure options aren't even included here.
 .PP
 .nf
-Nmap 4.21ALPHA1 ( http://insecure.org )
+Nmap 4.21ALPHA2 ( http://insecure.org )
 Usage: nmap [Scan Type(s)] [Options] {target specification}
 TARGET SPECIFICATION:
   Can pass hostnames, IP addresses, networks, etc.
@@ -286,7 +286,7 @@ Systems administrators often find this option valuable as well. It can easily be
 .sp
 The
 \fB\-sP\fR
-option sends an ICMP echo request and a TCP packet to port 80 by default. When executed by an unprivileged user, a SYN packet is sent (using a
+option sends an ICMP echo request and a TCP packet to port 80 by default. When executed by an unprivileged user, only a SYN packet is sent (using a
 \fBconnect()\fR
 call) to port 80 on the target. When a privileged user tries to scan targets on a local ethernet network, ARP requests (\fB\-PR\fR) are used unless
 \fB\-\-send\-ip\fR