mirror of
https://github.com/nmap/nmap.git
synced 2026-08-04 06:40:48 +00:00
Did an audit throughout the book and changed a bunch of numbers 0-9 to write out zero through nine. I guess this is more consistant, but I'm not sure it is any better. Shrug.
This commit is contained in:
fyodor
parent
bd18974ef8
commit
8734956cf3
3 changed files with 48 additions and 48 deletions
|
|
@ -115,7 +115,7 @@ OS details: Linux 2.6.20-1 (Fedora Core 5)
|
|||
|
||||
TRACEROUTE (using port 80/tcp)
|
||||
HOP RTT ADDRESS
|
||||
[Cut first 7 hops for brevity]
|
||||
[Cut first seven hops for brevity]
|
||||
8 10.59 so-4-2-0.mpr3.pao1.us.above.net (64.125.28.142)
|
||||
9 11.00 metro0.sv.svcolo.com (208.185.168.173)
|
||||
10 9.93 scanme.nmap.org (64.13.134.52)
|
||||
|
|
@ -772,7 +772,7 @@ Traceroutes are performed post-scan using information from the scan results to d
|
|||
</para>
|
||||
|
||||
<para>
|
||||
Traceroute works by sending packets with a low TTL (time-to-live) in an attempt to elicit ICMP Time Exceeded messages from intermediate hops between the scanner and the target host. Standard traceroute implementations start with a TTL of 1 and increment the TTL until the destination host is reached. Nmap's traceroute starts with a high TTL and then decrements the TTL until it reaches 0. Doing it backwards lets Nmap employ clever caching algorithms to speed up traces over multiple hosts. On average Nmap sends 5–10 fewer packets per host, depending on network conditions. If a single subnet is being scanned (i.e. 192.168.0.0/24) Nmap may only have to send a single packet to most hosts.
|
||||
Traceroute works by sending packets with a low TTL (time-to-live) in an attempt to elicit ICMP Time Exceeded messages from intermediate hops between the scanner and the target host. Standard traceroute implementations start with a TTL of 1 and increment the TTL until the destination host is reached. Nmap's traceroute starts with a high TTL and then decrements the TTL until it reaches zero. Doing it backwards lets Nmap employ clever caching algorithms to speed up traces over multiple hosts. On average Nmap sends 5–10 fewer packets per host, depending on network conditions. If a single subnet is being scanned (i.e. 192.168.0.0/24) Nmap may only have to send a single packet to most hosts.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
|
@ -1275,7 +1275,7 @@ really has no open ports. If most scanned ports are
|
|||
<literal>closed</literal> but a few common port numbers (such as 22,
|
||||
25, 53) are <literal>filtered</literal>, the system is most likely
|
||||
susceptible. Occasionally, systems will even show the exact opposite
|
||||
behavior. If your scan shows 1000 open ports and 3 closed or filtered
|
||||
behavior. If your scan shows 1000 open ports and three closed or filtered
|
||||
ports, then those three may very well be the truly open ones.</para>
|
||||
|
||||
</listitem>
|
||||
|
|
@ -1749,7 +1749,7 @@ way.</para>
|
|||
|
||||
<para>When performing a version scan (<option>-sV</option>), Nmap sends a
|
||||
series of probes, each of which is assigned a rarity value
|
||||
between 1 and 9. The lower-numbered probes are effective
|
||||
between one and nine. The lower-numbered probes are effective
|
||||
against a wide variety of common services, while the higher
|
||||
numbered ones are rarely useful. The intensity level
|
||||
specifies which probes should be applied. The higher the
|
||||
|
|
@ -2236,7 +2236,7 @@ parallelism based on network performance. If packets are being dropped,
|
|||
Nmap slows down and allows fewer outstanding probes. The ideal probe
|
||||
number slowly rises as the network proves itself worthy. These
|
||||
options place minimum or maximum bounds on that variable. By default,
|
||||
the ideal parallelism can drop to 1 if the network proves unreliable
|
||||
the ideal parallelism can drop to one if the network proves unreliable
|
||||
and rise to several hundred in perfect conditions.</para>
|
||||
|
||||
<para>The most common usage is to set
|
||||
|
|
@ -2714,8 +2714,8 @@ lists the relevant options and describes what they do.</para>
|
|||
handling these tiny packets. The old-school sniffer named
|
||||
Sniffit segmentation faulted immediately upon receiving
|
||||
the first fragment. Specify this option once, and Nmap
|
||||
splits the packets into 8 bytes or less after the IP
|
||||
header. So a 20-byte TCP header would be split into 3
|
||||
splits the packets into eight bytes or less after the IP
|
||||
header. So a 20-byte TCP header would be split into three
|
||||
packets. Two with eight bytes of the TCP header, and one
|
||||
with the final four. Of course each fragment also has an
|
||||
IP header. Specify <option>-f</option> again to use 16 bytes per fragment
|
||||
|
|
@ -2723,7 +2723,7 @@ lists the relevant options and describes what they do.</para>
|
|||
Or you can specify
|
||||
your own offset size with the <option>--mtu</option> option. Don't also
|
||||
specify <option>-f</option> if you use <option>--mtu</option>. The offset must be a
|
||||
multiple of 8. While fragmented packets won't get by
|
||||
multiple of eight. While fragmented packets won't get by
|
||||
packet filters and firewalls that queue all IP fragments,
|
||||
such as the <varname>CONFIG_IP_ALWAYS_DEFRAG</varname> option in the Linux
|
||||
kernel, some networks can't afford the performance hit
|
||||
|
|
@ -3032,12 +3032,12 @@ support the option completely, as does UDP scan.</para>
|
|||
for the session. If the given string is an even number of hex
|
||||
digits (with the pairs optionally separated by a colon), Nmap will
|
||||
use those as the MAC. If fewer than 12 hex digits are provided, Nmap
|
||||
fills in the remainder of the 6 bytes with random values. If the
|
||||
argument isn't a 0 or hex string, Nmap looks through
|
||||
fills in the remainder of the six bytes with random values. If the
|
||||
argument isn't a zero or hex string, Nmap looks through
|
||||
<filename>nmap-mac-prefixes</filename> to find a vendor name containing the given string
|
||||
(it is case insensitive). If a match is found, Nmap uses the
|
||||
vendor's OUI (3-byte prefix)<indexterm><primary>organizationally unique identifier (OUI)</primary><seealso><filename>nmap-mac-prefixes</filename></seealso></indexterm>
|
||||
and fills out the remaining 3 bytes
|
||||
and fills out the remaining three bytes
|
||||
randomly. Valid <option>--spoof-mac</option> argument examples are <literal>Apple</literal>, <literal>0</literal>,
|
||||
<literal>01:02:03:04:05:06</literal>, <literal>deadbeefcafe</literal>, <literal>0020F2</literal>, and <literal>Cisco</literal>. This option only affects raw packet scans such as SYN scan or OS detection, not connection-oriented features such as version detection or the Nmap Scripting Engine.</para>
|
||||
|
||||
|
|
@ -3269,7 +3269,7 @@ piped to an awk or cut command to print the desired fields.</para>
|
|||
<para>Grepable output consists of comments (lines starting with a
|
||||
pound (#))<indexterm><primary>grepable output</primary><secondary>comments in</secondary></indexterm>
|
||||
and target lines. A target line includes a combination
|
||||
of 6 labeled fields, separated by tabs and followed with a colon.
|
||||
of six labeled fields, separated by tabs and followed with a colon.
|
||||
The fields are <literal>Host</literal>, <literal>Ports</literal>,
|
||||
<literal>Protocols</literal>, <literal>Ignored State</literal>,
|
||||
<literal>OS</literal>, <literal>Seq Index</literal>,
|
||||
|
|
@ -4014,7 +4014,7 @@ overwhelming requests. Specify <option>--open</option> to only see
|
|||
</para>
|
||||
|
||||
<para>Launches host enumeration and a TCP scan at the first half
|
||||
of each of the 255 possible 8 bit subnets in the 198.116 class B
|
||||
of each of the 255 possible 8-bit subnets in the 198.116 class B
|
||||
address space. This tests whether the systems run SSH, DNS, POP3,
|
||||
or IMAP on their standard ports, or anything on port 4564. For any
|
||||
of these ports found open, version detection is used to determine
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue