Nmap Development: Identifying BeOS DR9?

[Edhel <edhel () bigfoot com>]

I noticed that BeOS DR9, AKA "Preview Release" isn't listed in
nmap-os-fingerprints, so I installed this OS on my Mac and
scanned it from my FreeBSD computer on the other end of my desk.
The results were disappointing. I have BeOS DR9's included
telnet, ftp, and web servers running, but nmap always claims
that the test conditions are "non-ideal". Is there anything I
can do to achieve an "ideal" scan for submission? Below is the
output of a few scans:


[spatchtower:root] /tmp/nmap-3.30 > ./nmap -O -v -p 20-24,80 10.0.2.2
No tcp, udp, or ICMP scantype specified, assuming SYN Stealth scan. Use -sP if you really 
don't want to portscan (and just want to see what hosts are up).
Starting nmap 3.30 ( http://www.insecure.org/nmap/ ) at 2003-09-10 20:37 EDT
Host powermacintosh8500 (10.0.2.2) appears to be up ... good.
Initiating SYN Stealth Scan against powermacintosh8500 (10.0.2.2) at 20:37
Adding open port 80/tcp
The SYN Stealth Scan took 2 seconds to scan 6 ports.
For OSScan assuming that port 80 is open and port 20 is closed and neither are firewalled
For OSScan assuming that port 80 is open and port 20 is closed and neither are firewalled
Insufficient responses for TCP sequencing (0), OS detection may be less accurate
For OSScan assuming that port 80 is open and port 20 is closed and neither are firewalled
Insufficient responses for TCP sequencing (0), OS detection may be less accurate
Interesting ports on powermacintosh8500 (10.0.2.2):
(The 3 ports scanned but not shown below are in state: closed)
Port       State       Service
21/tcp     filtered    ftp
23/tcp     filtered    telnet
80/tcp     open        http
Device type: general purpose
Running (JUST GUESSING) : Be BeOS 4.X (88%)
Aggressive OS guesses: BeOS 4 - 4.5 (88%)
No exact OS matches for host (test conditions non-ideal).

Nmap run completed -- 1 IP address (1 host up) scanned in 28.133 seconds

----------------------------------------------------------------------

[spatchtower:root] /tmp/nmap-3.30 > ./nmap -O -v -p 20-24,80 -sW 10.0.2.2

Starting nmap 3.30 ( http://www.insecure.org/nmap/ ) at 2003-09-10 20:44 EDT
Host powermacintosh8500 (10.0.2.2) appears to be up ... good.
Initiating Window Scan against powermacintosh8500 (10.0.2.2) at 20:44
Adding open port 21/tcp
Adding open port 80/tcp
Adding open port 24/tcp
Adding open port 22/tcp
Adding open port 20/tcp
Adding open port 23/tcp
The Window Scan took 0 seconds to scan 6 ports.
Warning:  OS detection will be MUCH less reliable because we did not find at least 1 open 
and 1 closed TCP port
For OSScan assuming that port 20 is open and port 37098 is closed and neither are firewalled
WARNING:  RST from port 20 -- is this port really open?
WARNING:  RST from port 20 -- is this port really open?
WARNING:  RST from port 20 -- is this port really open?
Insufficient responses for TCP sequencing (0), OS detection may be less accurate
For OSScan assuming that port 20 is open and port 44672 is closed and neither are firewalled
WARNING:  RST from port 20 -- is this port really open?
WARNING:  RST from port 20 -- is this port really open?
WARNING:  RST from port 20 -- is this port really open?
Insufficient responses for TCP sequencing (0), OS detection may be less accurate
For OSScan assuming that port 20 is open and port 37075 is closed and neither are firewalled
WARNING:  RST from port 20 -- is this port really open?
WARNING:  RST from port 20 -- is this port really open?
WARNING:  RST from port 20 -- is this port really open?
Insufficient responses for TCP sequencing (0), OS detection may be less accurate
Interesting ports on powermacintosh8500 (10.0.2.2):
Port       State       Service
20/tcp     open        ftp-data
21/tcp     open        ftp
22/tcp     open        ssh
23/tcp     open        telnet
24/tcp     open        priv-mail
80/tcp     open        http
Device type: print server
Running (JUST GUESSING) : Intel embedded (90%)
Aggressive OS guesses: Intel Netport Express PRO print server V04.33a (90%)
No exact OS matches for host (test conditions non-ideal).

Nmap run completed -- 1 IP address (1 host up) scanned in 22.981 seconds

----------------------------------------------------------------------

[spatchtower:root] /tmp/nmap-3.30 > ./nmap -O -v -p 20-24,80 -sU 10.0.2.2

Starting nmap 3.30 ( http://www.insecure.org/nmap/ ) at 2003-09-10 20:47 EDT
Host powermacintosh8500 (10.0.2.2) appears to be up ... good.
Initiating UDP Scan against powermacintosh8500 (10.0.2.2) at 20:47
The UDP Scan took 0 seconds to scan 6 ports.
Adding open port 23/udp
Adding open port 80/udp
Adding open port 22/udp
Adding open port 24/udp
Adding open port 20/udp
Adding open port 21/udp
Warning:  OS detection will be MUCH less reliable because we did not find at least 1 open 
and 1 closed TCP port
Interesting ports on powermacintosh8500 (10.0.2.2):
Port       State       Service
20/udp     open        ftp-data
21/udp     open        ftp
22/udp     open        ssh
23/udp     open        telnet
24/udp     open        priv-mail
80/udp     open        http
Device type: print server|general purpose
Running (JUST GUESSING) : Intel embedded (89%), Apple Mac OS 7.X (86%), Convex SPP-UX (86%)
Aggressive OS guesses: Intel Netport Express PRO print server V04.33a (89%), Apple Mac OS 
7.0-7.1 With MacTCP 1.1.1 - 2.0.6 (86%), Convex SPP-UX 5.2.1 (86%), SPP-UX 5.x on a Convex 
SPP-1600 (86%)
No exact OS matches for host (test conditions non-ideal).

Nmap run completed -- 1 IP address (1 host up) scanned in 16.932 seconds


---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List run by ezmlm-idx (www.ezmlm.org).