Re: NMAP Identity obscuring

On Wed, Nov 22, 2000 at 09:58:57AM -0800, lamont_at_icopyright.com wrote:

> once upon a time i wrote a program called tft.c that tested tcp flags by
> running through all 64 combinations of flags (i didn't include X+Y) and
> checking what kind of packets came back.

but this still only tests a TCP in CLOSED or LISTEN...

i've met a few ppl now who've written TCP fingerprinting tools that
walk through all the states. you know who you are. ;-) i wish you guys
would publish your code already (or your paper, at least), so the rest
of us don't have to reinvent the wheel!

-d.

---
http://www.monkey.org/~dugsong/
--------------------------------------------------
For help using this (nmap-hackers) mailing list, send a blank email to 
nmap-hackers-help_at_insecure.org . List run by ezmlm-idx (www.ezmlm.org).