RE: 24-Hour Beta: Nmap 4.69BETA1

["Rob Nicholls" <robert () everythingeverything co uk>]

Strange, mine seems to be behaving properly (first scan was using nmap's
default range of ports and picked 113, second was only against port 80):

TRACEROUTE (using port 113/tcp)
HOP RTT    ADDRESS
1   0.00   xxx.xxx.xxx (xx.xx.xx.xx)
2   63.00  xxx.xxx.xxx (xx.xx.xx.xx)
3   32.00  xxx.xxx.xxx (xx.xx.xx.xx)
4   47.00  xxx.xxx.xxx (xx.xx.xx.xx)
5   31.00  xxx.xxx.xxx (xx.xx.xx.xx)
6   31.00  xxx.xxx.xxx (xx.xx.xx.xx)
7   31.00  ldn-tch-i2-link.telia.net (213.248.84.109)
8   31.00  ldn-b2-link.telia.net (80.91.250.213)
9   47.00  ldn-bb1-link.telia.net (80.91.252.9)
10  47.00  ldn-b1-link.telia.net (80.91.248.89)
11  63.00  abovenet-112933-ldn-b1.telia.net (213.248.75.2)
12  140.00 so-0-1-0.mpr1.dca2.us.above.net (64.125.27.57)
13  109.00 so-1-2-0.mpr1.lga5.us.above.net (64.125.26.102)
14  172.00 so-2-1-0.mpr1.sjc2.above.net (64.125.26.229)
15  172.00 so-4-2-0.mpr3.pao1.us.above.net (64.125.28.142)
16  204.00 metro0.sv.svcolo.com (208.185.168.173)
17  187.00 scanme.nmap.org (64.13.134.52)

TRACEROUTE (using port 80/tcp)
HOP RTT    ADDRESS
1   0.00   xxx.xxx.xxx (xx.xx.xx.xx)
2   63.00  xxx.xxx.xxx (xx.xx.xx.xx)
3   32.00  xxx.xxx.xxx (xx.xx.xx.xx)
4   47.00  xxx.xxx.xxx (xx.xx.xx.xx)
5   31.00  xxx.xxx.xxx (xx.xx.xx.xx)
6   31.00  xxx.xxx.xxx (xx.xx.xx.xx)
7   47.00  ldn-tch-i2-link.telia.net (213.248.84.109)
8   78.00  ldn-b2-link.telia.net (80.91.250.213)
9   93.00  ldn-bb1-link.telia.net (80.91.252.9)
10  78.00  ldn-b1-link.telia.net (80.91.248.89)
11  78.00  abovenet-112933-ldn-b1.telia.net (213.248.75.2)
12  156.00 so-0-1-0.mpr1.dca2.us.above.net (64.125.27.57)
13  110.00 so-1-2-0.mpr1.lga5.us.above.net (64.125.26.102)
14  188.00 so-2-1-0.mpr1.sjc2.above.net (64.125.26.229)
15  172.00 so-4-2-0.mpr3.pao1.us.above.net (64.125.28.142)
16  219.00 metro0.sv.svcolo.com (208.185.168.173)
17  172.00 scanme.nmap.org (64.13.134.52)

For reference, Nmap's verbose output said:

Initiating Traceroute at 22:22
64.13.134.52: guessing hop distance at 20
Completed Traceroute at 22:22, 1.08s elapsed


Rob


> -----Original Message-----
> From: Alan Jones [mailto:asjones987 () gmail com]
> Sent: 07 September 2008 21:05
> To: nmap-dev () insecure org
> Subject: Re: 24-Hour Beta: Nmap 4.69BETA1
>
> Here is a nmap scan to scanme.inscure.org
>
>
> TRACEROUTE (using port 80/tcp)
> HOP RTT  ADDRESS
> 1   2.00 home (192.168.1.254)
> 2   2.00 scanme.nmap.org (64.13.134.52)
>
>
> Normal Trace looks like this
> Tracing route to scanme.insecure.org [64.13.134.52]
> over a maximum of 30 hops:
>
>   1     2 ms    <1 ms    <1 ms  home [192.168.1.254]
>   2    10 ms    11 ms    11 ms  adsl-70-232-79-
> 254.dsl.ltrkar.sbcglobal.net[70.
> 232.79.254]
>   3    13 ms    12 ms    10 ms  dist1-vlan62.ltrkar.sbcglobal.net [
> 76.253.179.49
> ]
>   4    10 ms    10 ms    11 ms  bb1-g6-3-0.ltrkar.sbcglobal.net [
> 151.164.64.246]
>
>   5    27 ms    29 ms    28 ms  151.164.189.80
>   6    28 ms    28 ms    29 ms  asn6461-
> abovenet.eqchil.sbcglobal.net[151.164.2
> 51.46]
>   7    32 ms    28 ms    28 ms  so-0-1-0.mpr1.ord2.us.above.net [
> 64.125.30.146]
>
>   8    80 ms   119 ms    80 ms  so-2-0-0.mpr1.sjc2.us.above.net [
> 64.125.26.137]
>
>   9    78 ms    77 ms    78 ms  so-4-0-0.mpr3.pao1.us.above.net [
> 64.125.28.221]
>
>  10   127 ms    80 ms    87 ms  metro0.sv.svcolo.com [208.185.168.173]
>  11   110 ms    78 ms    94 ms  scanme.nmap.org [64.13.134.52]
>
> Trace complete.
>
>
>
> On Sun, Sep 7, 2008 at 3:01 PM, Alan Jones <asjones987 () gmail com>
> wrote:
>
> > [forgot to send this to the list instead of just doing reply]
> >
> > Hmmm for my initial test I have found the Internet has gotten much
> close to
> > my house
> >
> > Two hops from my house to both Yahoo, scanme.insecure.org, and to my
> > office mail server.
> >
> > Normally 15 to my office and 10 to yahoo. based on a tracert from a
> command
> > prompt.
> >
> > also when you have multiple hosts that have been scanned does the
> Zenmap
> > "Output" tab not update when you click on on host vs another like the
> "Ports
> > / Hosts" and the "Host Details" tabs do?
> >
> > I often like to just look at the raw output, but still have the GUI
> at
> > hand.
> >
> > thanks
> >
> > On Sun, Sep 7, 2008 at 3:15 AM, Fyodor <fyodor () insecure org> wrote:
> >
> > > Hi Folks!  I've built the new release (after more than 2 months
> since
> > > the last one), and this one is a whopper!  Remember that we had
> those
> > > 6 SoC students during much of the period coding up a storm!  And of
> > > course people like David and Jah and Sven and others were too.  I'd
> > > like to thank David for staying up late with me to fix some
> > > last-minute bugs and do the Mac builds.
> > >
> > > You may recall that I was amazed that the 4.68 CHANGELOG had 42
> > > significant changes.  Well, this one has 91!  And some of them are
> > > whoppers.  For example:
> > >
> > > o The new Zenmap Scan Topology (Radialnet) system.  See
> > >  http://nmap.org/book/zenmap-topology.html
> > >
> > > o Zenmap Scan Aggregation
> > >
> > > o All the changes allowed by port frequency data, including
> redefining
> > >  the default scan ports and -F features.
> > >
> > > o Tons of new NSE scripts and libraries, and improvements to the
> > >  existing ones.
> > >
> > > o Windows 2000 works again
> > >
> > > o Bunches of new OS detection fingerprints, including passing the
> 1500
> > >  fingerprint mark in nmap-os-db.
> > >
> > > o And lots more!
> > >
> > > So instead of just releasing this as 4.70, I want to give you guys
> on
> > > nmap-dev a quick chance to run it through its paces and make sure
> > > there are no showstopper problems.  So I'm hoping that if some of
> you
> > > have some free time on Sunday, you'll do that!  Be sure to report
> any
> > > issues found to nmap-dev.  With a patch, if possible, but bug
> reports
> > > are useful on their own too!  Then I hope to build the stable
> release
> > > early in the week (maybe on Monday).
> > >
> > > So please test Nmap 4.69BETA1 out!  Here are the goods in the usual
> > > formats:
> > >
> > > http://nmap.org/dist/nmap-4.69BETA1.tar.bz2
> > > http://nmap.org/dist/nmap-4.69BETA1.tgz
> > > http://nmap.org/dist/nmap-4.69BETA1-setup.exe
> > > http://nmap.org/dist/nmap-4.69BETA1-win32.zip
> > > http://nmap.org/dist/nmap-4.69BETA1.dmg
> > > http://nmap.org/dist/nmap-4.69BETA1-1.i386.rpm
> > > http://nmap.org/dist/nmap-4.69BETA1-1.x86_64.rpm
> > > http://nmap.org/dist/zenmap-4.69BETA1-1.noarch.rpm
> > > http://nmap.org/dist/nmap-4.69BETA1-1.src.rpm
> > >
> > > Please note that the feature freeze is still on until the stable
> > > release.  I only want important 4.69BETA1 bug fixes checked in until
> > > then.
> > >
> > > Here is the giant list of changes:
> > >
> > > o [Zenmap] Added a new Scan Topology system. The idea is that if we
> > >  are going to call Nmap the "Network Mapper", it should at least be
> > >  able to draw you a map of the network!  And that is what this new
> > >  system does. It was achieved by integrating the RadialNet Nmap
> > >  visualization tool
> (http://www.dca.ufrn.br/~joaomedeiros/radialnet<http://www.dca.ufrn.br/
> %7Ejoaomedeiros/radialnet>
> > > ),
> > >  into Zenmap. Joao Medeiros has been developing RadialNet for more
> > >  than a year. For details, complete with some of the most beautiful
> > >  Zenmap screen shots ever, visit
> > >  http://nmap.org/book/zenmap-topology.html. The integration work was
> > >  done by SoC student Vladimir Mitrovic and his mentor David Fifield.
> > >
> > > o [Zenmap] Another exciting new Zenmap feature is Scan Aggregation.
> > >  This allows you to visualize and analyze the results of multiple
> > >  scans at once, as if they were from one Nmap execution. So you
> might
> > >  scan one network, analyze the results a bit, then scan some of the
> > >  machines more intensely or add a completely new subnet to the
> > >  scan. The new results are seamlessly added to the old, as described
> > >  at http://nmap.org/book/zenmap-scanning.html#aggregation. [David,
> > >  Vladimir]
> > >
> > > o Expanded nmap-services to include information on how frequently
> each
> > >  port number is found open.  The results were generated by scanning
> > >  tens of millions of IPs on the Internet this Summer, and augmented
> > >  with internal network data contributed by some large
> > >  organizations. [Fyodor]
> > >
> > > o Nmap now scans the most common 1,000 ports by default in either
> > >  protocol (UDP scan is still optional).  This is a decrease from
> > >  1,715 TCP ports and 1,488 UDP ports in Nmap 4.68.  So Nmap is
> faster
> > >  by default and, since the port selection is better thanks to the
> > >  port frequency data, it often finds more open ports as
> > >  well. [Fyodor]
> > >
> > > o Nmap fast scan (-F) now scans the top 100 ports by default in
> either
> > >  protocol.  This is a decrease from 1,276 (TCP) and 1,017 (UDP) in
> > >  Nmap 4.68. Port scanning time with -F is generally an order of
> > >  magnitude faster than before, making -F worthy of its "fast scan"
> > >  moniker. [Fyodor]
> > >
> > > o The --top-ports option lets you specify the number of ports you
> wish
> > >  to scan in each protocol, and will pick the most popular ports for
> > >  you based on the new frequency data.  For both TCP and UDP, the top
> > >  10 ports gets you roughly half of the open ports.  The top 1,000
> > >  (out of 65,536 possible) finds roughly 93% of the open TCP ports
> and
> > >  more than 95% of the open UDP ports. [Fyodor, Doug Hoyte]
> > >
> > > o David integrated all of your OS detection fingerprint and
> correction
> > >  submissions from March 11 until mid-July.  In the process we
> reached
> > >  the 1500-signature milestone for the 2nd generation OS detection
> > >  system. We can now detect the newest iPhones, Linux 2.6.25, OS X
> > >  Darwin 9.2.2, Windows Vista SP1, and even the Nintendo Wii. Nmap
> now
> > >  has 1,503 signatures, vs. 1,320 in 4.68. Integration is now faster
> > >  and more pleasant thanks to the new OSassist application developed
> > >  by Nmap SoC student Michael Pattrick. See
> > >  http://seclists.org/nmap-dev/2008/q3/0089.html and
> > >  http://seclists.org/nmap-dev/2008/q3/0139.html for more details.
> > >
> > > o Nmap now works with Windows 2000 again, after being broken by our
> > >  IPv6 support improvements in version 4.65. A couple new
> dependencies
> > >  are required to run on Win2K, as described at
> > >  http://nmap.org/book/inst-windows.html#inst-win2k .
> > >
> > > o [Zenmap] Added a context-sensitive help system to the Profile
> > >  Editor.  You can now mouse-over options to learn more about what
> > >  they are used for and their proper argument syntax. [Jurand Nogiec]
> > >
> > > o When Nmap finds a probe during ping scan which elicits a response,
> > >  it now saves that information for the port scan and later phases.
> > >  It can then "ping" the host with that probe as necessary to collect
> > >  timing information even if the host is not responding to the normal
> > >  port scan packets. Previously, Nmap's port scan timing pings could
> > >  only use information gathered during that port scan itself.  A
> > >  number of other "port scan ping" system improvements were made at
> > >  the same time to improve performance against firewalled hosts. For
> > >  full details, see http://seclists.org/nmap-dev/2008/q3/0647.html
> > >  [David, Michael, Fyodor]
> > >
> > > o --traceroute now uses the timing ping probe saved from host
> > >  discovery and port scanning instead of finding its own probe. The
> > >  timing ping probe is always the best probe Nmap knows about for
> > >  eliciting a response from a target. This will have the most effect
> > >  on traceroute after a ping scan, where traceroute would sometimes
> > >  pick an ineffective probe and traceroute would fail even though the
> > >  target was up. [David]
> > >
> > > o Added dns-safe-recursion-port and dns-safe-recursion-txid
> > >  (non-default NSE scripts) which use the 3rd party dns-oarc.net
> > >  lookup to test the source port and transaction ID randomness of
> > >  discovered DNS servers (assuming they allow recursion at all).
> > >  These scripts, which test for the "Kaminsky" DNS bugs, were
> > >  contributed by Brandon Enright.
> > >
> > > o Added whois.nse, which queries the Regional Internet Registries
> > >  (RIRs) to determine who the target IP addresses are assigned
> > >  to. [Jah]
> > >
> > > o [Zenmap] Overhauled the default list of scan profiles based on
> > >  nmap-dev discussion.  Users now have a much more diverse and useful
> > >  set of default profile options. And if they don't like any of those
> > >  canned scan commands, they can easily create their own in the
> > >  Profile Editor! [David]
> > >
> > > o Fyodor made a number of performance tweaks, such as:
> > >  o increase host group sizes in many cases, so Nmap will now
> commonly
> > >    scan 64 hosts at a time rather than 30
> > >  o align host groups with common network boundaries, such as /24 or
> > >   /25
> > >  o Increase maximum per-target port-scan ping frequency to one every
> > >    1.25 seconds rather than every five. Port scan pings happen
> > >    against heavily firewalled hosts and the like when Nmap is not
> > >    receiving enough responses to normal scan to properly calculate
> > >    timing variables and detect packet drops.
> > >
> > > o Added a new NSE binlib library, which offers bin.pack() and
> > >  bin.unpack() functions for dealing with storing values in and
> > >  extracting them from binary strings.  For details, see
> > >  http://nmap.org/book/nse-library.html#nse-binlib . [Philip
> > >  Pickering]
> > >
> > > o Added a new NSE DNS library. See this thread:
> > >  http://seclists.org/nmap-dev/2008/q3/0310.html [Philip Pickering]
> > >
> > > o Added new NSE libraries for base64 encoding, SNMP, and POP3 mail
> > >  operations.  They are described at
> > >  http://seclists.org/nmap-dev/2008/q3/0233.html . [Philip Pickering]
> > >
> > > o Added NSE scripts popcapa (retrieves POP3 server capabilities) and
> > >  brutePOP3 (brute force POP3 authentication cracker) which make use
> > >  of the new POP3 library. [Philip Pickering]
> > >
> > > o Added the SNMPcommunitybrute NSE script, which is a brute force
> > >  community string cracker. Also modified SNMPsysdescr to use the new
> > >  SNMP library. [Philip Pickering]
> > >
> > > o Fixed the SMTPcommands script so that it can't return multiple
> > >  values (which was causing problems). Thanks to Jah for tracking
> down
> > >  the problem and sending a fix for SMTPcommands. Then Patrick fixed
> > >  NSE so it can handle misbehaving scripts like this without causing
> > >  mysterious side effects.
> > >
> > > o Added a new NSE Unpwdb (username/password database) library for
> > >  easily obtaining usernames or passwords from a list.  The functions
> > >  usernames() and passwords() return a closure which returns a new
> > >  list entry with every call, or nil when the list is exhausted.  You
> > >  can specify your own username and/or password lists via the script
> > >  arguments userdb and passdb, respectively. [Kris]
> > >
> > > o Nmap's Nsock-utilizing subsystems (DNS, NSE, version detection)
> have
> > >  been updated to support the -S and --ip-options flags. [Kris]
> > >
> > > o A new --max-rate option was added, which complements --min-rate.
> It
> > >  allows you to specify the maximum byte rate that Nmap is allowed to
> > >  send packets. [David]
> > >
> > > o Added --ip-options support for the connect() scan (-sT). [Kris]
> > >
> > > o Nsock now supports binding to a local address and setting IPv4
> > >  options with nsi_set_localaddr() and nsi_set_ipoptions(),
> > >  respectively. [Kris]
> > >
> > > o Added IPProto Ping (-PO) support to Traceroute, and fixed support
> for
> > >  IPProto Scan (-sO) and the ICMP Pings (-PE, -PP, -PM) in Traceroute
> > >  as well.  These could cause Nmap to hang during Traceroute. [Kris]
> > >
> > > o [Zenmap] Added a "Cancel" button for cancelling a scan in progress
> > >  without losing any Nmap output obtained so far. [Jurand Nogiec]
> > >
> > > o Improve the netbios-smb-os-discovery NSE script to improve target
> > >  port selection and to also decode the system's timestamp from an
> SMB
> > >  response. [Ron at SkullSecurity]
> > >
> > > o Nmap now avoids collapsing large numbers of ports in open|filtered
> > >  state (e.g. just printing that 500 ports are in that state rather
> > >  than listing them individually) if verbosity or debugging levels
> are
> > >  greater than two.  See this thread:
> > >  http://seclists.org/nmap-dev/2008/q3/0312.html . [Fyodor]
> > >
> > > o The NSE http library now supports chunked encoding. [Sven Klemm]
> > >
> > > o The NSE datafiles library now has generic file parsing routines,
> and
> > >  the parsing of the standard nmap data files (e.g. nmap-services,
> > >  nmap-protocols, etc.) now uses those generic routines.  NSE scripts
> > >  and libraries may find them useful for dealing with their own data
> > >  files, such as password lists. [Jah]
> > >
> > > o Passed the big revision 10,000 milestone in the Nmap project SVN
> > >  server: http://seclists.org/nmap-dev/2008/q3/0682.html
> > >
> > > o Added some Windows and MinGW compatibility patches submitted by
> > >  Gisle Vanem.
> > >
> > > o Improved nse_init so that compilation/runtime errors in NSE
> scripts
> > >  no longer cause the script engine to abort. [Patrick]
> > >
> > > o Fix a cosmetic bug in --script-trace hex dump output which
> resulting
> > >  in bytes with the highest bit set being prefixed with ffffff. [Sven
> > >  Klemm]
> > >
> > > o Removed the nselib-bin directory. The last remaining shared NSE
> > >  module, bit, has been made static by Patrick. Shared modules were
> > >  broken for static builds of Nmap, such as those in the RPMS. We
> also
> > >  had the compilation problems (particularly on OpenBSD) with shared
> > >  modules which lead us to make PCRE static a while back. [David]
> > >
> > > o Updated rpcinfo NSE script to use the new pack/unpack (binlib)
> > >  functions, use the new tab library, include better documentation,
> and
> > >  fix some bugs. [Sven Klemm]
> > >
> > > o Add useful details to the error message printed when an NSE script
> > >  fails to load (due to syntax error, etc.) [Patrick]
> > >
> > > o Fix a bug in the NSE http library which would cause some scripts
> to
> > >  give the error: SCRIPT ENGINE: C:\Program
> > >  Files\Nmap\nselib/http.lua:77: attempt to call field 'parse' (a nil
> > >  value) [Jah]
> > >
> > > o Fixed a Makefile problem (race condition) which could lead to
> build
> > >  failures when launching make in parallel mode (e.g. -j4). [Michal
> > >  Januszewski]
> > >
> > > o Added new addrow() function to NSE tab library.  It allows
> > >  developers to add a whole row at once rather than doing a separate
> > >  add() call for each column in a row. [Sven Klemm]
> > >
> > > o Completion time estimates provided in verbose mode or when you hit
> a
> > >  key during scanning are now more accurate thanks to algorithm
> > >  improvements by David.
> > >
> > > o Fixed a number of NSE scripts which used print_debug()
> > >  incorrectly. See
> > >  http://seclists.org/nmap-dev/2008/q3/0470.html. [Sven Klemm].
> > >
> > > o [Zenmap] The Ports/Hosts view now provides full version detection
> > >  values rather than just a simple summary. [Jurand Nogiec]
> > >
> > > o [Zenmap] When you edit the command-entry field, then change the
> > >  target selection, Nmap no longer blows away your edits in favor of
> > >  using your current profile. [Jurand Nogiec]
> > >
> > > o Nsock now returns data from UDP packets individually, preserving
> the
> > >  packet boundary, rather than concatenating the data from multiple
> > >  packets into a single buffer.  This fixes a problem related to our
> > >  reverse-DNS system, which can only handle one DNS packet at a time.
> > >  Thanks to Tim Adam of ManageSoft for debugging the problem and
> > >  sending the patch.  Doug Hoyte helped with testing, and it was
> > >  applied by Fyodor.
> > >
> > > o [Zenmap] Fixed a crash which would occur when you try to compare
> two
> > >  files, either of which has more than one extraports element.
> [David]
> > > o [Zenmap] Make the higwidgets library a subpackage of zenmapGUI to
> > >  avoid file name conflicts with Umit. [David]
> > >
> > > o Added the undocumented (except here) --nogcc option which disables
> > >  global/group congestion control algorithms and so each member of a
> > >  scan group of machines is treated separately.  This is just an
> > >  experimental option for now. [Fyodor]
> > >
> > > o [Zenmap] The Ports/Hosts display now has different colors for open
> > >  and closed ports. [Vladimir]
> > >
> > > o Fixed Zenmap so that it displays all Nmap errors.  Previously,
> only
> > >  stdout was redirected into the window, and not stderr.  Now they
> are
> > >  both redirected. [Vladimir]
> > >
> > > o NSE can now be used in combination with ping scan (e.g. "-sP
> > >  --script") so that you can execute host scripts without needing to
> > >  perform a port scan. [Kris]
> > >
> > > o [NSE] Category names are now case insensitive. [Patrick]
> > >
> > > o [NSE] Each thread for a script now gets its own action closure
> (and
> > >   upvalues). See: http://seclists.org/nmap-dev/2008/q2/0549.html
> > >  [Patrick]
> > >
> > > o [NSE] The script_scan_result structure has been changed to a
> class,
> > >  ScriptResult, which now holds a Script's output in an std::string.
> > >  This removes the need to use malloc and free to manage this memory.
> > >  A similar change was made to the run_record structure. [Patrick]
> > >
> > > o [NSE] Fixed a socket exhaustion deadlock which could prevent a
> > >  script scan from ever finishing. Now, rather than limit the total
> > >  number of sockets which can be open, we limit the number of scripts
> > >  which can have sockets open at once.  And once a script has one
> > >  socket opened, it is permitted to open as many more as it
> > >  needs. [Patrick]
> > >
> > > o A hashing library (code from OpenSSL) was added to NSE.  hashlib
> > >  contains md5 and sha1 routines. [Philip Pickering]
> > >
> > > o Fixed host discovery probe matching when looking at the returned
> TCP
> > >  data in an ICMP error message.  This could formerly lead to
> > >  incorrectly discarded responses and the debugging error message:
> > >  "Bogus trynum or sequence number in ICMP error message" [Kris]
> > >
> > > o Fixed a segmentation fault in Nsock which occurred when calling
> > >  nsock_write() with a data length of -1 (which means the data is a
> > >  NUL-terminated string and Nsock should take the length itself) and
> > >  the Nsock trace level was at least 2. [Kris]
> > >
> > > o The NSE Comm library now defaults to trying to read as many bytes
> as
> > >  are available rather than lines if neither the "bytes" nor "lines"
> > >  options are given.  Thanks to Brandon for reporting a problem which
> > >  he noticed in the dns-test-open-recursion script. [Kris]
> > >
> > > o Updated zoneTrans.nse to replace length bytes in returned domain
> > >  names to periods itself rather than relying on NSE's old behavior
> of
> > >  replacing non-printable characters with periods.  Thanks to Rob
> > >  Nicholls for reporting the problem. [Kris]
> > >
> > > o Some Zenmap crashes have been fixed: trying to "refresh" the
> output
> > >  of a scan loaded from a file, and trying to re-save a file loaded
> > >  from the command line in some circumstances. [David]
> > >
> > > o [Zenmap] The file selector now remembers what directory it was
> last
> > >  looking at. [David]
> > >
> > > o Added an extra layer of validity checking to received packets
> > >  (readip_pcap), just to be extra safe. See
> > >  http://seclists.org/nmap-dev/2008/q3/0644.html . [Kris]
> > >
> > > o Zenmap defaults to showing files matching both *.xml and *.usr in
> > >  the file selector. Previously it only showed those matching *.usr.
> > >  The new combined format will be XML and .usr will be deprecated.
> > >  See http://seclists.org/nmap-dev/2008/q3/0093.html .
> > >
> > > o Nmap avoids printing the sending rate in bytes per second during a
> > >  TCP connect scan. Because the number of bytes per probe is not
> > >  known, it used to print current sending rates: 11248.85 packets /
> s,
> > >  0.00 bytes / s.  Now it will print simply print rates like
> "11248.85
> > >  packets / s". [David]
> > >
> > > o [Zenmap] Nmap's installation process now include .desktop files
> > >  which install menu items for launchi svn log for
> > >  full details. [David]
> > >
> > > o Nmap --reason output no longer falsely reports a localhost-
> response
> > >  during -PN scans. See
> > >  http://seclists.org/nmap-dev/2008/q3/0188.html. [Michael]
> > >
> > > o [Zenmap] The higwidgets Python package has moved so it is now a
> > >  subpackage of zenmapGUI. This avoids naming conflicts with Umit,
> > >  which uses a slightly different version of higwidgets. [David]
> > >
> > > o A bug that could cause some host discovery probes to be
> incorrectly
> > >  interpreted as drops was fixed. This occurred only when the IP
> > >  protocol ping (-PO) option was combined with other ping
> > >  types. [David]
> > >
> > > o A new scanflags attribute has been added to XML output, which
> lists
> > >  all user specified --scanflags for the scan. nmap.dtd has been
> > >  modified to account for this. [Michael]
> > >
> > > o The loading of the nmap-services file has been made much
> > >  faster--roughly 9 times faster in common cases.  This is important
> > >  for the new (much larger) frequency augmented nmap-services
> > >  file. [David]
> > >
> > > o Added a script (ASN.nse) which uses Team Cymru's DNS interface to
> > >  determine the routing AS numbers of scanned IP addresses.  They
> even
> > >  set up a special domain just for Nmap queries.  The script is still
> > >  experimental and non-default. [Jah, Michael]
> > >
> > > o [Zenmap] Clicking "Cancel" in a file chooser in the diff interface
> > >  no longer causes a crash. [David]
> > >
> > > o The shtool build helper script has been updated to version 2.0.8.
> An
> > >  older version of shutil caused installation to fail when the locale
> > >  was set to et_EE. Thanks to Michal Januszewski for the bug
> > >  report. [David]
> > >
> > > o [Zenmap] Removed services.dmp and os_dmp.dmp and all the files
> that
> > >  referred to them. They are not needed with the new search
> > >  interface. Also removed an unused search progress bar.  And some
> > >  broken fingerprint submission code.  Yay for de-bloating! [David]
> > >
> > > o [Zenmap] Added "%F" to the Exec link in the new Zenmap desktop
> > >  file. We expect (hope) that this will allow dragging and dropping
> > >  XML files onto the icon. [David]
> > >
> > > o [Zenmap] The -o[XGASN] options can now be specified, just as you
> can
> > >  at the console. [Vladimir]
> > >
> > > o [Zenmap] You can now shrink the scan window below its default
> > >  size thanks to NmapOutputViewer code enhancements. [David]
> > >
> > > o [Zenmap] Removed optional use of the Psyco Python optimizer since
> > >  Zenmap is not the kind of CPU-bound application which benefits from
> > >  Psyco.
> > >
> > > o [Zenmap] You can now select more than one host in the "Ports /
> > >  Hosts" view by control-clicking them in the column at left.
> > >
> > > o [Zenmap] The profile editor now offers the --traceroute option.
> > >
> > > o Zenmap now uses Unicode objects pervasively when dealing with Nmap
> > >  text output, though the only internationalized text Nmap currently
> > >  outputs is the user's time zone. [David]
> > >
> > > o Unprintable characters in NSE script output (which really
> shouldn't
> > >  happen anyway) are now printed like \xHH, where HH is the
> > >  hexadecimal representation of the character. See
> > >  http://seclists.org/nmap-dev/2008/q3/0180.html . [Patrick]
> > >
> > > o Nmap sometimes sent packets with incorrect IP checksums,
> > >  particularly when sending the UDP probes in OS detection. This has
> > >  been fixed. Thanks to Gisle Vanem for reporting and investigating
> the
> > >  bug. [David]
> > >
> > > o Fixed the --without-liblua configure option so that it works
> > >  again. [David]
> > >
> > > o In the interest of forward compatibility, the xmloutputversion
> > >  attribute in Nmap XML output is no longer constrained to be a
> > >  certain string ("1.02"). The xmloutputversion should be taken as
> > >  merely advisory by authors of parsers.
> > >
> > > o Zenmap no longer leaves any temporary files lying around. [David]
> > >
> > > o Nmap only prints an uptime guess in verbose mode now, because in
> > >  some situations it can be very inaccurate. See the discussion at
> > >  http://seclists.org/nmap-dev/2008/q3/0392.html. [David]
> > >
> > >
> > > Enjoy!
> > > Fyodor
> > >
> > > _______________________________________________
> > > Sent through the nmap-dev mailing list
> > > http://cgi.insecure.org/mailman/listinfo/nmap-dev
> > > Archived at http://SecLists.Org
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://SecLists.Org


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org