Re: [RFC] Now Redoing Ncat's Output Options

["DePriest, Jason R." <jrdepriest () gmail com>]

On Sat, Oct 11, 2008 at 2:24 AM, Dirk Loss <> wrote:
>  > On Sat, Oct 11, 2008 at 12:22:22AM -0500 or thereabouts, Kris Katterjohn
> wrote:
> > > But this email isn't about removing these options, just renaming them.
> > >  Unless
> > > there are any compelling reasons to remove them, in which case feel free
> > > to
> > > mention them.
> >
> > cat -v [1].
> >
> > I vote remove 'em. Unix already has a way to print hex output:
>
> That's a good point. Maybe we should not focus on output _formats_, but more
> on output _contents_, i.e. include some of Ncats internal information that
> would be lost in a plain binary ouput. Such as direction of the
> communication (who said what), timestamps, or other meta information. Just
> as the metadata in Nmap's XML.
>
> Another aspect: As Ncat is supposed to work on Windows boxes as well, where
> some typical Unix text-utils aren't available, it might make sense to
> include at least some common formatting options in Ncat.
>
> Regards
> Dirk

@doug - spoken like a true unix guru.

The same can be said for built-in proxy server options.  Why use those
when you can use corkscrew or something like that?

Having an option to dump output as pcap format would let Windows users
pipe it through windump.

My favorite output option is like
       -X     When  parsing  and  printing,  in  addition  to printing
the headers of each packet, print the data of each
              packet (minus its link level header) in hex and ASCII.
This is very handy for analysing new protocols.
from tcpdump, or the similar option in Snort.  I don't have Snort
installed on this system, so I can't tell you exactly which set of
options I mean.  Basically, it has hex and ascii decode side-by-side.

A question is: do we want this to be a drop-in replacement for netcat
or do we want it to be a clone + improvement that may break old
scripts using netcat?
If the plan is improvement all the way, then the file output options
should be as close a match to nmap's as they can.

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org