DataSoft / Honeyd

virtual honeypots
GNU General Public License v2.0
350 stars 103 forks source link

Read and ignore the "Match Points" section of nmap-os-db #8

Closed DataSoft closed 11 years ago

DataSoft commented 12 years ago

The new format for nmap-os-db starts out with a dummy "Match Points" personality which looks like this:

MatchPoints SEQ(SP=25%GCD=75%ISR=25%TI=100%CI=50%II=100%SS=80%TS=100) OPS(O1=20%O2=20%O3=20%O4=20%O5=20%O6=20) WIN(W1=15%W2=15%W3=15%W4=15%W5=15%W6=15) ECN(R=100%DF=20%T=15%TG=15%W=15%O=15%CC=100%Q=20) T1(R=100%DF=20%T=15%TG=15%S=20%A=20%F=30%RD=20%Q=20) T2(R=80%DF=20%T=15%TG=15%W=25%S=20%A=20%F=30%O=10%RD=20%Q=20) T3(R=80%DF=20%T=15%TG=15%W=25%S=20%A=20%F=30%O=10%RD=20%Q=20) T4(R=100%DF=20%T=15%TG=15%W=25%S=20%A=20%F=30%O=10%RD=20%Q=20) T5(R=100%DF=20%T=15%TG=15%W=25%S=20%A=20%F=30%O=10%RD=20%Q=20) T6(R=100%DF=20%T=15%TG=15%W=25%S=20%A=20%F=30%O=10%RD=20%Q=20) T7(R=80%DF=20%T=15%TG=15%W=25%S=20%A=20%F=30%O=10%RD=20%Q=20) U1(R=50%DF=20%T=15%TG=15%IPL=100%UN=100%RIPL=100%RID=100%RIPCK=100%RUCK=100%RUD=100) IE(R=50%DFI=40%T=15%TG=15%CD=100)

This section tells the rest of nmap how many points each hit are worth, in the event that no exact match is found. However, it's not useful in honeyd.

The current (as of the fix for ticket #23) solution is to manually comment out this section. But we should do better. Read in this section and then ignore it programmatically.

PherricOxide commented 11 years ago

Fixed in a65f58bba3e9031c25ea90bd7ea3dcc8fc1133a2