0

I have discovered that the Nmap OS database has some fingerprints missing for OS versions. For example, Apple iOS versions 7.1.2 and 9.3.2 are missing. Basically my question is to do with the reason why these OS versions are missing fingerprints in the Nmap-OS-DB. Have they not yet been added/nobody has submitted a fingerprint for these OS versions? Or, are the fingerprints for such versions as iOS 9.3.2 not distinct enough from existing Apple iOS fingerprints stored within Nmap-OS-DB?

(From the analysis of Nmap fingerprints that I've executed against iOS 9.3.2 it would appear that there are enough unique fields within the fingerprint to distinguish this fingerprint from other existing fingerprints within the Nmap-OS-DB).

Improve this question
5
  • The simplest explanation. Whom ever is responsible for the database forgot these releases. So what is your question exactly?
    – Ramhound
    Jul 9, 2016 at 17:18
  • @Ramhound I just wanted to clarify that it was just the case that these missing fingerprints were missing because they had not been added yet rather than they were missing because the fingerprint output from an nmap os-guess scan was too similar to existing fingerprints within the nmap-os-db
    – smoggers
    Jul 9, 2016 at 17:28
  • If they are the only versions missing its possible its on purpose. You would have to ask the person(s) responsible for the database that question though.
    – Ramhound
    Jul 9, 2016 at 17:30
  • I believe there are Nmap developers who answer Nmap related queries on superuser. I believe @bonsaiviking works on Nmap development, if this is false then I apologise and I will delete the question
    – smoggers
    Jul 9, 2016 at 17:57
  • While I appreciate the rep from questions like these, @JakeGould is right: it is generally better to ask on the Nmap dev mailing list or #nmap on Freenode.
    – bonsaiviking
    Jul 12, 2016 at 3:22

1 Answer 1

Reset to default
1

The fingerprints in Nmap's OS database are user-submitted. The most likely reason these particular versions are missing is that no user has scanned those OS versions and submitted a fingerprint. This may be because they match an existing fingerprint with a close version; there is not likely to be a difference between iOS 7.1.1 and 7.1.2, for instance. A user in this case would have to know the exact target version, perform a scan with debugging output to obtain the raw fingerprint, then submit that fingerprint as a correction with the new OS version.

Another reason may be that the fingerprint was submitted later than the date of release for the Nmap database you are using. The nmap packages in the repositories for Debian, Red Hat, Ubuntu, etc. are usually out-of-date. Additionally, integrating user-submitted fingerprints is a manual process that takes several weeks of dedicated time to accomplish each year. We (the Nmap developers) are always looking for ways to improve this process and make more frequent updates, but generally there are only 2 releases per year.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .