I have discovered that the Nmap OS database has some fingerprints missing for OS versions. For example, Apple iOS versions 7.1.2 and 9.3.2 are missing. Basically my question is to do with the reason why these OS versions are missing fingerprints in the Nmap-OS-DB. Have they not yet been added/nobody has submitted a fingerprint for these OS versions? Or, are the fingerprints for such versions as iOS 9.3.2 not distinct enough from existing Apple iOS fingerprints stored within Nmap-OS-DB?

(From the analysis of Nmap fingerprints that I've executed against iOS 9.3.2 it would appear that there are enough unique fields within the fingerprint to distinguish this fingerprint from other existing fingerprints within the Nmap-OS-DB).

  • The simplest explanation. Whom ever is responsible for the database forgot these releases. So what is your question exactly? – Ramhound Jul 9 '16 at 17:18
  • @Ramhound I just wanted to clarify that it was just the case that these missing fingerprints were missing because they had not been added yet rather than they were missing because the fingerprint output from an nmap os-guess scan was too similar to existing fingerprints within the nmap-os-db – smoggers Jul 9 '16 at 17:28
  • If they are the only versions missing its possible its on purpose. You would have to ask the person(s) responsible for the database that question though. – Ramhound Jul 9 '16 at 17:30
  • 1
    This question should be closed because—unless someone here works on the development if Nmap—utterly none of us can answer a question that focuses on the core development concepts and potentially missing items from Nmap. – Giacomo1968 Jul 9 '16 at 17:50
  • I believe there are Nmap developers who answer Nmap related queries on superuser. I believe @bonsaiviking works on Nmap development, if this is false then I apologise and I will delete the question – smoggers Jul 9 '16 at 17:57

The fingerprints in Nmap's OS database are user-submitted. The most likely reason these particular versions are missing is that no user has scanned those OS versions and submitted a fingerprint. This may be because they match an existing fingerprint with a close version; there is not likely to be a difference between iOS 7.1.1 and 7.1.2, for instance. A user in this case would have to know the exact target version, perform a scan with debugging output to obtain the raw fingerprint, then submit that fingerprint as a correction with the new OS version.

Another reason may be that the fingerprint was submitted later than the date of release for the Nmap database you are using. The nmap packages in the repositories for Debian, Red Hat, Ubuntu, etc. are usually out-of-date. Additionally, integrating user-submitted fingerprints is a manual process that takes several weeks of dedicated time to accomplish each year. We (the Nmap developers) are always looking for ways to improve this process and make more frequent updates, but generally there are only 2 releases per year.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.