n0t

[Marcin Ulikowski]

Aloha,

I'd like to announce version 1.86 of n0t - network 0S tracer

In short n0t is an easy to use sniffer with remote OS and NAT
detection, simple IDS (NMap, XMAS, NULL scans), output
configuration scripts (very useful for really big traffic)
and BPF filter (tcpdump-style).

I believe discussion will help in process of debugging and
developing next versions of this tool. Please send any comments,
suggestions and (what's probably the most important) new OS
fingerprints to n0t database.

Also, please send any information about successful or unsuccessful
attempts of compiling/launching n0t on different platforms.

n0t in action:

(root!osiris ~/n0t)# ./n0t -c n0t-sample.out -i ppp0 -S
n0t - network 0S tracer, version 1.86
(c) Marcin Ulikowski <r3b00t@itsec.pl>
n0t: parsed 156 signatures in 'n0t.fp'
n0t: listening on 'ppp0'
22:30:46 83.28.253.45:1145 -> 217.153.145.198:80 [.S....]
LEN:48 TTL:64 WSS:5840 DF (0 hops)
OS: Linux 2.4
22:30:57 83.28.253.45:2563 -> 216.136.204.117:80 [.S....] (NAT)
LEN:60 TTL:63 WSS:57344 DF (1 hops)
OS: FreeBSD 4.6 - 4.9
caught SIGINT(2) signal, exiting... (2 packets, 108 bytes read)

Newest version is always available at
http://r3b00t.itsec.pl/n0t/n0t-latest.tgz

--
----------------------------------------------
Marcin Ulikowski && http://r3b00t.itsec.pl/
Accidents are accidents only to ignorance
-------------------- `kill${IFS}-9${IFS}-1` --

[Michal Zalewski]

On Sat, 5 Jun 2004, Marcin Ulikowski wrote:

> I'd like to announce version 1.86 of n0t - network 0S tracer

Which, by the way, is mostly a line-by-line copy of p0f (including
software requirements in the documentation, manpages, my obscure set of
typedefs, variable names, configuration parameters, fingerprint checking
code and so forth), except that it offers fewer features and considerably
less accuracy than the most recent version of my utility
[http://lcamtuf.coredump.cx/p0f.shtml], as the fingerprinting code is
mostly based on a very old version of the program.

Naturally, p0f is open source, and hence can be copied and reused any way
you wish, except that it appears to be a good idea to credit the author if
you establish a work that is merely a dumbed down version of the code,
reuses some fairly novel ideas, and is not really offering any noteworthy
improvements over the original, particularly if you then announce it
publicly.

Heck, even the name appears to be quite similar.

As such, although I am not opposed to attempts to further advance the
field of passive fingerprinting, in this particular I would advise BUGTRAQ
readers to stick to p0f for now, which is again available at
http://lcamtuf.coredump.cx/p0f.shtml. P0f is a small, robust and
functional passive OS fingerprinting and NAT detection / network probing
tool.

--
------------------------- bash$ ){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2004-06-09 12:45 --

http://lcamtuf.coredump.cx/photo/current/