nmap-2.08/ 40700 764 764 0 6662341761 11361 5ustar fyodorfyodornmap-2.08/nmap.c100600 764 764 313035 6662340551 12620 0ustar fyodorfyodor#include "nmap.h" #include "osscan.h" /* global options */ extern char *optarg; extern int optind; struct ops o; /* option structure */ int main(int argc, char *argv[]) { char *p, *q; int i, j, arg, argvlen; FILE *inputfd = NULL; char *host_spec; short fastscan=0, randomize=1, resolve_all=0; short quashargv = 0; int numhosts_scanned = 0; int numhosts_up = 0; int starttime; struct timeval tv; /* Just for seeding random generator */ unsigned short *ports = NULL; char myname[MAXHOSTNAMELEN + 1]; #if (defined(IN_ADDR_DEEPSTRUCT) || defined( SOLARIS)) /* Note that struct in_addr in solaris is 3 levels deep just to store an * unsigned int! */ struct ftpinfo ftp = { FTPUSER, FTPPASS, "", { { { 0 } } } , 21, 0}; #else struct ftpinfo ftp = { FTPUSER, FTPPASS, "", { 0 }, 21, 0}; #endif struct hostent *target = NULL; char **fakeargv = (char **) safe_malloc(sizeof(char *) * (argc + 1)); struct hoststruct *currenths; char emptystring[1]; int sourceaddrwarning = 0; /* Have we warned them yet about unguessable source addresses? */ /* Trap these sigs for cleanup */ signal(SIGINT, sigdie); signal(SIGTERM, sigdie); signal(SIGHUP, sigdie); if (!o.debugging) signal(SIGSEGV, sigdie); #ifdef ROUTETHROUGHTEST /* Routethrough stuph -- kill later */ { char *dev; struct in_addr dest; struct in_addr source; if (!resolve(argv[1], &dest)) fatal("Failed to resolve %s\n", argv[1]); dev = routethrough(&dest, &source); if (dev) printf("%s routes through device %s using IP address %s\n", argv[1], dev, inet_ntoa(source)); else printf("Could not determine which device to route through for %s!!!\n", argv[1]); exit(0); } #endif /* argv faking silliness */ for(i=0; i < argc; i++) { fakeargv[i] = safe_malloc(strlen(argv[i]) + 1); strncpy(fakeargv[i], argv[i], strlen(argv[i]) + 1); } fakeargv[argc] = NULL; printf("\nStarting nmap V. %s by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)\n", VERSION); /* Seed our random generator */ gettimeofday(&tv, NULL); if (tv.tv_usec) srand(tv.tv_usec); else if (tv.tv_sec) srand(tv.tv_sec); else srand(time(NULL)); /* initialize our options */ options_init(); emptystring[0] = '\0'; /* It wouldn't be an emptystring w/o this ;) */ if (argc < 2 ) printusage(argv[0]); /* OK, lets parse these args! */ while((arg = getopt(argc,fakeargv,"Ab:D:de:Ffg:hIi:M:m:NnOo:P:p:qRrS:s:T:Vv")) != EOF) { switch(arg) { case 'A': o.allowall++; break; case 'b': o.bouncescan++; if (parse_bounce(&ftp, optarg) < 0 ) { fprintf(stderr, "Your argument to -b is fucked up. Use the normal url style: user:pass@server:port or just use server and use default anon login\n Use -h for help\n"); } break; case 'D': p = optarg; do { q = strchr(p, ','); if (q) *q = '\0'; if (!strcasecmp(p, "me")) { if (o.decoyturn != -1) fatal("Can only use 'ME' as a decoy once.\n"); o.decoyturn = o.numdecoys++; } else { if (o.numdecoys >= MAX_DECOYS -1) fatal("You are only allowed %d decoys (if you need more redefine MAX_DECOYS in nmap.h)"); if (resolve(p, &o.decoys[o.numdecoys])) { o.numdecoys++; } else { fatal("Failed to resolve decoy host: %s (must be hostname or IP address", optarg); } } if (q) { *q = ','; p = q+1; } } while(q); break; case 'd': o.debugging++; o.verbose++; break; case 'e': strncpy(o.device, optarg,63); o.device[63] = '\0'; break; case 'F': fastscan++; break; case 'f': o.fragscan++; break; case 'g': o.magic_port = atoi(optarg); o.magic_port_set = 1; if (!o.magic_port) fatal("-g needs nonzero argument"); break; case 'h': case '?': printusage(argv[0]); break; case 'I': o.identscan++; break; case 'i': if (inputfd) { fatal("Only one input filename allowed"); } if (!strcmp(optarg, "-")) { inputfd = stdin; printf("Reading target specifications from stdin\n"); } else { inputfd = fopen(optarg, "r"); if (!inputfd) { fatal("Failed to open input file %s for reading", optarg); } printf("Reading target specifications from FILE: %s\n", optarg); } break; case 'M': o.max_sockets = atoi(optarg); if (o.max_sockets < 1) fatal("Argument to -M must be at least 1!"); if (o.max_sockets > MAX_SOCKETS_ALLOWED) { printf("Warning: You are limited to MAX_SOCKETS_ALLOWED (%d) parallel sockets. If you really need more, change the #define and recompile.\n", MAX_SOCKETS_ALLOWED); o.max_sockets = MAX_SOCKETS_ALLOWED; } break; case 'm': if (o.machinelogfd != NULL) fatal("Only one machine log filename allowed"); o.machinelogfd = fopen(optarg, "w"); if (!o.machinelogfd) fatal("Failed to open machine parseable log file %s", optarg); break; case 'N': o.force++; break; case 'n': o.noresolve++; break; case 'O': o.osscan++; o.reference_FPs = parse_fingerprint_reference_file(); break; case 'o': if (o.logfd != NULL) fatal("Only one log filename allowed"); o.logfd = fopen(optarg, "w"); if (!o.logfd) fatal("Failed to open output file %s for writing", optarg); break; case 'P': if (*optarg == '\0' || *optarg == 'I') o.pingtype |= PINGTYPE_ICMP; else if (*optarg == '0' || *optarg == 'N' || *optarg == 'D') o.pingtype = PINGTYPE_NONE; else if (*optarg == 'S') { o.pingtype |= (PINGTYPE_TCP|PINGTYPE_TCP_USE_SYN); if (isdigit((int) *(optarg+1))) { o.tcp_probe_port = atoi(optarg+1); printf("TCP probe port is %hu\n", o.tcp_probe_port); } else if (o.verbose) printf("TCP probe port is %hu\n", o.tcp_probe_port); } else if (*optarg == 'T' || *optarg == 'A') { o.pingtype |= (PINGTYPE_TCP|PINGTYPE_TCP_USE_ACK); if (isdigit((int) *(optarg+1))) { o.tcp_probe_port = atoi(optarg+1); printf("TCP probe port is %hu\n", o.tcp_probe_port); } else if (o.verbose) printf("TCP probe port is %hu\n", o.tcp_probe_port); } else if (*optarg == 'B') { o.pingtype = (PINGTYPE_TCP|PINGTYPE_TCP_USE_ACK|PINGTYPE_ICMP); if (isdigit((int) *(optarg+1))) o.tcp_probe_port = atoi(optarg+1); printf("TCP probe port is %hu\n", o.tcp_probe_port); } else {fatal("Illegal Argument to -P, use -P0, -PI, -PT, or -PT80 (or whatever number you want for the TCP probe destination port)"); } break; case 'p': if (ports) fatal("Only 1 -p option allowed, separate multiple ranges with commas."); ports = getpts(optarg); break; if (!ports) fatal("Your port specification string is not parseable"); case 'q': quashargv++; break; case 'R': resolve_all++; break; case 'r': randomize = 0; error("Warning: Randomize syntax has been changed, -r now requests that ports NOT be randomized"); break; case 'S': if (o.spoofsource) fatal("You can only use the source option once! Use -D -D etc. for decoys\n"); o.source = safe_malloc(sizeof(struct in_addr)); o.spoofsource = 1; if (!resolve(optarg, o.source)) fatal("Failed to resolve source address, try dotted decimal IP address\n"); break; case 's': if (!*optarg) { fprintf(stderr, "An option is required for -s, most common are -sT (tcp scan), -sS (SYN scan), -sF (FIN scan), -sU (UDP scan) and -sP (Ping scan)"); printusage(argv[0]); } p = optarg; while(*p) { switch(*p) { case 'B': fatal("No scan type 'B', did you mean bounce scan (-b)?"); break; case 'F': o.finscan = 1; break; case 'M': o.maimonscan = 1; break; case 'N': o.nullscan = 1; break; case 'P': o.pingscan = 1; break; case 'S': o.synscan = 1; break; case 'T': o.connectscan = 1; break; case 'U': printf("WARNING: -sU is now UDP scan -- for TCP FIN scan use -sF\n"); o.udpscan++; break; case 'X': o.xmasscan++;break; default: error("Scantype %c not supported\n",*p); printusage(argv[0]); break; } p++; } break; case 'T': o.ptime = atoi(optarg); break; case 'V': printf("\nnmap V. %s by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)\n", VERSION); exit(0); break; case 'v': o.verbose++; break; } } if (o.pingtype == PINGTYPE_UNKNOWN) { if (o.isr00t) o.pingtype = PINGTYPE_TCP|PINGTYPE_TCP_USE_ACK|PINGTYPE_ICMP; else o.pingtype = PINGTYPE_TCP; } /* Now we check the option sanity */ /* Insure that at least one scantype is selected */ if (!o.connectscan && !o.udpscan && !o.synscan && !o.finscan && !o.maimonscan && !o.nullscan && !o.xmasscan && !o.bouncescan && !o.pingscan) { o.connectscan++; if (o.verbose) error("No scantype specified, assuming vanilla tcp connect() scan. Use -sP if you really don't want to portscan (and just want to see what hosts are up)."); } if (o.pingtype != PINGTYPE_NONE && o.spoofsource) { error("WARNING: If -S is being used to fake your source address, you may also have to use -e and -P0 . If you are using it to specify your real source address, you can ignore this warning."); } if (o.connectscan && o.spoofsource) { error("WARNING: -S will not affect the source address used in a connect() scan. Use -sS or another raw scan if you want to use the specified source address for the port scanning stage of nmap"); } if (fastscan && ports) { fatal("You can specify fast scan (-F) or explicitly select individual ports (-p), but not both"); } else if (fastscan) { ports = getfastports(o.synscan|o.connectscan|o.fragscan|o.finscan|o.maimonscan|o.bouncescan|o.nullscan|o.xmasscan,o.udpscan); } if (o.pingscan && ports) { fatal("You cannot use -F (fast scan) or -p (explicit port selection) with PING scan"); } if (o.pingscan && fastscan) { fatal("The fast scan (-F) is incompatible with ping scan"); } if (!ports) { ports = getdefaultports(o.synscan|o.connectscan|o.fragscan|o.finscan| o.maimonscan|o.bouncescan|o.nullscan|o.xmasscan, o.udpscan); } /* Default dest port for tcp probe */ if (!o.tcp_probe_port) o.tcp_probe_port = 80; if (o.pingscan && (o.connectscan || o.udpscan || o.synscan || o.finscan || o.maimonscan || o.nullscan || o.xmasscan || o.bouncescan)) { fatal("Ping scan is not valid with any other scan types (the other ones all include a ping scan"); } /* We start with stuff users should not do if they are not root */ if (!o.isr00t) { if (o.pingtype & PINGTYPE_ICMP) { error("Warning: You are not root -- using TCP pingscan rather than ICMP"); o.pingtype = PINGTYPE_TCP; } if (o.finscan || o.synscan || o.maimonscan || o.nullscan || o.xmasscan || o.udpscan ) { fatal("You requested a scan type which requires r00t privileges, and you do not have them.\n"); } if (o.numdecoys > 0) { fatal("Sorry, but you've got to be r00t to use decoys, boy!"); } if (o.fragscan) { fatal("Sorry, but fragscan requires r00t privileges\n"); } if (o.osscan) { fatal("TCP/IP fingerprinting (for OS scan) requires root privileges which you do not appear to possess. Sorry, dude.\n"); } } if (o.bouncescan && o.pingtype != PINGTYPE_NONE) printf("Hint: if your bounce scan target hosts aren't reachable from here, remember to use -P0 so we don't try and ping them prior to the scan\n"); if (o.connectscan + o.synscan + o.finscan + o.maimonscan + o.xmasscan + o.nullscan > 1) { fatal("You specified more than one type of TCP scan. Please choose only one of -sT, -sS, -sF, -sM, -sX, and -sN"); } if (o.numdecoys > 0 && (o.bouncescan || o.connectscan)) { fatal("Decoys are irrelevant to the bounce or connect scans"); } if (o.fragscan && (o.connectscan || (o.udpscan && (o.synscan + o.finscan + o.maimonscan + o.xmasscan + o.nullscan == 0)))) fatal("Fragmentation scan can only be used with SYN, FIN, Maimon, XMAS, or NULL scan types"); if (o.identscan && !o.connectscan) { error("Identscan only works with connect scan (-sT) ... ignoring option"); } if (o.osscan && o.bouncescan) error("Combining bounce scan with OS scan seems silly, but I will let you do whatever you want!"); #if !defined(LINUX) && !defined(OPENBSD) && !defined(FREEBSD) && !defined(NETBSD) if (o.fragscan) { fprintf(stderr, "Warning: Packet fragmentation selected on a host other than Linux, OpenBSD, FreeBSD, or NetBSD. This may or may not work.\n"); } #endif if (o.max_sockets > MAX_SOCKETS_ALLOWED) { error("Warning: You are limited to MAX_SOCKETS_ALLOWED (%d) parallel sockets. If you really need more, change the #define and recompile.\n", MAX_SOCKETS_ALLOWED); o.max_sockets = MAX_SOCKETS_ALLOWED; } if (o.osscan && o.pingscan) { fatal("WARNING: OS Scan is unreliable with a ping scan. You need to use a scan type along with it, such as -sS, -sT, -sF, etc instead of -sP"); } if (o.magic_port_set && o.connectscan) { error("WARNING: -g is incompatible with the default connect() scan (-sT). Use a raw scan such as -sS if you want to set the source port."); } /* Set up our array of decoys! */ if (o.decoyturn == -1) { o.decoyturn = (o.numdecoys == 0)? 0 : get_random_uint() % o.numdecoys; o.numdecoys++; for(i=o.numdecoys-1; i > o.decoyturn; i--) o.decoys[i] = o.decoys[i-1]; } /* We need to find what interface to route through if: * --None have been specified AND * --We are root and doing tcp ping OR * --We are doing a raw sock scan and NOT pinging anyone */ if (o.source && !*o.device) { if (ipaddr2devname(o.device, o.source) != 0) { fatal("Could not figure out what device to send the packet out on with the source address you gave me! If you are trying to sp00f your scan, this is normal, just give the -e eth0 or -e ppp0 or whatever. Otherwise you can still use -e, but I find it kindof fishy."); } } if (*o.device && !o.source) { o.source = safe_malloc(sizeof(struct in_addr)); if (devname2ipaddr(o.device, o.source) == -1) { fatal("I cannot figure out what source address to use for device %s, does it even exist?", o.device); } } /* If he wants to bounce off of an ftp site, that site better damn well be reachable! */ if (o.bouncescan) { if (!inet_aton(ftp.server_name, &ftp.server)) { if ((target = gethostbyname(ftp.server_name))) memcpy(&ftp.server, target->h_addr_list[0], 4); else { fprintf(stderr, "Failed to resolve ftp bounce proxy hostname/IP: %s\n", ftp.server_name); exit(1); } } else if (o.verbose) printf("Resolved ftp bounce attack proxy to %s (%s).\n", ftp.server_name, inet_ntoa(ftp.server)); } fflush(stdout); if (o.logfd) { /* Brief info incase they forget what was scanned */ fprintf(o.logfd, "# Log of: "); for(i=0; i < argc; i++) fprintf(o.logfd, "%s ", fakeargv[i]); fprintf(o.logfd, "\n"); } /* more fakeargv junk, BTW malloc'ing extra space in argv[0] doesn't work */ if (quashargv) { argvlen = strlen(argv[0]); if (argvlen < strlen(FAKE_ARGV)) fatal("If you want me to fake your argv, you need to call the program with a longer name. Try the full pathname, or rename it fyodorssuperdedouperportscanner"); strncpy(argv[0], FAKE_ARGV, strlen(FAKE_ARGV)); for(i = strlen(FAKE_ARGV); i < argvlen; i++) argv[0][i] = '\0'; for(i=1; i < argc; i++) { argvlen = strlen(argv[i]); for(j=0; j <= argvlen; j++) argv[i][j] = '\0'; } } signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE so our program doesn't crash because of it, but we really shouldn't get an unsuspected SIGPIPE */ if (o.max_sockets && (i = max_sd()) && i < o.max_sockets) { printf("Your specified max_parallel_sockets of %d, but your system says it might only give us %d. Trying anyway\n", o.max_sockets, i); } if (!o.max_sockets) { o.max_sockets = max_sd(); if (!o.max_sockets) o.max_sockets = 60; else if (o.max_sockets > 5) o.max_sockets -= 4; /* To make up for misc. uncounted sockets */ o.max_sockets = MIN(o.max_sockets, 125); } if (o.debugging > 1) printf("The max # of sockets we are using is: %d\n", o.max_sockets); if (randomize) shortfry(ports); starttime = time(NULL); while((host_spec = grab_next_host_spec(inputfd, argc, fakeargv))) { while((currenths = nexthost(host_spec, 500, o.ptime)) && currenths->host.s_addr) { numhosts_scanned++; if (currenths->flags & HOST_UP) numhosts_up++; /* printf("Nexthost() returned: %s\n", inet_ntoa(currenths->host));*/ target = NULL; if (((currenths->flags & HOST_UP) || resolve_all) && !o.noresolve) target = gethostbyaddr((char *) ¤ths->host, 4, AF_INET); if (target) { currenths->name = strdup(target->h_name); } else { currenths->name = emptystring; } if (o.source) memcpy(¤ths->source_ip, o.source, sizeof(struct in_addr)); if (!o.pingscan) { if (o.pingtype != PINGTYPE_NONE && (currenths->flags & HOST_UP) && (o.verbose || o.debugging)) printf("Host %s (%s) appears to be up ... good.\n", currenths->name, inet_ntoa(currenths->host)); else if (o.verbose && o.pingtype != PINGTYPE_NONE && !(currenths->flags & HOST_UP)) { if (resolve_all) nmap_log("Host %s (%s) appears to be down, skipping it.\n", currenths->name, inet_ntoa(currenths->host)); else printf("Host %s (%s) appears to be down, skipping it.\n", currenths->name, inet_ntoa(currenths->host)); } } else { if (currenths->flags & HOST_UP) { nmap_log("Host %s (%s) appears to be up.\n", currenths->name, inet_ntoa(currenths->host)); nmap_machine_log("Host: %s (%s)\tStatus: Up\n", inet_ntoa(currenths->host), currenths->name); } else if (o.verbose || o.debugging || resolve_all) { if (resolve_all) nmap_log("Host %s (%s) appears to be down.\n", currenths->name, inet_ntoa(currenths->host)); else printf("Host %s (%s) appears to be down.\n", currenths->name, inet_ntoa(currenths->host)); } } if (currenths->wierd_responses) { nmap_log("Host %s (%s) seems to be a subnet broadcast address (returned %d extra pings). Skipping host.\n", currenths->name, inet_ntoa(currenths->host), currenths->wierd_responses); nmap_machine_log("Host: %s (%s)\tStatus: Smurf (%d responses)\n", inet_ntoa(currenths->host), currenths->name, currenths->wierd_responses); } /* The !currenths->wierd_responses was commented out after I found a smurf address which DID allow port scanninng and you could even telnetthere. wierd :0 */ if (currenths->flags & HOST_UP /* && !currenths->wierd_responses*/ && !o.pingscan) { if (currenths->flags & HOST_UP && !currenths->source_ip.s_addr && ( o.synscan || o.finscan || o.maimonscan || o.udpscan || o.nullscan || o.xmasscan)) { if (gethostname(myname, MAXHOSTNAMELEN) || !(target = gethostbyname(myname))) fatal("Cannot get hostname! Try using -S or -e \n"); memcpy(¤ths->source_ip, target->h_addr_list[0], sizeof(struct in_addr)); if (! sourceaddrwarning) { printf("We could not determine for sure which interface to use, so we are guessing %s . If this is wrong, use -S .\n", inet_ntoa(currenths->source_ip)); sourceaddrwarning = 1; } } /* Figure out what link-layer device (interface) to use (ie eth0, ppp0, etc) */ if (!*currenths->device && currenths->flags & HOST_UP && (o.nullscan || o.xmasscan || o.udpscan || o.finscan || o.maimonscan || o.synscan || o.osscan) && (ipaddr2devname( currenths->device, ¤ths->source_ip) != 0)) fatal("Could not figure out what device to send the packet out on! You might possibly want to try -S (but this is probably a bigger problem). If you are trying to sp00f the source of a SYN/FIN scan with -S , then you must use -e eth0 (or other devicename) to tell us what interface to use.\n"); /* Set up the decoy */ o.decoys[o.decoyturn] = currenths->source_ip; /* Time for some actual scanning! */ if (o.synscan) pos_scan(currenths, ports, SYN_SCAN); if (o.connectscan) pos_scan(currenths, ports, CONNECT_SCAN); if (o.finscan) super_scan(currenths, ports, FIN_SCAN); if (o.xmasscan) super_scan(currenths, ports, XMAS_SCAN); if (o.nullscan) super_scan(currenths, ports, NULL_SCAN); if (o.maimonscan) super_scan(currenths, ports, MAIMON_SCAN); if (o.udpscan) super_scan(currenths, ports, UDP_SCAN); if (o.bouncescan) { if (ftp.sd <= 0) ftp_anon_connect(&ftp); if (ftp.sd > 0) bounce_scan(currenths, ports, &ftp); } if (o.osscan) { os_scan(currenths); } if (!currenths->ports && !o.pingscan) { nmap_log("No ports open for host %s (%s)\n", currenths->name, inet_ntoa(currenths->host)); nmap_machine_log("Host: %s (%s)\tStatus: Up", inet_ntoa(currenths->host), currenths->name); } if (currenths->ports) { nmap_log("Interesting ports on %s (%s):\n", currenths->name, inet_ntoa(currenths->host)); nmap_machine_log("Host: %s (%s)", inet_ntoa(currenths->host), currenths->name); invertfirewalled(¤ths->ports, ports); printandfreeports(currenths->ports); } if (o.osscan) { if (currenths->seq.responses > 3) { nmap_log("%s", seqreport(&(currenths->seq))); nmap_machine_log("\tSeq Index: %d", currenths->seq.index); } if (currenths->FP_matches[0]) { nmap_machine_log("\tOS: %s", currenths->FP_matches[0]->OS_name); i = 1; while(currenths->FP_matches[i]) { nmap_machine_log("|%s", currenths->FP_matches[i]->OS_name); i++; } if (!currenths->FP_matches[1]) nmap_log("Remote operating system guess: %s", currenths->FP_matches[0]->OS_name); else { nmap_log("Remote OS guesses: %s", currenths->FP_matches[0]->OS_name); i = 1; while(currenths->FP_matches[i]) { nmap_log(", %s", currenths->FP_matches[i]->OS_name); i++; } } nmap_log("\n"); if (currenths->goodFP >= 0 && (o.debugging || o.verbose > 1)) { nmap_log("OS Fingerprint:\n%s\n", fp2ascii(currenths->FPs[currenths->goodFP])); } nmap_log("\n"); } else { if (currenths->goodFP == ENOMATCHESATALL) { nmap_log("No OS matches for host (see http://www.insecure.org/cgi-bin/nmap-submit.cgi).\nTCP/IP fingerprint:\n%s\n\n", mergeFPs(currenths->FPs, currenths->numFPs)); } else if (currenths->goodFP == ETOOMANYMATCHES) { nmap_log("Too many fingerprints match this host for me to give an accurate OS guess\n"); if (o.debugging || o.verbose) { nmap_log("TCP/IP fingerprint:\n%s\n\n", mergeFPs(currenths->FPs, currenths->numFPs)); } } } for(i=0; i < currenths->numFPs; i++) freeFingerPrint(currenths->FPs[i]); } if (o.machinelogfd) fflush(o.machinelogfd); if (o.debugging) printf("Final times for host: srtt: %d rttvar: %d to: %d\n", currenths->to.srtt, currenths->to.rttvar, currenths->to.timeout); nmap_machine_log("\n"); } fflush(stdout); if (o.machinelogfd) fflush(o.machinelogfd); if (o.logfd) fflush(o.logfd); } } i = time(NULL) - starttime; printf("Nmap run completed -- %d %s (%d %s up) scanned in %d %s\n", numhosts_scanned, (numhosts_scanned == 1)? "IP address" : "IP addresses", numhosts_up, (numhosts_up == 1)? "host" : "hosts", i, (i == 1)? "second": "seconds"); return 0; } void options_init() { bzero( (char *) &o, sizeof(struct ops)); o.isr00t = !(geteuid()); o.debugging = DEBUGGING; o.verbose = DEBUGGING; /*o.max_sockets = MAX_SOCKETS;*/ o.magic_port = 33000 + (get_random_uint() % 31000); #ifdef IGNORE_ZERO_AND_255_HOSTS o.allowall = !(IGNORE_ZERO_AND_255_HOSTS); #endif o.ptime = PING_TIMEOUT; o.pingtype = PINGTYPE_UNKNOWN; o.decoyturn = -1; } inline void max_rcvbuf(int sd) { int optval = 524288 /*2^19*/, optlen = sizeof(int); if (setsockopt(sd, SOL_SOCKET, SO_RCVBUF, (void *) &optval, optlen)) if (o.debugging) perror("Problem setting large socket recieve buffer"); if (o.debugging) { getsockopt(sd, SOL_SOCKET, SO_RCVBUF,(void *) &optval, &optlen); printf("Our buffer size is now %d\n", optval); } } /* Maximize the open file descriptor limit for this process go up to the max allowed */ int max_sd() { struct rlimit r; #if(defined(RLIMIT_NOFILE)) if (!getrlimit(RLIMIT_NOFILE, &r)) { r.rlim_cur = r.rlim_max; if (setrlimit(RLIMIT_NOFILE, &r)) if (o.debugging) perror("setrlimit RLIMIT_NOFILE failed"); if (!getrlimit(RLIMIT_NOFILE, &r)) return r.rlim_cur; else return 0; } #endif #if(defined(RLIMIT_OFILE) && !defined(RLIMIT_NOFILE)) if (!getrlimit(RLIMIT_OFILE, &r)) { r.rlim_cur = r.rlim_max; if (setrlimit(RLIMIT_OFILE, &r)) if (o.debugging) perror("setrlimit RLIMIT_OFILE failed"); if (!getrlimit(RLIMIT_OFILE, &r)) return r.rlim_cur; else return 0; } #endif return 0; } inline int block_socket(int sd) { int options; options = (~O_NONBLOCK) & fcntl(sd, F_GETFL); fcntl(sd, F_SETFL, options); return 1; } inline void broadcast_socket(int sd) { int one = 1; if (setsockopt(sd, SOL_SOCKET, SO_BROADCAST, (void *)&one, sizeof(int)) != 0) { printf("Failed to secure socket broadcasting permission\n"); perror("setsockopt"); } } /* We set the socket lingering so we will RST connection instead of wasting bandwidth with the four step close */ inline void init_socket(int sd) { struct linger l; l.l_onoff = 1; l.l_linger = 0; if (setsockopt(sd, SOL_SOCKET, SO_LINGER, (void *) &l, sizeof(struct linger))) { fprintf(stderr, "Problem setting socket SO_LINGER, errno: %d\n", errno); perror("setsockopt"); } } /* Convert a string like "-100,200-1024,3000-4000,60000-" into an array of port numbers*/ unsigned short *getpts(char *origexpr) { int exlen = strlen(origexpr); char *p,*q; unsigned short *tmp, *ports; int i=0, j=0,start,end; char *expr = strdup(origexpr); char *mem = expr; ports = safe_malloc(65536 * sizeof(short)); for(;j < exlen; j++) if (expr[j] != ' ') expr[i++] = expr[j]; expr[i] = '\0'; exlen = i; i=0; while((p = strchr(expr,','))) { *p = '\0'; if (*expr == '-') {start = 1; end = atoi(expr+ 1);} else { start = end = atoi(expr); if ((q = strchr(expr,'-')) && *(q+1) ) end = atoi(q + 1); else if (q && !*(q+1)) end = 65535; } if (o.debugging) printf("The first port is %d, and the last one is %d\n", start, end); if (start < 1 || start > end || end > 65535) fatal("Your port specifications are illegal!"); for(j=start; j <= end; j++) { if (i < 65536) ports[i++] = j; else fatal("Too many ports specified"); } expr = p + 1; } if (*expr == '-') { start = 1; end = atoi(expr+ 1); } else { start = end = atoi(expr); if ((q = strchr(expr,'-')) && *(q+1) ) end = atoi(q+1); else if (q && !*(q+1)) end = 65535; } if (o.debugging) printf("The first port is %d, and the last one is %d\n", start, end); if (start < 1 || start > end || end > 65535) fatal("Your port specifications are illegal!"); for(j=start; j <= end; j++) { if (i < 65536) ports[i++] = j; else fatal("Too many ports specified"); } o.numports = i; /* ports[i++] = j;*/ ports[i++] = 0; tmp = realloc(ports, o.numports * sizeof(short)); free(mem); return tmp; } void printusage(char *name) { printf("nmap V. %s usage: nmap [Scan Type(s)] [Options] \n\ Scan types\n\ -sT tcp connect() port scan\n\ -sS tcp SYN stealth port scan (must be root)\n\ -sF,-sX,-sN Stealth FIN, Xmas, or Null scan (only works against UNIX).\n\ -sP ping \"scan\". Find which hosts on specified network(s) are up but don't \n\ port scan them\n\ -sU UDP port scan, must be r00t\n\ -b ftp \"bounce attack\" port scan\n\ Options (none are required, most can be combined):\n\ -f use tiny fragmented packets for SYN, FIN, Xmas, or NULL scan.\n\ -P0 Don't ping hosts (needed to scan www.microsoft.com and others)\n\ -PT Use \"TCP Ping\" to see what hosts are up (for normal and ping scans).\n\ -PT21 Use \"TCP Ping\" scan with probe destination port of 21 (or whatever).\n\ -PI Use ICMP ping packet to determines hosts that are up\n\ -PB Do BOTH TCP & ICMP scans in parallel (TCP dest port can be specified after the 'B')\n\ -PS Use TCP SYN sweep rather than the default ACK sweep used in \"TCP ping\"\n\ -O Use TCP/IP fingerprinting to guess what OS the remote host is running\n\ -p ports: ex: \'-p 23\' will only try port 23 of the host(s)\n\ \'-p 20-30,63000-\' scans 20-30 and 63000-65535. default: 1-1024 + /etc/services\n\ -Ddecoy_host1,decoy2,ME,decoy3[,...] Launch scans from decoy host(s) along\n\ with the real one. If you care about the order your real IP appears,\n\ stick \"ME\" somewhere in the list. Even if the target detects the\n\ scan, they are unlikely to know which IP is scanning them and which \n\ are decoys.\n\ -F fast scan. Only scans ports in /etc/services, a la strobe(1).\n\ -I Get identd (rfc 1413) info on listening TCP processes.\n\ -n Don't DNS resolve anything unless we have to (makes ping scans faster)\n\ -R Try to resolve all hosts, even down ones (can take a lot of time)\n\ -o Output scan logs to in human readable.\n\ -m Output scan logs to in machine parseable format.\n\ -i Grab IP numbers or hostnames from file. Use '-' for stdin\n\ -g Sets the source port used for scans. 20 and 53 are good choices.\n\ -S If you want to specify the source address of SYN or FYN scan.\n", VERSION); if (!o.allowall) printf(" -A Allow scanning .0 and .255 addresses" ); printf(" -v Verbose. Its use is recommended. Use twice for greater effect.\n\ -h help, print this junk. Also see http://www.insecure.org/nmap/\n\ -V Print version number and exit.\n"); printf(" -e . Send packets on interface (eth0,ppp0,etc.).\n"); printf(" -q quash argv to something benign, currently set to \"%s\". (deprecated)\n", FAKE_ARGV); printf("Hostnames specified as internet hostname or IP address. Optional '/mask' \ specifies subnet. For example: cert.org/24 or 192.88.209.5/24 or 192.88.209.0-255 or '128.88.209.*' all scan CERT's Class C.\n\ SEE THE MAN PAGE FOR MORE THOROUGH EXPLANATIONS AND EXAMPLES.\n"); exit(0); } char *seqreport(struct seq_info *seq) { static char report[512]; char tmp[256]; char *p; int i; int len; sprintf(report, "TCP Sequence Prediction: Class=%s\n Difficulty=%d (%s)\n", seqclass2ascii(seq->class), seq->index, (seq->index < 10)? "Trivial joke" : (seq->index < 80)? "Easy" : (seq->index < 3000)? "Medium" : (seq->index < 5000)? "Formidable" : (seq->index < 100000)? "Worthy challenge" : "Good luck!"); if (o.verbose) { tmp[0] = '\n'; tmp[1] = '\0'; p = tmp + 1; strcpy(p, "Sequence numbers: "); p += 18; for(i=0; i < seq->responses; i++) { len = sprintf(p, "%lX ", seq->seqs[i]); #ifdef SPRINTF_RETURNS_STRING p += strlen(p); #else p += len; #endif } *--p = '\n'; strcat(report, tmp); } return report; } char *seqclass2ascii(int class) { switch(class) { case SEQ_CONSTANT: return "constant sequence number (!)"; case SEQ_64K: return "64K rule"; case SEQ_TD: return "trivial time dependency"; case SEQ_i800: return "increments by 800"; case SEQ_RI: return "random positive increments"; case SEQ_TR: return "truly random"; case SEQ_UNKNOWN: return "unknown class"; default: return "Error, WTF?"; } } struct port *lookupport(portlist ports, unsigned short portno, unsigned short protocol) { portlist result = ports; while(result && result->portno <= portno) { if(result->portno == portno && result->proto == protocol) return result; result = result->next; } return NULL; } /* gawd, my next project will be in c++ so I don't have to deal with this crap ... simple linked list implementation */ int addport(portlist *ports, unsigned short portno, unsigned short protocol, char *owner, int state) { struct port *current, *tmp; int len; /* Make sure state is OK */ if (state != PORT_OPEN && state != PORT_CLOSED && state != PORT_FIREWALLED && state != PORT_UNFIREWALLED) fatal("addport: attempt to add port number %d with illegal state %d\n", portno, state); if (*ports) { current = *ports; /* case 1: we add to the front of the list */ if (portno <= current->portno) { if (current->portno == portno && current->proto == protocol) { if (current->state != state) { current->state = state; return 0; } if (o.debugging || o.verbose) printf("Duplicate port (%hu/%s)\n", portno , (protocol == IPPROTO_TCP)? "tcp": "udp"); /* I still want to use the newer info in most cases */ current->state = state; if (!current->owner && owner && *owner) current->owner = strdup(owner); return -1; } tmp = current; *ports = safe_malloc(sizeof(struct port)); (*ports)->next = tmp; current = *ports; current->portno = portno; current->proto = protocol; current->confidence = CONF_HIGH; current->state = state; if (owner && *owner) { len = strlen(owner); current->owner = malloc(sizeof(char) * (len + 1)); strncpy(current->owner, owner, len + 1); } else current->owner = NULL; } else { /* case 2: we add somewhere in the middle or end of the list */ while( current->next && current->next->portno < portno) current = current->next; if (current->next && current->next->portno == portno && current->next->proto == protocol) { if (current->state != state) { current->state = state; return 0; } if (o.debugging || o.verbose) printf("Duplicate port (%hu/%s)\n", portno , (protocol == IPPROTO_TCP)? "tcp": "udp"); /* I still want to use the newer info in most cases */ current->state = state; if (!current->owner && owner && *owner) current->owner = strdup(owner); return -1; } tmp = current->next; current->next = safe_malloc(sizeof(struct port)); current->next->next = tmp; tmp = current->next; tmp->portno = portno; tmp->proto = protocol; tmp->confidence = CONF_HIGH; tmp->state = state; if (owner && *owner) { len = strlen(owner); tmp->owner = malloc(sizeof(char) * (len + 1)); strncpy(tmp->owner, owner, len + 1); } else tmp->owner = NULL; } } else { /* Case 3, list is null */ *ports = safe_malloc(sizeof(struct port)); tmp = *ports; tmp->portno = portno; tmp->proto = protocol; tmp->confidence = CONF_HIGH; tmp->state = state; if (owner && *owner) { len = strlen(owner); tmp->owner = safe_malloc(sizeof(char) * (len + 1)); strncpy(tmp->owner, owner, len + 1); } else tmp->owner = NULL; tmp->next = NULL; } return 0; /*success */ } int deleteport(portlist *ports, unsigned short portno, unsigned short protocol) { portlist current, tmp; if (!*ports) { if (o.debugging > 1) error("Tried to delete from empty port list!"); return -1; } current = *ports; /* Case 1, deletion from front of list*/ if (current->portno == portno && current->proto == protocol) { tmp = current->next; if (current->owner) free(current->owner); current->next = NULL; /* Just because */ free(current); *ports = tmp; } else { for(;current->next && (current->next->portno != portno || current->next->proto != protocol); current = current->next) ; if (!current->next) return -1; tmp = current->next; current->next = tmp->next; if (tmp->owner) free(tmp->owner); tmp->next = NULL; /* Just because */ free(tmp); } return 0; /* success */ } char *grab_next_host_spec(FILE *inputfd, int argc, char **fakeargv) { static char host_spec[512]; int host_spec_index; int ch; if (!inputfd) { return( (optind < argc)? fakeargv[optind++] : NULL); } host_spec_index = 0; while((ch = getc(inputfd)) != EOF) { if (ch == ' ' || ch == '\n' || ch == '\t' || ch == '\0') { if (host_spec_index == 0) continue; host_spec[host_spec_index] = '\0'; return host_spec; } else if (host_spec_index < 511) { host_spec[host_spec_index++] = (char) ch; } else fatal("One of the host_specifications from your input file is too long (> %d chars)", sizeof(host_spec)); } host_spec[host_spec_index] = '\0'; if (!*host_spec) return NULL; return host_spec; } char *statenum2str(int state) { switch(state) { case PORT_OPEN: return "open"; break; case PORT_FIREWALLED: return "filtered"; break; case PORT_UNFIREWALLED: return "unfiltered"; break; case PORT_CLOSED: return "closed"; break; default: return "unknown"; break; } return "unknown"; } void printandfreeports(portlist ports) { char protocol[4]; char *state; int first = 1; struct servent *service; port *current = ports, *tmp; nmap_log("Port State Protocol Service"); nmap_log("%s", (o.identscan)?" Owner\n":"\n"); nmap_machine_log("\tPorts: "); while(current != NULL) { if (!first) nmap_machine_log(", "); else first = 0; strcpy(protocol,(current->proto == IPPROTO_TCP)? "tcp": "udp"); state = statenum2str(current->state); service = nmap_getservbyport(htons(current->portno), protocol); nmap_log("%-8d%-12s%-11s%-16s%s\n", current->portno, state, protocol, (service)? service->s_name: "unknown", (current->owner)? current->owner : ""); /* format is 22/TCP/Open/root/banner/TBD/TBD/ */ nmap_machine_log("%d/%s/%s/%s////", current->portno, state, protocol, (current->owner)? current->owner : ""); tmp = current; current = current->next; if (tmp->owner) free(tmp->owner); free(tmp); } nmap_log("\n"); } int listen_icmp(int icmpsock, unsigned short outports[], unsigned short numtries[], int *num_out, struct in_addr target, portlist *ports) { char response[1024]; struct sockaddr_in stranger; int sockaddr_in_size = sizeof(struct sockaddr_in); struct in_addr bs; struct ip *ip = (struct ip *)response; struct ip *ip2; struct icmp *icmp = (struct icmp *) (response + sizeof(struct ip)); unsigned short *data; int badport, numcaught=0, bytes, i, tmptry=0, found=0; while ((bytes = recvfrom(icmpsock, response, 1024, 0, (struct sockaddr *) &stranger, &sockaddr_in_size)) > 0) { numcaught++; bs.s_addr = ip->ip_src.s_addr; if (ip->ip_src.s_addr == target.s_addr && ip->ip_p == IPPROTO_ICMP && icmp->icmp_type == 3 && icmp->icmp_code == 3) { ip2 = (struct ip *) (response + 4 * ip->ip_hl + sizeof(struct icmp)); data = (unsigned short *) ((char *)ip2 + 4 * ip2->ip_hl); badport = ntohs(data[1]); /*delete it from our outports array */ found = 0; for(i=0; i < o.max_sockets; i++) if (outports[i] == badport) { found = 1; tmptry = numtries[i]; outports[i] = numtries[i] = 0; (*num_out)--; break; } if (o.debugging && found && tmptry > 0) printf("Badport: %d on try number %d\n", badport, tmptry); if (!found) { if (o.debugging) printf("Badport %d came in late, deleting from portlist.\n", badport); if (deleteport(ports, badport, IPPROTO_UDP) < 0) if (o.debugging) printf("Port deletion failed.\n"); } } else { if (o.debugging) printf("Caught icmp type %d code %d\n", icmp->icmp_type, icmp->icmp_code); } } return numcaught; } /* This attempts to calculate the round trip time (rtt) to a host by timing a connect() to a port which isn't listening. A better approach is to time a ping (since it is more likely to get through firewalls (note, this isn't always true nowadays --fyodor). This is now implemented in isup() for users who are root. */ unsigned long calculate_sleep(struct in_addr target) { struct timeval begin, end; int sd; struct sockaddr_in sock; int res; if ((sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {perror("Socket troubles"); exit(1);} sock.sin_family = AF_INET; sock.sin_addr.s_addr = target.s_addr; sock.sin_port = htons(o.magic_port); gettimeofday(&begin, NULL); if ((res = connect(sd, (struct sockaddr *) &sock, sizeof(struct sockaddr_in))) != -1) printf("You might want to use a different value of -g (or change o.magic_port in the include file), as it seems to be listening on the target host!\n"); close(sd); gettimeofday(&end, NULL); if (end.tv_sec - begin.tv_sec > 5 ) /*uh-oh!*/ return 0; return (end.tv_sec - begin.tv_sec) * 1000000 + (end.tv_usec - begin.tv_usec); } /* Checks whether the identd port (113) is open on the target machine. No sense wasting time trying it for each good port if it is down! */ int check_ident_port(struct in_addr target) { int sd; char buf[4096]; struct sockaddr_in sock; int res; struct sockaddr_in stranger; int sockaddr_in_len = sizeof(struct sockaddr_in); fd_set fds_read, fds_write; struct timeval tv; tv.tv_sec = o.ptime; tv.tv_usec = 0; if ((sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {perror("Socket troubles"); exit(1);} unblock_socket(sd); sock.sin_family = AF_INET; sock.sin_addr.s_addr = target.s_addr; sock.sin_port = htons(113); /*should use getservbyname(3), yeah, yeah */ FD_SET(sd, &fds_read); FD_SET(sd, &fds_write); res = connect(sd, (struct sockaddr *) &sock, sizeof(struct sockaddr_in)); if (res != -1) /* must be scanning localhost, this socket is non-blocking */ goto success; if (errno == ECONNREFUSED) /* Unlikely in non-blocking, but could happen */ goto failure; if ((res = select(sd+1, &fds_read, &fds_write, NULL, &tv)) > 0) { /* Yay, it may be up ... */ if (FD_ISSET(sd, &fds_read) && FD_ISSET(sd, &fds_write)) { res = recvfrom(sd, buf,4096, 0, (struct sockaddr *) & stranger, &sockaddr_in_len); if (res >= 0) goto success; goto failure; } else if (FD_ISSET(sd, &fds_write)) { res = send(sd, buf, 0, 0); if (res < 0) goto failure; goto success; } else if (FD_ISSET(sd, &fds_read)) { printf("I have never seen this type of socket selectable for read only. Please let me know how you did it and what OS you are running (fyodor@dhp.com).\n"); goto success; } else { printf("Wow, select blatantly lied to us! Please let fyodor know what OS you are running (fyodor@dhp.com).\n"); goto failure; } } failure: close(sd); if (o.debugging || o.verbose) printf("identd port not active\n"); return 0; success: close(sd); if (o.debugging || o.verbose) printf("identd port is active\n"); return 1; } /* returns 0 for possibly temporary error, -1 means we shouldn't attempt inetd again on this host */ int getidentinfoz(struct in_addr target, int localport, int remoteport, char *owner) { int sd; struct sockaddr_in sock; int res; char request[15]; char response[1024]; char *p,*q; char *os; owner[0] = '\0'; if ((sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {perror("Socket troubles"); exit(1);} sock.sin_family = AF_INET; sock.sin_addr.s_addr = target.s_addr; sock.sin_port = htons(113); usleep(50000); /* If we aren't careful, we really MIGHT take out inetd, some are very fragile */ res = connect(sd, (struct sockaddr *) &sock, sizeof(struct sockaddr_in)); if (res < 0 ) { if (o.debugging || o.verbose) printf("identd port not active now for some reason ... hope we didn't break it!\n"); close(sd); return 0; } sprintf(request,"%hu,%hu\r\n", remoteport, localport); if (o.debugging > 1) printf("Connected to identd, sending request: %s", request); if (write(sd, request, strlen(request) + 1) == -1) { perror("identd write"); close(sd); return 0; } else if ((res = read(sd, response, 1024)) == -1) { perror("reading from identd"); close(sd); return 0; } else { close(sd); if (o.debugging > 1) printf("Read %d bytes from identd: %s\n", res, response); if ((p = strchr(response, ':'))) { p++; if ((q = strtok(p, " :"))) { if (!strcasecmp( q, "error")) { if (strstr(response, "HIDDEN-USER") || strstr(response, "hidden-user")) { printf("identd returning HIDDEN-USER, giving up on it\n"); return -1; } if (o.debugging) printf("ERROR returned from identd for port %d\n", remoteport); return 0; } if ((os = strtok(NULL, " :"))) { if ((p = strtok(NULL, " :"))) { if ((q = strchr(p, '\r'))) *q = '\0'; if ((q = strchr(p, '\n'))) *q = '\0'; strncpy(owner, p, 512); owner[512] = '\0'; } } } } } return 1; } /* We don't exactly need real crypto here (thank god!)\n"*/ int shortfry(unsigned short *ports) { int num; unsigned short tmp; int i; for(i=0; i < o.numports; i++) { num = get_random_uint() % (o.numports); tmp = ports[i]; ports[i] = ports[num]; ports[num] = tmp; } return 1; } /* Much of this is swiped from my send_tcp_raw function above, which doesn't support fragmentation */ int send_small_fragz(int sd, struct in_addr *source, struct in_addr *victim, unsigned long seq, int sport, int dport, int flags) { struct pseudo_header { /*for computing TCP checksum, see TCP/IP Illustrated p. 145 */ unsigned long s_addy; unsigned long d_addr; char zer0; unsigned char protocol; unsigned short length; }; /*In this placement we get data and some field alignment so we aren't wasting too much to compute the TCP checksum.*/ char packet[sizeof(struct ip) + sizeof(struct tcphdr) + 100]; struct ip *ip = (struct ip *) packet; struct tcphdr *tcp = (struct tcphdr *) (packet + sizeof(struct ip)); struct pseudo_header *pseudo = (struct pseudo_header *) (packet + sizeof(struct ip) - sizeof(struct pseudo_header)); char *frag2 = packet + sizeof(struct ip) + 16; struct ip *ip2 = (struct ip *) (frag2 - sizeof(struct ip)); static int myttl = 0; int res; struct sockaddr_in sock; int id; if (!myttl) myttl = (time(NULL) % 14) + 51; /* It was a tough decision whether to do this here for every packet or let the calling function deal with it. In the end I grudgingly decided to do it here and potentially waste a couple microseconds... */ sethdrinclude(sd); /*Why do we have to fill out this damn thing? This is a raw packet, after all */ sock.sin_family = AF_INET; sock.sin_port = htons(dport); sock.sin_addr.s_addr = victim->s_addr; bzero((char *)packet, sizeof(struct ip) + sizeof(struct tcphdr)); pseudo->s_addy = source->s_addr; pseudo->d_addr = victim->s_addr; pseudo->protocol = IPPROTO_TCP; pseudo->length = htons(sizeof(struct tcphdr)); tcp->th_sport = htons(sport); tcp->th_dport = htons(dport); tcp->th_seq = (seq)? htonl(seq) : get_random_uint(); tcp->th_off = 5 /*words*/; tcp->th_flags = flags; tcp->th_win = htons(2048); /* Who cares */ tcp->th_sum = in_cksum((unsigned short *)pseudo, sizeof(struct tcphdr) + sizeof(struct pseudo_header)); /* Now for the ip header of frag1 */ bzero((char *) packet, sizeof(struct ip)); ip->ip_v = 4; ip->ip_hl = 5; /*RFC 791 allows 8 octet frags, but I get "operation not permitted" (EPERM) when I try that. */ ip->ip_len = BSDFIX(sizeof(struct ip) + 16); id = ip->ip_id = get_random_uint(); ip->ip_off = BSDFIX(MORE_FRAGMENTS); ip->ip_ttl = myttl; ip->ip_p = IPPROTO_TCP; ip->ip_src.s_addr = source->s_addr; ip->ip_dst.s_addr = victim->s_addr; #if HAVE_IP_IP_SUM ip->ip_sum= in_cksum((unsigned short *)ip, sizeof(struct ip)); #endif if (o.debugging > 1) { printf("Raw TCP packet fragment #1 creation completed! Here it is:\n"); hdump(packet,20); } if (o.debugging > 1) printf("\nTrying sendto(%d , packet, %d, 0 , %s , %d)\n", sd, ntohs(ip->ip_len), inet_ntoa(*victim), (int) sizeof(struct sockaddr_in)); /* Lets save this and send it AFTER we send the second one, just to be cute ;) */ if ((res = sendto(sd, packet,sizeof(struct ip) + 16 , 0, (struct sockaddr *)&sock, sizeof(struct sockaddr_in))) == -1) { perror("sendto in send_syn_fragz"); return -1; } if (o.debugging > 1) printf("successfully sent %d bytes of raw_tcp!\n", res); /* Create the second fragment */ bzero((char *) ip2, sizeof(struct ip)); ip2->ip_v= 4; ip2->ip_hl = 5; ip2->ip_len = BSDFIX(sizeof(struct ip) + 4); /* the rest of our TCP packet */ ip2->ip_id = id; ip2->ip_off = BSDFIX(2); ip2->ip_ttl = myttl; ip2->ip_p = IPPROTO_TCP; ip2->ip_src.s_addr = source->s_addr; ip2->ip_dst.s_addr = victim->s_addr; #if HAVE_IP_IP_SUM ip2->ip_sum = in_cksum((unsigned short *)ip2, sizeof(struct ip)); #endif if (o.debugging > 1) { printf("Raw TCP packet fragment creation completed! Here it is:\n"); hdump(packet,20); } if (o.debugging > 1) printf("\nTrying sendto(%d , ip2, %d, 0 , %s , %d)\n", sd, ntohs(ip2->ip_len), inet_ntoa(*victim), (int) sizeof(struct sockaddr_in)); if ((res = sendto(sd, (void *)ip2,sizeof(struct ip) + 4 , 0, (struct sockaddr *)&sock, (int) sizeof(struct sockaddr_in))) == -1) { perror("sendto in send_tcp_raw frag #2"); return -1; } return 1; } portlist super_scan(struct hoststruct *target, unsigned short *portarray, stype scantype) { int initial_packet_width = 10; /* How many scan packets in parallel (to start with) */ int packet_incr = 4; /* How much we increase the parallel packets by each round */ double fallback_percent = 0.7; int rawsd; char myname[513]; int scanflags = 0; int dropped = 0; /* These three are for UDP squelching */ int freshportstried = 0; int senddelay = 0; pcap_t *pd; int bytes; struct ip *ip, *ip2; struct tcphdr *tcp; struct bpf_program fcode; char err0r[PCAP_ERRBUF_SIZE]; char filter[512]; char *p; int changed = 0; /* Have we found new ports (or rejected earlier "found" ones) this round? */ int numqueries_outstanding = 0; /* How many unexpired queries are on the 'net right now? */ double numqueries_ideal = initial_packet_width; /* How many do we WANT to be on the 'net right now? */ int max_width = 150; /* No more packets than this at once, pleeze */ int tries = 0; int tmp = 0; unsigned int localnet, netmask; int starttime; unsigned short newport; int newstate = 999; /* This ought to break something if used illegally */ struct hostent *myhostent = NULL; struct portinfo *scan, *openlist, *current, *fresh, *testinglist, *next; int portlookup[65536]; /* Indexes port number -> scan[] index */ int decoy; struct timeval now; int UDPPacketWarning = 0; int i; unsigned short *data; int packet_trynum = 0; int windowdecrease = 0; /* Has the window been decreased this round yet? */ struct icmp *icmp; if (o.debugging) printf("Starting super_scan\n"); memset(portlookup, 255, 65536 * sizeof(int)); /* 0xffffffff better always be (int) -1 */ scan = safe_malloc(o.numports * sizeof(struct portinfo)); /* Initialize timeout info */ /* target->to.srtt = (target->rtt > 0)? 4 * target->rtt : 1000000; target->to.rttvar = (target->rtt > 0)? target->rtt / 2 : 1000000; target->to.timeout = target->to.srtt + 4 * target->to.rttvar; */ /* Initialize our portlist (scan) */ for(i = 0; i < o.numports; i++) { scan[i].state = PORT_FRESH; scan[i].portno = portarray[i]; scan[i].trynum = 0; scan[i].prev = i-1; if (i < o.numports -1 ) scan[i].next = i+1; else scan[i].next = -1; portlookup[portarray[i]] = i; } current = fresh = testinglist = &scan[0]; /* fresh == unscanned ports, testinglist is a list of all ports that haven't been determined to be closed yet */ openlist = NULL; /* we haven't shown any ports to be open yet... */ /* Init our raw socket */ if ((rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 ) pfatal("socket troubles in super_scan"); broadcast_socket(rawsd); /* This isn't pretty, but I don't have much of a choice */ /* No reason to do this since we don't receive on this socket, and it can cause ENOBUF errors if socket transmit buffers overflow unblock_socket(rawsd); */ /* Do we have a correct source address? */ if (!target->source_ip.s_addr) { if (gethostname(myname, MAXHOSTNAMELEN) != 0 && !((myhostent = gethostbyname(myname)))) fatal("Cannot get hostname! Try using -S or -e \n"); memcpy(&target->source_ip, myhostent->h_addr_list[0], sizeof(struct in_addr)); if (o.debugging || o.verbose) printf("We skillfully deduced that your address is %s\n", inet_ntoa(target->source_ip)); } /* Now for the pcap opening nonsense ... */ /* Note that the snaplen is 92 = 64 byte max IPhdr + 24 byte max link_layer * header + 4 bytes of TCP port info. */ if (!(pd = pcap_open_live(target->device, 92, (o.spoofsource)? 1 : 0, 20, err0r))) fatal("pcap_open_live: %s", err0r); if (pcap_lookupnet(target->device, &localnet, &netmask, err0r) < 0) fatal("Failed to lookup device subnet/netmask: %s", err0r); p = strdup(inet_ntoa(target->host)); sprintf(filter, "(icmp and dst host %s) or (tcp and src host %s and dst host %s and ( dst port %d or dst port %d))", inet_ntoa(target->source_ip), p, inet_ntoa(target->source_ip), o.magic_port , o.magic_port + 1); free(p); /* Due to apparent bug in libpcap */ if (islocalhost(&(target->host))) filter[0] = '\0'; if (o.debugging) printf("Packet capture filter: %s\n", filter); if (pcap_compile(pd, &fcode, filter, 0, netmask) < 0) fatal("Error compiling our pcap filter: %s\n", pcap_geterr(pd)); if (pcap_setfilter(pd, &fcode) < 0 ) fatal("Failed to set the pcap filter: %s\n", pcap_geterr(pd)); if (scantype == XMAS_SCAN) scanflags = TH_FIN|TH_URG|TH_PUSH; else if (scantype == NULL_SCAN) scanflags = 0; else if (scantype == FIN_SCAN) scanflags = TH_FIN; else if (scantype == MAIMON_SCAN) scanflags = TH_FIN|TH_ACK; else if (scantype != UDP_SCAN) { fatal("Unknown scan type for super_scan"); } starttime = time(NULL); if (o.debugging || o.verbose) printf("Initiating FIN,NULL, UDP, or Xmas stealth scan against %s (%s)\n", target->name, inet_ntoa(target->host)); do { changed = 0; if (tries > 3 && senddelay == 0) senddelay = 10000; while(testinglist != NULL) /* While we have live queries or more ports to scan */ { /* Check the possible retransmissions first */ gettimeofday(&now, NULL); for( current = testinglist; current ; current = next) { next = (current->next > -1)? &scan[current->next] : NULL; if (current->state == PORT_TESTING) { if ( TIMEVAL_SUBTRACT(now, current->sent[current->trynum]) > target->to.timeout) { if (current->trynum > 0) { /* We consider this port valid, move it to open list */ if (o.debugging > 1) { printf("Moving port %hu to the open list\n", current->portno); } freshportstried--; current->state = PORT_OPEN; /* First delete from old list */ if (current->next > -1) scan[current->next].prev = current->prev; if (current->prev > -1) scan[current->prev].next = current->next; if (current == testinglist) testinglist = (current->next >= 0)? &scan[current->next] : NULL; current->next = -1; current->prev = -1; /* Now move into new list */ if (!openlist) openlist = current; else { current->next = openlist - scan; openlist = current; scan[current->next].prev = current - scan; } numqueries_outstanding--; } else { /* Initial timeout ... we've got to resend */ if (o.debugging > 1) { printf("Initial timeout, resending to portno %hu\n", current->portno); } current->trynum++; /* If they didn't specify the magic port, we use magic_port +1 so we can tell that it was a retransmit later */ i = (o.magic_port_set)? o.magic_port : o.magic_port + 1; gettimeofday(¤t->sent[1], NULL); now = current->sent[1]; for(decoy=0; decoy < o.numdecoys; decoy++) { if (o.fragscan) send_small_fragz(rawsd, &o.decoys[decoy], &target->host, 0,i, current->portno, scanflags); else if (scantype != UDP_SCAN) send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, i, current->portno, 0, 0, scanflags, 0, NULL, 0, 0, 0); else send_udp_raw(rawsd, &o.decoys[decoy], &target->host, i, current->portno, NULL ,0); if (senddelay && scantype == UDP_SCAN) usleep(senddelay); } } } } else { /* current->state == PORT_FRESH */ /* OK, now we have gone through our list of in-transit queries, so now we try to send off new queries if we can ... */ if (numqueries_outstanding > (int) numqueries_ideal) break; if (o.debugging > 1) printf("Sending initial query to port %hu\n", current->portno); freshportstried++; /* lets send a packet! */ current->state = PORT_TESTING; /* if (!testinglist) testinglist = current; */ numqueries_outstanding++; gettimeofday(¤t->sent[0], NULL); for(decoy=0; decoy < o.numdecoys; decoy++) { if (o.fragscan) send_small_fragz(rawsd, &o.decoys[decoy], &target->host, 0, o.magic_port, current->portno, scanflags); else if (scantype != UDP_SCAN) send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, o.magic_port, current->portno, 0, 0, scanflags, 0, NULL, 0, 0, 0); else send_udp_raw(rawsd, &o.decoys[decoy], &target->host, o.magic_port, current->portno, NULL, 0); if (scantype == UDP_SCAN && senddelay) usleep(senddelay); } } } if (o.debugging > 1) printf("Ideal number of queries: %d\n", (int) numqueries_ideal); tmp++; /* Now that we have sent the packets we wait for responses */ windowdecrease = 0; while (( ip = (struct ip*) readip_pcap(pd, &bytes))) { if (bytes < (4 * ip->ip_hl) + 4) continue; current = NULL; if (ip->ip_p == IPPROTO_ICMP || ip->ip_src.s_addr == target->host.s_addr) { if (ip->ip_p == IPPROTO_TCP) { tcp = (struct tcphdr *) (((char *) ip) + 4 * ip->ip_hl); if (tcp->th_flags & TH_RST) { newstate = PORT_CLOSED; newport = ntohs(tcp->th_sport); if (portlookup[newport] < 0) { if (o.debugging) { printf("Strange packet from port %d:\n", ntohs(tcp->th_sport)); readtcppacket((char *)ip, bytes); } current = NULL; continue; } current = &scan[portlookup[newport]]; if (ntohs(tcp->th_dport) != o.magic_port && ntohs(tcp->th_dport) != o.magic_port + 1) { if (o.debugging) { error("BAD TCP packet detected to port %d from port %d", ntohs(tcp->th_dport), newport); } continue; } if (current->state != PORT_TESTING && o.debugging) { error("TCP packet detected from port %d which is in state %d (should usually be PORT_TESTING (but not always)", newport, current->state); } if (!o.magic_port_set) { packet_trynum = ntohs(tcp->th_dport) - o.magic_port; if ((packet_trynum|1) != 1) packet_trynum = -1; } else packet_trynum = -1; if (current->trynum == 0) packet_trynum = 0; } else { continue; } /* Wrong TCP flags */ } else if (ip->ip_p == IPPROTO_ICMP) { icmp = (struct icmp *) ((char *)ip + 4 * ip->ip_hl); ip2 = (struct ip *) (((char *) icmp) + 8); if (ip2->ip_dst.s_addr != target->host.s_addr) continue; data = (unsigned short *) ((char *)ip2 + 4 * ip2->ip_hl); /* printf("Caught ICMP packet:\n"); hdump(icmp, ntohs(ip->ip_len) - sizeof(struct ip)); */ if (icmp->icmp_type == 3) { newport = ntohs(data[1]); if (portlookup[newport] < 0) { if (o.debugging) { printf("Strange ICMP packet type 3 code %d related to port %d:\n", icmp->icmp_code, newport); } readtcppacket((char *)ip, bytes); continue; } current = &scan[portlookup[newport]]; if (!o.magic_port_set) { packet_trynum = ntohs(data[0]) - o.magic_port; if ((packet_trynum|1) != 1) packet_trynum = -1; } else { if (current->trynum == 0) { packet_trynum = 0; } else packet_trynum = -1; } switch(icmp->icmp_code) { case 2: /* pr0t0c0l unreachable */ newstate = PORT_FIREWALLED; break; case 3: /* p0rt unreachable */ if (scantype == UDP_SCAN) { newstate = PORT_CLOSED; } else newstate = PORT_FIREWALLED; break; case 13: /* Administratively prohibited packet */ newstate = PORT_FIREWALLED; break; default: if (o.debugging) { error("Received strange ICMP destunreach response -- code: %d", icmp->icmp_code); hdump((unsigned char *)icmp, ntohs(ip->ip_len) - sizeof(struct ip)); } continue; } } } else if (ip->ip_p == IPPROTO_UDP) { if (UDPPacketWarning == 0) { UDPPacketWarning = 1; if (o.debugging) error("UDP packet received\n"); } continue; } if (current) { if (current->state == PORT_OPEN) { /* 0oPs! we gave up on this port two early, now we must pay */ /* Let us first strop this fucer from the open list ... */ if (current->next > -1) scan[current->next].prev = current->prev; if (current->prev > -1) scan[current->prev].next = current->next; if (openlist == current) openlist = (current->next >= 0)? &scan[current->next]:NULL; } else if (current->state == PORT_CLOSED && (packet_trynum < 0)) { target->to.rttvar *= 1.2; if (o.debugging) { printf("Late packet, couldn't figure out sendno so we do varianceincrease to %d\n", target->to.rttvar); } } if (packet_trynum > -1) { /* Update our records */ adjust_timeouts(current->sent[packet_trynum], &(target->to)); numqueries_ideal = MIN(numqueries_ideal + (packet_incr/numqueries_ideal), max_width); if (packet_trynum > 0 && current->trynum > 0) { /* The first packet was apparently lost, slow down */ dropped++; if (freshportstried > 50 && ((double) dropped/freshportstried) > 0.3) { if (!senddelay) senddelay = 50000; else senddelay = MIN(senddelay * 2, 1000000); if (senddelay >= 200000 && scantype == UDP_SCAN) max_width = 2; freshportstried = 0; dropped = 0; if (o.verbose || o.debugging ) printf("Too many drops ... increasing senddelay to %d\n", senddelay); } if (windowdecrease == 0) { numqueries_ideal *= fallback_percent; if (numqueries_ideal < 1) numqueries_ideal = 1; if (o.debugging) { printf("Lost a packet, decreasing window to %d\n", (int) numqueries_ideal); windowdecrease++; if (scantype == UDP_SCAN) usleep(250000); } } else if (o.debugging > 1) { printf("Lost a packet, but not decreasing\n"); } } } if (current->state != newstate) { changed++; } if (current->state != PORT_OPEN && current->state != PORT_CLOSED) { numqueries_outstanding--; } if (current->state == PORT_TESTING && current == testinglist) testinglist = (current->next >= 0)? &scan[current->next] : NULL; else if (current->state == PORT_OPEN && current == openlist) openlist = (current->next >= 0)? &scan[current->next] : NULL; if (current->next >= 0) scan[current->next].prev = current->prev; if (current->prev >= 0) scan[current->prev].next = current->next; current->state = newstate; if (current->state != PORT_CLOSED) { addport(&target->ports, current->portno, (scantype == UDP_SCAN)? IPPROTO_UDP : IPPROTO_TCP, NULL, current->state); } } } } } /* Prepare for retry */ testinglist = openlist; for(current = openlist; current; current = (current->next >= 0)? &scan[current->next] : NULL) { current->state = PORT_FRESH; current->trynum = 0; if (o.debugging) { printf("Preparing for retry, open port %d noted\n", current->portno); } } openlist = NULL; numqueries_ideal = initial_packet_width; if (o.debugging) printf("Done with round %d\n", tries); } while(changed && ++tries < 100); openlist = testinglist; if (o.debugging || o.verbose) printf("The UDP or stealth FIN/NULL/XMAS scan took %ld seconds to scan %d ports.\n", (long) time(NULL) - starttime, o.numports); for (current = openlist; current; current = (current->next >= 0)? &scan[current->next] : NULL) { if (scantype != UDP_SCAN) addport(&target->ports, current->portno, IPPROTO_TCP, NULL, PORT_OPEN); else addport(&target->ports, current->portno, IPPROTO_UDP, NULL, PORT_OPEN); } free(scan); close(rawsd); pcap_close(pd); return target->ports; } portlist pos_scan(struct hoststruct *target, unsigned short *portarray, stype scantype) { int initial_packet_width = 10; /* How many scan packets in parallel (to start with) */ struct scanstats ss; int rawsd; char myname[513]; int scanflags = 0; int victim; int senddelay = 0; pcap_t *pd = NULL; struct bpf_program fcode; char err0r[PCAP_ERRBUF_SIZE]; char filter[512]; char *p; int tries = 0; int res; int connecterror = 0; unsigned int localnet, netmask; int starttime; struct hostent *myhostent = NULL; struct sockaddr_in sock; struct portinfo *scan, *current, *next; struct portinfolist pil; int portlookup[65536]; /* Indexes port number -> scan[] index */ int decoy; struct timeval now; struct connectsockinfo csi; unsigned long sequences[3]; /* for various reasons we use 3 separate ones rather than simply incrementing from a base */ int i; if (o.debugging) printf("Starting pos_scan\n"); ss.packet_incr = 4; ss.fallback_percent = 0.7; ss.numqueries_outstanding = 0; ss.numqueries_ideal = initial_packet_width; ss.ports_left = o.numports; ss.alreadydecreasedqueries = 0; bzero(&pil, sizeof(pil)); FD_ZERO(&csi.fds_read); FD_ZERO(&csi.fds_write); FD_ZERO(&csi.fds_except); if (scantype == SYN_SCAN) ss.max_width = 150; else ss.max_width = o.max_sockets; memset(portlookup, 255, 65536 * sizeof(int)); /* 0xffffffff better always be (int) -1 */ bzero(csi.socklookup, sizeof(csi.socklookup)); scan = safe_malloc(o.numports * sizeof(struct portinfo)); /* Initialize our portlist (scan) */ for(i = 0; i < o.numports; i++) { scan[i].state = PORT_FRESH; scan[i].portno = portarray[i]; scan[i].trynum = 0; scan[i].prev = i-1; scan[i].sd[0] = scan[i].sd[1] = scan[i].sd[2] = -1; if (i < o.numports -1 ) scan[i].next = i+1; else scan[i].next = -1; portlookup[portarray[i]] = i; } current = pil.testinglist = &scan[0]; /* testinglist is a list of all ports that haven't been determined to be closed yet */ /* Init our raw socket */ if (scantype == SYN_SCAN) { if ((rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 ) pfatal("socket troubles in super_scan"); /* We do not wan't to unblock the socket since we want to wait if kernel send buffers fill up rather than get ENOBUF, and we won't be receiving on the socket anyway unblock_socket(rawsd);*/ broadcast_socket(rawsd); /* Init ISNs */ get_random_bytes(sequences, sizeof(sequences)); /* Do we have a correct source address? */ if (!target->source_ip.s_addr) { if (gethostname(myname, MAXHOSTNAMELEN) != 0 && !((myhostent = gethostbyname(myname)))) fatal("Cannot get hostname! Try using -S or -e \n"); memcpy(&target->source_ip, myhostent->h_addr_list[0], sizeof(struct in_addr)); if (o.debugging || o.verbose) printf("We skillfully deduced that your address is %s\n", inet_ntoa(target->source_ip)); } /* Now for the pcap opening nonsense ... Note that the snaplen is 100 = 64 byte max IPhdr + 24 byte max link_layer header + first 12 bytes of TCP header. */ if (!(pd = pcap_open_live(target->device, 100, (o.spoofsource)? 1 : 0, 20, err0r))) fatal("pcap_open_live: %s", err0r); if (pcap_lookupnet(target->device, &localnet, &netmask, err0r) < 0) fatal("Failed to lookup device subnet/netmask: %s", err0r); p = strdup(inet_ntoa(target->host)); sprintf(filter, "(icmp and dst host %s) or (tcp and src host %s and dst host %s)", inet_ntoa(target->source_ip), p, inet_ntoa(target->source_ip)); free(p); /* Due to apparent bug in libpcap */ if (islocalhost(&(target->host))) filter[0] = '\0'; if (o.debugging) printf("Packet capture filter: %s\n", filter); if (pcap_compile(pd, &fcode, filter, 0, netmask) < 0) fatal("Error compiling our pcap filter: %s\n", pcap_geterr(pd)); if (pcap_setfilter(pd, &fcode) < 0 ) fatal("Failed to set the pcap filter: %s\n", pcap_geterr(pd)); scanflags = TH_SYN; } else { rawsd = -1; /* Init our sock */ bzero((char *)&sock,sizeof(struct sockaddr_in)); sock.sin_addr.s_addr = target->host.s_addr; sock.sin_family=AF_INET; } starttime = time(NULL); if (o.debugging || o.verbose) { if (scantype == SYN_SCAN) printf("Initiating SYN half-open stealth scan against %s (%s)\n", target->name, inet_ntoa(target->host)); else printf("Initiating TCP connect() scan against %s (%s)\n",target->name, inet_ntoa(target->host)); } do { ss.changed = 0; if (tries > 3 && tries < 10) { senddelay += 10000 * (tries - 3); if (o.verbose) printf("Bumping up senddelay by %d (to %d), due to excessive drops\n", 10000 * (tries - 3), senddelay); } else if (tries >= 10) { senddelay += 75000; if (o.verbose) printf("Bumping up senddelay by 75000 (to %d), due to excessive drops\n", senddelay); } if (senddelay > 200000) { ss.max_width = 5; } while(pil.testinglist != NULL) /* While we have live queries or more ports to scan */ { /* Check the possible retransmissions first */ gettimeofday(&now, NULL); for( current = pil.testinglist; current ; current = next) { next = (current->next > -1)? &scan[current->next] : NULL; if (current->state == PORT_TESTING) { if ( TIMEVAL_SUBTRACT(now, current->sent[current->trynum]) > target->to.timeout) { if (current->trynum > 1) { /* No responses !#$!#@$ firewalled? */ if (o.debugging) { printf("Moving port %hu to the potentially firewalled list\n", current->portno); } if (current->state != PORT_TESTING) fatal("Whacked port state! Bailing!"); current->state = PORT_FIREWALLED; /* For various reasons */ /* First delete from old list */ if (current->next > -1) scan[current->next].prev = current->prev; if (current->prev > -1) scan[current->prev].next = current->next; if (current == pil.testinglist) pil.testinglist = (current->next >= 0)? &scan[current->next] : NULL; current->next = -1; current->prev = -1; /* Now move into new list */ if (!pil.firewalled) pil.firewalled = current; else { current->next = pil.firewalled - scan; pil.firewalled = current; scan[current->next].prev = current - scan; } if (scantype == SYN_SCAN) ss.numqueries_outstanding--; else { /* close the appropriate sd for each try */ for(i=0; i <= current->trynum; i++) { if (current->sd[i] >= 0) { csi.socklookup[current->sd[i]] = NULL; FD_CLR(current->sd[i], &csi.fds_read); FD_CLR(current->sd[i], &csi.fds_write); FD_CLR(current->sd[i], &csi.fds_except); close(current->sd[i]); current->sd[i] = -1; ss.numqueries_outstanding--; } } } } else { /* timeout ... we've got to resend */ if (o.debugging > 1) { printf("Timeout, resending to portno %hu\n", current->portno); } current->trynum++; gettimeofday(¤t->sent[current->trynum], NULL); now = current->sent[current->trynum]; if (scantype == SYN_SCAN) { for(decoy=0; decoy < o.numdecoys; decoy++) { if (o.fragscan) send_small_fragz(rawsd, &o.decoys[decoy], &target->host, sequences[current->trynum],o.magic_port + tries * 3 + current->trynum, current->portno, scanflags); else send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, o.magic_port + tries * 3 + current->trynum, current->portno, sequences[current->trynum], 0, scanflags, 0, NULL, 0,0, 0); } } else { /* Connect scan */ /* Unfortunately, retries cost us a socket! If we are out of sockets, we must drop one of our earlier tries :( */ if (ss.numqueries_outstanding >= ss.max_width) { victim = -1; for(i=0; i < current->trynum; i++) if (current->sd[i] >= 0) { victim = i; break; } if (victim == -1) fatal("Illegal situation in pos_scan -- please report to fyodor@dhp.com"); csi.socklookup[current->sd[victim]] = NULL; FD_CLR(current->sd[victim], &csi.fds_read); FD_CLR(current->sd[victim], &csi.fds_write); FD_CLR(current->sd[victim], &csi.fds_except); close(current->sd[victim]); current->sd[victim] = -1; } else { ss.numqueries_outstanding++; } res = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (res == -1) pfatal("Socket troubles in pos_scan 143"); csi.socklookup[res] = current; unblock_socket(res); init_socket(res); sock.sin_port = htons(current->portno); current->sd[current->trynum] = res; res = connect(res,(struct sockaddr *)&sock,sizeof(struct sockaddr)); if (res != -1) { posportupdate(target, current, current->trynum, scan, &ss, scantype, PORT_OPEN, &pil, &csi); } else { switch(errno) { case EINPROGRESS: /* The one I always see */ case EAGAIN: /* GOOD REASON FOR THIS????block_socket(sockets[current_socket]); */ if (csi.maxsd < current->sd[current->trynum]) csi.maxsd = current->sd[current->trynum]; FD_SET( current->sd[current->trynum], &csi.fds_write); FD_SET( current->sd[current->trynum], &csi.fds_read); FD_SET( current->sd[current->trynum], &csi.fds_except); break; default: if (!connecterror) { connecterror++; printf("Strange error from connect (%d):", errno); fflush(stdout); perror(""); /*falling through intentionally*/ } case ECONNREFUSED: posportupdate(target, current, current->trynum, scan, &ss, scantype, PORT_CLOSED, &pil, &csi); break; } } } if (senddelay) usleep(senddelay); } } } else { if (current->state != PORT_FRESH) fatal("State mismatch!!@ %d", current->state); /* current->state == PORT_FRESH */ /* OK, now we have gone through our list of in-transit queries, so now we try to send off new queries if we can ... */ if (ss.numqueries_outstanding > (int) ss.numqueries_ideal) break; if (o.debugging > 1) printf("Sending initial query to port %hu\n", current->portno); /* Otherwise lets send a packet! */ current->state = PORT_TESTING; current->trynum = 0; /* if (!testinglist) testinglist = current; */ ss.numqueries_outstanding++; gettimeofday(¤t->sent[0], NULL); if (scantype == SYN_SCAN) { for(decoy=0; decoy < o.numdecoys; decoy++) { if (o.fragscan) send_small_fragz(rawsd, &o.decoys[decoy], &target->host, sequences[current->trynum], o.magic_port + tries * 3, current->portno, scanflags); else send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, o.magic_port + tries * 3, current->portno, sequences[current->trynum], 0, scanflags, 0, NULL, 0, 0, 0); if (senddelay) usleep(senddelay); } } else { /* CONNECT SCAN */ res = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (res == -1) pfatal("Socket troubles in pos_scan 11234"); csi.socklookup[res] = current; unblock_socket(res); init_socket(res); sock.sin_port = htons(current->portno); current->sd[current->trynum] = res; res = connect(res,(struct sockaddr *)&sock,sizeof(struct sockaddr)); if (res != -1) { posportupdate(target, current, current->trynum, scan, &ss, scantype, PORT_OPEN, &pil, &csi); } else { switch(errno) { case EINPROGRESS: /* The one I always see */ case EAGAIN: /* GOOD REASON FOR THIS????block_socket(sockets[current_socket]); */ if (csi.maxsd < current->sd[current->trynum]) csi.maxsd = current->sd[current->trynum]; FD_SET( current->sd[current->trynum], &csi.fds_write); FD_SET( current->sd[current->trynum], &csi.fds_read); FD_SET( current->sd[current->trynum], &csi.fds_except); break; default: if (!connecterror) { connecterror++; printf("Strange error from connect (%d):", errno); fflush(stdout); perror(""); /*falling through intentionally*/ } case ECONNREFUSED: posportupdate(target, current, current->trynum, scan, &ss, scantype, PORT_CLOSED, &pil, &csi); break; } } } if (senddelay) usleep(senddelay); } } /* if (o.debugging > 1) printf("Ideal number of queries: %d outstanding: %d max %d ports_left %d timeout %d\n", (int) ss.numqueries_ideal, ss.numqueries_outstanding, ss.max_width, ss.ports_left, target->to.timeout);*/ /* Now that we have sent the packets we wait for responses */ ss.alreadydecreasedqueries = 0; if (scantype == SYN_SCAN) get_syn_results(target, scan, &ss, &pil, portlookup, pd, sequences); else { get_connect_results(target, scan, &ss, &pil, portlookup, sequences, &csi); } } if (ss.numqueries_outstanding != 0) { fatal("Bean counting error no. 4321897: ports_left: %d numqueries_outstanding: %d\n", ss.ports_left, ss.numqueries_outstanding); } /* We only want to try if the 'firewalled' list contains elements, meaning that some ports timed out. We retry until nothing changes for a round (not counting the very first round). */ if (pil.firewalled) { if (tries == 0 || ss.changed) { pil.testinglist = pil.firewalled; for( current = pil.testinglist; current ; current = (current->next > -1)? &scan[current->next] : NULL) { current->state = PORT_FRESH; current->trynum = 0; current->sd[0] = current->sd[1] = current->sd[2] = -1; if (o.debugging) { printf("Preparing for retry, nonresponsive port %d noted\n", current->portno); } } pil.firewalled = NULL; } else { /* Consider the ports firewalled */ for( current = pil.firewalled; current ; current = (current->next > -1)? &scan[current->next] : NULL) { addport(&target->ports, current->portno, IPPROTO_TCP, NULL, PORT_FIREWALLED); } pil.testinglist = NULL; } tries++; } ss.numqueries_ideal = initial_packet_width; if (o.debugging) printf("Done with round %d\n", tries); } while(pil.testinglist && tries < 20); if (tries == 20) { error("WARNING: GAVE UP ON SCAN AFTER 20 RETRIES"); } if (o.verbose) printf("The %s scan took %ld seconds to scan %d ports.\n", (scantype == SYN_SCAN)? "SYN" : "TCP connect", (long) time(NULL) - starttime, o.numports); free(scan); if (rawsd >= 0) close(rawsd); if (pd) pcap_close(pd); return target->ports; } /* Does the appropriate stuff when the port we are looking at is found to be open trynum is the try number that was successful I USE CURRENT->STATE TO DETERMINE WHETHER THE PORT IS OPEN OR FIREWALLED */ void posportupdate(struct hoststruct *target, struct portinfo *current, int trynum, struct portinfo *scan, struct scanstats *ss ,stype scantype, int newstate, struct portinfolist *pil, struct connectsockinfo *csi) { static int tryident = -1; static struct hoststruct *lasttarget = NULL; struct sockaddr_in mysock; int sockaddr_in_len = sizeof(SA); int i; char owner[1024]; if (tryident == -1 || target != lasttarget) tryident = o.identscan; lasttarget = target; owner[0] = '\0'; if (current->state != PORT_OPEN && current->state != PORT_CLOSED && current->state != PORT_FIREWALLED && current->state != PORT_TESTING) { if (o.debugging) error("Whacked packet to port %hu passed to posportupdate with state %d\n", current->portno, current->state); return; } /* Lets do the timing stuff */ if (trynum > -1) adjust_timeouts(current->sent[trynum], &(target->to)); /* If a non-zero trynum finds a port that hasn't been discovered, the earlier packets(s) were probably dropped. So we decrease our numqueries_ideal, otherwise we increase it slightly */ if (trynum == 0) { ss->numqueries_ideal = MIN(ss->numqueries_ideal + (ss->packet_incr/ss->numqueries_ideal), ss->max_width); } else if (trynum != -1) { if (!ss->alreadydecreasedqueries) { ss->alreadydecreasedqueries = 1; ss->numqueries_ideal *= ss->fallback_percent; if (ss->numqueries_ideal < 1.0) ss->numqueries_ideal = 1.0; } } /* Collect IDENT info if requested */ if (newstate == PORT_OPEN && scantype == CONNECT_SCAN && tryident) { if (getsockname(current->sd[trynum], (SA *) &mysock, &sockaddr_in_len )) { pfatal("getsockname"); } if (getidentinfoz(target->host, ntohs(mysock.sin_port), current->portno, owner) == -1) tryident = 0; } /* Now we convert current->state to state by making whatever adjustments are neccessary */ switch(current->state) { case PORT_OPEN: return; /* Whew! That was easy! */ break; case PORT_FRESH: printf("Fresh port %hu passed to posportupdate!\n", current->portno); return; break; case PORT_CLOSED: current->state = newstate; break; case PORT_TESTING: ss->changed++; if (scantype == SYN_SCAN) ss->numqueries_outstanding--; else { for(i=0; i <= current->trynum; i++) if (current->sd[i] > -1) { csi->socklookup[current->sd[i]] = NULL; FD_CLR(current->sd[i], &(csi->fds_read)); FD_CLR(current->sd[i], &(csi->fds_write)); FD_CLR(current->sd[i], &(csi->fds_except)); if (current->sd[i] == csi->maxsd) csi->maxsd--; close(current->sd[i]); current->sd[i] = -1; ss->numqueries_outstanding--; } } /* Now we delete the port from the testinglist */ if (current == pil->testinglist) pil->testinglist = (current->next >= 0)? &scan[current->next] : NULL; if (current->next >= 0) scan[current->next].prev = current->prev; if (current->prev >= 0) scan[current->prev].next = current->next; break; case PORT_FIREWALLED: ss->changed++; if (current == pil->firewalled) pil->firewalled = (current->next >= 0)? &scan[current->next] : NULL; if (current->next >= 0) scan[current->next].prev = current->prev; if (current->prev >= 0) scan[current->prev].next = current->next; break; default: fatal("Unexpected port state: %d\n", current->state); break; } current->state = newstate; current->next = -1; current->prev = -1; if (newstate == PORT_OPEN || newstate == PORT_FIREWALLED) { if (o.verbose) printf("Adding TCP port %hu (state %s).\n", current->portno, (current->state == PORT_OPEN)? "Open" : "Firewalled"); addport(&target->ports, current->portno, IPPROTO_TCP, owner, newstate); } return; } inline void adjust_timeouts(struct timeval sent, struct timeout_info *to) { int delta = 0; struct timeval end; gettimeofday(&end, NULL); if (o.debugging > 1) { printf("Timeout vals: srtt: %d rttvar: %d to: %d ", to->srtt, to->rttvar, to->timeout); } if (to->srtt == -1 && to->rttvar == -1) { /* We need to initialize the sucker ... */ to->srtt = TIMEVAL_SUBTRACT(end, sent); to->rttvar = MAX(5000, MIN(to->srtt, 600000)); to->timeout = to->srtt + (to->rttvar << 2); } else { delta = TIMEVAL_SUBTRACT(end, sent); if (delta >= 8000000) { if (o.verbose) error("adjust_timeout: packet supposedly had rtt of %lu microseconds. Ignoring time.", delta); return; } delta -= to->srtt; /* sanity check 2*/ if (delta > 1500000 && delta > 3 * to->srtt + 2 * to->rttvar) { /* WANKER ALERT! */ if (o.debugging) { printf("Bogus delta: %d (srtt %d) ... ignoring\n", delta, to->srtt); } return; } to->srtt += delta >> 3; to->rttvar += (ABS(delta) - to->rttvar) >> 2; to->timeout = to->srtt + (to->rttvar << 2); } if (o.debugging > 1) { printf("delta %d ==> srtt: %d rttvar: %d to: %d\n", delta, to->srtt, to->rttvar, to->timeout); } if (to->rttvar > 2300000) { printf("RTTVAR has grown to over 2.3 seconds, decreasing to 2.0\n"); to->rttvar = 2000000; } /* It hurts to do this ... it really does ... but otherwise we are being too risky */ to->timeout = MAX(to->timeout, 75000); if (to->srtt < 0 || to->rttvar < 0 || to->timeout < 0 || delta < -50000000) { fatal("Serious time computation problem in adjust_timeout ... end = (%d, %d) sent=(%d,%d) delta = %d srtt = %d rttvar = %d to = %d", end.tv_sec, end.tv_usec, sent.tv_sec, sent.tv_usec, delta, to->srtt, to->rttvar, to->timeout); } } int get_connect_results(struct hoststruct *target, struct portinfo *scan, struct scanstats *ss, struct portinfolist *pil, int *portlookup, unsigned long *sequences, struct connectsockinfo *csi) { fd_set fds_rtmp, fds_wtmp, fds_xtmp; int selectres; int selectedfound; struct timeval timeout; int i, sd; int res; int trynum; char buf[2048]; struct portinfo *current = NULL; do { fds_rtmp = csi->fds_read; fds_wtmp = csi->fds_write; fds_xtmp = csi->fds_except; timeout.tv_sec = 0; timeout.tv_usec = 20000; selectedfound = 0; selectres = select(csi->maxsd+1, &fds_rtmp, &fds_wtmp, &fds_xtmp, &timeout); for(sd=0; selectedfound < selectres && sd <= csi->maxsd; sd++) { current = csi->socklookup[sd]; if (!current) continue; trynum = -1; if (FD_ISSET(sd, &fds_rtmp) || FD_ISSET(sd, &fds_wtmp) || FD_ISSET(sd, &fds_xtmp)) { /* current = csi->socklookup[i];*/ for(i=0; i < 3; i++) if (current->sd[i] == sd) { trynum = i; break; } /* assert(current != NULL);*/ assert(trynum != -1); } else continue; if (o.debugging > 1 && current != NULL) printf("portnumber %d selected for", current->portno); if (FD_ISSET(sd, &fds_rtmp)) { if (o.debugging > 1) printf(" READ"); selectedfound++; } if (FD_ISSET(sd, &fds_wtmp)) { if (o.debugging > 1) printf(" WRITE"); selectedfound++; } if (FD_ISSET(sd, &fds_xtmp)) { if (o.debugging > 1) printf(" EXCEPT"); selectedfound++; } if (o.debugging > 1 && current != NULL) printf("\n"); if (FD_ISSET(sd, &fds_rtmp)) { /* Well, it selected for read ... SO LETS READ IT! */ res = read(current->sd[trynum], buf, sizeof(buf)); if (res == -1) { switch(errno) { case ECONNREFUSED: /* case EAGAIN:*/ posportupdate(target, current, trynum, scan, ss, CONNECT_SCAN, PORT_CLOSED, pil, csi); break; case EHOSTUNREACH: /* It could be the host is down, or it could be firewalled. We will go on the safe side & assume port is closed ... on second thought, lets go firewalled! and see if it causes any trouble */ posportupdate(target, current, trynum, scan, ss, CONNECT_SCAN, PORT_FIREWALLED, pil, csi); break; case ENETDOWN: case ENETUNREACH: case ENETRESET: case ECONNABORTED: case ETIMEDOUT: case EHOSTDOWN: sprintf(buf, "Strange read error from %s -- bailing scan", inet_ntoa(target->host)); perror(buf); return -1; break; default: sprintf(buf, "Strange read error from %s", inet_ntoa(target->host)); perror(buf); break; } } else { posportupdate(target, current, trynum, scan, ss, CONNECT_SCAN, PORT_OPEN, pil, csi); } } else if (FD_ISSET(sd, &fds_wtmp)) { /* Selected for writing, lets to the zero-byte-write test */ #if !OPENBSD res = send(current->sd[trynum], buf, 0, 0); #endif if (res < 0 ) { if (o.debugging > 1) { printf("Bad port %hu caught by 0-byte write: ", current->portno); perror(""); } posportupdate(target, current, trynum, scan, ss, CONNECT_SCAN, PORT_CLOSED, pil, csi); } else { posportupdate(target, current, trynum, scan, ss, CONNECT_SCAN, PORT_OPEN, pil, csi); } } else { printf("Hmmm ... port %hu selected for except-only ... assuming closed\n", current->portno); posportupdate(target, current, trynum, scan, ss, CONNECT_SCAN, PORT_CLOSED, pil, csi); } } } while(ss->numqueries_outstanding > 0 && selectres > 0); return 0; } void get_syn_results(struct hoststruct *target, struct portinfo *scan, struct scanstats *ss, struct portinfolist *pil, int *portlookup, pcap_t *pd, unsigned long *sequences) { struct ip *ip; int bytes; struct tcphdr *tcp; int trynum; int newstate = -1; int i; int newport; struct portinfo *current = NULL; struct icmp *icmp; struct ip *ip2; unsigned short *data; while (ss->numqueries_outstanding > 0 && ( ip = (struct ip*) readip_pcap(pd, &bytes))) { if (bytes < (4 * ip->ip_hl) + 4) continue; current = NULL; trynum = newport = -1; newstate = PORT_UNKNOWN; if (ip->ip_src.s_addr == target->host.s_addr && ip->ip_p == IPPROTO_TCP) { tcp = (struct tcphdr *) (((char *) ip) + 4 * ip->ip_hl); i = ntohs(tcp->th_dport); if (i < o.magic_port || i > o.magic_port + 15) { if (o.debugging > 1) error("SYN scan got TCP packet to port %d (magic port is %d) ... ignoring", i, o.magic_port); continue; } newport = ntohs(tcp->th_sport); /* In case we are scanning localhost and see outgoing packets */ if (ip->ip_src.s_addr == target->source_ip.s_addr && !tcp->th_ack) { continue; } if (portlookup[newport] < 0) { if (o.debugging) { printf("Strange packet from port %d:\n", ntohs(tcp->th_sport)); readtcppacket((char *)ip, bytes); } current = NULL; continue; } current = &scan[portlookup[newport]]; for(i=0; i < 3; i++) { if (MOD_DIFF(sequences[i],ntohl(tcp->th_ack)) < 5) break; } if (i < 3) trynum = i; else { if (o.debugging) printf("Strange ACK number from target: %lX\n", (unsigned long) ntohl(tcp->th_ack)); trynum = (current->trynum == 0)? 0 : -1; } if ((tcp->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) { newstate = PORT_OPEN; } else if (tcp->th_flags & TH_RST) { newstate = PORT_CLOSED; } } else if (ip->ip_p == IPPROTO_ICMP) { icmp = (struct icmp *) ((char *)ip + sizeof(struct ip)); ip2 = (struct ip *) (((char *) ip) + 4 * ip->ip_hl + 8); data = (unsigned short *) ((char *)ip2+ 4 * ip2->ip_hl); /* printf("Caught ICMP packet:\n"); hdump(icmp, ntohs(ip->ip_len) - sizeof(struct ip)); */ if (icmp->icmp_type == 3) { if (icmp->icmp_code != 1 && icmp->icmp_code != 2 && icmp->icmp_code != 3 && icmp->icmp_code != 13) { error("Unexpected ICMP type/code 3/%d unreachable packet:", icmp->icmp_code); hdump((unsigned char *)icmp, ntohs(ip->ip_len) - sizeof(struct ip)); continue; } newport = ntohs(data[1]); if (portlookup[newport] >= 0) { current = &scan[portlookup[newport]]; trynum = (current->trynum == 0)? 0 : -1; newstate = PORT_FIREWALLED; } else { if (o.debugging) { error("Illegal ICMP type/code 3/%d unreachable packet:", icmp->icmp_code); hdump((unsigned char *)icmp, ntohs(ip->ip_len) - sizeof(struct ip)); } continue; } } } /* OK, now we manipulate the port lists and adjust the time */ if (current) { posportupdate(target, current, trynum, scan, ss, SYN_SCAN, newstate, pil, NULL); current = NULL; trynum = -1; newstate = PORT_UNKNOWN; } } } /* This is an ugly hack -- but the idea is that if 90% of the ports are in the firewalled state, we'd rather show the ports in the UNFIREWALLED state */ void invertfirewalled(portlist *pl, unsigned short *ports) { int firewalledports = 0; port *current; int i; for(current = *pl; current; current = current->next) { if (current->state == PORT_FIREWALLED) firewalledports++; } if (firewalledports > 10 && (((double) firewalledports / o.numports) > 0.6)) { nmap_log("(Not showing ports in state: filtered)\n"); /* OK, we are going to add an UNFIREWALLED entry for every port not listed and then we will delete every port that is firewalled */ for(i=0; i < o.numports; i++) { if (o.udpscan) { current = lookupport(*pl, ports[i], IPPROTO_UDP); if (!current) addport(pl, ports[i], IPPROTO_UDP, NULL, PORT_UNFIREWALLED); else { if (current->state == PORT_FIREWALLED) if (deleteport(pl, ports[i], IPPROTO_UDP) == -1) fatal("Deletion of port %d failed\n", ports[i]); } } if (o.connectscan || o.nullscan || o.xmasscan || o.synscan || o.maimonscan || o.finscan || o.bouncescan) { current = lookupport(*pl, ports[i], IPPROTO_TCP); if (!current) addport(pl, ports[i], IPPROTO_TCP, NULL, PORT_UNFIREWALLED); else { if (current->state == PORT_FIREWALLED) if (deleteport(pl, ports[i], IPPROTO_TCP) == -1) fatal("Deletion of port %d failed\n", ports[i]); } } } } } int ftp_anon_connect(struct ftpinfo *ftp) { int sd; struct sockaddr_in sock; int res; char recvbuf[2048]; char command[512]; if (o.verbose || o.debugging) printf("Attempting connection to ftp://%s:%s@%s:%i\n", ftp->user, ftp->pass, ftp->server_name, ftp->port); if ((sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) { perror("Couldn't create ftp_anon_connect socket"); return 0; } sock.sin_family = AF_INET; sock.sin_addr.s_addr = ftp->server.s_addr; sock.sin_port = htons(ftp->port); res = connect(sd, (struct sockaddr *) &sock, sizeof(struct sockaddr_in)); if (res < 0 ) { printf("Your ftp bounce proxy server won't talk to us!\n"); exit(1); } if (o.verbose || o.debugging) printf("Connected:"); while ((res = recvtime(sd, recvbuf, 2048,7)) > 0) if (o.debugging || o.verbose) { recvbuf[res] = '\0'; printf("%s", recvbuf); } if (res < 0) { perror("recv problem from ftp bounce server"); exit(1); } snprintf(command, 511, "USER %s\r\n", ftp->user); send(sd, command, strlen(command), 0); res = recvtime(sd, recvbuf, 2048,12); if (res <= 0) { perror("recv problem from ftp bounce server"); exit(1); } recvbuf[res] = '\0'; if (o.debugging) printf("sent username, received: %s", recvbuf); if (recvbuf[0] == '5') { printf("Your ftp bounce server doesn't like the username \"%s\"\n", ftp->user); exit(1); } snprintf(command, 511, "PASS %s\r\n", ftp->pass); send(sd, command, strlen(command), 0); res = recvtime(sd, recvbuf, 2048,12); if (res < 0) { perror("recv problem from ftp bounce server\n"); exit(1); } if (!res) printf("Timeout from bounce server ..."); else { recvbuf[res] = '\0'; if (o.debugging) printf("sent password, received: %s", recvbuf); if (recvbuf[0] == '5') { fprintf(stderr, "Your ftp bounce server refused login combo (%s/%s)\n", ftp->user, ftp->pass); exit(1); } } while ((res = recvtime(sd, recvbuf, 2048,2)) > 0) if (o.debugging) { recvbuf[res] = '\0'; printf("%s", recvbuf); } if (res < 0) { perror("recv problem from ftp bounce server"); exit(1); } if (o.verbose) printf("Login credentials accepted by ftp server!\n"); ftp->sd = sd; return sd; } int recvtime(int sd, char *buf, int len, int seconds) { int res; struct timeval timeout; fd_set readfd; timeout.tv_sec = seconds; timeout.tv_usec = 0; FD_ZERO(&readfd); FD_SET(sd, &readfd); res = select(sd + 1, &readfd, NULL, NULL, &timeout); if (res > 0 ) { res = recv(sd, buf, len, 0); if (res >= 0) return res; perror("recv in recvtime"); return 0; } else if (!res) return 0; perror("select() in recvtime"); return -1; } portlist bounce_scan(struct hoststruct *target, unsigned short *portarray, struct ftpinfo *ftp) { int starttime, res , sd = ftp->sd, i=0; char *t = (char *)&target->host; int retriesleft = FTP_RETRIES; char recvbuf[2048]; char targetstr[20]; char command[512]; unsigned short portno,p1,p2; snprintf(targetstr, 20, "%d,%d,%d,%d,", UC(t[0]), UC(t[1]), UC(t[2]), UC(t[3])); starttime = time(NULL); if (o.verbose || o.debugging) printf("Initiating TCP ftp bounce scan against %s (%s)\n", target->name, inet_ntoa(target->host)); for(i=0; portarray[i]; i++) { portno = htons(portarray[i]); p1 = ((unsigned char *) &portno)[0]; p2 = ((unsigned char *) &portno)[1]; snprintf(command, 512, "PORT %s%i,%i\r\n", targetstr, p1,p2); if (o.debugging) printf("Attempting command: %s", command); if (send(sd, command, strlen(command), 0) < 0 ) { perror("send in bounce_scan"); if (retriesleft) { if (o.verbose || o.debugging) printf("Our ftp proxy server hung up on us! retrying\n"); retriesleft--; close(sd); ftp->sd = ftp_anon_connect(ftp); if (ftp->sd < 0) return target->ports; sd = ftp->sd; i--; } else { fprintf(stderr, "Our socket descriptor is dead and we are out of retries. Giving up.\n"); close(sd); ftp->sd = -1; return target->ports; } } else { /* Our send is good */ res = recvtime(sd, recvbuf, 2048,15); if (res <= 0) perror("recv problem from ftp bounce server\n"); else { /* our recv is good */ recvbuf[res] = '\0'; if (o.debugging) printf("result of port query on port %i: %s", portarray[i], recvbuf); if (recvbuf[0] == '5') { if (portarray[i] > 1023) { fprintf(stderr, "Your ftp bounce server sucks, it won't let us feed bogus ports!\n"); exit(1); } else { fprintf(stderr, "Your ftp bounce server doesn't allow priviliged ports, skipping them.\n"); while(portarray[i] && portarray[i] < 1024) i++; if (!portarray[i]) { fprintf(stderr, "And you didn't want to scan any unpriviliged ports. Giving up.\n"); /* close(sd); ftp->sd = -1; return *ports;*/ /* screw this gentle return crap! This is an emergency! */ exit(1); } } } else /* Not an error message */ if (send(sd, "LIST\r\n", 6, 0) > 0 ) { res = recvtime(sd, recvbuf, 2048,12); if (res <= 0) perror("recv problem from ftp bounce server\n"); else { recvbuf[res] = '\0'; if (o.debugging) printf("result of LIST: %s", recvbuf); if (!strncmp(recvbuf, "500", 3)) { /* fuck, we are not aligned properly */ if (o.verbose || o.debugging) printf("misalignment detected ... correcting.\n"); res = recvtime(sd, recvbuf, 2048,10); } if (recvbuf[0] == '1' || recvbuf[0] == '2') { if (o.verbose || o.debugging) printf("Port number %i appears good.\n", portarray[i]); addport(&target->ports, portarray[i], IPPROTO_TCP, NULL, PORT_OPEN); if (recvbuf[0] == '1') { res = recvtime(sd, recvbuf, 2048,5); recvbuf[res] = '\0'; if (res > 0) { if (o.debugging) printf("nxt line: %s", recvbuf); if (recvbuf[0] == '4' && recvbuf[1] == '2' && recvbuf[2] == '6') { deleteport(&target->ports, portarray[i], IPPROTO_TCP); if (o.debugging || o.verbose) printf("Changed my mind about port %i\n", portarray[i]); } } } } } } } } } if (o.debugging || o.verbose) printf("Scanned %d ports in %ld seconds via the Bounce scan.\n", o.numports, (long) time(NULL) - starttime); return target->ports; } /* parse a URL stype ftp string of the form user:pass@server:portno */ int parse_bounce(struct ftpinfo *ftp, char *url) { char *p = url,*q, *s; if ((q = strrchr(url, '@'))) /*we have username and/or pass */ { *(q++) = '\0'; if ((s = strchr(q, ':'))) { /* has portno */ *(s++) = '\0'; strncpy(ftp->server_name, q, MAXHOSTNAMELEN); ftp->port = atoi(s); } else strncpy(ftp->server_name, q, MAXHOSTNAMELEN); if ((s = strchr(p, ':'))) { /* User AND pass given */ *(s++) = '\0'; strncpy(ftp->user, p, 63); strncpy(ftp->pass, s, 255); } else { /* Username ONLY given */ printf("Assuming %s is a username, and using the default password: %s\n", p, ftp->pass); strncpy(ftp->user, p, 63); } } else /* no username or password given */ if ((s = strchr(url, ':'))) { /* portno is given */ *(s++) = '\0'; strncpy(ftp->server_name, url, MAXHOSTNAMELEN); ftp->port = atoi(s); } else /* default case, no username, password, or portnumber */ strncpy(ftp->server_name, url, MAXHOSTNAMELEN); ftp->user[63] = ftp->pass[255] = ftp->server_name[MAXHOSTNAMELEN] = 0; return 1; } void nmap_log(char *fmt, ...) { va_list ap; va_start(ap, fmt); vfprintf(stdout, fmt, ap); fflush(stdout); if (o.logfd && o.logfd != stdout) { vfprintf(o.logfd, fmt, ap); } va_end(ap); return; } /* For logging machine readable stuff */ void nmap_machine_log(char *fmt, ...) { va_list ap; if (!o.machinelogfd) return; va_start(ap, fmt); vfprintf(o.machinelogfd, fmt, ap); va_end(ap); return; } void sigdie(int signo) { switch(signo) { case SIGINT: fprintf(stderr, "caught SIGINT signal, cleaning up\n"); break; case SIGTERM: fprintf(stderr, "caught SIGTERM signal, cleaning up\n"); break; case SIGHUP: fprintf(stderr, "caught SIGHUP signal, cleaning up\n"); break; case SIGSEGV: fprintf(stderr, "caught SIGSEGV signal, cleaning up\n"); if (o.debugging) abort(); break; case SIGBUS: fprintf(stderr, "caught SIGBUS signal, cleaning up\n"); break; default: fprintf(stderr, "caught signal %d, cleaning up\n", signo); break; } fflush(stdout); if (o.logfd && o.logfd != stdout) fclose(o.logfd); exit(1); } int nmap_fetchfile(char *filename_returned, int bufferlen, char *file) { char *dirptr; int res; int foundsomething = 0; struct passwd *pw; char dot_buffer[512]; static int warningcount = 0; /* First we try $NMAPDIR/file next we try ~user/nmap/file then we try LIBDIR/nmap/file <--LIBDIR finally we try ./file */ if ((dirptr = getenv("NMAPDIR"))) { res = snprintf(filename_returned, bufferlen, "%s/%s", dirptr, file); if (res > 0 && res < bufferlen) { if (fileexistsandisreadable(filename_returned)) foundsomething = 1; } } if (!foundsomething) { pw = getpwuid(getuid()); if (pw) { res = snprintf(filename_returned, bufferlen, "%s/.nmap/%s", pw->pw_dir, file); if (res > 0 && res < bufferlen) { if (fileexistsandisreadable(filename_returned)) foundsomething = 1; } } if (!foundsomething && getuid() != geteuid()) { pw = getpwuid(geteuid()); if (pw) { res = snprintf(filename_returned, bufferlen, "%s/nmap/%s", pw->pw_dir, file); if (res > 0 && res < bufferlen) { if (fileexistsandisreadable(filename_returned)) foundsomething = 1; } } } } if (!foundsomething) { res = snprintf(filename_returned, bufferlen, "%s/%s", LIBDIR, file); if (res > 0 && res < bufferlen) { if (fileexistsandisreadable(filename_returned)) foundsomething = 1; } } if (foundsomething && (*filename_returned != '.')) { res = snprintf(dot_buffer, sizeof(dot_buffer), "./%s", file); if (res > 0 && res < bufferlen) { if (fileexistsandisreadable(dot_buffer)) { if (warningcount++ < 5) error("WARNING! The following files exist and are readable: %s and %s. I am choosing %s for security reasons. set NMAPDIR=. to give priority to files in your local directory", filename_returned, dot_buffer, filename_returned); } } } if (!foundsomething) { res = snprintf(filename_returned, bufferlen, "./%s", file); if (res > 0 && res < bufferlen) { if (fileexistsandisreadable(filename_returned)) foundsomething = 1; } } if (!foundsomething) { filename_returned[0] = '\0'; return -1; } if (o.debugging > 1) error("Fetchfile found %s\n", filename_returned); return 0; } int fileexistsandisreadable(char *pathname) { FILE *fp; /* We check this the easy way! */ fp = fopen(pathname, "r"); if (fp) fclose(fp); return (fp == NULL)? 0 : 1; } nmap-2.08/targets.c100600 764 764 104452 6662340645 13343 0ustar fyodorfyodor#include "targets.h" extern struct ops o; struct hoststruct *nexthost(char *hostexp, int lookahead, int pingtimeout) { static int lastindex = -1; static struct hoststruct *hostbatch = NULL; char *device; int numhosts = 0; static int targets_valid = 0; static char *lastexp = NULL; static int i; static struct targets targets; static char *lasthostexp = NULL; if (!hostbatch) hostbatch = safe_malloc((lookahead + 1) * sizeof(struct hoststruct)); if (!lastexp) { lastexp = safe_malloc(1024); *lastexp = '\0'; } if (strcmp(lastexp, hostexp)) { /* New expression -- reinit everything */ targets_valid = 0; lastindex = -1; strncpy(lastexp, hostexp, 1024); lastexp[1023] = '\0'; } if (!targets_valid) { if (!parse_targets(&targets, hostexp)) return NULL; targets_valid = 1; lasthostexp = hostexp; } if (lastindex >= 0 && lastindex < lookahead && hostbatch[lastindex + 1].host.s_addr) return &hostbatch[++lastindex]; /* OK, we need to refresh our target array */ lastindex = 0; bzero((char *) hostbatch, (lookahead + 1) * sizeof(struct hoststruct)); do { if (targets.maskformat) { for(i = 0; i < lookahead && targets.currentaddr.s_addr <= targets.end.s_addr; i++) { if (!o.allowall && ((!(targets.currentaddr.s_addr % 256) || targets.currentaddr.s_addr % 256 == 255))) { struct in_addr iii; iii.s_addr = htonl(targets.currentaddr.s_addr); printf("Skipping host %s because no '-A' and IGNORE_ZERO_AND_255_HOSTS is set in the source.\n", inet_ntoa(iii)); targets.currentaddr.s_addr++; i--; } else hostbatch[i].host.s_addr = htonl(targets.currentaddr.s_addr++); } hostbatch[i].host.s_addr = 0; } else { for(i=0; targets.current[0] <= targets.last[0] && i < lookahead ;) { for(; targets.current[1] <= targets.last[1] && i < lookahead ;) { for(; targets.current[2] <= targets.last[2] && i < lookahead ;) { for(; targets.current[3] <= targets.last[3] && i < lookahead ; targets.current[3]++) { if (o.debugging > 1) printf("doing %d.%d.%d.%d = %d.%d.%d.%d\n", targets.current[0], targets.current[1], targets.current[2], targets.current[3], targets.addresses[0][targets.current[0]],targets.addresses[1][targets.current[1]],targets.addresses[2][targets.current[2]],targets.addresses[3][targets.current[3]]); hostbatch[i++].host.s_addr = htonl(targets.addresses[0][targets.current[0]] << 24 | targets.addresses[1][targets.current[1]] << 16 | targets.addresses[2][targets.current[2]] << 8 | targets.addresses[3][targets.current[3]]); if (!o.allowall && (!(ntohl(hostbatch[i - 1].host.s_addr) % 256) || ntohl(hostbatch[i - 1].host.s_addr) % 256 == 255)) { printf("Skipping host %s because no '-A' and IGNORE_ZERO_AND_255_HOSTS is set in the source.\n", inet_ntoa(hostbatch[i - 1].host)); i--; } } if (i < lookahead && targets.current[3] > targets.last[3]) { targets.current[3] = 0; targets.current[2]++; } } if (i < lookahead && targets.current[2] > targets.last[2]) { targets.current[2] = 0; targets.current[1]++; } } if (i < lookahead && targets.current[1] > targets.last[1]) { targets.current[1] = 0; targets.current[0]++; } } hostbatch[i].host.s_addr = 0; } numhosts = i; for(i=0; i < numhosts; i++) { /* If we were given an IP address & device, insert it now */ if (o.source) { memcpy((char *)&hostbatch[i].source_ip,(char *) o.source, sizeof(struct in_addr)); strcpy(hostbatch[i].device, o.device); } /* If we still do not have a source IP, we create one IFF 1) We are r00t AND 2) We are doing tcp pingscan OR 3) We are doing NO scan AND we are doing a raw-mode portscan or osscan*/ else { if (o.isr00t && ((o.pingtype & PINGTYPE_TCP) || (o.pingtype == PINGTYPE_NONE && (o.synscan || o.finscan || o.xmasscan || o.nullscan || o.maimonscan || o.udpscan || o.osscan )))) { device = routethrough(&(hostbatch[i].host), &(hostbatch[i].source_ip)); if (!device) { if (o.pingtype == PINGTYPE_NONE) { fatal("Could not determine what interface to route packets through, run again with -e "); } else { error("WARNING: Could not determine what interface to route packets through to %s, changing ping scantype to ICMP only", inet_ntoa(hostbatch[i].host)); o.pingtype = PINGTYPE_ICMP; } } else { strcpy(hostbatch[i].device, device); } } } } if ((o.pingtype == PINGTYPE_ICMP) || (hostbatch[0].host.s_addr && (o.pingtype != PINGTYPE_NONE))) massping(hostbatch, i, pingtimeout); else for(i=0; hostbatch[i].host.s_addr; i++) { hostbatch[i].to.srtt = -1; hostbatch[i].to.rttvar = -1; hostbatch[i].to.timeout = 6000000; hostbatch[i].flags |= HOST_UP; /*hostbatch[i].up = 1;*/ } } while(i != 0 && !hostbatch[0].host.s_addr); /* Loop now unneeded */ return &hostbatch[0]; } int parse_targets(struct targets *targets, char *h) { int i=0,j=0,k=0; int start, end; char *r,*s, *target_net; char *addy[5]; char *hostexp = strdup(h); struct hostent *target; unsigned long longtmp; int namedhost = 0; /*struct in_addr current_in;*/ addy[0] = addy[1] = addy[2] = addy[3] = addy[4] = NULL; addy[0] = r = hostexp; /* First we break the expression up into the four parts of the IP address + the optional '/mask' */ target_net = strtok(hostexp, "/"); s = strtok(NULL, ""); /* find the end of the token from hostexp */ targets->netmask = ( s ) ? atoi(s) : 32; if ((int) targets->netmask < 0 || targets->netmask > 32) { printf("Illegal netmask value (%d), must be /0 - /32 . Assuming /32 (one host)\n", targets->netmask); targets->netmask = 32; } for(i=0; *(hostexp + i); i++) if (isupper((int) *(hostexp +i)) || islower((int) *(hostexp +i))) { namedhost = 1; break; } if (targets->netmask != 32 || namedhost) { targets->maskformat = 1; if (!inet_aton(target_net, &(targets->start))) { if ((target = gethostbyname(target_net))) memcpy(&(targets->start), target->h_addr_list[0], sizeof(struct in_addr)); else { fprintf(stderr, "Failed to resolve given hostname/IP: %s. Note that you can't use '/mask' AND '[1-4,7,100-]' style IP ranges\n", target_net); free(hostexp); return 0; } } longtmp = ntohl(targets->start.s_addr); targets->start.s_addr = longtmp & (unsigned long) (0 - (1<<(32 - targets->netmask))); targets->end.s_addr = longtmp | (unsigned long) ((1<<(32 - targets->netmask)) - 1); targets->currentaddr = targets->start; if (targets->start.s_addr <= targets->end.s_addr) { free(hostexp); return 1; } fprintf(stderr, "Host specification invalid"); free(hostexp); return 0; } else { i=0; targets->maskformat = 0; while(*++r) { if (*r == '.' && ++i < 4) { *r = '\0'; addy[i] = r + 1; } else if (*r == '[') { *r = '\0'; addy[i]++; } else if (*r == ']') *r = '\0'; /*else if ((*r == '/' || *r == '\\') && i == 3) { *r = '\0'; addy[4] = r + 1; }*/ else if (*r != '*' && *r != ',' && *r != '-' && !isdigit((int)*r)) fatal("Invalid character in host specification."); } if (i != 3) fatal("Target host specification is illegal."); for(i=0; i < 4; i++) { j=0; while((s = strchr(addy[i],','))) { *s = '\0'; if (*addy[i] == '*') { start = 0; end = 255; } else if (*addy[i] == '-') { start = 0; if (!addy[i] + 1) end = 255; else end = atoi(addy[i]+ 1); } else { start = end = atoi(addy[i]); if ((r = strchr(addy[i],'-')) && *(r+1) ) end = atoi(r + 1); else if (r && !*(r+1)) end = 255; } if (o.debugging) printf("The first host is %d, and the last one is %d\n", start, end); if (start < 0 || start > end) fatal("Your host specifications are illegal!"); for(k=start; k <= end; k++) targets->addresses[i][j++] = k; addy[i] = s + 1; } if (*addy[i] == '*') { start = 0; end = 255; } else if (*addy[i] == '-') { start = 0; if (!addy[i] + 1) end = 255; else end = atoi(addy[i]+ 1); } else { start = end = atoi(addy[i]); if ((r = strchr(addy[i],'-')) && *(r+1) ) end = atoi(r+1); else if (r && !*(r+1)) end = 255; } if (o.debugging) printf("The first host is %d, and the last one is %d\n", start, end); if (start < 0 || start > end) fatal("Your host specifications are illegal!"); if (j + (end - start) > 255) fatal("Your host specifications are illegal!"); for(k=start; k <= end; k++) targets->addresses[i][j++] = k; targets->last[i] = j - 1; } } bzero((char *)targets->current, 4); free(hostexp); return 1; } void massping(struct hoststruct *hostbatch, int num_hosts, int pingtimeout) { static struct timeout_info to = { 0,0,0}; static int gsize = LOOKAHEAD; int hostnum; struct pingtune pt; struct scanstats ss; struct timeval begin_select; struct pingtech ptech; struct tcpqueryinfo tqi; int max_block_size = 40; struct ppkt { unsigned char type; unsigned char code; unsigned short checksum; unsigned short id; unsigned short seq; }; unsigned int elapsed_time; int blockinc; int sd_blocking = 1; struct sockaddr_in sock; short seq = 0; int sd = -1, rawsd = -1, rawpingsd = -1; struct timeval *time; struct timeval start, end, t1, t2; unsigned short id; pcap_t *pd = NULL; struct bpf_program fcode; char err0r[PCAP_ERRBUF_SIZE]; char filter[512]; unsigned int localnet, netmask; unsigned short sportbase; bzero((char *)&ptech, sizeof(struct pingtech)); bzero((char *) &pt, sizeof(struct pingtune)); pt.up_this_block = 0; pt.block_unaccounted = LOOKAHEAD; pt.discardtimesbefore = 0; pt.down_this_block = 0; pt.num_responses = 0; pt.max_tries = 5; /* Maximum number of tries for a block */ pt.group_size = gsize; pt.group_start = 0; pt.block_tries = 0; /* How many tries this block has gone through */ /* What port should we send from? */ if (o.magic_port_set) sportbase = o.magic_port; else sportbase = o.magic_port + 20; /* What kind of scans are we doing? */ if ((o.pingtype & PINGTYPE_ICMP) && hostbatch[0].source_ip.s_addr) ptech.rawicmpscan = 1; else if (o.pingtype & PINGTYPE_ICMP) ptech.icmpscan = 1; if (o.pingtype & PINGTYPE_TCP) { if (o.isr00t) ptech.rawtcpscan = 1; else ptech.connecttcpscan = 1; } time = safe_malloc(sizeof(struct timeval) * ((pt.max_tries) * num_hosts)); bzero(time, sizeof(struct timeval) * pt.max_tries * num_hosts); id = (unsigned short) get_random_uint(); if (ptech.connecttcpscan) max_block_size = MIN(50, o.max_sockets); bzero((char *)&tqi, sizeof(tqi)); if (ptech.connecttcpscan) { tqi.sockets = safe_malloc(sizeof(int) * (pt.max_tries) * num_hosts); memset(tqi.sockets, 255, sizeof(int) * (pt.max_tries) * num_hosts); FD_ZERO(&(tqi.fds_r)); FD_ZERO(&(tqi.fds_w)); FD_ZERO(&(tqi.fds_x)); tqi.sockets_out = 0; tqi.maxsd = 0; } if (ptech.icmpscan) { sd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP); if (sd < 0) pfatal("Socket trouble in massping"); unblock_socket(sd); sd_blocking = 0; if (num_hosts > 10) max_rcvbuf(sd); if (o.allowall) broadcast_socket(sd); } else sd = -1; /* if to timeout structure hasn't been initialized yet */ if (!to.srtt && !to.rttvar && !to.timeout) { /* to.srtt = 800000; to.rttvar = 500000; */ /* we will init these when we get real data */ to.timeout = pingtimeout * 1e6; } /* Init our raw socket */ if (o.numdecoys > 1 || ptech.rawtcpscan || ptech.rawicmpscan) { if ((rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 ) pfatal("socket trobles in massping"); if (o.allowall) broadcast_socket(rawsd); if ((rawpingsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 ) pfatal("socket trobles in massping"); if (o.allowall) broadcast_socket(rawpingsd); } else { rawsd = -1; rawpingsd = -1; } if (ptech.rawicmpscan || ptech.rawtcpscan) { /* we need a pcap descript0r! */ /* MAX snaplen needed = 24 bytes max link_layer header 64 bytes max IPhdr 16 bytes of the TCP header --- = 104 byte snaplen */ if (!(pd = pcap_open_live(hostbatch[0].device, 104, o.spoofsource, 20, err0r))) fatal("pcap_open_live: %s", err0r); if (pcap_lookupnet(hostbatch[0].device, &localnet, &netmask, err0r) < 0) fatal("Failed to lookup device subnet/netmask: %s", err0r); sprintf(filter, "(icmp and dst host %s) or (tcp and dst host %s and ( dst port %d or dst port %d or dst port %d or dst port %d or dst port %d))", inet_ntoa(hostbatch[0].source_ip),inet_ntoa(hostbatch[0].source_ip), sportbase , sportbase + 1, sportbase + 2, sportbase + 3, sportbase + 4); /* Due to apparent bug in libpcap */ if (islocalhost(&(hostbatch[0].host))) filter[0] = '\0'; if (o.debugging) printf("Packet capture filter: %s\n", filter); if (pcap_compile(pd, &fcode, filter, 0, netmask) < 0) fatal("Error compiling our pcap filter: %s\n", pcap_geterr(pd)); if (pcap_setfilter(pd, &fcode) < 0 ) fatal("Failed to set the pcap filter: %s\n", pcap_geterr(pd)); } if (ptech.rawicmpscan + ptech.icmpscan + ptech.connecttcpscan + ptech.rawtcpscan == 1) blockinc = 8; else blockinc = 5; bzero((char *)&sock,sizeof(struct sockaddr_in)); gettimeofday(&start, NULL); pt.group_end = MIN(pt.group_start + pt.group_size -1, num_hosts -1); while(pt.group_start < num_hosts) { /* while we have hosts left to scan */ do { /* one block */ pt.discardtimesbefore = -1; pt.up_this_block = 0; pt.down_this_block = 0; pt.block_unaccounted = 0; for(hostnum=pt.group_start; hostnum <= pt.group_end; hostnum++) { /* If (we don't know whether the host is up yet) ... */ if (!(hostbatch[hostnum].flags & HOST_UP) && !hostbatch[hostnum].wierd_responses && !(hostbatch[hostnum].flags & HOST_DOWN)) { /* Send a ping packet to it */ seq = hostnum * pt.max_tries + pt.block_tries; if (ptech.icmpscan && !sd_blocking) { block_socket(sd); sd_blocking = 1; } if (ptech.icmpscan || ptech.rawicmpscan) sendpingquery(sd, rawpingsd, &hostbatch[hostnum], seq, id, &ss, time, ptech); if (ptech.rawtcpscan) { sendrawtcppingquery(rawsd, &hostbatch[hostnum], seq, time, &pt); } else if (ptech.connecttcpscan) { sendconnecttcpquery(hostbatch, &tqi, &hostbatch[hostnum], seq, time, &pt, &to); } pt.block_unaccounted++; gettimeofday(&t2, NULL); if (TIMEVAL_SUBTRACT(t2,time[seq]) > 1000000) { pt.discardtimesbefore = hostnum; if (o.debugging) printf("Huge send delay: %lu microseconds\n", (unsigned long) TIMEVAL_SUBTRACT(t2,t1)); } } } /* for() loop */ /* OK, we have sent our ping packets ... now we wait for responses */ gettimeofday(&begin_select, NULL); do { if (ptech.icmpscan && sd_blocking ) { unblock_socket(sd); sd_blocking = 0; } if(ptech.icmpscan || ptech.rawicmpscan || ptech.rawtcpscan) { get_ping_results(sd, pd, hostbatch, time, &pt, &to, id, &ptech); } if (ptech.connecttcpscan) { get_connecttcpscan_results(&tqi, hostbatch, time, &pt, &to); } gettimeofday(&end, NULL); elapsed_time = TIMEVAL_SUBTRACT(end, begin_select); } while( elapsed_time < to.timeout); /* try again if a new box was found but some are still unaccounted for and we haven't run out of retries. Also retry if the block is extremely small. */ pt.dropthistry = 0; pt.block_tries++; } while ((pt.up_this_block > 0 || pt.group_end - pt.group_start <= 3) && pt.block_unaccounted > 0 && pt.block_tries < pt.max_tries); if (o.debugging) printf("Finished block: srtt: %d rttvar: %d timeout: %d block_tries: %d up_this_block: %d down_this_block: %d group_sz: %d\n", to.srtt, to.rttvar, to.timeout, pt.block_tries, pt.up_this_block, pt.down_this_block, pt.group_end - pt.group_start + 1); if ((pt.block_tries == 1) || (pt.block_tries == 2 && pt.up_this_block == 0 && pt.down_this_block == 0)) /* Then it did not miss any hosts (that we know of)*/ pt.group_size = MIN(pt.group_size + blockinc, max_block_size); /* Move to next block */ pt.block_tries = 0; pt.group_start = pt.group_end +1; pt.group_end = MIN(pt.group_start + pt.group_size -1, num_hosts -1); /* pt.block_unaccounted = pt.group_end - pt.group_start + 1; */ } close(sd); if (ptech.connecttcpscan) free(tqi.sockets); if (sd >= 0) close(sd); if (rawsd >= 0) close(rawsd); if (rawpingsd >= 0) close(rawpingsd); free(time); if (pd) pcap_close(pd); if (o.debugging) printf("massping done: num_hosts: %d num_responses: %d\n", num_hosts, pt.num_responses); gsize = pt.group_size; return; } int sendconnecttcpquery(struct hoststruct *hostbatch, struct tcpqueryinfo *tqi, struct hoststruct *target, int seq, struct timeval *time, struct pingtune *pt, struct timeout_info *to) { int res,i; int tmpsd; int hostnum, trynum; struct sockaddr_in sock; int sockaddr_in_len = sizeof(struct sockaddr_in); trynum = seq % pt->max_tries; hostnum = seq / pt->max_tries; assert(tqi->sockets_out <= o.max_sockets); if (tqi->sockets_out == o.max_sockets) { /* We've got to free one! */ for(i=0; i < trynum; i++) { tmpsd = hostnum * pt->max_tries + i; if (tqi->sockets[tmpsd] >= 0) { if (o.debugging) printf("sendconnecttcpquery: Scavenging a free socket due to serious shortage\n"); close(tqi->sockets[tmpsd]); tqi->sockets[tmpsd] = -1; tqi->sockets_out--; break; } } if (i == trynum) fatal("sendconnecttcpquery: Could not scavenge a free socket!"); } /* Since we know we now have a free s0cket, lets take it */ assert(tqi->sockets[seq] == -1); tqi->sockets[seq] = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (tqi->sockets[seq] == -1) fatal("Socket creation in sendconnecttcpquery"); tqi->maxsd = MAX(tqi->maxsd, tqi->sockets[seq]); tqi->sockets_out++; unblock_socket(tqi->sockets[seq]); init_socket(tqi->sockets[seq]); bzero(&sock, sockaddr_in_len); sock.sin_family = AF_INET; sock.sin_port = htons(o.tcp_probe_port); sock.sin_addr.s_addr = target->host.s_addr; res = connect(tqi->sockets[seq],(struct sockaddr *)&sock,sizeof(struct sockaddr)); gettimeofday(&time[seq], NULL); if ((res != -1 || errno == ECONNREFUSED)) { /* This can happen on localhost, successful/failing connection immediately in non-blocking mode */ hostupdate(hostbatch, target, HOST_UP, 1, trynum, to, &time[seq], pt, tqi, PINGTYPE_CONNECTTCP); if (tqi->maxsd == tqi->sockets[seq]) tqi->maxsd--; } else if (errno == ENETUNREACH) { if (o.debugging) error("Got ENETUNREACH from sendconnecttcpquery connect()"); hostupdate(hostbatch, target, HOST_DOWN, 1, trynum, to, &time[seq], pt, tqi, PINGTYPE_CONNECTTCP); } else { /* We'll need to select() and wait it out */ FD_SET(tqi->sockets[seq], &(tqi->fds_r)); FD_SET(tqi->sockets[seq], &(tqi->fds_w)); FD_SET(tqi->sockets[seq], &(tqi->fds_x)); } return 0; } int sendrawtcppingquery(int rawsd, struct hoststruct *target, int seq, struct timeval *time, struct pingtune *pt) { int decoy, trynum; int myseq; unsigned short sportbase; if (o.magic_port_set) sportbase = o.magic_port; else sportbase = o.magic_port + 20; trynum = seq % pt->max_tries; myseq = (get_random_uint() << 19) + (seq << 3) + 3; /* Response better end in 011 or 100 */ memcpy((char *)&(o.decoys[o.decoyturn]), (char *)&target->source_ip, sizeof(struct in_addr)); for (decoy = 0; decoy < o.numdecoys; decoy++) { if (o.pingtype & PINGTYPE_TCP_USE_SYN) { send_tcp_raw( rawsd, &o.decoys[decoy], &(target->host), sportbase + trynum, o.tcp_probe_port, myseq, 0, TH_SYN, 0, NULL, 0, NULL, 0); } else { send_tcp_raw( rawsd, &o.decoys[decoy], &(target->host), sportbase + trynum, o.tcp_probe_port, myseq, 0, TH_ACK, 0, NULL, 0, NULL, 0); } } gettimeofday(&time[seq], NULL); return 0; } int sendpingquery(int sd, int rawsd, struct hoststruct *target, int seq, unsigned short id, struct scanstats *ss, struct timeval *time, struct pingtech ptech) { struct ppkt { unsigned char type; unsigned char code; unsigned short checksum; unsigned short id; unsigned short seq; } pingpkt; int decoy; int res; struct sockaddr_in sock; char *ping = (char *) &pingpkt; /* Fill out the ping packet */ pingpkt.type = 8; pingpkt.code = 0; pingpkt.id = id; pingpkt.seq = seq; pingpkt.checksum = 0; pingpkt.checksum = in_cksum((unsigned short *)ping, 8); /* Now for our sock */ if (ptech.icmpscan) { bzero((char *)&sock, sizeof(struct sockaddr_in)); sock.sin_family= AF_INET; sock.sin_addr = target->host; if (sizeof(struct ppkt) != 8) fatal("Your native data type sizes are too screwed up for this to work."); } else { memcpy((char *) &(o.decoys[o.decoyturn]), (char *)&target->source_ip, sizeof(struct in_addr)); } for (decoy = 0; decoy < o.numdecoys; decoy++) { if (ptech.icmpscan && decoy == o.decoyturn) { if ((res = sendto(sd,(char *) ping,8,0,(struct sockaddr *)&sock, sizeof(struct sockaddr))) != 8) { fprintf(stderr, "sendto in sendpingquery returned %d (should be 8)!\n", res); perror("sendto"); } } else { send_ip_raw( rawsd, &o.decoys[decoy], &(target->host), IPPROTO_ICMP, ping, 8); } } gettimeofday(&time[seq], NULL); return 0; } int get_connecttcpscan_results(struct tcpqueryinfo *tqi, struct hoststruct *hostbatch, struct timeval *time, struct pingtune *pt, struct timeout_info *to) { int res, res2, tm; struct timeval myto, start, end; int hostindex; int trynum, newstate = HOST_DOWN; int seq; char buf[256]; int foundsomething = 0; fd_set myfds_r,myfds_w,myfds_x; gettimeofday(&start, NULL); while(pt->block_unaccounted) { /* OK so there is a little fudge factor, SUE ME! */ myto.tv_sec = to->timeout / 1000000; myto.tv_usec = to->timeout % 1000000; foundsomething = 0; myfds_r = tqi->fds_r; myfds_w = tqi->fds_w; myfds_x = tqi->fds_x; res = select(tqi->maxsd + 1, &myfds_r, &myfds_w, &myfds_x, &myto); if (res > 0) { for(hostindex = pt->group_start; hostindex <= pt->group_end; hostindex++) { for(trynum=0; trynum <= pt->block_tries; trynum++) { seq = hostindex * pt->max_tries + trynum; if (tqi->sockets[seq] >= 0) { if (o.debugging > 1) { if (FD_ISSET(tqi->sockets[seq], &(myfds_r))) { printf("WRITE selected for machine %s\n", inet_ntoa(hostbatch[hostindex].host)); } if ( FD_ISSET(tqi->sockets[seq], &myfds_w)) { printf("READ selected for machine %s\n", inet_ntoa(hostbatch[hostindex].host)); } if ( FD_ISSET(tqi->sockets[seq], &myfds_x)) { printf("EXC selected for machine %s\n", inet_ntoa(hostbatch[hostindex].host)); } } if (FD_ISSET(tqi->sockets[seq], &myfds_r) || FD_ISSET(tqi->sockets[seq], &myfds_w) || FD_ISSET(tqi->sockets[seq], &myfds_x)) { foundsomething = 0; res2 = read(tqi->sockets[seq], buf, sizeof(buf)); if (res2 == -1) { switch(errno) { case ECONNREFUSED: case EAGAIN: if (errno == EAGAIN && o.verbose) { printf("Machine %s MIGHT actually be listening on probe port %d\n", inet_ntoa(hostbatch[hostindex].host), o.tcp_probe_port); } foundsomething = 1; newstate = HOST_UP; break; case ENETDOWN: case ENETUNREACH: case ENETRESET: case ECONNABORTED: case ETIMEDOUT: case EHOSTDOWN: case EHOSTUNREACH: foundsomething = 1; newstate = HOST_DOWN; break; default: sprintf (buf, "Strange read error from %s", inet_ntoa(hostbatch[hostindex].host)); perror(buf); break; } } else { foundsomething = 1; newstate = HOST_UP; if (o.verbose) { buf[res2] = '\0'; if (res2 == 0) printf("Machine %s is actually LISTENING on probe port %d\n", inet_ntoa(hostbatch[hostindex].host), o.tcp_probe_port); else printf("Machine %s is actually LISTENING on probe port %d, banner: %s\n", inet_ntoa(hostbatch[hostindex].host), o.tcp_probe_port, buf); } } if (foundsomething) { hostupdate(hostbatch, &hostbatch[hostindex], newstate, 1, trynum, to, &time[seq], pt, tqi, PINGTYPE_CONNECTTCP); /* break;*/ } } } } } } gettimeofday(&end, NULL); tm = TIMEVAL_SUBTRACT(end,start); if (tm > (30 * to->timeout)) { error("WARNING: getconnecttcpscanresults is taking way to long, skipping"); break; } if (res == 0 && tm > to->timeout) break; } /* OK, now we have to kill all outstanding queries to make room for the next group :( I'll miss these little guys. */ for(hostindex = pt->group_start; hostindex <= pt->group_end; hostindex++) { for(trynum=0; trynum <= pt->block_tries; trynum++) { seq = hostindex * pt->max_tries + trynum; if ( tqi->sockets[seq] >= 0) { tqi->sockets_out--; close(tqi->sockets[seq]); tqi->sockets[seq] = -1; } } } tqi->maxsd = 0; assert(tqi->sockets_out == 0); FD_ZERO(&(tqi->fds_r)); FD_ZERO(&(tqi->fds_w)); FD_ZERO(&(tqi->fds_x)); return 0; } int get_ping_results(int sd, pcap_t *pd, struct hoststruct *hostbatch, struct timeval *time, struct pingtune *pt, struct timeout_info *to, int id, struct pingtech *ptech) { fd_set fd_r, fd_x; struct timeval myto, tmpto, start, end; int bytes, res; struct ppkt { unsigned char type; unsigned char code; unsigned short checksum; unsigned short id; unsigned short seq; } *ping = NULL, *ping2 = NULL; char response[16536]; struct tcphdr *tcp; struct ip *ip, *ip2; int hostnum = -99999; /* This ought to crash us if it is used uninitialized */ int tm; int dotimeout = 1; int newstate = HOST_DOWN; int foundsomething; unsigned short newport; int trynum = -999999; int pingtype = -999999; int timeout = 0; unsigned short sequence = 65534; unsigned long tmpl; unsigned short sportbase; FD_ZERO(&fd_r); FD_ZERO(&fd_x); /* Decide on the timeout, based on whether we need to also watch for TCP stuff */ if (ptech->icmpscan && !ptech->rawtcpscan) { /* We only need to worry about pings, so we set timeout for the whole she-bang! */ myto.tv_sec = to->timeout / 1000000; myto.tv_usec = to->timeout % 1000000; } else { myto.tv_sec = 0; myto.tv_usec = 20000; } if (o.magic_port_set) sportbase = o.magic_port; else sportbase = o.magic_port + 20; gettimeofday(&start, NULL); while(pt->block_unaccounted > 0 && !timeout) { tmpto = myto; if (pd) { ip = (struct ip*) readip_pcap(pd, &bytes); } else { FD_SET(sd, &fd_r); FD_SET(sd, &fd_x); res = select(sd+1, &fd_r, NULL, &fd_x, &tmpto); if (res == 0) break; bytes = read(sd,&response,sizeof(response)); ip = (struct ip *) &(response); } gettimeofday(&end, NULL); tm = TIMEVAL_SUBTRACT(end,start); if (tm > (MAX(400000,3 * to->timeout))) timeout = 1; if (bytes == 0 && tm > to->timeout) { timeout = 1; } if (bytes == 0) continue; if (bytes > 0 && bytes <= 20) { error("%d byte micro packet received in get_ping_results"); continue; } foundsomething = 0; dotimeout = 0; /* First check if it is ICMP or TCP */ if (ip->ip_p == IPPROTO_ICMP) { /* if it is our response */ ping = (struct ppkt *) ((ip->ip_hl * 4) + (char *) ip); if (bytes < ip->ip_hl * 4 + 8) { error("Supposed ping packet is only %d bytes long!", bytes); continue; } if ( !ping->type && !ping->code && ping->id == id) { hostnum = ping->seq / pt->max_tries; if (hostnum > pt->group_end) { if (o.debugging) error("Ping sequence %d leads to hostnum %d which is beyond the end of this group (%d)", ping->seq, hostnum, pt->group_end); continue; } if (!hostbatch[hostnum].source_ip.s_addr) hostbatch[hostnum].source_ip.s_addr = ip->ip_dst.s_addr; if (o.debugging) printf("We got a ping packet back from %s: id = %d seq = %d checksum = %d\n", inet_ntoa(ip->ip_src), ping->id, ping->seq, ping->checksum); if (hostbatch[hostnum].host.s_addr == ip->ip_src.s_addr) { foundsomething = 1; pingtype = PINGTYPE_ICMP; sequence = ping->seq; newstate = HOST_UP; trynum = sequence % pt->max_tries; if (pt->discardtimesbefore < ping->seq) dotimeout = 1; else dotimeout = 0; } else hostbatch[hostnum].wierd_responses++; } else if (ping->type == 3 || ping->type == 11 || ping->type == 4 || o.debugging) { if (bytes < ip->ip_hl * 4 + 28) { if (o.debugging) error("ICMP type %d code %d packet is only %d bytes\n", ping->type, ping->code, bytes); continue; } ip2 = (struct ip *) ((char *)ip + ip->ip_hl * 4 + 8); if (bytes < ip->ip_hl * 4 + 8 + ip2->ip_hl * 4 + 8) { if (o.debugging) error("ICMP type %d code %d packet is only %d bytes\n", ping->type, ping->code, bytes); continue; } ping2 = (struct ppkt *) ((char *)ip2 + ip2->ip_hl * 4); if (ping2->id != id) { if (o.debugging) { error("Illegal id %d found, should be %d (icmp type/code %d/%d)", ping2->id, id, ping->type, ping->code); if (o.debugging > 1) lamont_hdump((char *)ip, bytes); } continue; } sequence = ping2->seq; hostnum = sequence / pt->max_tries; trynum = sequence % pt->max_tries; if (hostnum > pt->group_end) { if (o.debugging) error("Bogus ping sequence: %d leads to bogus hostnum %d (icmp type/code %d/%d", sequence, hostnum, ping->type, ping->code); continue; } if (ping->type == 3) { if (o.debugging) printf("Got destination unreachable for %s\n", inet_ntoa(hostbatch[hostnum].host)); /* Since this gives an idea of how long it takes to get an answer, we add it into our times */ if (pt->discardtimesbefore < sequence) dotimeout = 1; foundsomething = 1; pingtype = PINGTYPE_ICMP; newstate = HOST_DOWN; } else if (ping->type == 11) { if (o.debugging) printf("Got Time Exceeded for %s\n", inet_ntoa(hostbatch[hostnum].host)); dotimeout = 0; /* I don't want anything to do with timing this */ foundsomething = 1; pingtype = PINGTYPE_ICMP; newstate = HOST_DOWN; } else if (ping->type == 4) { if (o.debugging) printf("Got ICMP source quench\n"); usleep(50000); } else if (o.debugging > 0) { printf("Got ICMP message type %d code %d\n", ping->type, ping->code); } } } else if (ip->ip_p == IPPROTO_TCP) { tcp = (struct tcphdr *) (((char *) ip) + 4 * ip->ip_hl); if (!(tcp->th_flags & TH_RST) && ((tcp->th_flags & (TH_SYN|TH_ACK)) != (TH_SYN|TH_ACK))) continue; newport = ntohs(tcp->th_sport); tmpl = ntohl(tcp->th_ack); /* Grab the sequence nr */ if (o.pingtype & PINGTYPE_TCP_USE_SYN) { if ((tmpl & 7) == 4 || (tmpl & 7) == 3) { sequence = (tmpl >> 3) & 0xffff; hostnum = sequence / pt->max_tries; trynum = sequence % pt->max_tries; } else { if (o.debugging) { error("Whacked ACK number from %s", inet_ntoa(ip->ip_src)); } continue; } } else { trynum = ntohs(tcp->th_dport) - sportbase; if (trynum >= pt->max_tries) { if (o.debugging) error("Bogus trynum %d", trynum); continue; } /* FUDGE! This ACK scan is cool but we don't get sequence numbers back! We'll have to brute force lookup to find the hostnum */ for(hostnum = pt->group_end; hostnum >= 0; hostnum--) { if (hostbatch[hostnum].host.s_addr == ip->ip_src.s_addr) break; } if (hostnum < 0) { if (o.debugging > 1) error("Warning, unexpacted packet from machine %s", inet_ntoa(ip->ip_src)); continue; } sequence = hostnum * pt->max_tries + trynum; } if (hostnum > pt->group_end) { if (o.debugging) { error("Response from host beyond group_end"); } continue; } if (o.debugging) printf("We got a TCP ping packet back from %s (hostnum = %d trynum = %d\n", inet_ntoa(ip->ip_src), hostnum, trynum); pingtype = PINGTYPE_RAWTCP; foundsomething = 1; if (pt->discardtimesbefore < sequence) dotimeout = 1; newstate = HOST_UP; } else if (o.debugging) { error("Found whacked packet protocol %d in get_ping_results", ip->ip_p); } if (foundsomething) { hostupdate(hostbatch, &hostbatch[hostnum], newstate, dotimeout, trynum, to, &time[sequence], pt, NULL,pingtype); } } return 0; } int hostupdate(struct hoststruct *hostbatch, struct hoststruct *target, int newstate, int dotimeout, int trynum, struct timeout_info *to, struct timeval *sent, struct pingtune *pt, struct tcpqueryinfo *tqi, int pingtype) { int hostnum = target - hostbatch; int i; int seq; int tmpsd; struct timeval tv; if (o.debugging) { gettimeofday(&tv, NULL); printf("Hostupdate called for machne %s state %s -> %s (trynum %d, dotimeadj: %s time: %ld)\n", inet_ntoa(target->host), readhoststate(target->flags), readhoststate(newstate), trynum, (dotimeout)? "yes" : "no", (long) TIMEVAL_SUBTRACT(tv, *sent)); } assert(hostnum <= pt->group_end); if (dotimeout) { adjust_timeouts(*sent, to); } /* If this is a tcp connect() pingscan, close all sockets */ if (pingtype == PINGTYPE_CONNECTTCP) { seq = (target - hostbatch) * pt->max_tries + trynum; assert(tqi->sockets[seq] >= 0); for(i=0; i <= pt->block_tries; i++) { seq = (target - hostbatch) * pt->max_tries + i; tmpsd = tqi->sockets[seq]; if (tmpsd >= 0) { assert(tqi->sockets_out > 0); tqi->sockets_out--; close(tmpsd); if (tmpsd == tqi->maxsd) tqi->maxsd--; FD_CLR(tmpsd, &(tqi->fds_r)); FD_CLR(tmpsd, &(tqi->fds_w)); FD_CLR(tmpsd, &(tqi->fds_x)); tqi->sockets[seq] = -1; } } } target->to = *to; if (target->flags & HOST_UP) { /* The target is already up and that takes precedence over HOST_DOWN or HOST_FIREWALLED, so we just return. */ return 0; } if (trynum > 0 && !(pt->dropthistry)) { pt->dropthistry = 1; if (o.debugging) printf("Decreasing massping group size from %d to ", pt->group_size); pt->group_size = MAX(pt->group_size * 0.75, 10); if (o.debugging) printf("%d\n", pt->group_size); } if (newstate == HOST_DOWN && (target->flags & HOST_DOWN)) { /* I see nothing to do here */ } else if (newstate == HOST_UP && (target->flags & HOST_DOWN)) { /* We give host_up precedence */ target->flags &= ~HOST_DOWN; /* Kill the host_down flag */ target->flags |= HOST_UP; if (hostnum >= pt->group_start) { assert(pt->down_this_block > 0); pt->down_this_block--; pt->up_this_block++; } } else if (newstate == HOST_DOWN) { target->flags |= HOST_DOWN; pt->down_this_block++; pt->block_unaccounted--; pt->num_responses++; } else { assert(newstate == HOST_UP); target->flags |= HOST_UP; pt->up_this_block++; pt->block_unaccounted--; pt->num_responses++; } return 0; } char *readhoststate(int state) { switch(state) { case HOST_UP: return "HOST_UP"; case HOST_DOWN: return "HOST_DOWN"; case HOST_FIREWALLED: return "HOST_FIREWALLED"; default: return "UNKNOWN/COMBO"; } return NULL; } nmap-2.08/tcpip.c100600 764 764 75760 6662340755 13004 0ustar fyodorfyodor#include "tcpip.h" /* Globals */ int jumpok = 0; static jmp_buf jmp_env; /* Sig_ALRM handler */ void sig_alarm(int signo) { if (jumpok) longjmp(jmp_env, 1); return; } inline void sethdrinclude(int sd) { #ifdef IP_HDRINCL int one = 1; setsockopt(sd, IPPROTO_IP, IP_HDRINCL, (void *) &one, sizeof(one)); #endif } /* Tests whether a packet sent to IP is LIKELY to route through the kernel localhost interface */ int islocalhost(struct in_addr *addr) { char dev[128]; /* If it is 0.0.0.0 or starts with 127.0.0.1 then it is probably localhost */ if ((addr->s_addr & htonl(0xFF000000)) == htonl(0x7F000000)) return 1; if (!addr->s_addr) return 1; /* If it is the same addy as a local interface, then it is probably localhost */ if (ipaddr2devname(dev, addr) != -1) return 1; /* OK, so to a first approximation, this addy is probably not localhost */ return 0; } /* Standard swiped internet checksum routine */ inline unsigned short in_cksum(unsigned short *ptr,int nbytes) { register long sum; /* assumes long == 32 bits */ u_short oddbyte; register u_short answer; /* assumes u_short == 16 bits */ /* * Our algorithm is simple, using a 32-bit accumulator (sum), * we add sequential 16-bit words to it, and at the end, fold back * all the carry bits from the top 16 bits into the lower 16 bits. */ sum = 0; while (nbytes > 1) { sum += *ptr++; nbytes -= 2; } /* mop up an odd byte, if necessary */ if (nbytes == 1) { oddbyte = 0; /* make sure top half is zero */ *((u_char *) &oddbyte) = *(u_char *)ptr; /* one byte only */ sum += oddbyte; } /* * Add back carry outs from top 16 bits to low 16 bits. */ sum = (sum >> 16) + (sum & 0xffff); /* add high-16 to low-16 */ sum += (sum >> 16); /* add carry */ answer = ~sum; /* ones-complement, then truncate to 16 bits */ return(answer); } /* Tries to resolve given hostname and stores result in ip . returns 0 if hostname cannot be resolved */ int resolve(char *hostname, struct in_addr *ip) { struct hostent *h; if (!hostname || !*hostname) fatal("NULL or zero-length hostname passed to resolve()"); if (inet_aton(hostname, ip)) return 1; /* damn, that was easy ;) */ if ((h = gethostbyname(hostname))) { memcpy(ip, h->h_addr_list[0], sizeof(struct in_addr)); return 1; } return 0; } int send_tcp_raw( int sd, struct in_addr *source, struct in_addr *victim, unsigned short sport, unsigned short dport, unsigned long seq, unsigned long ack, unsigned char flags, unsigned short window, char *options, int optlen, char *data, unsigned short datalen) { struct pseudo_header { /*for computing TCP checksum, see TCP/IP Illustrated p. 145 */ unsigned long s_addy; unsigned long d_addr; char zer0; unsigned char protocol; unsigned short length; }; char *packet = safe_malloc(sizeof(struct ip) + sizeof(struct tcphdr) + optlen + datalen); struct ip *ip = (struct ip *) packet; struct tcphdr *tcp = (struct tcphdr *) (packet + sizeof(struct ip)); struct pseudo_header *pseudo = (struct pseudo_header *) (packet + sizeof(struct ip) - sizeof(struct pseudo_header)); static int myttl = 0; /*With these placement we get data and some field alignment so we aren't wasting too much in computing the checksum */ int res = -1; struct sockaddr_in sock; char myname[MAXHOSTNAMELEN + 1]; struct hostent *myhostent = NULL; int source_malloced = 0; /* check that required fields are there and not too silly */ /* We used to check that sport and dport were nonzer0, but scr3w that! */ if ( !victim || sd < 0) { fprintf(stderr, "send_tcp_raw: One or more of your parameters suck!\n"); free(packet); return -1; } if (optlen % 4) { fatal("send_tcp_raw called with an option length argument of %d which is illegal because it is not divisible by 4", optlen); } if (!myttl) myttl = (get_random_uint() % 23) + 37; /* It was a tough decision whether to do this here for every packet or let the calling function deal with it. In the end I grudgingly decided to do it here and potentially waste a couple microseconds... */ sethdrinclude(sd); /* if they didn't give a source address, fill in our first address */ if (!source) { source_malloced = 1; source = safe_malloc(sizeof(struct in_addr)); if (gethostname(myname, MAXHOSTNAMELEN) || !(myhostent = gethostbyname(myname))) fatal("Cannot get hostname! Try using -S or -e \n"); memcpy(source, myhostent->h_addr_list[0], sizeof(struct in_addr)); #if ( TCPIP_DEBUGGING ) printf("We skillfully deduced that your address is %s\n", inet_ntoa(*source)); #endif } /*do we even have to fill out this damn thing? This is a raw packet, after all */ sock.sin_family = AF_INET; sock.sin_port = htons(dport); sock.sin_addr.s_addr = victim->s_addr; bzero((char *) packet, sizeof(struct ip) + sizeof(struct tcphdr)); pseudo->s_addy = source->s_addr; pseudo->d_addr = victim->s_addr; pseudo->protocol = IPPROTO_TCP; pseudo->length = htons(sizeof(struct tcphdr) + optlen + datalen); tcp->th_sport = htons(sport); tcp->th_dport = htons(dport); if (seq) { tcp->th_seq = htonl(seq); } else if (flags & TH_SYN) { get_random_bytes(&(tcp->th_seq), 4); } if (ack) tcp->th_ack = htonl(ack); /*else if (flags & TH_ACK) tcp->th_ack = rand() + rand();*/ tcp->th_off = 5 + (optlen /4) /*words*/; tcp->th_flags = flags; if (window) tcp->th_win = htons(window); else tcp->th_win = htons(1024 * (myttl % 4 + 1)); /* Who cares */ /* We should probably copy the data over too */ if (data && datalen) memcpy(packet + sizeof(struct ip) + sizeof(struct tcphdr) + optlen, data, datalen); /* And the options */ if (optlen) { memcpy(packet + sizeof(struct ip) + sizeof(struct tcphdr), options, optlen); } #if STUPID_SOLARIS_CHECKSUM_BUG tcp->th_sum = sizeof(struct tcphdr) + optlen + datalen; #else tcp->th_sum = in_cksum((unsigned short *)pseudo, sizeof(struct tcphdr) + optlen + sizeof(struct pseudo_header) + datalen); #endif /* Now for the ip header */ bzero(packet, sizeof(struct ip)); ip->ip_v = 4; ip->ip_hl = 5; ip->ip_len = BSDFIX(sizeof(struct ip) + sizeof(struct tcphdr) + optlen + datalen); get_random_bytes(&(ip->ip_id), 2); ip->ip_ttl = myttl; ip->ip_p = IPPROTO_TCP; ip->ip_src.s_addr = source->s_addr; ip->ip_dst.s_addr= victim->s_addr; #if HAVE_IP_IP_SUM ip->ip_sum = in_cksum((unsigned short *)ip, sizeof(struct ip)); #endif if (TCPIP_DEBUGGING > 1) { printf("Raw TCP packet creation completed! Here it is:\n"); readtcppacket(packet,BSDUFIX(ip->ip_len)); } res = Sendto("send_tcp_raw", sd, packet, BSDUFIX(ip->ip_len), 0, (struct sockaddr *)&sock, (int)sizeof(struct sockaddr_in)); if (source_malloced) free(source); free(packet); return res; } inline int Sendto(char *functionname, int sd, char *packet, int len, unsigned int flags, struct sockaddr *to, int tolen) { struct sockaddr_in *sin = (struct sockaddr_in *) to; int res; int retries = 0; int sleeptime = 0; do { if (TCPIP_DEBUGGING > 1) { printf("trying sendto(%d, packet, %d, 0, %s, %d)", sd, len, inet_ntoa(sin->sin_addr), tolen); } if ((res = sendto(sd, packet, len, flags, to, tolen)) == -1) { error("sendto in %s: sendto(%d, packet, %d, 0, %s, %d) => %s", functionname, sd, len, inet_ntoa(sin->sin_addr), tolen, strerror(errno)); if (retries > 2 || errno == EPERM) return -1; sleeptime = 15 * (1 << (2 * retries)); error("Sleeping %d seconds then retrying", sleeptime); fflush(stderr); sleep(sleeptime); } retries++; } while( res == -1); if (TCPIP_DEBUGGING > 1) printf("successfully sent %d bytes of raw_tcp!\n", res); return res; } /* A simple function I wrote to help in debugging, shows the important fields of a TCP packet*/ int readtcppacket(char *packet, int readdata) { struct ip *ip = (struct ip *) packet; struct tcphdr *tcp = (struct tcphdr *) (packet + sizeof(struct ip)); char *data = packet + sizeof(struct ip) + sizeof(struct tcphdr); int tot_len; struct in_addr bullshit, bullshit2; char sourcehost[16]; int i; int realfrag = 0; if (!packet) { fprintf(stderr, "readtcppacket: packet is NULL!\n"); return -1; } bullshit.s_addr = ip->ip_src.s_addr; bullshit2.s_addr = ip->ip_dst.s_addr; /* this is gay */ realfrag = BSDFIX(ntohs(ip->ip_off) & 8191 /* 2^13 - 1 */); tot_len = BSDFIX(ip->ip_len); strncpy(sourcehost, inet_ntoa(bullshit), 16); i = 4 * (ntohs(ip->ip_hl) + ntohs(tcp->th_off)); if (ip->ip_p== IPPROTO_TCP) { if (realfrag) printf("Packet is fragmented, offset field: %u\n", realfrag); else { printf("TCP packet: %s:%d -> %s:%d (total: %d bytes)\n", sourcehost, ntohs(tcp->th_sport), inet_ntoa(bullshit2), ntohs(tcp->th_dport), tot_len); printf("Flags: "); if (!tcp->th_flags) printf("(none)"); if (tcp->th_flags & TH_RST) printf("RST "); if (tcp->th_flags & TH_SYN) printf("SYN "); if (tcp->th_flags & TH_ACK) printf("ACK "); if (tcp->th_flags & TH_PUSH) printf("PSH "); if (tcp->th_flags & TH_FIN) printf("FIN "); if (tcp->th_flags & TH_URG) printf("URG "); printf("\n"); printf("ttl: %hu ", ip->ip_ttl); if (tcp->th_flags & (TH_SYN | TH_ACK)) printf("Seq: %lu\tAck: %lu\n", (unsigned long) ntohl(tcp->th_seq), (unsigned long) ntohl(tcp->th_ack)); else if (tcp->th_flags & TH_SYN) printf("Seq: %lu\n", (unsigned long) ntohl(tcp->th_seq)); else if (tcp->th_flags & TH_ACK) printf("Ack: %lu\n", (unsigned long) ntohl(tcp->th_ack)); } } if (readdata && i < tot_len) { printf("Data portion:\n"); while(i < tot_len) printf("%2X%c", data[i], (++i%16)? ' ' : '\n'); printf("\n"); } return 0; } /* A simple function I wrote to help in debugging, shows the important fields of a UDP packet*/ int readudppacket(char *packet, int readdata) { struct ip *ip = (struct ip *) packet; udphdr_bsd *udp = (udphdr_bsd *) (packet + sizeof(struct ip)); char *data = packet + sizeof(struct ip) + sizeof(udphdr_bsd); int tot_len; struct in_addr bullshit, bullshit2; char sourcehost[16]; int i; int realfrag = 0; if (!packet) { fprintf(stderr, "readudppacket: packet is NULL!\n"); return -1; } bullshit.s_addr = ip->ip_src.s_addr; bullshit2.s_addr = ip->ip_dst.s_addr; /* this is gay */ realfrag = BSDFIX(ntohs(ip->ip_off) & 8191 /* 2^13 - 1 */); tot_len = BSDFIX(ip->ip_len); strncpy(sourcehost, inet_ntoa(bullshit), 16); i = 4 * (ntohs(ip->ip_hl)) + 8; if (ip->ip_p== IPPROTO_UDP) { if (realfrag) printf("Packet is fragmented, offset field: %u\n", realfrag); else { printf("UDP packet: %s:%d -> %s:%d (total: %d bytes)\n", sourcehost, ntohs(udp->uh_sport), inet_ntoa(bullshit2), ntohs(udp->uh_dport), tot_len); printf("ttl: %hu ", ip->ip_ttl); } } if (readdata && i < tot_len) { printf("Data portion:\n"); while(i < tot_len) printf("%2X%c", data[i], (++i%16)? ' ' : '\n'); printf("\n"); } return 0; } int send_udp_raw( int sd, struct in_addr *source, struct in_addr *victim, unsigned short sport, unsigned short dport, char *data, unsigned short datalen) { char *packet = safe_malloc(sizeof(struct ip) + sizeof(udphdr_bsd) + datalen); struct ip *ip = (struct ip *) packet; udphdr_bsd *udp = (udphdr_bsd *) (packet + sizeof(struct ip)); static int myttl = 0; int res; struct sockaddr_in sock; char myname[MAXHOSTNAMELEN + 1]; struct hostent *myhostent = NULL; int source_malloced = 0; struct pseudo_udp_hdr { struct in_addr source; struct in_addr dest; char zero; char proto; unsigned short length; } *pseudo = (struct pseudo_udp_hdr *) ((char *)udp - 12) ; /* check that required fields are there and not too silly */ if ( !victim || !sport || !dport || sd < 0) { fprintf(stderr, "send_udp_raw: One or more of your parameters suck!\n"); free(packet); return -1; } if (!myttl) myttl = (get_random_uint() % 23) + 37; /* It was a tough decision whether to do this here for every packet or let the calling function deal with it. In the end I grudgingly decided to do it here and potentially waste a couple microseconds... */ sethdrinclude(sd); /* if they didn't give a source address, fill in our first address */ if (!source) { source_malloced = 1; source = safe_malloc(sizeof(struct in_addr)); if (gethostname(myname, MAXHOSTNAMELEN) || !(myhostent = gethostbyname(myname))) fatal("Cannot get hostname! Try using -S or -e \n"); memcpy(source, myhostent->h_addr_list[0], sizeof(struct in_addr)); #if ( TCPIP_DEBUGGING ) printf("We skillfully deduced that your address is %s\n", inet_ntoa(*source)); #endif } /*do we even have to fill out this damn thing? This is a raw packet, after all */ sock.sin_family = AF_INET; sock.sin_port = htons(dport); sock.sin_addr.s_addr = victim->s_addr; bzero((char *) packet, sizeof(struct ip) + sizeof(udphdr_bsd)); udp->uh_sport = htons(sport); udp->uh_dport = htons(dport); udp->uh_ulen = htons(8 + datalen); /* We should probably copy the data over too */ if (data) memcpy(packet + sizeof(struct ip) + sizeof(udphdr_bsd), data, datalen); /* Now the psuedo header for checksuming */ pseudo->source.s_addr = source->s_addr; pseudo->dest.s_addr = victim->s_addr; pseudo->proto = IPPROTO_UDP; pseudo->length = htons(sizeof(udphdr_bsd) + datalen); /* OK, now we should be able to compute a valid checksum */ #if STUPID_SOLARIS_CHECKSUM_BUG udp->uh_sum = sizeof(struct udphdr) + datalen; #else udp->uh_sum = in_cksum((unsigned short *)pseudo, 20 /* pseudo + UDP headers */ + datalen); #endif /* Goodbye, pseudo header! */ bzero(pseudo, 12); /* Now for the ip header */ ip->ip_v = 4; ip->ip_hl = 5; ip->ip_len = BSDFIX(sizeof(struct ip) + sizeof(udphdr_bsd) + datalen); get_random_bytes(&(ip->ip_id), 2); ip->ip_ttl = myttl; ip->ip_p = IPPROTO_UDP; ip->ip_src.s_addr = source->s_addr; ip->ip_dst.s_addr= victim->s_addr; #if HAVE_IP_IP_SUM ip->ip_sum = in_cksum((unsigned short *)ip, sizeof(struct ip)); #endif if (TCPIP_DEBUGGING > 1) { printf("Raw UDP packet creation completed! Here it is:\n"); readudppacket(packet,1); } res = Sendto("send_udp_raw", sd, packet, BSDUFIX(ip->ip_len), 0, (struct sockaddr *)&sock, (int)sizeof(struct sockaddr_in)); if (source_malloced) free(source); free(packet); return res; } int send_ip_raw( int sd, struct in_addr *source, struct in_addr *victim, unsigned char proto, char *data, unsigned short datalen) { char *packet = safe_malloc(sizeof(struct ip) + datalen); struct ip *ip = (struct ip *) packet; static int myttl = 0; int res = -1; struct sockaddr_in sock; char myname[MAXHOSTNAMELEN + 1]; struct hostent *myhostent = NULL; int source_malloced = 0; /* check that required fields are there and not too silly */ if ( !victim || sd < 0) { fprintf(stderr, "send_ip_raw: One or more of your parameters suck!\n"); free(packet); return -1; } if (!myttl) myttl = (get_random_uint() % 23) + 37; /* It was a tough decision whether to do this here for every packet or let the calling function deal with it. In the end I grudgingly decided to do it here and potentially waste a couple microseconds... */ sethdrinclude(sd); /* if they didn't give a source address, fill in our first address */ if (!source) { source_malloced = 1; source = safe_malloc(sizeof(struct in_addr)); if (gethostname(myname, MAXHOSTNAMELEN) || !(myhostent = gethostbyname(myname))) fatal("Cannot get hostname! Try using -S or -e \n"); memcpy(source, myhostent->h_addr_list[0], sizeof(struct in_addr)); #if ( TCPIP_DEBUGGING ) printf("We skillfully deduced that your address is %s\n", inet_ntoa(*source)); #endif } /*do we even have to fill out this damn thing? This is a raw packet, after all */ sock.sin_family = AF_INET; sock.sin_port = 0; sock.sin_addr.s_addr = victim->s_addr; bzero((char *) packet, sizeof(struct ip)); /* Now for the ip header */ ip->ip_v = 4; ip->ip_hl = 5; ip->ip_len = BSDFIX(sizeof(struct ip) + datalen); get_random_bytes(&(ip->ip_id), 2); ip->ip_ttl = myttl; ip->ip_p = proto; ip->ip_src.s_addr = source->s_addr; ip->ip_dst.s_addr= victim->s_addr; #if HAVE_IP_IP_SUM ip->ip_sum = in_cksum((unsigned short *)ip, sizeof(struct ip)); #endif /* We should probably copy the data over too */ if (data) memcpy(packet + sizeof(struct ip), data, datalen); if (TCPIP_DEBUGGING > 1) { printf("Raw IP packet creation completed! Here it is:\n"); hdump(packet, BSDUFIX(ip->ip_len)); } res = Sendto("send_ip_raw", sd, packet, BSDUFIX(ip->ip_len), 0, (struct sockaddr *)&sock, (int)sizeof(struct sockaddr_in)); if (source_malloced) free(source); free(packet); return res; } inline int unblock_socket(int sd) { int options; /*Unblock our socket to prevent recvfrom from blocking forever on certain target ports. */ options = O_NONBLOCK | fcntl(sd, F_GETFL); fcntl(sd, F_SETFL, options); return 1; } /* Get the source address and interface name */ #if 0 char *getsourceif(struct in_addr *src, struct in_addr *dst) { int sd, sd2; unsigned short p1; struct sockaddr_in sock; int socklen = sizeof(struct sockaddr_in); struct sockaddr sa; int sasize = sizeof(struct sockaddr); int ports, res; char buf[65536]; struct timeval tv; unsigned int start; int data_offset, ihl, *intptr; int done = 0; /* Get us some unreserved port numbers */ get_random_bytes(&p1, 2); if (p1 < 5000) p1 += 5000; if (!getuid()) { if ((sd2 = socket(AF_INET, SOCK_PACKET, htons(ETH_P_ALL))) == -1) {perror("Linux Packet Socket troubles"); return 0;} unblock_socket(sd2); if ((sd = socket(AF_INET, SOCK_DGRAM, 0)) == -1) {perror("Socket troubles"); return 0;} sock.sin_family = AF_INET; sock.sin_addr = *dst; sock.sin_port = htons(p1); if (connect(sd, (struct sockaddr *) &sock, sizeof(struct sockaddr_in)) == -1) { perror("UDP connect()"); close(sd); close(sd2); return NULL; } if (getsockname(sd, (SA *)&sock, &socklen) == -1) { perror("getsockname"); close(sd); close(sd2); return NULL; } ports = (ntohs(sock.sin_port) << 16) + p1; #if ( TCPIP_DEBUGGING ) printf("ports is %X\n", ports); #endif if (send(sd, "", 0, 0) == -1) fatal("Could not send UDP packet"); start = time(NULL); do { tv.tv_sec = 2; tv.tv_usec = 0; res = recvfrom(sd2, buf, 65535, 0, &sa, &sasize); if (res < 0) { if (errno != EWOULDBLOCK) perror("recvfrom"); } if (res > 0) { #if ( TCPIP_DEBUGGING ) printf("Got packet!\n"); printf("sa.sa_data: %s\n", sa.sa_data); printf("Hex dump of packet (len %d):\n", res); hdump(buf, res); #endif data_offset = get_link_offset(sa.sa_data); ihl = (*(buf + data_offset) & 0xf) * 4; /* If it is big enough and it is IPv4 */ if (res >= data_offset + ihl + 4 && (*(buf + data_offset) & 0x40)) { intptr = (int *) ((char *) buf + data_offset + ihl); if (*intptr == ntohl(ports)) { intptr = (int *) ((char *) buf + data_offset + 12); #if ( TCPIP_DEBUGGING ) printf("We've found our packet [krad]\n"); #endif memcpy(src, buf + data_offset + 12, 4); close(sd); close(sd2); return strdup(sa.sa_data); } } } } while(!done && time(NULL) - start < 2); close(sd); close(sd2); } return NULL; } #endif /* 0 */ int getsourceip(struct in_addr *src, struct in_addr *dst) { int sd; struct sockaddr_in sock; int socklen = sizeof(struct sockaddr_in); unsigned short p1; get_random_bytes(&p1, 2); if (p1 < 5000) p1 += 5000; if ((sd = socket(AF_INET, SOCK_DGRAM, 0)) == -1) {perror("Socket troubles"); return 0;} sock.sin_family = AF_INET; sock.sin_addr = *dst; sock.sin_port = htons(p1); if (connect(sd, (struct sockaddr *) &sock, sizeof(struct sockaddr_in)) == -1) { perror("UDP connect()"); close(sd); return 0; } bzero(&sock, sizeof(struct sockaddr_in)); if (getsockname(sd, (SA *)&sock, &socklen) == -1) { perror("getsockname"); close(sd); return 0; } src->s_addr = sock.sin_addr.s_addr; close(sd); return 1; /* Calling function responsible for checking validity */ } #if 0 int get_link_offset(char *device) { int sd; struct ifreq ifr; sd = socket(AF_INET, SOCK_DGRAM, 0); memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); #if (defined(SIOCGIFHWADDR) && defined(ARPHRD_ETHER) && defined(ARPHRD_METRICOM) && defined(ARPHRD_SLIP) && defined(ARPHRD_CSLIP) && defined(ARPHRD_SLIP6) && defined(ARPHRD_PPP) && defined(ARPHRD_LOOPBACK) ) if (ioctl(sd, SIOCGIFHWADDR, &ifr) < 0 ) { fatal("Can't obtain link offset. What kind of interface are you using?"); } close(sd); switch (ifr.ifr_hwaddr.sa_family) { case ARPHRD_ETHER: /* These two are standard ethernet */ case ARPHRD_METRICOM: return 14; break; case ARPHRD_SLIP: case ARPHRD_CSLIP: case ARPHRD_SLIP6: case ARPHRD_CSLIP6: case ARPHRD_PPP: return 0; break; case ARPHRD_LOOPBACK: /* Loopback interface (obviously) */ return 14; break; default: fatal("Unknown link layer device: %d", ifr.ifr_hwaddr.sa_family); } #else printf("get_link_offset called even though your host doesn't support it. Assuming Ethernet or Loopback connection (wild guess)\n"); return 14; #endif /* Not reached */ exit(1); } #endif /* Read an IP packet using libpcap . We return the packet and take a pcap descripter and a pointer to the packet length (which we set in the function. If you want a read timeout, specify one in pcap_open_live(). If you want a maximum length returned, you also should specify that in pcap_open_live() */ char *readip_pcap(pcap_t *pd, unsigned int *len) { static int offset = -1; static pcap_t *lastpcap = NULL; struct pcap_pkthdr head; char *p; int datalink; if (!pd) fatal("NULL packet device passed to readip_pcap"); if (!lastpcap || pd != lastpcap) { /* New packet capture device, need to recompute offset */ if ( (datalink = pcap_datalink(pd)) < 0) fatal("Cannot obtain datalink information: %s", pcap_geterr(pd)); switch(datalink) { case DLT_EN10MB: offset = 14; break; case DLT_IEEE802: offset = 22; break; case DLT_NULL: offset = 4; break; case DLT_SLIP: #if (FREEBSD || OPENBSD || NETBSD || BSDI) offset = 16; #else offset = 24; /* Anyone use this??? */ #endif break; case DLT_PPP: #if (FREEBSD || OPENBSD || NETBSD || BSDI) offset = 4; #else #ifdef SOLARIS offset = 8; #else offset = 24; /* Anyone use this? */ #endif /* ifdef solaris */ #endif /* if freebsd || openbsd || netbsd || bsdi */ break; case DLT_RAW: offset = 0; break; default: fatal("Unknown datalink type (%d)", datalink); } } lastpcap = pd; do { p = (char *) pcap_next(pd, &head); if (p) p += offset; else { /* timed out */ *len=0; return NULL; } } while(!p || (*p & 0x40) != 0x40); /* Go until we get IPv4 packet */ *len = head.caplen - offset; return p; } /* Like readip_pcap except we use our own timeout value. This is needed due to a "bug" in libpcap. The Linux pcap_open_live takes a timeout but DOES NOT EVEN LOOK AT IT! */ char *readip_pcap_timed(pcap_t *pd, unsigned int *len, unsigned long timeout /*seconds */) { static int offset = -1; static pcap_t *lastpcap = NULL; struct pcap_pkthdr head; char *p; int datalink; if (!pd) fatal("NULL packet device passed to readip_pcap"); if (!lastpcap || pd != lastpcap) { /* New packet capture device, need to recompute offset */ if ( (datalink = pcap_datalink(pd)) < 0) fatal("Cannot obtain datalink information: %s", pcap_geterr(pd)); switch(datalink) { case DLT_EN10MB: offset = 14; break; case DLT_IEEE802: offset = 22; break; case DLT_NULL: offset = 4; break; case DLT_SLIP: case DLT_PPP: offset = 24; break; case DLT_RAW: offset = 0; break; default: fatal("Unknown datalink type (%d)", datalink); } } lastpcap = pd; signal(SIGALRM, sig_alarm); if (setjmp(jmp_env)) { /* We've timed out */ *len = 0; return NULL; } jumpok = 1; alarm(timeout); do { p = (char *) pcap_next(pd, &head); if (p) p += offset; } while(!p || (*p & 0x40) != 0x40); /* Go until we get IPv4 packet */ alarm(0); jumpok = 0; signal(SIGALRM, SIG_DFL); *len = head.caplen - offset; return p; } int ipaddr2devname( char *dev, struct in_addr *addr ) { struct interface_info *mydevs; int numdevs; int i; mydevs = getinterfaces(&numdevs); if (!mydevs) return -1; for(i=0; i < numdevs; i++) { if (addr->s_addr == mydevs[i].addr.s_addr) { strcpy(dev, mydevs[i].name); return 0; } } return -1; } int devname2ipaddr(char *dev, struct in_addr *addr) { struct interface_info *mydevs; int numdevs; int i; mydevs = getinterfaces(&numdevs); if (!mydevs) return -1; for(i=0; i < numdevs; i++) { if (!strcmp(dev, mydevs[i].name)) { memcpy(addr, (char *) &mydevs[i].addr, sizeof(struct in_addr)); return 0; } } return -1; } struct interface_info *getinterfaces(int *howmany) { static int initialized = 0; static struct interface_info mydevs[48]; static int numinterfaces = 0; int sd; int len; char *p; char buf[10240]; struct ifconf ifc; struct ifreq *ifr; struct sockaddr_in *sin; if (!initialized) { initialized = 1; /* Dummy socket for ioctl */ sd = socket(AF_INET, SOCK_DGRAM, 0); if (sd < 0) pfatal("socket in getinterfaces"); ifc.ifc_len = sizeof(buf); ifc.ifc_buf = buf; if (ioctl(sd, SIOCGIFCONF, &ifc) < 0) { fatal("Failed to determine your configured interfaces!\n"); } close(sd); ifr = (struct ifreq *) buf; if (ifc.ifc_len == 0) fatal("getinterfaces: SIOCGIFCONF claims you have no network interfaces!\n"); #if HAVE_SOCKADDR_SA_LEN /* len = MAX(sizeof(struct sockaddr), ifr->ifr_addr.sa_len);*/ len = ifr->ifr_addr.sa_len; #else len = sizeof(SA); #endif for(; ifr && *((char *)ifr) && ((char *)ifr) < buf + ifc.ifc_len; ((*(char **)&ifr) += sizeof(ifr->ifr_name) + len )) { sin = (struct sockaddr_in *) &ifr->ifr_addr; memcpy(&(mydevs[numinterfaces].addr), (char *) &(sin->sin_addr), sizeof(struct in_addr)); /* In case it is a stinkin' alias */ if ((p = strchr(ifr->ifr_name, ':'))) *p = '\0'; strncpy(mydevs[numinterfaces].name, ifr->ifr_name, 63); mydevs[numinterfaces].name[63] = '\0'; numinterfaces++; if (numinterfaces == 47) { error("My god! You seem to have WAY too many interfaces! Things may not work right\n"); break; } #if HAVE_SOCKADDR_SA_LEN /* len = MAX(sizeof(struct sockaddr), ifr->ifr_addr.sa_len);*/ len = ifr->ifr_addr.sa_len; #endif mydevs[numinterfaces].name[0] = '\0'; } } if (howmany) *howmany = numinterfaces; return mydevs; } /* An awesome function to determine what interface a packet to a given destination should be routed through. It returns NULL if no appropriate interface is found, oterwise it returns the device name and fills in the source parameter. Some of the stuff is from Stevens' Unix Network Programming V2. He had an easier suggestion for doing this (in the book), but it isn't portable :( */ char *routethrough(struct in_addr *dest, struct in_addr *source) { static int initialized = 0; int i; struct in_addr addy; static enum { procroutetechnique, connectsockettechnique, guesstechnique } technique = procroutetechnique; char buf[10240]; struct interface_info *mydevs; static struct myroute { struct interface_info *dev; unsigned long mask; unsigned long dest; } myroutes[128]; int numinterfaces = 0; char *p, *endptr; char iface[64]; static int numroutes = 0; FILE *routez; if (!dest) fatal("ipaddr2devname passed a NULL dest address"); if (!initialized) { /* Dummy socket for ioctl */ initialized = 1; mydevs = getinterfaces(&numinterfaces); /* Now we must go through several techniques to determine info */ routez = fopen("/proc/net/route", "r"); if (routez) { /* OK, linux style /proc/net/route ... we can handle this ... */ /* Now that we've got the interfaces, we g0 after the r0ut3Z */ fgets(buf, sizeof(buf), routez); /* Kill the first line */ while(fgets(buf,sizeof(buf), routez)) { p = strtok(buf, " \t\n"); if (!p) { error("Could not find interface in /proc/net/route line"); continue; } Strncpy(iface, p, sizeof(iface)); if ((p = strchr(iface, ':'))) { *p = '\0'; /* To support IP aliasing */ } p = strtok(NULL, " \t\n"); endptr = NULL; myroutes[numroutes].dest = strtol(p, &endptr, 16); if (!endptr || *endptr) { error("Failed to determine Destination from /proc/net/route"); continue; } for(i=0; i < 6; i++) { p = strtok(NULL, " \t\n"); if (!p) break; } if (!p) { error("Failed to find field %d in /proc/net/route", i + 2); continue; } endptr = NULL; myroutes[numroutes].mask = strtol(p, &endptr, 16); if (!endptr || *endptr) { error("Failed to determine mask from /proc/net/route"); continue; } #if TCPIP_DEBUGGING printf("#%d: for dev %s, The dest is %lX and the mask is %lX\n", numroutes, iface, myroutes[numroutes].dest, myroutes[numroutes].mask); #endif for(i=0; i < numinterfaces; i++) if (!strcmp(iface, mydevs[i].name)) { myroutes[numroutes].dev = &mydevs[i]; break; } if (i == numinterfaces) fatal("Failed to find interface %s mentioned in /proc/net/route\n", iface); numroutes++; if (numroutes == 128) fatal("My god! You seem to have WAY to many routes!\n"); } fclose(routez); } else { technique = connectsockettechnique; } } else { mydevs = getinterfaces(&numinterfaces); } /* WHEW, that takes care of initializing, now we have the easy job of finding which route matches */ if (islocalhost(dest)) { if (source) source->s_addr = htonl(0x7F000001); /* Now we find the localhost interface name, assuming 127.0.0.1 is localhost (it damn well better be!)... */ for(i=0; i < numinterfaces; i++) { if (mydevs[i].addr.s_addr == htonl(0x7F000001)) { return mydevs[i].name; } } return NULL; } if (technique == procroutetechnique) { for(i=0; i < numroutes; i++) { if ((dest->s_addr & myroutes[i].mask) == myroutes[i].dest) { if (source) { source->s_addr = myroutes[i].dev->addr.s_addr; } return myroutes[i].dev->name; } } } else if (technique == connectsockettechnique) { if (!getsourceip(&addy, dest)) return NULL; if (!addy.s_addr) { /* Solaris 2.4 */ struct hostent *myhostent = NULL; char myname[MAXHOSTNAMELEN + 1]; if (gethostname(myname, MAXHOSTNAMELEN) || !(myhostent = gethostbyname(myname))) fatal("Cannot get hostname! Try using -S or -e \n"); memcpy(&(addy.s_addr), myhostent->h_addr_list[0], sizeof(struct in_addr)); #if ( TCPIP_DEBUGGING ) printf("We skillfully deduced that your address is %s\n", inet_ntoa(*source)); #endif } /* Now we insure this claimed address is a real interface ... */ for(i=0; i < numinterfaces; i++) if (mydevs[i].addr.s_addr == addy.s_addr) { if (source) { source->s_addr = addy.s_addr; } return mydevs[i].name; } return NULL; } else fatal("I know sendmail technique ... I know rdist technique ... but I don't know what the hell kindof technique you are attempting!!!"); return NULL; } nmap-2.08/error.c100644 764 764 634 6603505602 12737 0ustar fyodorfyodor#include "error.h" void fatal(char *fmt, ...) { va_list ap; va_start(ap, fmt); fflush(stdout); vfprintf(stderr, fmt, ap); fprintf(stderr, "\nQUITTING!\n"); va_end(ap); exit(1); } void error(char *fmt, ...) { va_list ap; va_start(ap, fmt); fflush(stdout); vfprintf(stderr, fmt, ap); fprintf(stderr, "\n"); va_end(ap); return; } void pfatal(char *err) { perror(err); fprintf(stderr, "\n"); exit(1); } nmap-2.08/utils.c100600 764 764 12336 6657700417 13012 0ustar fyodorfyodor#include "utils.h" void *safe_malloc(int size) { void *mymem; fflush(stdout); if (size < 0) fatal("Tried to malloc negative amount of memory!!!"); mymem = malloc(size); if (mymem == NULL) fatal("Malloc Failed! Probably out of space."); fflush(stdout); return mymem; } /* Hex dump */ void hdump(unsigned char *packet, int len) { unsigned int i=0, j=0; printf("Here it is:\n"); for(i=0; i < len; i++){ j = (unsigned) (packet[i]); printf("%-2X ", j); if (!((i+1)%16)) printf("\n"); else if (!((i+1)%4)) printf(" "); } printf("\n"); } /* A better version of hdump, from Lamont Granquist. Modified slightly by Fyodor (fyodor@DHP.com) */ void lamont_hdump(unsigned char *bp, int length) { /* stolen from tcpdump, then kludged extensively */ static const char asciify[] = "................................ !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~................................................................................................................................."; register const u_short *sp; register const u_char *ap; register u_int i, j; register int nshorts, nshorts2; register int padding; printf("\n\t"); padding = 0; sp = (u_short *)bp; ap = (u_char *)bp; nshorts = (u_int) length / sizeof(u_short); nshorts2 = (u_int) length / sizeof(u_short); i = 0; j = 0; while(1) { while (--nshorts >= 0) { printf(" %04x", ntohs(*sp)); sp++; if ((++i % 8) == 0) break; } if (nshorts < 0) { if ((length & 1) && (((i-1) % 8) != 0)) { printf(" %02x ", *(u_char *)sp); padding++; } nshorts = (8 - (nshorts2 - nshorts)); while(--nshorts >= 0) { printf(" "); } if (!padding) printf(" "); } printf(" "); while (--nshorts2 >= 0) { printf("%c%c", asciify[*ap], asciify[*(ap+1)]); ap += 2; if ((++j % 8) == 0) { printf("\n\t"); break; } } if (nshorts2 < 0) { if ((length & 1) && (((j-1) % 8) != 0)) { printf("%c", asciify[*ap]); } break; } } if ((length & 1) && (((i-1) % 8) == 0)) { printf(" %02x", *(u_char *)sp); printf(" %c", asciify[*ap]); } printf("\n"); } char *strcasestr(char *haystack, char *pneedle) { char buf[512]; unsigned int needlelen; char *needle, *p, *q, *foundto; /* Should crash if !pneedle -- this is OK */ if (!*pneedle) return haystack; if (!haystack) return NULL; needlelen = strlen(pneedle); if (needlelen >= sizeof(buf)) { needle = (char *) malloc(needlelen + 1); } else needle = buf; p = pneedle; q = needle; while((*q++ = tolower(*p++))) ; p = haystack - 1; foundto = needle; while(*++p) { if(tolower(*p) == *foundto) { if(!*++foundto) { /* Yeah, we found it */ if (needlelen >= sizeof(buf)) free(needle); return p - needlelen + 1; } } else foundto = needle; } if (needlelen >= sizeof(buf)) free(needle); return NULL; } void Strncpy(char *dest, const char *src, size_t n) { strncpy(dest, src, n); dest[n] = '\0'; } #ifndef HAVE_USLEEP #ifdef HAVE_NANOSLEEP void usleep(unsigned long usec) { struct timespec ts; ts.tv_sec = usec / 1000000; ts.tv_nsec = (usec % 1000000) * 1000; nanosleep(&ts, NULL); } #endif #endif #ifndef HAVE_STRERROR char *strerror(int errnum) { static char buf[1024]; sprintf(buf, "your system is too old for strerror of errno %d\n", errnum); return buf; } #endif int get_random_int() { int i; get_random_bytes(&i, sizeof(int)); return i; } unsigned int get_random_uint() { unsigned int i; get_random_bytes(&i, sizeof(unsigned int)); return i; } int get_random_bytes(void *buf, int numbytes) { static char bytebuf[2048]; static char badrandomwarning = 0; static int bytesleft = 0; int res; int tmp; struct timeval tv; FILE *fp = NULL; int i; short *iptr; if (numbytes < 0 || numbytes > 0xFFFF) return -1; if (bytesleft == 0) { fp = fopen("/dev/urandom", "r"); if (!fp) fp = fopen("/dev/random", "r"); if (fp) { res = fread(bytebuf, 1, sizeof(bytebuf), fp); if (res != sizeof(bytebuf)) { error("Failed to read from /dev/urandom or /dev/random"); fclose(fp); fp = NULL; } bytesleft = sizeof(bytebuf); } if (!fp) { if (badrandomwarning == 0) { badrandomwarning++; error("WARNING: your system apparrently does not offer /dev/urandom or /dev/random. Reverting to less secure version."); } /* Seed our random generator */ gettimeofday(&tv, NULL); srand((tv.tv_sec ^ tv.tv_usec) ^ getpid()); for(i=0; i < sizeof(bytebuf) / sizeof(short); i++) { iptr = (short *) ((char *)bytebuf + i * sizeof(short)); *iptr = rand(); } bytesleft = (sizeof(bytebuf) / sizeof(short)) * sizeof(short); /* ^^^^^^^^^^^^^^^not as meaningless as it looks */ } else fclose(fp); } if (numbytes <= bytesleft) { /* we can cover it */ memcpy(buf, bytebuf + (sizeof(bytebuf) - bytesleft), numbytes); bytesleft -= numbytes; return 0; } /* We don't have enough */ memcpy(buf, bytebuf + (sizeof(bytebuf) - bytesleft), bytesleft); tmp = bytesleft; bytesleft = 0; return get_random_bytes((char *)buf + tmp, numbytes - tmp); } nmap-2.08/osscan.c100600 764 764 106412 6662340573 13156 0ustar fyodorfyodor#include "osscan.h" extern struct ops o; FingerPrint *get_fingerprint(struct hoststruct *target, struct seq_info *si) { FingerPrint *FP = NULL, *FPtmp = NULL; FingerPrint *FPtests[9]; struct AVal *seq_AVs; int last; struct ip *ip; struct tcphdr *tcp; struct icmp *icmp; struct timeval t1,t2; int i; struct hostent *myhostent = NULL; unsigned int localnet, netmask; pcap_t *pd; char myname[513]; int rawsd; int tries = 0; int newcatches; int current_port = 0; int testsleft; int testno; int timeout; unsigned long sequence_base; unsigned int openport; int bytes; unsigned int closedport; struct port *tport; char *p; int decoy; struct bpf_program fcode; char err0r[PCAP_ERRBUF_SIZE]; char filter[512]; double seq_inc_sum = 0; unsigned long seq_avg_inc = 0; struct udpprobeinfo *upi = NULL; unsigned long seq_gcd = 1; unsigned long seq_diffs[NUM_SEQ_SAMPLES]; int ossofttimeout, oshardtimeout; /* Init our fingerprint tests to each be NULL */ bzero(FPtests, sizeof(FPtests)); get_random_bytes(&sequence_base, sizeof(unsigned long)); /* Init our raw socket */ if ((rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 ) pfatal("socket trobles in get_fingerprint"); unblock_socket(rawsd); broadcast_socket(rawsd); /* Do we have a correct source address? */ if (!target->source_ip.s_addr) { if (gethostname(myname, MAXHOSTNAMELEN) != 0 && !((myhostent = gethostbyname(myname)))) fatal("Cannot get hostname! Try using -S or -e \n"); memcpy(&target->source_ip, myhostent->h_addr_list[0], sizeof(struct in_addr)); if (o.debugging || o.verbose) printf("We skillfully deduced that your address is %s\n", inet_ntoa(target->source_ip)); } /* Now for the pcap opening nonsense ... */ /* Note that the snaplen is 152 = 64 byte max IPhdr + 24 byte max link_layer * header + 64 byte max TCP header. Had to up it for UDP test */ ossofttimeout = MAX(200000, target->to.timeout); oshardtimeout = MAX(500000, 5 * target->to.timeout); if (!(pd = pcap_open_live(target->device, 650, (o.spoofsource)? 1 : 0, (ossofttimeout + 500)/ 1000, err0r))) fatal("pcap_open_live: %s", err0r); if (o.debugging) printf("Wait time is %d\n", (ossofttimeout +500)/1000); if (pcap_lookupnet(target->device, &localnet, &netmask, err0r) < 0) fatal("Failed to lookup device subnet/netmask: %s", err0r); p = strdup(inet_ntoa(target->host)); sprintf(filter, "(icmp and dst host %s) or (tcp and src host %s and dst host %s)", inet_ntoa(target->source_ip), p, inet_ntoa(target->source_ip)); free(p); /* Due to apparent bug in libpcap */ if (islocalhost(&(target->host))) filter[0] = '\0'; if (o.debugging) printf("Packet capture filter: %s\n", filter); if (pcap_compile(pd, &fcode, filter, 0, netmask) < 0) fatal("Error compiling our pcap filter: %s\n", pcap_geterr(pd)); if (pcap_setfilter(pd, &fcode) < 0 ) fatal("Failed to set the pcap filter: %s\n", pcap_geterr(pd)); /* Lets find an open port to used */ openport = -1; for(tport = target->ports; tport; tport = tport->next) { if (tport->state == PORT_OPEN && tport->proto == IPPROTO_TCP && tport->confidence == CONF_HIGH) { openport = tport->portno; break; } else if (tport->state == PORT_OPEN && tport->proto == IPPROTO_TCP) { openport = tport->portno; } } closedport = (get_random_uint() % 14781) + 30000; if (o.verbose && openport != -1) printf("For OSScan assuming that port %d is open and port %d is closed and neither are firewalled\n", openport, closedport); current_port = o.magic_port + NUM_SEQ_SAMPLES +1; /* Now lets do the NULL packet technique */ testsleft = (openport == -1)? 4 : 7; FPtmp = NULL; /* bzero(FPtests, sizeof(FPtests));*/ tries = 0; do { newcatches = 0; if (openport != -1) { /* Test 1 */ if (!FPtests[1]) for(decoy=0; decoy < o.numdecoys; decoy++) { send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, current_port, openport, sequence_base, 0,TH_BOGUS|TH_SYN, 0,"\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); } /* Test 2 */ if (!FPtests[2]) for(decoy=0; decoy < o.numdecoys; decoy++) { send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, current_port +1, openport, sequence_base, 0,0, 0,"\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); } /* Test 3 */ if (!FPtests[3]) for(decoy=0; decoy < o.numdecoys; decoy++) { send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, current_port +2, openport, sequence_base, 0,TH_SYN|TH_FIN|TH_URG|TH_PUSH, 0,"\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); } /* Test 4 */ if (!FPtests[4]) for(decoy=0; decoy < o.numdecoys; decoy++) { send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, current_port +3, openport, sequence_base, 0,TH_ACK, 0,"\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); } } /* Test 5 */ if (!FPtests[5]) for(decoy=0; decoy < o.numdecoys; decoy++) { send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, current_port +4, closedport, sequence_base, 0,TH_SYN, 0,"\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); } /* Test 6 */ if (!FPtests[6]) for(decoy=0; decoy < o.numdecoys; decoy++) { send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, current_port +5, closedport, sequence_base, 0,TH_ACK, 0,"\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); } /* Test 7 */ if (!FPtests[7]) for(decoy=0; decoy < o.numdecoys; decoy++) { send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, current_port +6, closedport, sequence_base, 0,TH_FIN|TH_PUSH|TH_URG, 0,"\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); } if (!FPtests[8]) { upi = send_closedudp_probe(rawsd, &target->host, o.magic_port, closedport); } gettimeofday(&t1, NULL); timeout = 0; while(( ip = (struct ip*) readip_pcap(pd, &bytes)) && !timeout) { gettimeofday(&t2, NULL); if (TIMEVAL_SUBTRACT(t2,t1) > oshardtimeout) { timeout = 1; } if (bytes < (4 * ip->ip_hl) + 4) continue; if (ip->ip_p == IPPROTO_TCP) { tcp = ((struct tcphdr *) (((char *) ip) + 4 * ip->ip_hl)); testno = ntohs(tcp->th_dport) - current_port + 1; if (testno <= 0 || testno > 7) continue; if (o.debugging > 1) printf("Got packet for test number %d\n", testno); if (FPtests[testno]) continue; testsleft--; newcatches++; FPtests[testno] = safe_malloc(sizeof(FingerPrint)); bzero(FPtests[testno], sizeof(FingerPrint)); FPtests[testno]->results = fingerprint_iptcppacket(ip, 265, sequence_base); FPtests[testno]->name = (testno == 1)? "T1" : (testno == 2)? "T2" : (testno == 3)? "T3" : (testno == 4)? "T4" : (testno == 5)? "T5" : (testno == 6)? "T6" : (testno == 7)? "T7" : "PU"; } else if (ip->ip_p == IPPROTO_ICMP) { icmp = ((struct icmp *) (((char *) ip) + 4 * ip->ip_hl)); /* It must be a destination port unreachable */ if (icmp->icmp_type != 3 || icmp->icmp_code != 3) { /* This ain't no stinking port unreachable! */ continue; } if (bytes < ntohs(ip->ip_len)) { error("We only got %d bytes out of %d on our ICMP port unreachable packet, skipping", bytes, ntohs(ip->ip_len)); continue; } if (FPtests[8]) continue; FPtests[8] = safe_malloc(sizeof(FingerPrint)); bzero(FPtests[8], sizeof(FingerPrint)); FPtests[8]->results = fingerprint_portunreach(ip, upi); if (FPtests[8]->results) { FPtests[8]->name = "PU"; testsleft--; newcatches++; } else { free(FPtests[8]); FPtests[8] = NULL; } } } } while ( testsleft > 0 && (tries++ < 5 && (newcatches || tries == 1))); /* First we send our initial NUM_SEQ_SAMPLES SYN packets */ if (openport != -1) { for(i=1; i <= NUM_SEQ_SAMPLES; i++) { for(decoy=0; decoy < o.numdecoys; decoy++) { send_tcp_raw(rawsd, &o.decoys[decoy], &target->host, o.magic_port+i, openport, sequence_base + i, 0, TH_SYN, 0 , NULL, 0, NULL, 0); usleep( 5000 + target->to.srtt); } /* usleep(25000);*/ } /* Now we collect the replies */ si->responses = 0; timeout = 0; gettimeofday(&t1,NULL); while(si->responses < NUM_SEQ_SAMPLES && !timeout) { ip = (struct ip*) readip_pcap(pd, &bytes); gettimeofday(&t2, NULL); if (!ip) { if (TIMEVAL_SUBTRACT(t2,t1) > ossofttimeout) timeout = 1; continue; } else if (TIMEVAL_SUBTRACT(t2,t1) > oshardtimeout) { timeout = 1; } if (bytes < (4 * ip->ip_hl) + 4) continue; if (ip->ip_p == IPPROTO_TCP) { tcp = ((struct tcphdr *) (((char *) ip) + 4 * ip->ip_hl)); if (ntohs(tcp->th_dport) < o.magic_port || ntohs(tcp->th_dport) - o.magic_port > NUM_SEQ_SAMPLES || ntohs(tcp->th_sport) != openport) { continue; } if ((tcp->th_flags & TH_RST)) { /*readtcppacket((char *) ip, ntohs(ip->ip_len));*/ if (si->responses == 0) { printf("WARNING: RST from port %d -- is this port really open?\n", openport); /* We used to quit in this case, but left-overs from a SYN scan or lame-ass TCP wrappers can cause this! */ } continue; } else if ((tcp->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) { /*readtcppacket((char *)ip, ntohs(ip->ip_len));*/ si->seqs[si->responses++] = ntohl(tcp->th_seq); if (si->responses > 1) { seq_diffs[si->responses-2] = MOD_DIFF(ntohl(tcp->th_seq), si->seqs[si->responses-2]); } } } } if (si->responses >= 4) { seq_gcd = get_gcd_n_ulong(si->responses -1, seq_diffs); /* printf("The GCD is %lu\n", seq_gcd);*/ if (seq_gcd) { for(i=0; i < si->responses - 1; i++) seq_diffs[i] /= seq_gcd; for(i=0; i < si->responses - 1; i++) { if (MOD_DIFF(si->seqs[i+1],si->seqs[i]) > 50000000) { si->class = SEQ_TR; si->index = 9999999; /* printf("Target is a TR box\n");*/ break; } seq_avg_inc += seq_diffs[i]; } } if (seq_gcd == 0) { si->class = SEQ_CONSTANT; si->index = 0; } else if (seq_gcd % 64000 == 0) { si->class = SEQ_64K; /* printf("Target is a 64K box\n");*/ si->index = 1; } else if (seq_gcd % 800 == 0) { si->class = SEQ_i800; /* printf("Target is a i800 box\n");*/ si->index = 10; } else if (si->class == SEQ_UNKNOWN) { seq_avg_inc = (0.5) + seq_avg_inc / (si->responses - 1); /* printf("seq_avg_inc=%lu\n", seq_avg_inc);*/ for(i=0; i < si->responses -1; i++) { /* printf("The difference is %lu\n", seq_diffs[i]); printf("Adding %lu^2=%e", MOD_DIFF(seq_diffs[i], seq_avg_inc), pow(MOD_DIFF(seq_diffs[i], seq_avg_inc), 2));*/ seq_inc_sum += pow(MOD_DIFF(seq_diffs[i], seq_avg_inc), 2); } /* printf("The sequence sum is %e\n", seq_inc_sum);*/ seq_inc_sum /= (si->responses - 1); si->index = (unsigned long) (0.5 + pow(seq_inc_sum, 0.5)); /* printf("The sequence index is %d\n", si->index);*/ if (si->index < 75) { si->class = SEQ_TD; /* printf("Target is a Micro$oft style time dependant box\n");*/ } else { si->class = SEQ_RI; /* printf("Target is a random incremental box\n");*/ } } FPtests[0] = safe_malloc(sizeof(FingerPrint)); bzero(FPtests[0], sizeof(FingerPrint)); FPtests[0]->name = "TSeq"; seq_AVs = safe_malloc(sizeof(struct AVal) * 3); bzero(seq_AVs, sizeof(struct AVal) * 3); FPtests[0]->results = seq_AVs; seq_AVs[0].attribute = "Class"; switch(si->class) { case SEQ_CONSTANT: strcpy(seq_AVs[0].value, "C"); seq_AVs[0].next = &seq_AVs[1]; seq_AVs[1].attribute= "Val"; sprintf(seq_AVs[1].value, "%lX", si->seqs[0]); break; case SEQ_64K: strcpy(seq_AVs[0].value, "64K"); break; case SEQ_i800: strcpy(seq_AVs[0].value, "i800"); break; case SEQ_TD: strcpy(seq_AVs[0].value, "TD"); seq_AVs[0].next = &seq_AVs[1]; seq_AVs[1].attribute= "gcd"; sprintf(seq_AVs[1].value, "%lX", seq_gcd); seq_AVs[1].next = &seq_AVs[2]; seq_AVs[2].attribute="SI"; sprintf(seq_AVs[2].value, "%X", si->index); break; case SEQ_RI: strcpy(seq_AVs[0].value, "RI"); seq_AVs[0].next = &seq_AVs[1]; seq_AVs[1].attribute= "gcd"; sprintf(seq_AVs[1].value, "%lX", seq_gcd); seq_AVs[1].next = &seq_AVs[2]; seq_AVs[2].attribute="SI"; sprintf(seq_AVs[2].value, "%X", si->index); break; case SEQ_TR: strcpy(seq_AVs[0].value, "TR"); break; } } else { nmap_log("Insufficient responses for TCP sequencing (%d), OS detection will be MUCH less reliable\n", si->responses); } } else { nmap_log("Warning: No ports found open on this machine, OS detection will be MUCH less reliable\n"); } for(i=0; i < 9; i++) { if (i > 0 && !FPtests[i] && ((openport != -1) || i > 4)) { /* We create a Resp (response) attribute with value of N (no) because it is important here to note whether responses were or were not received */ FPtests[i] = safe_malloc(sizeof(FingerPrint)); bzero(FPtests[i], sizeof(FingerPrint)); seq_AVs = safe_malloc(sizeof(struct AVal)); seq_AVs->attribute = "Resp"; strcpy(seq_AVs->value, "N"); seq_AVs->next = NULL; FPtests[i]->results = seq_AVs; FPtests[i]->name = (i == 1)? "T1" : (i == 2)? "T2" : (i == 3)? "T3" : (i == 4)? "T4" : (i == 5)? "T5" : (i == 6)? "T6" : (i == 7)? "T7" : "PU"; } } last = -1; FP = NULL; for(i=0; i < 9 ; i++) { if (!FPtests[i]) continue; if (!FP) FP = FPtests[i]; if (last > -1) { FPtests[last]->next = FPtests[i]; } last = i; } if (last) FPtests[last]->next = NULL; close(rawsd); pcap_close(pd); return FP; } struct AVal *fingerprint_iptcppacket(struct ip *ip, int mss, unsigned long syn) { struct AVal *AVs; int length; int opcode; char *p,*q; struct tcphdr *tcp = ((struct tcphdr *) (((char *) ip) + 4 * ip->ip_hl)); AVs = malloc(6 * sizeof(struct AVal)); /* Link them together */ AVs[0].next = &AVs[1]; AVs[1].next = &AVs[2]; AVs[2].next = &AVs[3]; AVs[3].next = &AVs[4]; AVs[4].next = &AVs[5]; AVs[5].next = NULL; /* First we give the "response" flag to say we did actually receive a packet -- this way we won't match a template with Resp=N */ AVs[0].attribute = "Resp"; strcpy(AVs[0].value, "Y"); /* Next we check whether the Don't Fragment bit is set */ AVs[1].attribute = "DF"; if(ntohs(ip->ip_off) & 0x4000) { strcpy(AVs[1].value,"Y"); } else strcpy(AVs[1].value, "N"); /* Now we do the TCP Window size */ AVs[2].attribute = "W"; sprintf(AVs[2].value, "%hX", ntohs(tcp->th_win)); /* Time for the ACK, the codes are: S = same as syn S++ = syn + 1 O = other */ AVs[3].attribute = "ACK"; if (ntohl(tcp->th_ack) == syn + 1) strcpy(AVs[3].value, "S++"); else if (ntohl(tcp->th_ack) == syn) strcpy(AVs[3].value, "S"); else strcpy(AVs[3].value, "O"); /* Now time for the flags ... they must be in this order: B = Bogus (64, not a real TCP flag) U = Urgent A = Acknowledgement P = Push R = Reset S = Synchronize F = Final */ AVs[4].attribute = "Flags"; p = AVs[4].value; if (tcp->th_flags & TH_BOG) *p++ = 'B'; if (tcp->th_flags & TH_URG) *p++ = 'U'; if (tcp->th_flags & TH_ACK) *p++ = 'A'; if (tcp->th_flags & TH_PUSH) *p++ = 'P'; if (tcp->th_flags & TH_RST) *p++ = 'R'; if (tcp->th_flags & TH_SYN) *p++ = 'S'; if (tcp->th_flags & TH_FIN) *p++ = 'F'; *p++ = '\0'; /* Now for the TCP options ... */ AVs[5].attribute = "Ops"; p = AVs[5].value; /* Partly swiped from /usr/src/linux/net/ipv4/tcp_input.c in Linux kernel */ length = (tcp->th_off * 4) - sizeof(struct tcphdr); q = ((char *)tcp) + sizeof(struct tcphdr); while(length > 0) { opcode=*q++; length--; if (!opcode) { *p++ = 'L'; /* End of List */ break; } else if (opcode == 1) { *p++ = 'N'; /* No Op */ } else if (opcode == 2) { *p++ = 'M'; /* MSS */ q++; if(ntohs(*((unsigned short *) q)) == mss) *p++ = 'E'; /* Echoed */ q += 2; length -= 3; } else if (opcode == 3) { /* Window Scale */ *p++ = 'W'; q += 2; length -= 2; } else if (opcode == 8) { /* Timestamp */ *p++ = 'T'; q += 9; length -= 9; } } *p++ = '\0'; return AVs; } FingerPrint **match_fingerprint(FingerPrint *FP, int *matches_found) { static FingerPrint *matches[15]; int max_matches = 14; FingerPrint *current_os; FingerPrint *current_test; struct AVal *tst; int match = 1; int i,j; *matches_found = 0; if (!FP) { matches[0] = NULL; return matches; } for(i = 0; o.reference_FPs[i]; i++) { current_os = o.reference_FPs[i]; match = 1; for(current_test = current_os; current_test; current_test = current_test->next) { tst = gettestbyname(FP, current_test->name); if (tst) { match = AVal_match(current_test->results, tst); if (!match) break; } } if (match) { /* Yeah, we found a match! */ if ((*matches_found) >= max_matches -1) { matches[0] = NULL; *matches_found = ETOOMANYMATCHES; return matches; } /* Lets make sure we haven't found a match with this exact name before */ for(j=0; j < *matches_found; j++) { if (strcmp(current_os->OS_name, matches[j]->OS_name) == 0) break; } if (j == *matches_found) matches[(*matches_found)++] = current_os; } } matches[(*matches_found)] = NULL; return matches; } struct AVal *gettestbyname(FingerPrint *FP, char *name) { if (!FP) return NULL; do { if (!strcmp(FP->name, name)) return FP->results; FP = FP->next; } while(FP); return NULL; } struct AVal *getattrbyname(struct AVal *AV, char *name) { if (!AV) return NULL; do { if (!strcmp(AV->attribute, name)) return AV; AV = AV->next; } while(AV); return NULL; } int AVal_match(struct AVal *reference, struct AVal *fprint) { struct AVal *current_ref; struct AVal *current_fp; unsigned long number; unsigned long val; char *p, *q; /* OHHHH YEEEAAAAAHHHH!#!@#$!% */ char valcpy[512]; char *endptr; int andexp, orexp, expchar, numtrue; for(current_ref = reference; current_ref; current_ref = current_ref->next) { current_fp = getattrbyname(fprint, current_ref->attribute); if (!current_fp) continue; /* OK, we compare an attribute value in cinrrent_fp->value to a potentially large expression in current_ref->value. The syntax uses < (less than), > (greather than), + (non-zero), | (or), and & (and) No parenthesis are allowed and an expression cannot have | AND & */ numtrue = andexp = orexp = 0; strcpy(valcpy, current_ref->value); p = valcpy; if (strchr(current_ref->value, '|')) { orexp = 1; expchar = '|'; } else { andexp = 1; expchar = '&'; } do { q = strchr(p, expchar); if (q) *q = '\0'; if (!strcmp(p, "+")) { if (!*current_fp->value) { if (andexp) return 0; } else { val = strtol(current_fp->value, &endptr, 16); if (val == 0 || *endptr) { if (andexp) return 0; } else { numtrue++; if (orexp) break; } } } else if (*p == '<' && isxdigit((int) p[1])) { if (!*current_fp->value) { if (andexp) return 0; } number = strtol(p + 1, &endptr, 16); val = strtol(current_fp->value, &endptr, 16); if (val >= number || *endptr) { if (andexp) return 0; } else { numtrue++; if (orexp) break; } } else if (*p == '>' && isxdigit((int) p[1])) { if (!*current_fp->value) { if (andexp) return 0; } number = strtol(p + 1, &endptr, 16); val = strtol(current_fp->value, &endptr, 16); if (val <= number || *endptr) { if (andexp) return 0; } else { numtrue++; if (orexp) break; } } else { if (strcmp(p, current_fp->value)) { if (andexp) return 0; } else { numtrue++; if (orexp) break; } } if (q) p = q + 1; } while(q); if (numtrue == 0) return 0; /* Whew, we made it past one Attribute alive , on to the next! */ } return 1; } void freeFingerPrint(FingerPrint *FP) { FingerPrint *currentFP; FingerPrint *nextFP; if (!FP) return; for(currentFP = FP; currentFP; currentFP = nextFP) { nextFP = currentFP->next; if (currentFP->results) free(currentFP->results); free(currentFP); } return; } int os_scan(struct hoststruct *target) { FingerPrint **FP_matches[3]; int FP_nummatches[3]; struct seq_info si[3]; int try; int i; bzero(si, sizeof(si)); for(try=0; try < 3; try++) { target->FPs[try] = get_fingerprint(target, &si[try]); FP_matches[try] = match_fingerprint(target->FPs[try], &(FP_nummatches[try])); if (FP_matches[try][0]) break; if (try < 2) sleep(2); } target->numFPs = (try == 3)? 3 : try + 1; memcpy(&(target->seq), &si[target->numFPs - 1], sizeof(struct seq_info)); if (try != 3) { if (try > 0) { error("WARNING: OS didn't match until the %d try", try + 1); for(i=0; i < try; i++) { if (target->FPs[i]) { if (o.debugging) error("Failed match #%d (0-based):\n%s", i, fp2ascii(target->FPs[i])); freeFingerPrint(target->FPs[i]); target->FPs[i] = NULL; } } target->FPs[0] = target->FPs[try]; target->FPs[try] = NULL; try = 0; target->numFPs = 1; } target->goodFP = 0; } else { /* Uh-oh, we were NEVER able to match, lets take the first fingerprint */ for(try=0; try < 3; try++) { if (FP_nummatches[try] == 0) { target->goodFP = ENOMATCHESATALL; break; } } if (try == 3) target->goodFP = ETOOMANYMATCHES; } if (target->goodFP > 0) target->FP_matches = FP_matches[target->goodFP]; else target->FP_matches = FP_matches[0]; return 1; } char *mergeFPs(FingerPrint *FPs[], int numFPs) { static char str[10240]; struct AVal *AV; FingerPrint *currentFPs[32]; char *p = str; int i; int changed; if (numFPs <=0) return "(None)"; if (numFPs > 32) return "(Too many)"; bzero(str, sizeof(str)); for(i=0; i < numFPs; i++) { if (FPs[i] == NULL) { fatal("mergeFPs was handed a pointer to null fingerprint"); } currentFPs[i] = FPs[i]; } do { changed = 0; for(i = 0; i < numFPs; i++) { if (currentFPs[i]) { /* This junk means do not print this one if the next one is the same */ if (i == numFPs - 1 || !currentFPs[i+1] || strcmp(currentFPs[i]->name, currentFPs[i+1]->name) != 0 || AVal_match(currentFPs[i]->results,currentFPs[i+1]->results) ==0) { changed = 1; strcpy(p, currentFPs[i]->name); p += strlen(currentFPs[i]->name); *p++='('; for(AV = currentFPs[i]->results; AV; AV = AV->next) { strcpy(p, AV->attribute); p += strlen(AV->attribute); *p++='='; strcpy(p, AV->value); p += strlen(AV->value); *p++ = '%'; } if(*(p-1) != '(') p--; /* Kill the final & */ *p++ = ')'; *p++ = '\n'; } /* Now prepare for the next one */ currentFPs[i] = currentFPs[i]->next; } } } while(changed); *p = '\0'; return str; } char *fp2ascii(FingerPrint *FP) { static char str[2048]; FingerPrint *current; struct AVal *AV; char *p = str; bzero(str, sizeof(str)); if (!FP) return "(None)"; if(*(FP->OS_name)) { int len = 0; len = sprintf(str, "FingerPrint %s\n", FP->OS_name); #ifdef SPRINTF_RETURNS_STRING p += strlen(p); #else p += len; #endif } for(current = FP; current ; current = current->next) { strcpy(p, current->name); p += strlen(current->name); *p++='('; for(AV = current->results; AV; AV = AV->next) { strcpy(p, AV->attribute); p += strlen(AV->attribute); *p++='='; strcpy(p, AV->value); p += strlen(AV->value); *p++ = '%'; } if(*(p-1) != '(') p--; /* Kill the final & */ *p++ = ')'; *p++ = '\n'; } *p = '\0'; return str; } unsigned long get_gcd_n_ulong(int numvalues, unsigned long *values) { int gcd; int i; if (numvalues == 0) return 1; gcd = values[0]; for(i=1; i < numvalues; i++) gcd = euclid_gcd(gcd, values[i]); return gcd; } unsigned long euclid_gcd(unsigned long a, unsigned long b) { if (a < b) return euclid_gcd(b,a); if (!b) return a; return euclid_gcd(b, a % b); } FingerPrint **parse_fingerprint_reference_file() { FingerPrint **FPs; FingerPrint *current; FILE *fp; char filename[256]; char line[1024]; int numrecords = 0; int lineno = 0; char *p, *q; /* OH YEAH!!!! */ /* If you need more than 2048 fingerprints, tough */ FPs = safe_malloc(sizeof(FingerPrint *) * 2048); bzero(FPs, sizeof(FingerPrint *) * 2048); if (nmap_fetchfile(filename, sizeof(filename), "nmap-os-fingerprints") == -1){ fatal("OS scan requested but I cannot find nmap_os_fingerprints file. It should be in %s, ~/.nmap/ or .", LIBDIR); } fp = fopen(filename, "r"); top: while(fgets(line, sizeof(line), fp)) { lineno++; /* Read in a record */ if (*line == '\n' || *line == '#') continue; fparse: if (strncasecmp(line, "FingerPrint", 11)) { printf("Parse error on line %d of nmap_os_fingerprints file: %s\n", lineno, line); continue; } p = line + 12; while(*p && isspace((int) *p)) p++; if (!*p) { printf("Parse error on line %d of nmap_os_fingerprints file: %s\n", lineno, line); continue; } FPs[numrecords] = safe_malloc(sizeof(FingerPrint)); bzero(FPs[numrecords], sizeof(FingerPrint)); q = FPs[numrecords]->OS_name; while(*p && *p != '\n' && *p != '#') { *q++ = *p++; } q--; /* Now let us back up through any ending spaces */ while(isspace((int)*q)) q--; /* Terminate the sucker */ q++; *q = '\0'; current = FPs[numrecords]; /* Now we read the fingerprint itself */ while(fgets(line, sizeof(line), fp)) { lineno++; if (*line == '#') continue; if (*line == '\n') break; if (!strncmp(line, "FingerPrint",11)) { goto fparse; } p = line; q = strchr(line, '('); if (!q) { printf("Parse error on line %d of nmap_os_fingerprints file: %s\n", lineno, line); goto top; } *q = '\0'; if(current->name) { current->next = safe_malloc(sizeof(FingerPrint)); current = current->next; bzero(current, sizeof(FingerPrint)); } current->name = strdup(p); p = q+1; *q = '('; q = strchr(p, ')'); if (!q) { printf("Parse error on line %d of nmap_os_fingerprints file: %s\n", lineno, line); goto top; } *q = '\0'; current->results = str2AVal(p); } /* printf("Read in fingerprint:\n%s\n", fp2ascii(FPs[numrecords])); */ numrecords++; } fclose(fp); FPs[numrecords] = NULL; return FPs; } struct AVal *str2AVal(char *str) { int i = 1; int count = 1; char *q = str, *p=str; struct AVal *AVs; if (!*str) return NULL; /* count the AVals */ while((q = strchr(q, '%'))) { count++; q++; } AVs = safe_malloc(count * sizeof(struct AVal)); bzero(AVs, sizeof(struct AVal) * count); for(i=0; i < count; i++) { q = strchr(p, '='); if (!q) { fatal("Parse error with AVal string (%s) in nmap-os-fingerprints file", str); } *q = '\0'; AVs[i].attribute = strdup(p); p = q+1; if (i != count - 1) { q = strchr(p, '%'); if (!q) { fatal("Parse error with AVal string (%s) in nmap-os-fingerprints file", str); } *q = '\0'; AVs[i].next = &AVs[i+1]; } strcpy(AVs[i].value, p); p = q + 1; } return AVs; } struct udpprobeinfo *send_closedudp_probe(int sd, struct in_addr *victim, unsigned short sport, unsigned short dport) { static struct udpprobeinfo upi; static int myttl = 0; static unsigned char patternbyte = 0; static unsigned short id = 0; char packet[328]; /* 20 IP hdr + 8 UDP hdr + 300 data */ struct ip *ip = (struct ip *) packet; udphdr_bsd *udp = (udphdr_bsd *) (packet + sizeof(struct ip)); struct in_addr *source; int datalen = 300; char *data = packet + 28; unsigned short realcheck; /* the REAL checksum */ int res; struct sockaddr_in sock; int decoy; struct pseudo_udp_hdr { struct in_addr source; struct in_addr dest; char zero; char proto; unsigned short length; } *pseudo = (struct pseudo_udp_hdr *) ((char *)udp - 12) ; if (!patternbyte) patternbyte = (get_random_uint() % 60) + 65; memset(data, patternbyte, datalen); while(!id) id = get_random_uint(); /* check that required fields are there and not too silly */ if ( !victim || !sport || !dport || sd < 0) { fprintf(stderr, "send_udp_raw: One or more of your parameters suck!\n"); return NULL; } if (!myttl) myttl = (time(NULL) % 14) + 51; /* It was a tough decision whether to do this here for every packet or let the calling function deal with it. In the end I grudgingly decided to do it here and potentially waste a couple microseconds... */ sethdrinclude(sd); for(decoy=0; decoy < o.numdecoys; decoy++) { source = &o.decoys[decoy]; /*do we even have to fill out this damn thing? This is a raw packet, after all */ sock.sin_family = AF_INET; sock.sin_port = htons(dport); sock.sin_addr.s_addr = victim->s_addr; bzero((char *) packet, sizeof(struct ip) + sizeof(udphdr_bsd)); udp->uh_sport = htons(sport); udp->uh_dport = htons(dport); udp->uh_ulen = htons(8 + datalen); /* Now the psuedo header for checksuming */ pseudo->source.s_addr = source->s_addr; pseudo->dest.s_addr = victim->s_addr; pseudo->proto = IPPROTO_UDP; pseudo->length = htons(sizeof(udphdr_bsd) + datalen); /* OK, now we should be able to compute a valid checksum */ realcheck = in_cksum((unsigned short *)pseudo, 20 /* pseudo + UDP headers */ + datalen); #if STUPID_SOLARIS_CHECKSUM_BUG udp->uh_sum = sizeof(struct udphdr) + datalen; #else udp->uh_sum = realcheck; #endif /* Goodbye, pseudo header! */ bzero(pseudo, 12); /* Now for the ip header */ ip->ip_v = 4; ip->ip_hl = 5; ip->ip_len = BSDFIX(sizeof(struct ip) + sizeof(udphdr_bsd) + datalen); ip->ip_id = id; ip->ip_ttl = myttl; ip->ip_p = IPPROTO_UDP; ip->ip_src.s_addr = source->s_addr; ip->ip_dst.s_addr= victim->s_addr; upi.ipck = in_cksum((unsigned short *)ip, sizeof(struct ip)); #if HAVE_IP_IP_SUM ip->ip_sum = upi.ipck; #endif /* OK, now if this is the real she-bang (ie not a decoy) then we stick all the inph0 in our upi */ if (decoy == o.decoyturn) { upi.iptl = 28 + datalen; upi.ipid = id; upi.sport = sport; upi.dport = dport; upi.udpck = realcheck; upi.udplen = 8 + datalen; upi.patternbyte = patternbyte; upi.target.s_addr = ip->ip_dst.s_addr; } if (TCPIP_DEBUGGING > 1) { printf("Raw UDP packet creation completed! Here it is:\n"); readudppacket(packet,1); } if (TCPIP_DEBUGGING > 1) printf("\nTrying sendto(%d , packet, %d, 0 , %s , %d)\n", sd, BSDUFIX(ip->ip_len), inet_ntoa(*victim), (int) sizeof(struct sockaddr_in)); if ((res = sendto(sd, packet, BSDUFIX(ip->ip_len), 0, (struct sockaddr *)&sock, (int) sizeof(struct sockaddr_in))) == -1) { perror("sendto in send_udp_raw"); return NULL; } if (TCPIP_DEBUGGING > 1) printf("successfully sent %d bytes of raw_tcp!\n", res); } return &upi; } struct AVal *fingerprint_portunreach(struct ip *ip, struct udpprobeinfo *upi) { struct icmp *icmp; struct ip *ip2; int numtests = 10; unsigned short checksum; unsigned short *checksumptr; udphdr_bsd *udp; struct AVal *AVs; int i; int current_testno = 0; unsigned char *datastart, *dataend; /* The very first thing we do is make sure this is the correct response */ if (ip->ip_p != IPPROTO_ICMP) { error("fingerprint_portunreach handed a non-ICMP packet!"); return NULL; } if (ip->ip_src.s_addr != upi->target.s_addr) return NULL; /* Not the person we sent to */ icmp = ((struct icmp *) (((char *) ip) + 4 * ip->ip_hl)); if (icmp->icmp_type != 3 || icmp->icmp_code != 3) return NULL; /* Not a port unreachable */ ip2 = (struct ip*) ((char *)icmp + 8); udp = (udphdr_bsd *) ((char *)ip2 + 20); /* The ports better match as well ... */ if (ntohs(udp->uh_sport) != upi->sport || ntohs(udp->uh_dport) != upi->dport) { return NULL; } /* Create the Avals */ AVs = safe_malloc(numtests * sizeof(struct AVal)); bzero(AVs, numtests * sizeof(struct AVal)); /* Link them together */ for(i=0; i < numtests - 1; i++) AVs[i].next = &AVs[i+1]; /* First of all, if we got this far the response was yes */ AVs[current_testno].attribute = "Resp"; strcpy(AVs[current_testno].value, "Y"); current_testno++; /* Now let us do an easy one, Don't fragment */ AVs[current_testno].attribute = "DF"; if(ntohs(ip->ip_off) & 0x4000) { strcpy(AVs[current_testno].value,"Y"); } else strcpy(AVs[current_testno].value, "N"); current_testno++; /* Now lets do TOS of the response (note, I've never seen this be useful */ AVs[current_testno].attribute = "TOS"; sprintf(AVs[current_testno].value, "%hX", ip->ip_tos); current_testno++; /* Now we look at the IP datagram length that was returned, some machines send more of the original packet back than others */ AVs[current_testno].attribute = "IPLEN"; sprintf(AVs[current_testno].value, "%hX", ntohs(ip->ip_len)); current_testno++; /* OK, lets check the returned IP length, some systems @$@ this up */ AVs[current_testno].attribute = "RIPTL"; sprintf(AVs[current_testno].value, "%hX", ntohs(ip2->ip_len)); current_testno++; /* This next test doesn't work on Solaris because the lamers overwrite our ip_id */ #if !defined(SOLARIS) && !defined(SUNOS) /* Now lets see how they treated the ID we sent ... */ AVs[current_testno].attribute = "RID"; if (ntohs(ip2->ip_id) == 0) sprintf(AVs[current_testno].value, "0"); else if (ip2->ip_id == upi->ipid) sprintf(AVs[current_testno].value, "E"); /* The "expected" value */ else sprintf(AVs[current_testno].value, "F"); /* They fucked it up */ current_testno++; #endif /* Let us see if the IP checksum we got back computes */ AVs[current_testno].attribute = "RIPCK"; /* Thanks to some machines not having struct ip member ip_sum we have to go with this BS */ checksumptr = (unsigned short *) ((char *) ip2 + 10); checksum = *checksumptr; if (checksum == 0) sprintf(AVs[current_testno].value, "0"); else { *checksumptr = 0; if (in_cksum((unsigned short *)ip2, 20) == checksum) { sprintf(AVs[current_testno].value, "E"); /* The "expected" value */ } else { sprintf(AVs[current_testno].value, "F"); /* They fucked it up */ } *checksumptr = checksum; } current_testno++; /* UDP checksum */ AVs[current_testno].attribute = "UCK"; if (udp->uh_sum == 0) sprintf(AVs[current_testno].value, "0"); else if (udp->uh_sum == upi->udpck) sprintf(AVs[current_testno].value, "E"); /* The "expected" value */ else sprintf(AVs[current_testno].value, "F"); /* They fucked it up */ current_testno++; /* UDP length ... */ AVs[current_testno].attribute = "ULEN"; sprintf(AVs[current_testno].value, "%hX", ntohs(udp->uh_ulen)); current_testno++; /* Finally we ensure the data is OK */ datastart = ((unsigned char *)udp) + 8; dataend = (unsigned char *) ip + ntohs(ip->ip_len); while(datastart < dataend) { if (*datastart != upi->patternbyte) break; datastart++; } AVs[current_testno].attribute = "DAT"; if (datastart < dataend) sprintf(AVs[current_testno].value, "F"); /* They fucked it up */ else sprintf(AVs[current_testno].value, "E"); AVs[current_testno].next = NULL; return AVs; } nmap-2.08/charpool.c100600 764 764 3360 6657465151 13441 0ustar fyodorfyodor#include "charpool.h" static char *charpool[16]; static int currentcharpool; static int currentcharpoolsz; static char *nextchar; static int charpool_initialized = 0; #define ALIGN_ON sizeof(char *) static int cp_init(void) { /* Create our char pool */ currentcharpool = 0; currentcharpoolsz = 16384; nextchar = charpool[0] = (char *) safe_malloc(currentcharpoolsz); charpool_initialized = 1; return 0; } static inline void cp_grow(void) { /* Doh! We've got to make room */ if (++currentcharpool > 15) { fatal("Character Pool is out of buckets!"); } currentcharpoolsz <<= 1; nextchar = charpool[currentcharpool] = (char *) safe_malloc(currentcharpoolsz); } static inline void cp_align(void) { int res; if ((res = (nextchar - charpool[currentcharpool]) % ALIGN_ON)) { nextchar += ALIGN_ON - res; } return; } char *cp_alloc(int sz) { char *p; int modulus; if (!charpool_initialized) cp_init(); if ((modulus = sz % ALIGN_ON)) sz += modulus; if ((nextchar - charpool[currentcharpool]) + sz <= currentcharpoolsz) { p = nextchar; nextchar += sz; return p; } /* Doh! We've got to make room */ cp_grow(); return cp_alloc(sz); } char *cp_strdup(const char *src) { const char *p; char *q; /* end points to the first illegal char */ char *end; int modulus; if (!charpool_initialized) cp_init(); end = charpool[currentcharpool] + currentcharpoolsz; q = nextchar; p = src; while((nextchar < end) && *p) { *nextchar++ = *p++; } if (!*p) { /* Goody, we have space */ *nextchar++ = '\0'; if ((modulus = (nextchar - q) % ALIGN_ON)) nextchar += ALIGN_ON - modulus; return q; } /* Doh! We ran out -- need to allocate more */ cp_grow(); return cp_strdup(src); } nmap-2.08/services.c100600 764 764 12127 6657454764 13506 0ustar fyodorfyodor#include "services.h" extern struct ops o; static int services_initialized = 0; static int numtcpports = 0; static int numudpports = 0; static struct service_list *service_table[SERVICE_TABLE_SIZE]; static int nmap_services_init() { char filename[512]; FILE *fp; char servicename[128], proto[16]; unsigned short portno; char *p; char line[1024]; int lineno = 0; struct service_list *current, *previous; int res; if (nmap_fetchfile(filename, sizeof(filename), "nmap-services") == -1) { error("Unable to find nmap-services! Resorting to /etc/services"); strcpy(filename, "/etc/services"); } fp = fopen(filename, "r"); if (!fp) { fatal("Unable to open %s for reading service information", filename); } bzero(service_table, sizeof(service_table)); while(fgets(line, sizeof(line), fp)) { lineno++; p = line; res = sscanf(line, "%s %hu/%s", servicename, &portno, proto); if (res !=3) continue; portno = htons(portno); /* Now we make sure our services doesn't have duplicates */ for(current = service_table[portno % SERVICE_TABLE_SIZE], previous = NULL; current; current = current->next) { if (portno == current->servent->s_port && strcasecmp(proto, current->servent->s_proto) == 0) { if (o.debugging) { error("Port %d proto %s is duplicated in services file %s", ntohs(portno), proto, filename); } break; } previous = current; } if (current) continue; if (strncasecmp(proto, "tcp", 3) == 0) { numtcpports++; } else if (strncasecmp(proto, "udp", 3) == 0) { numudpports++; } else { if (o.debugging) error("Unknown protocol (%s) on line %d of services file %s.", proto, lineno, filename); continue; } current = (struct service_list *) cp_alloc(sizeof(struct service_list)); current->servent = (struct servent *) cp_alloc(sizeof(struct servent)); current->next = NULL; if (previous == NULL) { service_table[portno % SERVICE_TABLE_SIZE] = current; } else { previous->next = current; } current->servent->s_name = cp_strdup(servicename); current->servent->s_port = portno; current->servent->s_proto = cp_strdup(proto); current->servent->s_aliases = NULL; } fclose(fp); services_initialized = 1; return 0; } struct servent *nmap_getservbyport(int port, const char *proto) { struct service_list *current; if (!services_initialized) if (nmap_services_init() == -1) return NULL; for(current = service_table[port % SERVICE_TABLE_SIZE]; current; current = current->next) { if (port == current->servent->s_port && strcmp(proto, current->servent->s_proto) == 0) return current->servent; } /* Couldn't find it ... oh well. */ return NULL; } /* Be default we do all ports 1-1024 as well as any higher ports that are in /etc/services. */ unsigned short *getdefaultports(int tcpscan, int udpscan) { int portindex = 0; unsigned short *ports; char usedports[65536]; struct service_list *current; int bucket; int portsneeded = 1; /* the 1 is for the terminating 0 */ if (!services_initialized) if (nmap_services_init() == -1) fatal("Getfastports: Coudn't get port numbers"); bzero(usedports, sizeof(usedports)); for(bucket = 1; bucket < 1025; bucket++) { usedports[bucket] = 1; portsneeded++; } for(bucket = 0; bucket < SERVICE_TABLE_SIZE; bucket++) { for(current = service_table[bucket % SERVICE_TABLE_SIZE]; current; current = current->next) { if (!usedports[ntohs(current->servent->s_port)] && ((tcpscan && !strncmp(current->servent->s_proto, "tcp", 3)) || (udpscan && !strncmp(current->servent->s_proto, "udp", 3)))) { usedports[ntohs(current->servent->s_port)] = 1; portsneeded++; } } } ports = (unsigned short *) cp_alloc(portsneeded * sizeof(unsigned short)); o.numports = portsneeded - 1; for(bucket = 1; bucket < 65536; bucket++) { if (usedports[bucket]) ports[portindex++] = bucket; } ports[portindex] = 0; return ports; } unsigned short *getfastports(int tcpscan, int udpscan) { int portindex = 0; unsigned short *ports; char usedports[65536]; struct service_list *current; int bucket; int portsneeded = 1; /* the 1 is for the terminating 0 */ if (!services_initialized) if (nmap_services_init() == -1) fatal("Getfastports: Coudn't get port numbers"); bzero(usedports, sizeof(usedports)); for(bucket = 0; bucket < SERVICE_TABLE_SIZE; bucket++) { for(current = service_table[bucket % SERVICE_TABLE_SIZE]; current; current = current->next) { if (!usedports[ntohs(current->servent->s_port)] && ((tcpscan && !strncmp(current->servent->s_proto, "tcp", 3)) || (udpscan && !strncmp(current->servent->s_proto, "udp", 3)))) { usedports[ntohs(current->servent->s_port)] = 1; portsneeded++; } } } ports = (unsigned short *) cp_alloc(portsneeded * sizeof(unsigned short)); o.numports = portsneeded - 1; for(bucket = 1; bucket < 65536; bucket++) { if (usedports[bucket]) ports[portindex++] = bucket; } ports[portindex] = 0; return ports; } nmap-2.08/nmap.h100644 764 764 23034 6657432655 12625 0ustar fyodorfyodor#ifndef NMAP_H #define NMAP_H /************************INCLUDES**********************************/ #include #ifdef HAVE_CONFIG_H #include "config.h" #endif #ifdef STDC_HEADERS #include #else void *malloc(); void *realloc(); #endif #if STDC_HEADERS || HAVE_STRING_H #include #if !STDC_HEADERS && HAVE_MEMORY_H #include #endif #endif #if HAVE_STRINGS_H #include #endif #ifdef HAVE_BSTRING_H #include #endif #ifndef HAVE_BZERO #define bzero(s, n) memset((s), 0, (n)) #endif #ifndef HAVE_MEMCPY #define memcpy(d, s, n) bcopy((s), (d), (n)) #endif #include #include #ifdef HAVE_SYS_PARAM_H #include /* Defines MAXHOSTNAMELEN on BSD*/ #endif /* Linux uses these defines in netinet/ip.h and netinet/tcp.h to use the correct struct ip and struct tcphdr */ #ifndef __FAVOR_BSD #define __FAVOR_BSD #endif #ifndef __USE_BSD #define __USE_BSD #endif #ifndef __BSD_SOURCE #define __BSD_SOURCE #endif /* BSDI needs this to insure the correct struct ip */ #undef _IP_VHL #if HAVE_STRINGS_H #include #endif #include #include #include #include #include #include #include #include #if TIME_WITH_SYS_TIME # include # include #else # if HAVE_SYS_TIME_H # include # else # include # endif #endif #include #include #include #include #include #ifndef NETINET_IN_SYSTEM_H /* why the HELL does OpenBSD not do this? */ #include /* defines n_long needed for netinet/ip.h */ #define NETINET_IN_SYSTEM_H #endif #ifndef NETINET_IP_H /* why the HELL does OpenBSD not do this? */ #include #define NETINET_IP_H #endif #include #include #include #include #ifndef __FAVOR_BSD #define __FAVOR_BSD #endif #ifndef NETINET_TCP_H /* why the HELL does OpenBSD not do this? */ #include /*#include */ #define NETINET_TCP_H #endif #include /*#include *//* defines struct arphdr needed for if_ether.h */ #ifndef NET_IF_H /* why the HELL does OpenBSD not do this? */ #include #define NET_IF_H #endif #if HAVE_NETINET_IF_ETHER_H #ifndef NETINET_IF_ETHER_H #include #define NETINET_IF_ETHER_H #endif /* NETINET_IF_ETHER_H */ #endif /* HAVE_NETINET_IF_ETHER_H */ /******* DEFINES ************/ /* User configurable #defines: */ /* #define to zero if you don't want to ignore hosts of the form xxx.xxx.xxx.{0,255} (usually network and broadcast addresses) */ #define IGNORE_ZERO_AND_255_HOSTS 0 #ifndef VERSION #define VERSION "1.60-Beta" #endif #ifndef DEBUGGING #define DEBUGGING 0 #endif /* Default number of ports in parallel. Doesn't always involve actual sockets. Can also adjust with the -M command line option. */ #define MAX_SOCKETS 36 /* As an optimisation we limit the maximum value of MAX_SOCKETS to a very high value (avoids dynamic memmory allocation */ #define MAX_SOCKETS_ALLOWED 1025 /* How many hosts do we ping in parallel to see if they are up? */ #define LOOKAHEAD 25 /* If reads of a UDP port keep returning EAGAIN (errno 13), do we want to count the port as valid? */ #define RISKY_UDP_SCAN 0 /* How many syn packets do we send to TCP sequence a host? */ #define NUM_SEQ_SAMPLES 6 /* This ideally should be a port that isn't in use for any protocol on our machine or on the target */ #define MAGIC_PORT 49724 /* How many udp sends without a ICMP port unreachable error does it take before we consider the port open? */ #define UDP_MAX_PORT_RETRIES 4 /*How many seconds before we give up on a host being alive? */ #define PING_TIMEOUT 6 /* Also timeout for a connect() tcp scan port */ #define FAKE_ARGV "pine" /* What ps and w should show if you use -q */ /* How do we want to log into ftp sites for */ #define FTPUSER "anonymous" #define FTPPASS "-wwwuser@" #define FTP_RETRIES 2 /* How many times should we relogin if we lose control connection? */ #define MAX_TIMEOUTS MAX_SOCKETS /* How many timed out connection attempts in a row before we decide the host is dead? */ #define MAX_DECOYS 128 /* How many decoys are allowed? */ /* DO NOT change stuff after this point */ #define UC(b) (((int)b)&0xff) #define MORE_FRAGMENTS 8192 /*NOT a user serviceable parameter*/ #define SA struct sockaddr /*Ubertechnique from R. Stevens */ /*#define fatal(x) { fprintf(stderr, "%s\n", x); exit(-1); } #define error(x) fprintf(stderr, "%s\n", x);*/ /* hoststruct->flags stuff */ #define HOST_UP 1 #define HOST_DOWN 2 #define HOST_FIREWALLED 4 #define HOST_BROADCAST 8 /* use the wierd_responses member of hoststruct instead */ /* struct port stuff */ #define PORT_UNKNOWN 0 #define PORT_CLOSED 1 #define PORT_OPEN 2 #define PORT_FIREWALLED 4 #define PORT_TESTING 8 #define PORT_FRESH 16 #define PORT_UNFIREWALLED 32 #define CONF_NONE 0 #define CONF_LOW 1 #define CONF_HIGH 2 #define PINGTYPE_UNKNOWN 0 #define PINGTYPE_NONE 1 #define PINGTYPE_ICMP 2 #define PINGTYPE_TCP 4 #define PINGTYPE_TCP_USE_ACK 8 #define PINGTYPE_TCP_USE_SYN 16 #define PINGTYPE_RAWTCP 32 #define PINGTYPE_CONNECTTCP 64 #define SEQ_UNKNOWN 0 #define SEQ_64K 1 #define SEQ_TD 2 #define SEQ_RI 4 #define SEQ_TR 8 #define SEQ_i800 16 #define SEQ_CONSTANT 32 #ifndef MAXHOSTNAMELEN #define MAXHOSTNAMELEN 64 #endif #ifndef BSDFIX #if FREEBSD || BSDI || NETBSD #define BSDFIX(x) x #define BSDUFIX(x) x #else #define BSDFIX(x) htons(x) #define BSDUFIX(x) ntohs(x) #endif #endif /* BSDFIX */ /********************** LOCAL INCLUDES *****************************/ #include "tcpip.h" #include "global_structures.h" #include "error.h" #include "utils.h" #include "services.h" /***********************STRUCTURES**********************************/ /* Moved to global_structures.h */ /***********************PROTOTYPES**********************************/ /* print usage information */ void printusage(char *name); /* our scanning functions */ portlist super_scan(struct hoststruct *target, unsigned short *portarray, stype scantype); portlist pos_scan(struct hoststruct *target, unsigned short *portarray, stype scantype); portlist bounce_scan(struct hoststruct *target, unsigned short *portarray, struct ftpinfo *ftp); /* Scan helper functions */ unsigned long calculate_sleep(struct in_addr target); int check_ident_port(struct in_addr target); int getidentinfoz(struct in_addr target, int localport, int remoteport, char *owner); int parse_bounce(struct ftpinfo *ftp, char *url); int ftp_anon_connect(struct ftpinfo *ftp); /* Does the appropriate stuff when the port we are looking at is found to be open trynum is the try number that was successful */ void posportupdate(struct hoststruct *target, struct portinfo *current, int trynum, struct portinfo *scan, struct scanstats *ss ,stype scantype, int newstate, struct portinfolist *pil, struct connectsockinfo *csi); void get_syn_results(struct hoststruct *target, struct portinfo *scan, struct scanstats *ss, struct portinfolist *pil, int *portlookup, pcap_t *pd, unsigned long *sequences); int get_connect_results(struct hoststruct *target, struct portinfo *scan, struct scanstats *ss, struct portinfolist *pil, int *portlookup, unsigned long *sequences, struct connectsockinfo *csi); inline void adjust_timeouts(struct timeval sent, struct timeout_info *to); /* port manipulators */ unsigned short *getpts(char *expr); /* someone stole the name getports()! */ int addport(portlist *ports, unsigned short portno, unsigned short protocol, char *owner, int state); int deleteport(portlist *ports, unsigned short portno, unsigned short protocol); struct port *lookupport(portlist ports, unsigned short portno, unsigned short protocol); void printandfreeports(portlist ports); int shortfry(unsigned short *ports); /* socket manipulation functions */ void init_socket(int sd); int unblock_socket(int sd); int block_socket(int sd); void broadcast_socket(int sd); int recvtime(int sd, char *buf, int len, int seconds); void max_rcvbuf(int sd); int max_sd(); /* RAW packet building/dissasembling stuff */ int isup(struct in_addr target); int send_small_fragz(int sd, struct in_addr *source, struct in_addr *victim, unsigned long seq, int sport, int dport, int flags); int listen_icmp(int icmpsock, unsigned short outports[], unsigned short numtries[], int *num_out, struct in_addr target, portlist *ports); void massping(struct hoststruct *hostbatch, int numhosts, int pingtimeout); /* general helper functions */ void hdump(unsigned char *packet, int len); void *safe_malloc(int size); char *grab_next_host_spec(FILE *inputfd, int argc, char **fakeargv); int parse_targets(struct targets *targets, char *h); struct hoststruct *nexthost(char *hostexp, int lookahead, int pingtimeout); void options_init(); void nmap_log(char *fmt, ...); void nmap_machine_log(char *fmt, ...); char *statenum2str(int state); void sigdie(int signo); char *seqreport(struct seq_info *seq); char *seqclass2ascii(int clas); void invertfirewalled(portlist *pl, unsigned short *ports); int nmap_fetchfile(char *filename_returned, int bufferlen, char *file); int fileexistsandisreadable(char *pathname); /* From glibc 2.0.6 because Solaris doesn't seem to have this function */ #ifndef HAVE_INET_ATON int inet_aton(register const char *, struct in_addr *); #endif #ifndef HAVE_SNPRINTF int snprintf ( char *str, size_t n, const char *format, ... ); #endif #endif /* NMAP_H */ nmap-2.08/error.h100644 764 764 302 6606703163 12741 0ustar fyodorfyodor#ifndef ERROR_H #define ERROR_H #include #include #include void fatal(char *fmt, ...); void error(char *fmt, ...); void pfatal(char *err); #endif /* ERROR_H */ nmap-2.08/targets.h100600 764 764 3417 6626067075 13312 0ustar fyodorfyodor#ifndef TARGETS_H #define TARGETS_H /* This contains pretty much everythign we need ... */ #include "nmap.h" /**************************STRUCTURES******************************/ struct pingtune { int up_this_block; int down_this_block; int block_tries; int block_unaccounted; int max_tries; int num_responses; int dropthistry; int group_size; int group_start; int group_end; int discardtimesbefore; }; struct tcpqueryinfo { int *sockets; int maxsd; fd_set fds_r; fd_set fds_w; fd_set fds_x; int sockets_out; }; struct pingtech { int icmpscan: 1, rawicmpscan: 1, connecttcpscan: 1, rawtcpscan: 1; }; int get_ping_results(int sd, pcap_t *pd, struct hoststruct *hostbatch, struct timeval *time, struct pingtune *pt, struct timeout_info *to, int id, struct pingtech *ptech); int hostupdate(struct hoststruct *hostbatch, struct hoststruct *target, int newstate, int dotimeout, int trynum, struct timeout_info *to, struct timeval *sent, struct pingtune *pt, struct tcpqueryinfo *tqi, int pingtype); int sendpingquery(int sd, int rawsd, struct hoststruct *target, int seq, unsigned short id, struct scanstats *ss, struct timeval *time, struct pingtech ptech); int sendrawtcppingquery(int rawsd, struct hoststruct *target, int seq, struct timeval *time, struct pingtune *pt); int sendconnecttcpquery(struct hoststruct *hostbatch, struct tcpqueryinfo *tqi, struct hoststruct *target, int seq, struct timeval *time, struct pingtune *pt, struct timeout_info *to); int get_connecttcpscan_results(struct tcpqueryinfo *tqi, struct hoststruct *hostbatch, struct timeval *time, struct pingtune *pt, struct timeout_info *to); char *readhoststate(int state); #endif /* TARGETS_H */ nmap-2.08/osscan.h100644 764 764 2425 6657077005 13133 0ustar fyodorfyodor#ifndef OSSCAN_H #define OSSCAN_H #include "nmap.h" #include "tcpip.h" #include "global_structures.h" #define ENOMATCHESATALL -1 #define ETOOMANYMATCHES -2 /********************** STRUCTURES ***********************************/ /* moved to global_structures.h */ /********************** PROTOTYPES ***********************************/ int os_scan(struct hoststruct *target); FingerPrint *get_fingerprint(struct hoststruct *target, struct seq_info *si); struct AVal *fingerprint_iptcppacket(struct ip *ip, int mss, unsigned long syn); struct AVal *fingerprint_portunreach(struct ip *ip, struct udpprobeinfo *upi); struct udpprobeinfo *send_closedudp_probe(int rawsd, struct in_addr *dest, unsigned short sport, unsigned short dport); unsigned long get_gcd_n_ulong(int numvalues, unsigned long *values); unsigned long euclid_gcd(unsigned long a, unsigned long b); char *fp2ascii(FingerPrint *FP); FingerPrint **parse_fingerprint_reference_file(); FingerPrint **match_fingerprint(FingerPrint *FP, int *matches_found); struct AVal *str2AVal(char *p); struct AVal *gettestbyname(FingerPrint *FP, char *name); int AVal_match(struct AVal *reference, struct AVal *fprint); void freeFingerPrint(FingerPrint *FP); char *mergeFPs(FingerPrint *FPs[], int numFPs); #endif /*OSSCAN_H*/ nmap-2.08/tcpip.h100644 764 764 22307 6657163356 13012 0ustar fyodorfyodor#ifndef TCPIP_H #define TCPIP_H #ifdef HAVE_CONFIG_H #include "config.h" #endif #ifdef STDC_HEADERS #include #else void *malloc(); void *realloc(); #endif #if STDC_HEADERS || HAVE_STRING_H #include #if !STDC_HEADERS && HAVE_MEMORY_H #include #endif #endif #if HAVE_STRINGS_H #include #endif #ifdef HAVE_BSTRING_H #include #endif #ifndef HAVE_BZERO #define bzero(s, n) memset((s), 0, (n)) #endif #ifndef HAVE_MEMCPY #define memcpy(d, s, n) bcopy((s), (d), (n)) #endif #include #include #ifdef HAVE_SYS_PARAM_H #include /* Defines MAXHOSTNAMELEN on BSD*/ #endif /* Linux uses these defines in netinet/ip.h and netinet/tcp.h to use the correct struct ip and struct tcphdr */ #ifndef __FAVOR_BSD #define __FAVOR_BSD 1 #endif #ifndef __BSD_SOURCE #define __BSD_SOURCE 1 #endif #ifndef __USE_BSD #define __USE_BSD 1 #endif /* BSDI needs this to insure the correct struct ip */ #undef _IP_VHL #include #include #include #include #include #include #ifndef NETINET_IN_SYSTEM_H /* why the HELL does OpenBSD not do this? */ #include /* defines n_long needed for netinet/ip.h */ #define NETINET_IN_SYSTEM_H #endif #ifndef NETINET_IP_H /* why the HELL does OpenBSD not do this? */ #include #define NETINET_IP_H #endif #ifndef __FAVOR_BSD #define __FAVOR_BSD #endif #ifndef NETINET_TCP_H /* why the HELL does OpenBSD not do this? */ #include /*#include */ #define NETINET_TCP_H #endif #ifndef NETINET_UDP_H #include #define NETINET_UDP_H #endif #include #include #ifndef NET_IF_H /* why the HELL does OpenBSD not do this? */ #include #define NET_IF_H #endif #if HAVE_NETINET_IF_ETHER_H #ifndef NETINET_IF_ETHER_H #include #define NETINET_IF_ETHER_H #endif /* NETINET_IF_ETHER_H */ #endif /* HAVE_NETINET_IF_ETHER_H */ #if TIME_WITH_SYS_TIME # include # include #else # if HAVE_SYS_TIME_H # include # else # include # endif #endif #include #include #include #include #include #include #if HAVE_SYS_SOCKIO_H #include /* SIOCGIFCONF for Solaris */ #endif #include "error.h" #include "utils.h" #ifndef DEBUGGING #define DEBUGGING 0 #endif #ifndef TCPIP_DEBUGGING #define TCPIP_DEBUGGING 0 #endif #ifndef BSDFIX #if FREEBSD || BSDI || NETBSD #define BSDFIX(x) x #define BSDUFIX(x) x #else #define BSDFIX(x) htons(x) #define BSDUFIX(x) ntohs(x) #endif #endif /* Bogus TCP flag!!! Krad! */ #define TH_BOGUS 64 #define TH_BOG 64 struct interface_info { char name[64]; struct in_addr addr; }; #ifndef HAVE_STRUCT_IP #define HAVE_STRUCT_IP /* From Linux glibc, which apparently borrowed it from BSD code. Slightly modified for portability --fyodor@dhp.com */ /* * Structure of an internet header, naked of options. */ struct ip { #if WORDS_BIGENDIAN u_int8_t ip_v:4; /* version */ u_int8_t ip_hl:4; /* header length */ #else u_int8_t ip_hl:4; /* header length */ u_int8_t ip_v:4; /* version */ #endif u_int8_t ip_tos; /* type of service */ u_short ip_len; /* total length */ u_short ip_id; /* identification */ u_short ip_off; /* fragment offset field */ #define IP_RF 0x8000 /* reserved fragment flag */ #define IP_DF 0x4000 /* dont fragment flag */ #define IP_MF 0x2000 /* more fragments flag */ #define IP_OFFMASK 0x1fff /* mask for fragmenting bits */ u_int8_t ip_ttl; /* time to live */ u_int8_t ip_p; /* protocol */ u_short ip_sum; /* checksum */ struct in_addr ip_src, ip_dst; /* source and dest address */ }; #endif /* HAVE_STRUCT_IP */ #ifdef LINUX typedef struct udphdr_bsd { unsigned short uh_sport; /* source port */ unsigned short uh_dport; /* destination port */ unsigned short uh_ulen; /* udp length */ unsigned short uh_sum; /* udp checksum */ } udphdr_bsd; #else typedef struct udphdr udphdr_bsd; #endif #ifndef HAVE_STRUCT_ICMP #define HAVE_STRUCT_ICMP /* From Linux /usr/include/netinet/ip_icmp.h GLIBC */ /* * Internal of an ICMP Router Advertisement */ struct icmp_ra_addr { u_int32_t ira_addr; u_int32_t ira_preference; }; struct icmp { u_int8_t icmp_type; /* type of message, see below */ u_int8_t icmp_code; /* type sub code */ u_int16_t icmp_cksum; /* ones complement checksum of struct */ union { u_char ih_pptr; /* ICMP_PARAMPROB */ struct in_addr ih_gwaddr; /* gateway address */ struct ih_idseq /* echo datagram */ { u_int16_t icd_id; u_int16_t icd_seq; } ih_idseq; u_int32_t ih_void; /* ICMP_UNREACH_NEEDFRAG -- Path MTU Discovery (RFC1191) */ struct ih_pmtu { u_int16_t ipm_void; u_int16_t ipm_nextmtu; } ih_pmtu; struct ih_rtradv { u_int8_t irt_num_addrs; u_int8_t irt_wpa; u_int16_t irt_lifetime; } ih_rtradv; } icmp_hun; #define icmp_pptr icmp_hun.ih_pptr #define icmp_gwaddr icmp_hun.ih_gwaddr #define icmp_id icmp_hun.ih_idseq.icd_id #define icmp_seq icmp_hun.ih_idseq.icd_seq #define icmp_void icmp_hun.ih_void #define icmp_pmvoid icmp_hun.ih_pmtu.ipm_void #define icmp_nextmtu icmp_hun.ih_pmtu.ipm_nextmtu #define icmp_num_addrs icmp_hun.ih_rtradv.irt_num_addrs #define icmp_wpa icmp_hun.ih_rtradv.irt_wpa #define icmp_lifetime icmp_hun.ih_rtradv.irt_lifetime union { struct { u_int32_t its_otime; u_int32_t its_rtime; u_int32_t its_ttime; } id_ts; struct { struct ip idi_ip; /* options and then 64 bits of data */ } id_ip; struct icmp_ra_addr id_radv; u_int32_t id_mask; u_int8_t id_data[1]; } icmp_dun; #define icmp_otime icmp_dun.id_ts.its_otime #define icmp_rtime icmp_dun.id_ts.its_rtime #define icmp_ttime icmp_dun.id_ts.its_ttime #define icmp_ip icmp_dun.id_ip.idi_ip #define icmp_radv icmp_dun.id_radv #define icmp_mask icmp_dun.id_mask #define icmp_data icmp_dun.id_data }; #endif /* HAVE_STRUCT_ICMP */ /* This ideally should be a port that isn't in use for any protocol on our machine or on the target */ #define MAGIC_PORT 49724 #define TVAL2LONG(X) X.tv_sec * 1e6 + X.tv_usec #define SA struct sockaddr /* Prototypes */ /* Tries to resolve given hostname and stores result in ip . returns 0 if hostname cannot be resolved */ int resolve(char *hostname, struct in_addr *ip); /* An awesome function to determine what interface a packet to a given destination should be routed through. It returns NULL if no appropriate interface is found, oterwise it returns the device name and fills in the source parameter */ char *routethrough(struct in_addr *dest, struct in_addr *source); unsigned short in_cksum(unsigned short *ptr,int nbytes); int send_tcp_raw( int sd, struct in_addr *source, struct in_addr *victim, unsigned short sport, unsigned short dport, unsigned long seq, unsigned long ack, unsigned char flags, unsigned short window, char *options, int optlen, char *data, unsigned short datalen); int send_udp_raw( int sd, struct in_addr *source, struct in_addr *victim, unsigned short sport, unsigned short dport, char *data, unsigned short datalen); int send_ip_raw( int sd, struct in_addr *source, struct in_addr *victim, unsigned char proto, char *data, unsigned short datalen); /* A simple function I wrote to help in debugging, shows the important fields of a TCP packet*/ int readtcppacket(char *packet, int readdata); int readudppacket(char *packet, int readdata); /* Convert an IP address to the device (IE ppp0 eth0) using that address */ int ipaddr2devname( char *dev, struct in_addr *addr ); /* And vice versa */ int devname2ipaddr(char *dev, struct in_addr *addr); /* Where the above 2 functions get their info */ struct interface_info *getinterfaces(int *howmany); inline void sethdrinclude(int sd); int getsourceip(struct in_addr *src, struct in_addr *dst); /* Get the source IP and interface name that a packet to dst should be sent to. Interface name is dynamically assigned and thus should be freed */ char *getsourceif(struct in_addr *src, struct in_addr *dst); int islocalhost(struct in_addr *addr); int unblock_socket(int sd); inline int Sendto(char *functionname, int sd, char *packet, int len, unsigned int flags, struct sockaddr *to, int tolen); /* Standard swiped internet checksum routine */ unsigned short in_cksum(unsigned short *ptr,int nbytes); /* Hex dump */ int get_link_offset(char *device); char *readip_pcap(pcap_t *pd, unsigned int *len); char *readip_pcap_timed(pcap_t *pd, unsigned int *len, unsigned long timeout /*seconds */); #ifndef HAVE_INET_ATON int inet_aton(register const char *, struct in_addr *); #endif #endif /*TCPIP_H*/ nmap-2.08/utils.h100600 764 764 3000 6657135433 12763 0ustar fyodorfyodor#ifndef UTILS_H #define UTILS_H #include #include #include #include #include #include #include #include #include "config.h" #if TIME_WITH_SYS_TIME # include # include #else # if HAVE_SYS_TIME_H # include # else # include # endif #endif #include "error.h" #ifndef MAX #define MAX(x,y) (((x)>(y))?(x):(y)) #endif #ifndef MIN #define MIN(x,y) (((x)<(y))?(x):(y)) #endif #ifndef ABS #define ABS(x) (((x) >= 0)?(x):(-x)) #endif #ifndef MOD_DIFF #define MOD_DIFF(a,b) (unsigned long) (MIN((unsigned long)(a) - (unsigned long ) (b), (unsigned long )(b) - (unsigned long) (a))) #endif #ifndef FALSE #define FALSE 0 #endif #ifndef TRUE #define TRUE 1 #endif #define NIPQUAD(addr) \ (((addr) >> 0) & 0xff), \ (((addr) >> 8) & 0xff), \ (((addr) >> 16) & 0xff), \ (((addr) >> 24) & 0xff) #define TIMEVAL_SUBTRACT(a,b) (((a).tv_sec - (b).tv_sec) * 1000000 + (a).tv_usec - (b).tv_usec) void *safe_malloc(int size); char *strcasestr(char *haystack, char *pneedle); void hdump(unsigned char *packet, int len); void lamont_hdump(unsigned char *bp, int length); void Strncpy(char *dest, const char *src, size_t n); int get_random_bytes(void *buf, int numbytes); int get_random_int(); unsigned int get_random_uint(); #ifndef HAVE_USLEEP #ifdef HAVE_NANOSLEEP void usleep(unsigned long usec); #endif #endif #ifndef HAVE_STRERROR char *strerror(int errnum); #endif #endif nmap-2.08/global_structures.h100600 764 764 10422 6634303745 15412 0ustar fyodorfyodor#ifndef GLOBAL_STRUCTURES_H #define GLOBAL_STRUCTURES_H typedef struct port { unsigned short portno; unsigned char proto; char *owner; int state; int confidence; /* How sure are we about the state? */ struct port *next; } port; struct portinfo { unsigned short portno; short trynum; int sd[3]; /* Socket descriptors for connect_scan */ struct timeval sent[3]; int state; int next; /* not struct portinfo * for historical reasons */ int prev; }; struct portinfolist { struct portinfo *openlist; struct portinfo *firewalled; struct portinfo *testinglist; }; struct udpprobeinfo { unsigned short iptl; unsigned short ipid; unsigned short ipck; unsigned short sport; unsigned short dport; unsigned short udpck; unsigned short udplen; unsigned char patternbyte; struct in_addr target; }; struct connectsockinfo { fd_set fds_read; fd_set fds_write; fd_set fds_except; struct portinfo *socklookup[2048]; /* index socket descriptor -> scan[] index. No OS better give us an SD > 2047!@#$ */ int maxsd; }; /* The runtime statistics used to decide how fast to proced and how many ports we can try at once */ struct scanstats { int packet_incr; double fallback_percent; int numqueries_outstanding; /* How many unexpired queries are on the 'net right now? */ double numqueries_ideal; /* How many do we WANT to be on the 'net right now? */ int max_width; /* What is the MOST we will tolerate at once */ int ports_left; int changed; /* Has anything changed since last round? */ int alreadydecreasedqueries; }; struct ftpinfo { char user[64]; char pass[256]; /* methinks you're paranoid if you need this much space */ char server_name[MAXHOSTNAMELEN + 1]; struct in_addr server; unsigned short port; int sd; /* socket descriptor */ }; struct AVal { char *attribute; char value[128]; struct AVal *next; }; typedef struct FingerTest { char OS_name[256]; char *name; struct AVal *results; struct FingerTest *next; } FingerPrint; struct timeout_info { int srtt; /* Smoothed rtt estimate (microseconds) */ int rttvar; /* Rout trip time variance */ int timeout; /* Current timeout threshold (microseconds) */ }; struct seq_info { int class; int responses; unsigned long seqs[NUM_SEQ_SAMPLES]; int index; }; struct targets { /* These 4 are used for the '/mask' style of specifying target net*/ unsigned int netmask; unsigned int maskformat; struct in_addr start; struct in_addr currentaddr; struct in_addr end; /* These two are for the '138.[1-7,16,91-95,200-].12.1 style */ unsigned char addresses[4][256]; unsigned int current[4]; unsigned char last[4]; }; struct hoststruct { struct in_addr host; struct in_addr source_ip; char *name; struct seq_info seq; FingerPrint **FP_matches; FingerPrint *FPs[10]; int numFPs; int goodFP; struct port *ports; /* unsigned int up; unsigned int down; */ int wierd_responses; /* echo responses from other addresses, Ie a network broadcast address */ unsigned int flags; /* HOST_UP, HOST_DOWN, HOST_FIREWALLED, HOST_BROADCAST (instead of HOST_BROADCAST use wierd_responses */ struct timeout_info to; char device[64]; /* The device we transmit on */ }; struct ops /* someone took struct options, */ { int debugging; int verbose; int spoofsource; /* -S used */ struct in_addr *source; char device[64]; FingerPrint **reference_FPs; unsigned short magic_port; unsigned short magic_port_set; /* Was this set by user? */ unsigned short tcp_probe_port; int max_sockets; int isr00t; struct in_addr decoys[MAX_DECOYS]; int numdecoys; int decoyturn; int identscan; int osscan; int pingtype; int pingscan; int allowall; int ptime; int numports; int connectscan; int bouncescan; int nullscan; int xmasscan; int fragscan; int synscan; int maimonscan; int finscan; int udpscan; int noresolve; int force; /* force nmap to continue on even when the outcome seems somewhat certain */ FILE *logfd; /* Output log file descriptor */ FILE *machinelogfd; /* Machine parseable log file descriptor */ }; typedef port *portlist; typedef enum { SYN_SCAN, FIN_SCAN, XMAS_SCAN, UDP_SCAN, CONNECT_SCAN, NULL_SCAN, MAIMON_SCAN } stype; #endif /*GLOBAL_STRUCTURES_H */ nmap-2.08/charpool.h100600 764 764 217 6657341075 13422 0ustar fyodorfyodor#ifndef CHARPOOL_H #define CHARPOOL_H #include "utils.h" #include "error.h" char *cp_alloc(int sz); char *cp_strdup(const char *src); #endif nmap-2.08/services.h100600 764 764 730 6657360005 13430 0ustar fyodorfyodor#ifndef SERVICES_H #define SERVICES_H #include #include "nmap.h" #include "global_structures.h" #include "charpool.h" #include "error.h" #include "utils.h" #define SERVICE_TABLE_SIZE 1024 struct service_list { struct servent *servent; struct service_list *next; }; struct servent *nmap_getservbyport(int port, const char *proto); unsigned short *getfastports(int tcpscan, int udpscan); unsigned short *getdefaultports(int tcpscan, int udpscan); #endif nmap-2.08/inet_aton.c100644 764 764 4544 6570026750 13617 0ustar fyodorfyodor/***** THIS CODE IS FROM GLIBC 2.0.6 AND IS INCLUDED IN NMAP BECAUSE SOLARIS DOES NOT SEEM TO CONTAIN THE inet_aton(3C) FUNCTION (!). IT IS VERY SLIGHTLY MODIFIED. SPECIFICALLY, THIS COMES FROM resolv/inet_addr.c --fyodor@dhp.com ******/ #include "nmap.h" /* * Check whether "cp" is a valid ascii representation * of an Internet address and convert to a binary address. * Returns 1 if the address is valid, 0 if not. * This replaces inet_addr, the return value from which * cannot distinguish between failure and a local broadcast address. */ int inet_aton(cp, addr) register const char *cp; struct in_addr *addr; { register unsigned int val; /* changed from u_long --david */ register int base, n; register char c; u_int parts[4]; register u_int *pp = parts; c = *cp; for (;;) { /* * Collect number up to ``.''. * Values are specified as for C: * 0x=hex, 0=octal, isdigit=decimal. */ if (!isdigit((int)c)) return (0); val = 0; base = 10; if (c == '0') { c = *++cp; if (c == 'x' || c == 'X') base = 16, c = *++cp; else base = 8; } for (;;) { if (isascii((int)c) && isdigit((int)c)) { val = (val * base) + (c - '0'); c = *++cp; } else if (base == 16 && isascii((int)c) && isxdigit((int)c)) { val = (val << 4) | (c + 10 - (islower((int)c) ? 'a' : 'A')); c = *++cp; } else break; } if (c == '.') { /* * Internet format: * a.b.c.d * a.b.c (with c treated as 16 bits) * a.b (with b treated as 24 bits) */ if (pp >= parts + 3) return (0); *pp++ = val; c = *++cp; } else break; } /* * Check for trailing characters. */ if (c != '\0' && (!isascii((int)c) || !isspace((int)c))) return (0); /* * Concoct the address according to * the number of parts specified. */ n = pp - parts + 1; switch (n) { case 0: return (0); /* initial nondigit */ case 1: /* a -- 32 bits */ break; case 2: /* a.b -- 8.24 bits */ if (val > 0xffffff) return (0); val |= parts[0] << 24; break; case 3: /* a.b.c -- 8.8.16 bits */ if (val > 0xffff) return (0); val |= (parts[0] << 24) | (parts[1] << 16); break; case 4: /* a.b.c.d -- 8.8.8.8 bits */ if (val > 0xff) return (0); val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8); break; } if (addr) addr->s_addr = htonl(val); return (1); } nmap-2.08/snprintf.c100600 764 764 1610 6657441074 13467 0ustar fyodorfyodor#include #include "error.h" #include "charpool.h" #define SNPRINTF_BUFSIZE 8192 int snprintf ( char *str, size_t n, const char *format, ... ) { static char *buf = NULL; static int warning = 0; int len; va_list ap; int res = 0; va_start(ap, format); if (!warning) { error("WARNING: your system apparrently does not offer snprintf(). Reverting to less secure version"); warning = 1; } if (!buf) { buf = (char *) cp_alloc(SNPRINTF_BUFSIZE); } #ifndef SPRINTF_RETURNS_STRING res = vsprintf(buf, format, ap); if (res >= SNPRINTF_BUFSIZE || res < 0) { fatal("Our bufferZ may have been overfl0wed!!@#$!@#"); } #else res = 4; /* avoid compiler warnings */ vsprintf(buf, format, ap); /* Oh well -- at least they were warned */ #endif len = strlen(buf); if (len >= SNPRINTF_BUFSIZE) fatal("Our bufferZ may have been overfl0wed!!@#$!@#"); strcpy(str, buf); va_end (ap); return len; } nmap-2.08/nmap-os-fingerprints100600 764 764 306402 6657101204 15520 0ustar fyodorfyodor# Nmap OS FingerPrint List. If you add stuff to this, please send the # fingerprints or (even better) the OS name and IP address to # fyodor@DHP.com # Tseq is the TCP sequenceability test # T1 is a SYN packet with a bunch of TCP options to open port # T2 is a NULL packet w/options to open port # T3 is a SYN|FIN|URG|PSH packet w/options to open port # T4 is an ACK to open port w/options # T5 is a SYN to closed port w/options # T6 is an ACK to closed port w/options # T7 is a FIN|PSH|URG to a closed port w/options # PU is a UDP packet to a closed port # The usage license for this file is the same as that for which # you acquired nmap (probably GPL) # Thanks to Filipe Jorge Marques de Almeida # Switch 1100, 3300 FingerPrint 3Com SuperStack II (OS v 2.0) TSeq(Class=C) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to alligator 427 FingerPrint 3Com NetBuilder & NetBuilder II OS v8.1 TSeq(Class=TD%gcd=32|64|96%SI= FingerPrint 3Com NetBuilder & NetBuilder II OS v 9.3 TSeq(Class=TD%gcd=3C%SI= FingerPrint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Acorn RiscOS 3.7 using AcornNet TCP/IP stack # Thanks to Chris Wilson TSeq(Class=RI%gcd=<6) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Juan Cespedes FingerPrint AGE Logic, Inc. IBM XStation TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) FingerPrint AIX 3.2 TSeq(Class=64K) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Contributed by Salim Gasmi (salim@gasmi.net) Fingerprint AIX 3.2.5 (Bull HardWare) TSeq(Class=64K) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Thanks to Troy Solo FingerPrint AIX 4.0 TSeq(Class=64K) T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Thanks to Juan Cespedes FingerPrint AIX 4.02.0001.0000 TSeq(Class=TR) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) FingerPrint AIX 4.1 TSeq(Class=64K) T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) FingerPrint AIX 4.1 TSeq(Class=64K) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) FingerPrint AIX 4.1 # Thanks to van Hauser and others TSeq(Class=64K) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0|E%ULEN=134%DAT=E) FingerPrint AIX 4.2 TSeq(Class=TR) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) FingerPrint AIX 4.2 TSeq(Class=TR) T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) FingerPrint AIX 4.2 TSeq(Class=TR) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Thanks to Antti Pyykko FingerPrint AmigaOS Miami 2.1-3.0 TSeq(Class=TR) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Antti Pyykko FingerPrint AmigaOS Miami 3.0 TSeq(Class=TR) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Antti Pyykko FingerPrint AmigaOS Miami 3.1-3.2 TSeq(Class=TR) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Thanks to Antti Pyykko FingerPrint AmigaOS Miami Deluxe 0.9 - Miami 3.2B TSeq(Class=TR) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Thanks to Antti Pyykko FingerPrint AmigaOS AmiTCP/IP 4.3 TSeq(Class=64K) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Antti Pyykko FingerPrint AmigaOS AmiTCP/IP Genesis 4.6 TSeq(Class=64K) T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Nickolai Zeldovich FingerPrint Apollo Domain/OS SR10.4 TSeq(Class=TD|RI%gcd=<6%SI= FingerPrint AOS/VS or VSII TSeq(Class=TD%gcd=40|80|C0%SI=0) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Thanks to Mike Fidler FingerPrint Ascend P130 Router TSeq(Class=RI%gcd=<6%SI=>BBB& FingerPrint Ascend Max 1800 50Ap8+ or 2024 TSeq(Class=TD%gcd=388|710|A98%SI= FingerPrint Ascend Max-HP or Max-6000 version 6.1.7 TSeq(Class=RI%gcd=<6%SI=>1000) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Ascend Pipeline 50 running 5.1A Firmware # Thanks to Jan Koum TSeq(Class=64K) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to The Deviant FingerPrint Ascend GRF Router running Ascend Embedded/OS 2.1 TSeq(Class=RI%gcd=<5%SI=>600) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to LaMont Jones FingerPrint Ascend P75 TSeq(Class=RI%gcd=<6%SI=>500& FingerPrint Ascend Pipeline P130 TSeq(Class=TD%gcd=388|710|A98%SI= FingerPrint Ascend Pipeline 400/T1 (Software V 4.5B) TSeq(Class=TD%gcd=388|710|A98%SI= FingerPrint Ascend TNT OS +5.0Ap48+ TSeq(Class=RI%gcd=<6%SI=>BBB& TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Asanta IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 )) TSeq(Class=C%Val=4090000) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Asanta IntraSwitch 5324 TSeq(Class=C%Val=80000) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint AsanteHub 2072 Ethernet Hub TSeq(Class=C) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Artem Belevich FingerPrint Auspex Fileserver (AuspexOS 1.9.1/SunOS 4.1.4) TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Chris Tobkin FingerPrint A/UX 3.1.1 SVR2 TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint AXIS NetEye Camera Server V1.20 # Thanks to Pluvius TSeq(Class=C) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) FingerPrint AXIS NetEye Camera Server V1.20 # Thanks to Pluvius TSeq(Class=TD%gcd=20000|40000|60000|80000%SI=<5) TSeq(Class=C) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Thanks to Cyril.Chaboisseau@obs.coe.int FingerPrint Bay Networks BayStack 310T switch TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI= FingerPrint BeOS 4 TSeq(Class=TD%gcd=1%SI=0) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Contributed by pi@LF.net Fingerprint Bintec Brick XS SW Release 4.9.1 ISDN access router TSeq(Class=RI%gcd=<6%SI=>FF&FFF) T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint BSDI BSD/OS 3.0 TSeq(Class=RI%gcd=<6) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint BSDI 4.0 # Thanks to tom@bpf.promisc.org TSeq(Class=RI%gcd=<6%SI=>FFF) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Thanks to Francis J. Lacoste FingerPrint Cisco 762 IOS 4.1(2) or 766 ISDN router TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI= FingerPrint Cisco CacheEngine TSeq(Class=RI%gcd=<6%SI=>FF& FingerPrint Cisco CPA2500 (68030) or 2511 router TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(Resp=N) # Contributer wishes to remain anonymous FingerPrint Cisco PIX 4.2(2) Internal Interface TSeq(Class=C) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) # Contributed by Anonymous Fingerprint Cisco 766 IOS4.2(3.5) TSeq(Class=TD%gcd=82000%SI= FingerPrint Cisco 3640 IOS 11.1(7)AX [KUONG(7)AX] TSeq(Class=RI%gcd=<6%SI=>BBB& FingerPrint Cisco 5260 or 5300 terminal server IOS 11.3.6(T1) TSeq(Class=RI%gcd=<6%SI=>BBB) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Contributed by Pedro Ribeiro Fingerprint Cisco 4500-M running IOS 11.3(6) IP Plus TSeq(Class=RI|TD%gcd=1%SI= FingerPrint Cisco Catalyst 1900 switch or Netopia 655-U/POTS ISDN Router TSeq(Class=TD%gcd=<6|9C4|1388|1D4C|2710|30D4|3A98|445C|4E20%SI=<64) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) FingerPrint Cisco IOS 11.3 - 12.0 # Thanks to Jan B. Koum (Cisco 2516) TSeq(Class=RI%gcd=<6%SI=>1F4) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Cisco 7206 (IOS 11.1(17) # Thanks to jfesler@gigo.com TSeq(Class=RI%gcd=<6%SI=>666) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Cisco 7513/3640 Router (IOS 11.2(14)P) #Thanks to Solar Designer TSeq(Class=RI%gcd=<6%SI=<11170) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Contributed by tim_pettigrew@ins.com Fingerprint Cisco Local Director 420 version 2.1.1 TSeq(Class=C) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) # Contributed by solid Fingerprint Cisco Pix Firewall running PIX 4.1(5) TSeq(Class=C%Val=211E005F) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) # 25XX/45XX router, 29XX switch, RSP2 processor FingerPrint Cisco Router/Switch with IOS 11.2 # Thanks to Solar Designer TSeq(Class=RI%gcd=<6%SI=<18000) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Nickolai Zeldovich FingerPrint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4) T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to ROC Services # Tested against: 3 RISC Routers (2600i, 2800, and 3500R) all running # firmware 4.5 and two IntraPorts running 4.4.02. I'm told this also # applies to firmare 4.2 on RISC routers, but I have not checked. FingerPrint Compatible Systems (RISC Router, IntraPort) TSeq(Class=TD%gcd=388|710|A98%SI=<6) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Contributed by kill9@succeed.net Fingerprint Computone PowerRack IntelliServer Release 1.5.4d TSeq(Class=TD%gcd=40%SI=0) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) FingerPrint ComOS - Livingston PortMaster or U.S. Robotics/3com Total Control system T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Thanks to Joachim Larsson FingerPrint Corporate IP/IPX ISDN Small Office ISDN router (version 9.9.9/8.0) TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPRF%Ops=WNMETL) PU(Resp=N) FingerPrint Cray Unicos 9.0 - 10.0 or Unicos/mk 1.5.1 # Thanks to Mea Culpa TSeq(Class=RI%gcd=<6) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL) T2(Resp=N) T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Contributed by "Richard Johnson" Fingerprint Unicos 10.0.0 on Cray J90se TSeq(Class=RI%gcd=1%SI=AFD4) TSeq(Class=RI%gcd=1%SI=10DA7) TSeq(Class=RI%gcd=1%SI=D14A) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL) T2(Resp=N) T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Austin Wood # Thanks to Michael FingerPrint Cray UNICOS 9.0.1ai - 10.0.0.2 Seq(Class=RI%gcd=<6%SI=>F) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL) T2(Resp=N) T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Gustavo Molina FingerPrint Cyclades PathRouter V 1.2.4 TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Thanks to Xavier Man FingerPrint Cyberguard 4.0 firewall TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T2(Resp=N) T3(DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Thanks to Cyril.Chaboisseau@obs.coe.int FingerPrint Cyclades PathRAS Remote Access Server v1.1.8 TSeq(Class=TD%gcd=30C382%SI= FingerPrint Cyclades PathRAS V 1.1.7 TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) FingerPrint Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06 TSeq(Class=RI%gcd=<6%SI=>18000) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Contributed by vynka@original.xs4all.nl Fingerprint DECNIS 600 V4.1.3B System TSeq(Class=TD%gcd=30D4|C35%SI= FingerPrint DECserver700-16, Network Access SW V2.2 TSeq(Class=64K) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=600%ACK=S++|O%Flags=AR|A%Ops=) T4(DF=N%W=600%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Contributed by morewood@on.bell.ca Fingerprint DG/UX Release R4.11MU02 TSeq(Class=TD%gcd=10000|20000|30000%SI= Fingerprint Digital Unix 4.0E TSeq(Class=C) T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Thanks to anarch FingerPrint Epson Stylus 800n/EPSON Ethernet Ver. 4.20 T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(DF=N%W=200%ACK=S++%Flags=AF%Ops=) T3(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Contributed by Mike Bristow FingerPrint Extreme Gigabit switch (unknown version) TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Thanks to Richard Reiner FingerPrint Farralon Netopia router or Compatible Systems 900i TSeq(Class=TD%gcd=388|710|A98%SI= FingerPrint FlowPoint/2200 SDSL [ATM] Router v1.4.5 TSeq(Class=TD%gcd=<6%SI= FingerPrint FreeBSD 2.1.0 - 2.1.5 # Thanks to Jan Koum! TSeq(Class=64K) T1(DF=N%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint FreeBSD 2.2.1 - 3.0 # Thanks to David O'Brien TSeq(Class=RI%gcd=<6) T1(DF=Y%W=403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D|C0B7%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT) T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) FingerPrint FreeBSD 2.2.1 - 3.0 #Thanks to Jan Koum TSeq(Class=RI%gcd=<6) T1(DF=Y%W=402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Contributed by Neil Hillard Fingerprint Gold Card Ethernet Interface Firmware Ver. 3.19 (95.01.16). Apparently a MIO Network interface for HP LaserJets, etc. TSeq(Class=C%Val=52F7) T1(Resp=Y%DF=N%W=40%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=40%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Chris Tobkin FingerPrint HP Advancestack Etherswitch 224T TSeq(Class=TD%SI= # Don't ask me what this is :) David says # it is "a Utah port of BSD to HP machines" FingerPrint HP-BSD 2.0 TSeq(Class=64K) T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HPJ2600A Ethernet hub or HP ProCurve Switch 4000M # Thanks to Solar Designer (ROM A.01.00, HW A.01.00) & Jan Koum FingerPrint VxWorks 5.3.x bases system (usually an ethernet hub or switch) TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint HP Entria X station (running Netstation 7.x) # Thanks t Zippy TSeq(Class=64K) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint HP JetDirect Print Server TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=N%W=16D0|C90%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=|M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) FingerPrint HP Color DeskJet 1200C PS TSeq(Class=TD%gcd=<6%SI=3FFF) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # This is a wierd one # Thanks to Simon FingerPrint HP-UX 11.00 TSeq(Class=TD%gcd=>20000%SI=<3) T1(Resp=N) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint HP-UX 11.00 # Thanks to Jason Ledbetter TSeq(Class=RI|TD%gcd=<9%SI=>CC) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Contributed by Tkellar@fsp.com Fingerprint IBM 2210 router unknown patch level TSeq(Class=TD%gcd=<6%SI= FingerPrint IBM OS/2 Warp 4.0 TSeq(Class=i800) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to wom@wom.pp.ru FingerPrint IBM OS/2 Warp Server for E-business (Aurora) Beta TSeq(Class=RI%gcd=<6%SI=FF) T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to wom@wom.pp.ru FingerPrint IBM OS/2 Warp Server for E-business (Aurora) Beta TSeq(Class=RI%gcd=<6%SI=FF) T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # added by Beat Rubischon FingerPrint IBM AS/400 V3 and V4 TSeq(Class=RI%gcd=<6) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Simon FingerPrint IBM VM/ESA 2.2.0 CMS Mainframe System TSeq(Class=RI|TD%gcd=64|C8|12C|1F4|190%SI=FF& FingerPrint MultiTech CommPlete Controller TSeq(Class=TR|RI%gcd=<6%SI=>FFFF) T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) FingerPrint MVS TCP/IP TCPMVS 3.2 TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) FingerPrint IBM MVS TCP/IP stack V. 3.2 TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200) T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) FingerPrint IBM MVS TCP/IP TCPOE 3.3 # Thanks to van Hauser TSeq(Class=RI%gcd=<6%SI= TSeq(Class=RI%gcd=64|C8|12C|190) T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Thanks to Daniel Seagraves FingerPrint Instant Internet box TSeq(Class=TD%gcd=1000|2000|3000%SI= FingerPrint Intergraph Workstation (2000 Series) running CLiX R3.1 TSeq(Class=TD%gcd=209|1048|E3F%SI=<5) T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Thanks to Alexander Rylyakov FingerPrint IRIX 5.2 TSeq(Class=64K) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=F000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) FingerPrint IRIX 5.3 # Thanks to David O'Brien & Mea Culpa TSeq(Class=64K) T1(DF=N%W=EF2A|F000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=EF2A|F000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=EF2A|F000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint IRIX 6.2 - 6.5 # Thanks to Lamont Granquist TSeq(Class=TD|64K|RI%gcd=<6|3E8|7D0|BB8|FA0) T1(DF=N%W=EF2A|C000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A|C000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint IRIX 6.2 - 6.4 # Thanks to Lamont Granquist TSeq(Class=i800) T1(DF=N%W=C000|EF2A%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint IRIX 6.4 - 6.5 # Lamont Granquist (again :) TSeq(Class=RI|TD%gcd=28|50|78|A0|C8|F0|140%SI=<3E8) T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Peter Green FingerPrint IRIX 6.5 TSeq(Class=RI%gcd=10%SI=<2222) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Pluvius FingerPrint Kentrox Datasmart 656 CSU/DSU or USR Netserver/16 TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI= FingerPrint Lantronix LSB4 Ethernet Switch TSeq(Class=RI%gcd=<6%SI=>CCC& Fingerprint Linux 1.2.8 - 1.2.13 TSeq(Class=RI%gcd=<6%SI= FingerPrint Linux 2.0.0 TSeq(Class=RI%gcd=<6) T1(DF=N%W=7C00%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=6%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Linux 2.0.27 - 2.0.30 TSeq(Class=TR) T1(DF=N%W=7C00|3C00%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7C00|3C00%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Linux 2.0.32-34 TSeq(Class=TR) T1(DF=N%W=7FE0|3FE0|3FF0%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0|3FE0|3FF0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # On very rare cases, I get a T2 response back -- weird FingerPrint Linux 2.0.32-34 TSeq(Class=TR) T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Linux 2.0.35-36 TSeq(Class=TR) T1(DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to antoine FingerPrint Linux 2.1.24 PowerPC TSeq(Class=TR) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to David G. Andersen # Thanks to Peter Keel FingerPrint Linux 2.1.91 - 2.1.103 TSeq(Class=RI%gcd=<6%SI=>7A000) T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Linux 2.1.122 - 2.1.132; 2.2.0-pre1 - 2.2.0-pre4 TSeq(Class=RI%gcd=<8%SI=>7A000) T1(DF=Y%W=7F53|7C38%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53|7C38%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Contributed by Mike Mason Fingerprint Linux 2.2.0-pre6 - 2.2.0-final TSeq(Class=RI%gcd=<6%SI=>7A000) T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Not really constant -- just slow incrementation # This is an LCIII FingerPrint MacOS 7.1 # Thanks to Renaud Deraison TSeq(Class=C) T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint MacOS 7.5.5 - 8.0 # Thanks to //Stany TSeq(Class=64K) T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Contributed by davidj@zip.com.au FingerPrint MacOS 8 running on an LC 475 TSeq(Class=TR) T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint MacOS 8.5 # Thanks to A.j. Effin ReznoR TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) #FingerPrint MacOS 8.5.1 w/MacTCP #TSeq(Class=64K) #T1(Resp=Y%DF=Y%W=4137%ACK=S++%Flags=AS%Ops=MEWL) #T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) #T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) #T3(Resp=Y%DF=Y%W=4137%ACK=S++%Flags=AS%Ops=MEWL) #T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) #T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) #T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) #T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) #T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) #PU(Resp=Y%DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Chouin FingerPrint APC MasterSwitch Network Power Controller TSeq(Class=TR) T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) FingerPrint AXIS or Meridian Data Network CD-ROM server TSeq(Class=C) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=) T4(DF=N%W=200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) FingerPrint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) TSeq(Class=TD%gcd=40000%SI= FingerPrint Microplex Print Server TSeq(Class=C) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Contributed by Brett G. Lemoine Fingerprint Mirapoint M1000 (OS v 1.0.0) TSeq(Class=RI%gcd=<6) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Thanks to Daniel Seagraves FingerPrint MultiTech CommPlete (modem server) RAScard TSeq(Class=TD%gcd=388|710|A98%SI=<44) T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Sergey Mukhin FingerPrint NCR MP-RAS 3.0.x TSeq(Class=64K) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Peter 'g00bER' Kosinar FingerPrint NCSA Telnet (dos) TSeq(Class=C) T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Thanks to Andrew V. Kovalev # Host information: @WorkStation (i960 based) X-terminal FingerPrint Neoware NetOS V. 2.0.1 TSeq(Class=64K) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Christopher P. Lindsey FingerPrint NetApp OnTap 3.1.6 TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Calle Dybedahl FingerPrint NetApp OnTap 5.1.2 TSeq(Class=RI%gcd=<6%SI=>BBB) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E) # Notes on NetBSD (written by Charles M. Hannum ): # * The set of options in a SYN-ACK depends on the state of the # `net.inet.tcp.rfc1323' flag. # * Releases prior to 1.3 did not randomize the ISS at all. # * Releases prior to 1.3 incorrectly added the IP header length to the IP # packet length when returning an ICMP unreachable. # * Releases prior to 1.3 calculated the window size slightly wrong. # * Releases prior to 1.3 returned a non-zero window size when sending a RST # in response to an ACK on a listening socket (thereby making them # susceptible to stealth scanning). # * Releases prior to 1.3H/1.3.4 did not return a response to the null flag # test (thereby making them susceptible to stealth scanning). # * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in # the encapsulated IP header when sending an ICMP reply. On little endian # machines the IP ID field was byte-swapped. The checksums were always # zeroed. # * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when # MTU discovery was enabled. # Contributed by cjs@cynic.net FingerPrint NetBSD 1.0 little endian arch TSeq(Class=64K) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Contributed by cjs@cynic.net FingerPrint NetBSD 1.0 big endian arch TSeq(Class=64K) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Charles M. Hannum FingerPrint NetBSD 1.1 - 1.2.1 litle endian arch TSeq(Class=64K) T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Charles M. Hannum FingerPrint NetBSD 1.2 - 1.2.1 big endian arch TSeq(Class=64K) T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Charles M. Hannum FingerPrint NetBSD 1.3 - 1.3.3 little endian arch TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Charles M. Hannum FingerPrint NetBSD 1.3 - 1.3.3 big endian arch TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Charles M. Hannum FingerPrint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Charles M. Hannum FingerPrint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) big endian arch TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Charles M. Hannum FingerPrint NetBSD 1.3I (after 19990119) or 1.3.4 TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # A NeXT Turbo, unknown version number FingerPrint NeXT Mach TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint Novell Netware 3.12 - 5.00 # Thanks to Chris Wilson TSeq(Class=TD%gcd=10|20|30|40%SI=<64) T1(DF=Y%W=7D0|8000|2000|1FFF|FFFF%ACK=S++%Flags=AS%Ops=M|ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000|2000|1FFE|FFFF%ACK=O%Flags=AS|ASF%Ops=M|ME) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Jonathan Hunter FingerPrint Novell Netware 3.12 TSeq(Class=TD%gcd=35A3%SI=<5) T1(DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Max Vision FingerPrint OpenStep 4.1/NeXTStep 3.3 TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to jbresley@McLeodUSA.com FingerPrint OpenStep 4.2/Intel TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T1(Resp=Y%DF=N%W=F87%ACK=O%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Anthony J. Bettini # Thanks to Adam Shostack! FingerPrint OpenBSD 2.1 - 2.3/SPARC TSeq(Class=RI%gcd=<6%SI=>FF) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # This fingerprint had LAND patch installed # Contributed by Ivan Beveridge Fingerprint OpenBSD 2.1/X86 TSeq(Class=RI%gcd=<6%SI=>BBB) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint OpenBSD 2.2 - 2.3 TSeq(Class=RI%gcd=<6) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Todd Campbell FingerPrint OpenBSD 2.4 TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint OpenVMS 6.1 # Thanks to Mcneil J TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) FingerPrint OpenVMS 6.2 TSeq(Class=TR) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Brian Gorka FingerPrint OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package TSeq(Class=RI|TD%gcd=<6%SI= FingerPrint OpenVMS 7.1 Alpha running Digital's UCX v4.1ECO2 TCP/IP package TSeq(Class=64K) T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=) T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Thanks to Brian Gorka FingerPrint OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to sena FingerPrint Plan9 (can anyone give me a version number?) TSeq(Class=TR) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Michael Connolly FingerPrint Proteon OpenRoute 2.1 on a RBX200 Router TSeq(Class=TD%gcd=<6%SI= FingerPrint Proteon OpenRoute 3.0 gt series router TSeq(Class=TD%gcd=1%SI=0) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to sena FingerPrint QNX 4.24 TSeq(Class=64K) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Contributed by Sebastian.Schreiber@gmx.net Fingerprint SCO Release 5 TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint SCO OpenServer Release 5 TSeq(Class=RI%gcd=<6) T1(DF=N%W=6000|111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Contributed by Thomas Kellar Fingerprint UnixWare 2.01 TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) FingerPrint SCO UnixWare 2.1 # Thanks to Digital Messiah TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) FingerPrint SCO UnixWare 2.1.2 # Thanks to Drew Morone TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Thanks to Noah Romer FingerPrint SCO UnixWare 7.0.0 TSeq(Class=RI%gcd=FFFF) T1(W=60F4%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=) T4(W=0%ACK=O%Flags=R%Ops=) T5(W=0%ACK=S++%Flags=AR%Ops=) T6(W=0%ACK=O%Flags=R%Ops=) T7(W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Unknown SCO Version -- SysV R3.2 # Thanks to Stuart Stock TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Sten Kalenda FingerPrint Shiva AccessPort Bridge/Router Software V 2.1.0 TSeq(Class=TD%gcd=<6%SI= FingerPrint Shiva LanRover/8E Version 3.5 TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Thanks to Sten Kalenda FingerPrint Solaris 2.3 - 2.4 # Thanks to David O'Brien & Mea Culpa TSeq(Class=64K) T1(DF=Y%W=2332|FFAF%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=2332|FFAF%ACK=S++%Flags=AS%Ops=ME) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Solaris 2.5, 2.51 TSeq(Class=RI%gcd=<6) T1(DF=Y%W=2332|4452|FFAF|8377|879B%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint Solaris 2.6 - 2.7 TSeq(Class=RI%gcd=<6) T1(DF=Y%W=2297|2788|4431|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Contributed by Roger Anthony Fingerprint SonicWall/10 Firewall TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Thanks to Christopher P. Lindsey FingerPrint SPP-UX 5.2.1 TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=) T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Dug Song FingerPrint SPP-UX 5.x on a Convex SPP-1600 TSeq(Class=C) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=R%Ops=) T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Nickolai Zeldovich FingerPrint SunOS 4.0.3 TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Thanks to Bill Fenner Fingerprint SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Thanks to Bennett Todd FingerPrint SunOS 4.1.1 - 4.1.4 (or derivative) # Thanks to Renaud Deraison, Jericho, Lamont Granquist, and others TSeq(Class=64K) T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E) # Thanks to Sandor Barany" FingerPrint Tektronix Phaser 360 Extended TSeq(Class=i800) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to eddie FingerPrint Telebit Netblazer V3.32 Patchlevel 4 TSeq(Class=TD%gcd=40000|80000|C0000%SI= FingerPrint TOPS-20 Monitor 7(102540)-1,TD-1 TSeq(Class=TD%gcd=30000|60000|90000%SI= FingerPrint Toshiba TR650 ISDN Router TSeq(Class=TD%gcd=<9%SI=<14) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Thanks to David O'Brien & Mea Culpa & Keith Lewis FingerPrint Ultrix 4.2 - 4.5 TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) FingerPrint Windows NT4 / Win95 / Win98 TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4) T1(DF=Y%W=2017|16D0|860|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017|16D0|860|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Mike Bressem FingerPrint Windows NT4 / Win95 / Win98 TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4) T1(DF=Y%W=2017|16D0|860|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Thanks to Jan Koum -- ntbeta.microsoft.com FingerPrint Windows NT 5 Beta2 or Beta3 TSeq(Class=TD%gcd=<6%SI=<1000) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Contributed by Gideon Fingerprint Windows 2000 Beta 3 RC 5 (WinNT 5.0) TSeq(Class=TD%gcd=2|4|6|8|A%SI=<222) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) FingerPrint WorldGroup BBS (MajorBBS) w/TCP/IP TSeq(Class=RI|TR%gcd=<6%SI=>FFFF& FingerPrint VAX/VMS v5.5, CMU-TEK TCP/IP stack TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=64%ACK=O%Flags=AR%Ops=) T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=64%ACK=O%Flags=AR%Ops=) T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=) PU(Resp=N) FingerPrint VAX 7000-610 or 4200/SPX OR 6000-430 TSeq(Class=64K) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1800%ACK=O%Flags=A%Ops=) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Contributed by Matt Piechota Fingerprint Xerox 8830 Plotter TSeq(Class=TD%gcd=1000%SI=1) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) FingerPrint Xerox DocuPrint C55 TSeq(Class=TD%gcd=1000|2000|3000|4000%SI= FingerPrint Xylogics Remote Annex 4000 terminal server TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Thanks to Roeland Th Jansen FingerPrint Zyxel P128imh router TSeq(Class=TD%gcd=1000|2000|5000|4000|6000|8000|A000%SI=<5) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) nmap-2.08/nmap-services100600 764 764 256743 6657436537 14252 0ustar fyodorfyodortcpmux 1/tcp # TCP Port Service Multiplexer [rfc-1078] tcpmux 1/udp # TCP Port Service Multiplexer compressnet 2/tcp # Management Utility compressnet 2/udp # Management Utility compressnet 3/tcp # Compression Process compressnet 3/udp # Compression Process rje 5/tcp # Remote Job Entry rje 5/udp # Remote Job Entry echo 7/tcp # echo 7/udp # discard 9/tcp # sink null discard 9/udp # sink null systat 11/tcp # Active Users systat 11/udp # Active Users daytime 13/tcp # daytime 13/udp # netstat 15/tcp # qotd 17/tcp # Quote of the Day qotd 17/udp # Quote of the Day msp 18/tcp # Message Send Protocol msp 18/udp # Message Send Protocol chargen 19/tcp # ttytst source Character Generator chargen 19/udp # ttytst source Character Generator ftp-data 20/tcp # File Transfer [Default Data] ftp-data 20/udp # File Transfer [Default Data] ftp 21/tcp # File Transfer [Control] ftp 21/udp # File Transfer [Control] ssh 22/tcp # Secure Shell Login ssh 22/udp # Secure Shell Login telnet 23/tcp # telnet 23/udp # priv-mail 24/tcp # any private mail system priv-mail 24/udp # any private mail system smtp 25/tcp # Simple Mail Transfer smtp 25/udp # Simple Mail Transfer nsw-fe 27/tcp # NSW User System FE nsw-fe 27/udp # NSW User System FE msg-icp 29/tcp # MSG ICP msg-icp 29/udp # MSG ICP msg-auth 31/tcp # MSG Authentication msg-auth 31/udp # MSG Authentication dsp 33/tcp # Display Support Protocol dsp 33/udp # Display Support Protocol priv-print 35/tcp # any private printer server priv-print 35/udp # any private printer server time 37/tcp # timserver time 37/udp # timserver rap 38/tcp # Route Access Protocol rap 38/udp # Route Access Protocol rlp 39/tcp # Resource Location Protocol rlp 39/udp # Resource Location Protocol graphics 41/tcp # graphics 41/udp # nameserver 42/tcp # Host Name Server nameserver 42/udp # Host Name Server whois 43/tcp # nicname shois 43/udp # nicname mpm-flags 44/tcp # MPM FLAGS Protocol mpm-flags 44/udp # MPM FLAGS Protocol mpm 45/tcp # Message Processing Module [recv] mpm 45/udp # Message Processing Module [recv] mpm-snd 46/tcp # MPM [default send] mpm-snd 46/udp # MPM [default send] ni-ftp 47/tcp # NI FTP ni-ftp 47/udp # NI FTP auditd 48/tcp # Digital Audit Daemon auditd 48/udp # Digital Audit Daemon tacacs 49/tcp # Login Host Protocol (TACACS) tacacs 49/udp # Login Host Protocol (TACACS) re-mail-ck 50/tcp # Remote Mail Checking Protocol re-mail-ck 50/udp # Remote Mail Checking Protocol la-maint 51/tcp # IMP Logical Address Maintenance la-maint 51/udp # IMP Logical Address Maintenance xns-time 52/tcp # XNS Time Protocol xns-time 52/udp # XNS Time Protocol domain 53/tcp # Domain Name Server domain 53/udp # Domain Name Server xns-ch 54/tcp # XNS Clearinghouse xns-ch 54/udp # XNS Clearinghouse isi-gl 55/tcp # ISI Graphics Language isi-gl 55/udp # ISI Graphics Language xns-auth 56/tcp # XNS Authentication xns-auth 56/udp # XNS Authentication priv-term 57/tcp # any private terminal access priv-term 57/udp # any private terminal access xns-mail 58/tcp # XNS Mail xns-mail 58/udp # XNS Mail priv-file 59/tcp # any private file service priv-file 59/udp # any private file service ni-mail 61/tcp # NI MAIL ni-mail 61/udp # NI MAIL acas 62/tcp # ACA Services acas 62/udp # ACA Services via-ftp 63/tcp # VIA Systems - FTP & whois++ via-ftp 63/udp # VIA Systems - FTP & whois++ covia 64/tcp # Communications Integrator (CI) covia 64/udp # Communications Integrator (CI) tacacs-ds 65/tcp # TACACS-Database Service tacacs-ds 65/udp # TACACS-Database Service sql*net 66/tcp # Oracle SQL*NET sql*net 66/udp # Oracle SQL*NET bootps 67/tcp # Bootstrap Protocol Server bootps 67/udp # Bootstrap Protocol Server bootpc 68/tcp # Bootstrap Protocol Client bootpc 68/udp # Bootstrap Protocol Client tftp 69/tcp # Trivial File Transfer tftp 69/udp # Trivial File Transfer gopher 70/tcp # gopher 70/udp # netrjs-1 71/tcp # Remote Job Service netrjs-1 71/udp # Remote Job Service netrjs-2 72/tcp # Remote Job Service netrjs-2 72/udp # Remote Job Service netrjs-3 73/tcp # Remote Job Service netrjs-3 73/udp # Remote Job Service netrjs-4 74/tcp # Remote Job Service netrjs-4 74/udp # Remote Job Service priv-dial 75/tcp # any private dial out service priv-dial 75/udp # any private dial out service deos 76/tcp # Distributed External Object Store deos 76/udp # Distributed External Object Store priv-rje 77/tcp # any private RJE service, netrjs priv-rje 77/udp # any private RJE service, netjrs vettcp 78/tcp # vettcp 78/udp # finger 79/tcp # finger 79/udp # http 80/tcp # World Wide Web HTTP http 80/udp # World Wide Web HTTP hosts2-ns 81/tcp # HOSTS2 Name Server hosts2-ns 81/udp # HOSTS2 Name Server xfer 82/tcp # XFER Utility xfer 82/udp # XFER Utility mit-ml-dev 83/tcp # MIT ML Device mit-ml-dev 83/udp # MIT ML Device ctf 84/tcp # Common Trace Facility ctf 84/udp # Common Trace Facility mit-ml-dev 85/tcp # MIT ML Device mit-ml-dev 85/udp # MIT ML Device mfcobol 86/tcp # Micro Focus Cobol mfcobol 86/udp # Micro Focus Cobol priv-term-l 87/tcp # any private terminal link, ttylink kerberos-sec 88/tcp # Kerberos (v5) kerberos-sec 88/udp # Kerberos (v5) su-mit-tg 89/tcp # SU/MIT Telnet Gateway su-mit-tg 89/udp # SU/MIT Telnet Gateway dnsix 90/tcp # DNSIX Securit Attribute Token Map dnsix 90/udp # DNSIX Securit Attribute Token Map mit-dov 91/tcp # MIT Dover Spooler mit-dov 91/udp # MIT Dover Spooler npp 92/tcp # Network Printing Protocol npp 92/udp # Network Printing Protocol dcp 93/tcp # Device Control Protocol dcp 93/udp # Device Control Protocol objcall 94/tcp # Tivoli Object Dispatcher objcall 94/udp # Tivoli Object Dispatcher supdup 95/tcp # BSD supdupd(8) supdup 95/udp # dixie 96/tcp # DIXIE Protocol Specification dixie 96/udp # DIXIE Protocol Specification swift-rvf 97/tcp # Swift Remote Virtural File Protocol swift-rvf 97/udp # Swift Remote Virtural File Protocol tacnews 98/tcp # TAC News tacnews 98/udp # TAC News metagram 99/tcp # Metagram Relay metagram 99/udp # Metagram Relay newacct 100/tcp # [unauthorized use] hostname 101/tcp # hostnames NIC Host Name Server hostname 101/udp # hostnames NIC Host Name Server iso-tsap 102/tcp # tsap ISO-TSAP Class 0 iso-tsap 102/udp # tsap ISO-TSAP Class 0 gppitnp 103/tcp # Genesis Point-to-Point Trans Net, or x400 ISO Email gppitnp 103/udp # Genesis Point-to-Point Trans Net acr-nema 104/tcp # ACR-NEMA Digital Imag. & Comm. 300 acr-nema 104/udp # ACR-NEMA Digital Imag. & Comm. 300 csnet-ns 105/tcp # Mailbox Name Nameserver csnet-ns 105/udp # Mailbox Name Nameserver pop3pw 106/tcp # Eudora compatible PW changer 3com-tsmux 106/udp # rtelnet 107/tcp # Remote Telnet rtelnet 107/udp # Remote Telnet Service snagas 108/tcp # SNA Gateway Access Server snagas 108/udp # SNA Gateway Access Server pop-2 109/tcp # PostOffice V.2 pop-2 109/udp # PostOffice V.2 pop-3 110/tcp # PostOffice V.3 pop-3 110/udp # PostOffice V.3 sunrpc 111/tcp # portmapper, rpcbind sunrpc 111/udp # portmapper, rpcbind mcidas 112/tcp # McIDAS Data Transmission Protocol mcidas 112/udp # McIDAS Data Transmission Protocol auth 113/tcp # ident, tap, Authentication Service auth 113/udp # ident, tap, Authentication Service audionews 114/tcp # Audio News Multicast audionews 114/udp # Audio News Multicast sftp 115/tcp # Simple File Transfer Protocol sftp 115/udp # Simple File Transfer Protocol ansanotify 116/tcp # ANSA REX Notify ansanotify 116/udp # ANSA REX Notify uucp-path 117/tcp # UUCP Path Service uucp-path 117/udp # UUCP Path Service sqlserv 118/tcp # SQL Services sqlserv 118/udp # SQL Services nntp 119/tcp # Network News Transfer Protocol nntp 119/udp # Network News Transfer Protocol cfdptkt 120/tcp # cfdptkt 120/udp # erpc 121/tcp # Encore Expedited Remote Pro.Call erpc 121/udp # Encore Expedited Remote Pro.Call smakynet 122/tcp # smakynet 122/udp # ntp 123/tcp # Network Time Protocol ntp 123/udp # Network Time Protocol ansatrader 124/tcp # ANSA REX Trader ansatrader 124/udp # ANSA REX Trader locus-map 125/tcp # Locus PC-Interface Net Map Ser locus-map 125/udp # Locus PC-Interface Net Map Ser unitary 126/tcp # Unisys Unitary Login unitary 126/udp # Unisys Unitary Login locus-con 127/tcp # Locus PC-Interface Conn Server locus-con 127/udp # Locus PC-Interface Conn Server gss-xlicen 128/tcp # GSS X License Verification gss-xlicen 128/udp # GSS X License Verification pwdgen 129/tcp # Password Generator Protocol pwdgen 129/udp # Password Generator Protocol cisco-fna 130/tcp # cisco FNATIVE cisco-fna 130/udp # cisco FNATIVE cisco-tna 131/tcp # cisco TNATIVE cisco-tna 131/udp # cisco TNATIVE cisco-sys 132/tcp # cisco SYSMAINT cisco-sys 132/udp # cisco SYSMAINT statsrv 133/tcp # Statistics Service statsrv 133/udp # Statistics Service ingres-net 134/tcp # INGRES-NET Service ingres-net 134/udp # INGRES-NET Service loc-srv 135/tcp # NCS local location broker loc-srv 135/udp # Location Service profile 136/tcp # PROFILE Naming System profile 136/udp # PROFILE Naming System netbios-ns 137/tcp # NETBIOS Name Service netbios-ns 137/udp # NETBIOS Name Service netbios-dgm 138/tcp # NETBIOS Datagram Service netbios-dgm 138/udp # NETBIOS Datagram Service netbios-ssn 139/tcp # NETBIOS Session Service netbios-ssn 139/udp # NETBIOS Session Service emfis-data 140/tcp # EMFIS Data Service emfis-data 140/udp # EMFIS Data Service emfis-cntl 141/tcp # EMFIS Control Service emfis-cntl 141/udp # EMFIS Control Service bl-idm 142/tcp # Britton-Lee IDM bl-idm 142/udp # Britton-Lee IDM imap2 143/tcp # Interim Mail Access Protocol v2 imap2 143/udp # Interim Mail Access Protocol v2 news 144/tcp # NewS window system news 144/udp # NewS window system uaac 145/tcp # UAAC Protocol uaac 145/udp # UAAC Protocol iso-tp0 146/tcp # iso-tp0 146/udp # iso-ip 147/tcp # iso-ip 147/udp # cronus 148/tcp # CRONUS-SUPPORT cronus 148/udp # CRONUS-SUPPORT aed-512 149/tcp # AED 512 Emulation Service aed-512 149/udp # AED 512 Emulation Service sql-net 150/tcp # sql-net 150/udp # hems 151/tcp # hems 151/udp # bftp 152/tcp # Background File Transfer Program bftp 152/udp # Background File Transfer Program sgmp 153/tcp # sgmp 153/udp # netsc-prod 154/tcp # netsc-prod 154/udp # netsc-dev 155/tcp # netsc-dev 155/udp # sqlsrv 156/tcp # SQL Service sqlsrv 156/udp # SQL Service knet-cmp 157/tcp # KNET/VM Command/Message Protocol knet-cmp 157/udp # KNET/VM Command/Message Protocol pcmail-srv 158/tcp # PCMail Server pcmail-srv 158/udp # PCMail Server nss-routing 159/tcp # nss-routing 159/udp # sgmp-traps 160/tcp # sgmp-traps 160/udp # snmp 161/tcp # snmp 161/udp # Simple Net Mgmt Proto snmptrap 162/tcp # snmp-trap snmptrap 162/udp # snmp-trap cmip-man 163/tcp # CMIP/TCP Manager cmip-man 163/udp # CMIP/TCP Manager cmip-agent 164/tcp # CMIP/TCP Agent smip-agent 164/udp # CMIP/TCP Agent xns-courier 165/tcp # Xerox xns-courier 165/udp # Xerox s-net 166/tcp # Sirius Systems s-net 166/udp # Sirius Systems namp 167/tcp # namp 167/udp # rsvd 168/tcp # rsvd 168/udp # send 169/tcp # send 169/udp # print-srv 170/tcp # Network PostScript print-srv 170/udp # Network PostScript multiplex 171/tcp # Network Innovations Multiplex multiplex 171/udp # Network Innovations Multiplex cl/1 172/tcp # Network Innovations CL/1 cl/1 172/udp # Network Innovations CL/1 xyplex-mux 173/tcp # xyplex-mux 173/udp # mailq 174/tcp # mailq 174/udp # vmnet 175/tcp # vmnet 175/udp # genrad-mux 176/tcp # genrad-mux 176/udp # xdmcp 177/tcp # X Display Mgr. Control Proto xdmcp 177/udp # X Display Manager Control Protocol nextstep 178/tcp # NextStep Window Server nextstep 178/udp # NextStep Window Server bgp 179/tcp # Border Gateway Protocol bgp 179/udp # Border Gateway Protocol ris 180/tcp # Intergraph ris 180/udp # Intergraph unify 181/tcp # unify 181/udp # audit 182/tcp # Unisys Audit SITP audit 182/udp # Unisys Audit SITP ocbinder 183/tcp # ocbinder 183/udp # ocserver 184/tcp # ocserver 184/udp # remote-kis 185/tcp # remote-kis 185/udp # kis 186/tcp # KIS Protocol kis 186/udp # KIS Protocol aci 187/tcp # Application Communication Interface aci 187/udp # Application Communication Interface mumps 188/tcp # Plus Five's MUMPS mumps 188/udp # Plus Five's MUMPS qft 189/tcp # Queued File Transport qft 189/udp # Queued File Transport gacp 190/tcp # Gateway Access Control Protocol cacp 190/udp # Gateway Access Control Protocol prospero 191/tcp # Prospero Directory Service prospero 191/udp # Prospero Directory Service osu-nms 192/tcp # OSU Network Monitoring System osu-nms 192/udp # OSU Network Monitoring System srmp 193/tcp # Spider Remote Monitoring Protocol srmp 193/udp # Spider Remote Monitoring Protocol irc 194/tcp # Internet Relay Chat irc 194/udp # Internet Relay Chat Protocol dn6-nlm-aud 195/tcp # DNSIX Network Level Module Audit dn6-nlm-aud 195/udp # DNSIX Network Level Module Audit dn6-smm-red 196/tcp # DNSIX Session Mgt Module Audit Redir dn6-smm-red 196/udp # DNSIX Session Mgt Module Audit Redir dls 197/tcp # Directory Location Service dls 197/udp # Directory Location Service dls-mon 198/tcp # Directory Location Service Monitor dls-mon 198/udp # Directory Location Service Monitor smux 199/tcp # SNMP Unix Multiplexer smux 199/udp # src 200/tcp # IBM System Resource Controller src 200/udp # IBM System Resource Controller at-rtmp 201/tcp # AppleTalk Routing Maintenance at-rtmp 201/udp # AppleTalk Routing Maintenance at-nbp 202/tcp # AppleTalk Name Binding at-nbp 202/udp # AppleTalk Name Binding at-3 203/tcp # AppleTalk Unused at-3 203/udp # AppleTalk Unused at-echo 204/tcp # AppleTalk Echo at-echo 204/udp # AppleTalk Echo at-5 205/tcp # AppleTalk Unused at-5 205/udp # AppleTalk Unused at-zis 206/tcp # AppleTalk Zone Information at-zis 206/udp # AppleTalk Zone Information at-7 207/tcp # AppleTalk Unused at-7 207/udp # AppleTalk Unused at-8 208/tcp # AppleTalk Unused at-8 208/udp # AppleTalk Unused tam 209/tcp # Trivial Authenticated Mail Protocol tam 209/udp # Trivial Authenticated Mail Protocol z39.50 210/tcp # wais, ANSI Z39.50 z39.50 210/udp # wais, ANSI Z39.50 914c/g 211/tcp # Texas Instruments 914C/G Terminal 914c/g 211/udp # Texas Instruments 914C/G Terminal anet 212/tcp # ATEXSSTR anet 212/udp # ATEXSSTR ipx 213/tcp # ipx 213/udp # vmpwscs 214/tcp # vmpwscs 214/udp # softpc 215/tcp # Insignia Solutions softpc 215/udp # Insignia Solutions atls 216/tcp # Access Technology License Server atls 216/udp # Access Technology License Server dbase 217/tcp # dBASE Unix dbase 217/udp # dBASE Unix mpp 218/tcp # Netix Message Posting Protocol mpp 218/udp # Netix Message Posting Protocol uarps 219/tcp # Unisys ARPs uarps 219/udp # Unisys ARPs imap3 220/tcp # Interactive Mail Access Protocol v3 imap3 220/udp # Interactive Mail Access Protocol v3 fln-spx 221/tcp # Berkeley rlogind with SPX auth fln-spx 221/udp # Berkeley rlogind with SPX auth rsh-spx 222/tcp # Berkeley rshd with SPX auth rsh-spx 222/udp # Berkeley rshd with SPX auth cdc 223/tcp # Certificate Distribution Center cdc 223/udp # Certificate Distribution Center direct 242/tcp # direct 242/udp # sur-meas 243/tcp # Survey Measurement sur-meas 243/udp # Survey Measurement dayna 244/tcp # dayna 244/udp # link 245/tcp # link 245/udp # dsp3270 246/tcp # Display Systems Protocol dsp3270 246/udp # Display Systems Protocol subntbcst_tftp 247/tcp # subntbcst_tftp 247/udp # bhfhs 248/tcp # bhfhs 248/udp # rap 256/tcp # rap 256/udp # set 257/tcp # secure electronic transaction set 257/udp # secure electronic transaction yak-chat 258/tcp # yak winsock personal chat yak-chat 258/udp # yak winsock personal chat esro-gen 259/tcp # efficient short remote operations esro-gen 259/udp # efficient short remote operations openport 260/tcp # openport 260/udp # nsiiops 261/tcp # iiop name service over tls/ssl nsiiops 261/udp # iiop name service over tls/ssl arcisdms 262/tcp # arcisdms 262/udp # hdap 263/tcp # hdap 263/udp # bgmp 264/tcp # bgmp 264/udp # http-mgmt 280/tcp # http-mgmt 280/udp # personal-link 281/tcp # personal-link 281/udp # cableport-ax 282/tcp # cable port a/x cableport-ax 282/udp # cable port a/x novastorbakcup 308/tcp # novastor backup novastorbakcup 308/udp # novastor backup entrusttime 309/tcp # entrusttime 309/udp # bhmds 310/tcp # bhmds 310/udp # asip-webadmin 311/tcp # appleshare ip webadmin asip-webadmin 311/udp # appleshare ip webadmin vslmp 312/tcp # vslmp 312/udp # magenta-logic 313/tcp # magenta-logic 313/udp # opalis-robot 314/tcp # opalis-robot 314/udp # dpsi 315/tcp # dpsi 315/udp # decauth 316/tcp # decauth 316/udp # zannet 317/tcp # zannet 317/udp # pip 321/tcp # pip 321/udp # pdap 344/tcp # Prospero Data Access Protocol pdap 344/udp # Prospero Data Access Protocol pawserv 345/tcp # Perf Analysis Workbench pawserv 345/udp # Perf Analysis Workbench zserv 346/tcp # Zebra server zserv 346/udp # Zebra server fatserv 347/tcp # Fatmen Server fatserv 347/udp # Fatmen Server csi-sgwp 348/tcp # Cabletron Management Protocol csi-sgwp 348/udp # Cabletron Management Protocol mftp 349/tcp # mftp 349/udp # matip-type-a 350/tcp # MATIP Type A matip-type-a 350/udp # matip-type-b 351/tcp # MATIP Type B or bhoetty matip-type-b 351/udp # MATIP Type B or bhoetty dtag-ste-sb 352/tcp # DTAG, or bhoedap4 dtag-ste-sb 352/udp # DTAG, or bhoedap4 ndsauth 353/tcp # ndsauth 353/udp # bh611 354/tcp # bh611 354/udp # datex-asn 355/tcp # datex-asn 355/udp # cloanto-net-1 356/tcp # Cloanto Net 1 cloanto-net-1 356/udp # bhevent 357/tcp # bhevent 357/udp # shrinkwrap 358/tcp # shrinkwrap 358/udp # tenebris_nts 359/tcp # Tenebris Network Trace Service tenebris_nts 359/udp # Tenebris Network Trace Service scoi2odialog 360/tcp # scoi2odialog 360/udp # semantix 361/tcp # semantix 361/udp # srssend 362/tcp # SRS Send srssend 362/udp # SRS Send rsvp_tunnel 363/tcp # rsvp_tunnel 363/udp # aurora-cmgr 364/tcp # aurora-cmgr 364/udp # dtk 365/tcp # Deception Tool Kit (lame -- see www.all.net) dtk 365/udp # Deception Tool Kit (lame -- see www.all.net) odmr 366/tcp # odmr 366/udp # mortgageware 367/tcp # mortgageware 367/udp # qbikgdp 368/tcp # qbikgdp 368/udp # rpc2portmap 369/tcp # rpc2portmap 369/udp # codaauth2 370/tcp # codaauth2 370/udp # clearcase 371/tcp # clearcase 371/udp # ulistserv 372/tcp # Unix Listserv ulistserv 372/udp # Unix Listserv legent-1 373/tcp # Legent Corporation (now Computer Associates Intl.) legent-1 373/udp # Legent Corporation (now Computer Associates Intl.) legent-2 374/tcp # Legent Corporation (now Computer Associates Intl.) legent-2 374/udp # Legent Corporation (now Computer Associates Intl.) hassle 375/tcp # hassle 375/udp # nip 376/tcp # Amiga Envoy Network Inquiry Proto nip 376/udp # Amiga Envoy Network Inquiry Proto tnETOS 377/tcp # NEC Corporation tnETOS 377/udp # NEC Corporation dsETOS 378/tcp # NEC Corporation dsETOS 378/udp # NEC Corporation is99c 379/tcp # TIA/EIA/IS-99 modem client is99c 379/udp # TIA/EIA/IS-99 modem client is99s 380/tcp # TIA/EIA/IS-99 modem server is99s 380/udp # TIA/EIA/IS-99 modem server hp-collector 381/tcp # hp performance data collector hp-collector 381/udp # hp performance data collector hp-managed-node 382/tcp # hp performance data managed node hp-managed-node 382/udp # hp performance data managed node hp-alarm-mgr 383/tcp # hp performance data alarm manager hp-alarm-mgr 383/udp # hp performance data alarm manager arns 384/tcp # A Remote Network Server System arns 384/udp # A Remote Network Server System ibm-app 385/tcp # IBM Application ibm-app 385/udp # IBM Application asa 386/tcp # ASA Message Router Object Def. asa 386/udp # ASA Message Router Object Def. aurp 387/tcp # Appletalk Update-Based Routing Pro. aurp 387/udp # Appletalk Update-Based Routing Pro. unidata-ldm 388/tcp # Unidata LDM Version 4 unidata-ldm 388/udp # Unidata LDM Version 4 ldap 389/tcp # Lightweight Directory Access Protocol ldap 389/udp # Lightweight Directory Access Protocol uis 390/tcp # uis 390/udp # synotics-relay 391/tcp # SynOptics SNMP Relay Port synotics-relay 391/udp # SynOptics SNMP Relay Port synotics-broker 392/tcp # SynOptics Port Broker Port synotics-broker 392/udp # SynOptics Port Broker Port dis 393/tcp # Data Interpretation System dis 393/udp # Data Interpretation System embl-ndt 394/tcp # EMBL Nucleic Data Transfer embl-ndt 394/udp # EMBL Nucleic Data Transfer netcp 395/tcp # NETscout Control Protocol netcp 395/udp # NETscout Control Protocol netware-ip 396/tcp # Novell Netware over IP netware-ip 396/udp # Novell Netware over IP mptn 397/tcp # Multi Protocol Trans. Net. mptn 397/udp # Multi Protocol Trans. Net. kryptolan 398/tcp # kryptolan 398/udp # iso-tsap-c2 399/tcp # ISO-TSAP Class 2 iso-tsap-c2 399/udp # ISO-TSAP Class 2 work-sol 400/tcp # Workstation Solutions work-sol 400/udp # Workstation Solutions ups 401/tcp # Uninterruptible Power Supply ups 401/udp # Uninterruptible Power Supply genie 402/tcp # Genie Protocol genie 402/udp # Genie Protocol decap 403/tcp # decap 403/udp # nced 404/tcp # nced 404/udp # ncld 405/tcp # ncld 405/udp # imsp 406/tcp # Interactive Mail Support Protocol imsp 406/udp # Interactive Mail Support Protocol timbuktu 407/tcp # timbuktu 407/udp # prm-sm 408/tcp # Prospero Resource Manager Sys. Man. prm-sm 408/udp # Prospero Resource Manager Sys. Man. prm-nm 409/tcp # Prospero Resource Manager Node Man. prm-nm 409/udp # Prospero Resource Manager Node Man. decladebug 410/tcp # DECLadebug Remote Debug Protocol decladebug 410/udp # DECLadebug Remote Debug Protocol rmt 411/tcp # Remote MT Protocol rmt 411/udp # Remote MT Protocol synoptics-trap 412/tcp # Trap Convention Port synoptics-trap 412/udp # Trap Convention Port smsp 413/tcp # smsp 413/udp # infoseek 414/tcp # infoseek 414/udp # bnet 415/tcp # bnet 415/udp # silverplatter 416/tcp # silverplatter 416/udp # onmux 417/tcp # onmux 417/udp # hyper-g 418/tcp # hyper-g 418/udp # ariel1 419/tcp # ariel1 419/udp # smpte 420/tcp # smpte 420/udp # ariel2 421/tcp # ariel2 421/udp # ariel3 422/tcp # ariel3 422/udp # opc-job-start 423/tcp # IBM Operations Planning and Control Start opc-job-start 423/udp # IBM Operations Planning and Control Start opc-job-track 424/tcp # IBM Operations Planning and Control Track opc-job-track 424/udp # IBM Operations Planning and Control Track icad-el 425/tcp # icad-el 425/udp # smartsdp 426/tcp # smartsdp 426/udp # svrloc 427/tcp # Server Location svrloc 427/udp # Server Location ocs_cmu 428/tcp # ocs_cmu 428/udp # ocs_amu 429/tcp # ocs_amu 429/udp # utmpsd 430/tcp # utmpsd 430/udp # utmpcd 431/tcp # utmpcd 431/udp # iasd 432/tcp # iasd 432/udp # nnsp 433/tcp # Usenet, Network News Transfer nnsp 433/udp # mobileip-agent 434/tcp # mobileip-agent 434/udp # mobilip-mn 435/tcp # mobilip-mn 435/udp # dna-cml 436/tcp # dna-cml 436/udp # comscm 437/tcp # comscm 437/udp # dsfgw 438/tcp # dsfgw 438/udp # dasp 439/tcp # dasp 439/udp # sgcp 440/tcp # sgcp 440/udp # decvms-sysmgt 441/tcp # decvms-sysmgt 441/udp # cvc_hostd 442/tcp # cvc_hostd 442/udp # https 443/tcp # secure http (SSL) https 443/udp # snpp 444/tcp # Simple Network Paging Protocol snpp 444/udp # Simple Network Paging Protocol microsoft-ds 445/tcp # microsoft-ds 445/udp # ddm-rdb 446/tcp # ddm-rdb 446/udp # ddm-dfm 447/tcp # ddm-dfm 447/udp # ddm-ssl 448/tcp # ddm-byte ddm-ssl 448/udp # ddm-byte as-servermap 449/tcp # AS Server Mapper as-servermap 449/udp # AS Server Mapper tserver 450/tcp # tserver 450/udp # sfs-smp-net 451/tcp # Cray Network Semaphore server sfs-smp-net 451/udp # Cray Network Semaphore server sfs-config 452/tcp # Cray SFS config server sfs-config 452/udp # Cray SFS config server creativeserver 453/tcp # creativeserver 453/udp # contentserver 454/tcp # contentserver 454/udp # creativepartnr 455/tcp # creativepartnr 455/udp # macon-tcp 456/tcp # macon-udp 456/udp # scohelp 457/tcp # scohelp 457/udp # appleqtc 458/tcp # apple quick time appleqtc 458/udp # apple quick time ampr-rcmd 459/tcp # ampr-rcmd 459/udp # skronk 460/tcp # skronk 460/udp # datasurfsrv 461/tcp # datasurfsrv 461/udp # datasurfsrvsec 462/tcp # datasurfsrvsec 462/udp # alpes 463/tcp # alpes 463/udp # kpasswd5 464/tcp # Kerberos (v5) kpasswd5 464/udp # Kerberos (v5) smtps 465/tcp # smtp protocol over TLS/SSL (was ssmtp) smtps 465/udp # smtp protocol over TLS/SSL (was ssmtp) digital-vrc 466/tcp # digital-vrc 466/udp # mylex-mapd 467/tcp # mylex-mapd 467/udp # photuris 468/tcp # Photuris Key Management photuris 468/udp # rcp 469/tcp # Radio Control Protocol rcp 469/udp # Radio Control Protocol scx-proxy 470/tcp # scx-proxy 470/udp # mondex 471/tcp # mondex 471/udp # ljk-login 472/tcp # ljk-login 472/udp # hybrid-pop 473/tcp # hybrid-pop 473/udp # tn-tl-w1 474/tcp # tn-tl-w2 474/udp # tcpnethaspsrv 475/tcp # tcpnethaspsrv 475/udp # tn-tl-fd1 476/tcp # tn-tl-fd1 476/udp # ss7ns 477/tcp # ss7ns 477/udp # spsc 478/tcp # spsc 478/udp # iafserver 479/tcp # iafserver 479/udp # loadsrv 480/tcp # iafdbase 480/udp # dvs 481/tcp # ph 481/udp # bgs-nsi 482/tcp # xlog 482/udp # ulpnet 483/tcp # ulpnet 483/udp # integra-sme 484/tcp # Integra Software Management Environment integra-sme 484/udp # Integra Software Management Environment powerburst 485/tcp # Air Soft Power Burst powerburst 485/udp # Air Soft Power Burst sstats 486/tcp # avian 486/udp # saft 487/tcp # saft Simple Asynchronous File Transfer saft 487/udp # saft Simple Asynchronous File Transfer gss-http 488/tcp # gss-http 488/udp # nest-protocol 489/tcp # nest-protocol 489/udp # micom-pfs 490/tcp # micom-pfs 490/udp # go-login 491/tcp # go-login 491/udp # ticf-1 492/tcp # Transport Independent Convergence for FNA ticf-1 492/udp # Transport Independent Convergence for FNA ticf-2 493/tcp # Transport Independent Convergence for FNA ticf-2 493/udp # Transport Independent Convergence for FNA pov-ray 494/tcp # pov-ray 494/udp # intecourier 495/tcp # intecourier 495/udp # pim-rp-disc 496/tcp # pim-rp-disc 496/udp # dantz 497/tcp # dantz 497/udp # siam 498/tcp # siam 498/udp # iso-ill 499/tcp # ISO ILL Protocol iso-ill 499/udp # ISO ILL Protocol isakmp 500/tcp # isakmp 500/udp # stmf 501/tcp # stmf 501/udp # asa-appl-proto 502/tcp # asa-appl-proto 502/udp # intrinsa 503/tcp # intrinsa 503/udp # citadel 504/tcp # citadel 504/udp # mailbox-lm 505/tcp # mailbox-lm 505/udp # ohimsrv 506/tcp # ohimsrv 506/udp # crs 507/tcp # crs 507/udp # xvttp 508/tcp # xvttp 508/udp # snare 509/tcp # snare 509/udp # fcp 510/tcp # FirstClass Protocol fcp 510/udp # FirstClass Protocol passgo 511/tcp # passgo 511/udp # exec 512/tcp # BSD rexecd(8) biff 512/udp # comsat login 513/tcp # BSD rlogind(8) who 513/udp # BSD rwhod(8) shell 514/tcp # BSD rshd(8) syslog 514/udp # BSD syslogd(8) printer 515/tcp # spooler (lpd) printer 515/udp # spooler (lpd) videotex 516/tcp # videotex 516/udp # talk 517/tcp # like tenex link, but across talk 517/udp # BSD talkd(8) ntalk 518/tcp # (talkd) ntalk 518/udp # (talkd) utime 519/tcp # unixtime utime 519/udp # unixtime efs 520/tcp # extended file name server route 520/udp # router routed -- RIP ripng 521/tcp # ripng 521/udp # ulp 522/tcp # ulp 522/udp # ibm-db2 523/tcp # ibm-db2 523/udp # ncp 524/tcp # ncp 524/udp # timed 525/tcp # timeserver timed 525/udp # timeserver tempo 526/tcp # newdate tempo 526/udp # newdate stx 527/tcp # Stock IXChange stx 527/udp # Stock IXChange custix 528/tcp # Customer IXChange custix 528/udp # Customer IXChange irc-serv 529/tcp # irc-serv 529/udp # courier 530/tcp # rpc courier 530/udp # rpc conference 531/tcp # chat conference 531/udp # chat netnews 532/tcp # readnews netnews 532/udp # readnews netwall 533/tcp # for emergency broadcasts netwall 533/udp # for emergency broadcasts mm-admin 534/tcp # MegaMedia Admin mm-admin 534/udp # MegaMedia Admin iiop 535/tcp # iiop 535/udp # opalis-rdv 536/tcp # opalis-rdv 536/udp # nmsp 537/tcp # Networked Media Streaming Protocol nmsp 537/udp # Networked Media Streaming Protocol gdomap 538/tcp # gdomap 538/udp # apertus-ldp 539/tcp # Apertus Technologies Load Determination apertus-ldp 539/udp # Apertus Technologies Load Determination uucp 540/tcp # uucpd uucp 540/udp # uucpd uucp-rlogin 541/tcp # uucp-rlogin 541/udp # commerce 542/tcp # commerce 542/udp # klogin 543/tcp # Kerberos (v4/v5) klogin 543/udp # Kerberos (v4/v5) kshell 544/tcp # krcmd Kerberos (v4/v5) kshell 544/udp # krcmd Kerberos (v4/v5) ekshell 545/tcp # Kerberos encrypted remote shell -kfall appleqtcsrvr 545/udp # dhcpv6-client 546/tcp # DHCPv6 Client dhcpv6-client 546/udp # DHCPv6 Client dhcpv6-server 547/tcp # DHCPv6 Server dhcpv6-server 547/udp # DHCPv6 Server afpovertcp 548/tcp # AFP over TCP afpovertcp 548/udp # AFP over TCP idfp 549/tcp # idfp 549/udp # new-rwho 550/tcp # new-who new-rwho 550/udp # new-who cybercash 551/tcp # cybercash 551/udp # deviceshare 552/tcp # deviceshare 552/udp # pirp 553/tcp # pirp 553/udp # rtsp 554/tcp # Real Time Stream Control Protocol rtsp 554/udp # Real Time Stream Control Protocol dsf 555/tcp # dsf 555/udp # remotefs 556/tcp # rfs, rfs_server, Brunhoff remote filesystem remotefs 556/udp # rfs, rfs_server, Brunhoff remote filesystem openvms-sysipc 557/tcp # openvms-sysipc 557/udp # sdnskmp 558/tcp # sdnskmp 558/udp # teedtap 559/tcp # teedtap 559/udp # rmonitor 560/tcp # rmonitord rmonitor 560/udp # rmonitord monitor 561/tcp # monitor 561/udp # chshell 562/tcp # chcmd chshell 562/udp # chcmd snews 563/tcp # snews 563/udp # 9pfs 564/tcp # plan 9 file service 9pfs 564/udp # plan 9 file service whoami 565/tcp # whoami 565/udp # streettalk 566/tcp # banyan-rpc 567/tcp # banyan-rpc 567/udp # ms-shuttle 568/tcp # Microsoft shuttle ms-shuttle 568/udp # Microsoft shuttle ms-rome 569/tcp # Microsoft rome ms-rome 569/udp # Microsoft rome meter 570/tcp # demon meter 570/udp # demon umeter 571/tcp # udemon umeter 571/udp # udemon sonar 572/tcp # sonar 572/udp # banyan-vip 573/tcp # banyan-vip 573/udp # ftp-agent 574/tcp # FTP Software Agent System ftp-agent 574/udp # FTP Software Agent System vemmi 575/tcp # vemmi 575/udp # ipcd 576/tcp # ipcd 576/udp # vnas 577/tcp # vnas 577/udp # ipdd 578/tcp # ipdd 578/udp # decbsrv 579/tcp # decbsrv 579/udp # sntp-heartbeat 580/tcp # sntp-heartbeat 580/udp # bdp 581/tcp # Bundle Discovery Protocol bdp 581/udp # Bundle Discovery Protocol scc-security 582/tcp # scc-security 582/udp # philips-vc 583/tcp # Philips Video-Conferencing philips-vc 583/udp # Philips Video-Conferencing keyserver 584/tcp # keyserver 584/udp # imap4-ssl 585/tcp # IMAP4+SSL (use of 585 is not recommended, imap4-ssl 585/udp # use 993 instead) password-chg 586/tcp # password-chg 586/udp # submission 587/tcp # submission 587/udp # cal 588/tcp # cal 588/udp # eyelink 589/tcp # eyelink 589/udp # tns-cml 590/tcp # tns-cml 590/udp # http-alt 591/tcp # FileMaker, Inc. - HTTP Alternate http-alt 591/udp # FileMaker, Inc. - HTTP Alternate eudora-set 592/tcp # eudora-set 592/udp # http-rpc-epmap 593/tcp # HTTP RPC Ep Map http-rpc-epmap 593/udp # HTTP RPC Ep Map tpip 594/tcp # tpip 594/udp # cab-protocol 595/tcp # cab-protocol 595/udp # smsd 596/tcp # smsd 596/udp # ptcnameservice 597/tcp # PTC Name Service ptcnameservice 597/udp # PTC Name Service sco-websrvrmg3 598/tcp # SCO Web Server Manager 3 sco-websrvrmg3 598/udp # SCO Web Server Manager 3 acp 599/tcp # Aeolon Core Protocol acp 599/udp # Aeolon Core Protocol ipcserver 600/tcp # Sun IPC server ipcserver 600/udp # Sun IPC server urm 606/tcp # Cray Unified Resource Manager urm 606/udp # Cray Unified Resource Manager nqs 607/tcp # nqs 607/udp # sift-uft 608/tcp # Sender-Initiated/Unsolicited File Transfer sift-uft 608/udp # Sender-Initiated/Unsolicited File Transfer npmp-trap 609/tcp # npmp-trap 609/udp # npmp-local 610/tcp # npmp-local 610/udp # npmp-gui 611/tcp # npmp-gui 611/udp # ginad 634/tcp # ginad 634/udp # mount 635/udp # NFS Mount Service pcnfs 640/udp # PC-NFS DOS Authentication bwnfs 650/udp # BW-NFS DOS Authentication doom 666/tcp # doom Id Software doom 666/udp # doom Id Software elcsd 704/tcp # errlog copy/server daemon elcsd 704/udp # errlog copy/server daemon entrustmanager 709/tcp # EntrustManager - NorTel DES auth network see 389/tcp entrustmanager 709/udp # EntrustManager - NorTel DES auth network see 389/tcp netviewdm1 729/tcp # IBM NetView DM/6000 Server/Client netviewdm1 729/udp # IBM NetView DM/6000 Server/Client netviewdm2 730/tcp # IBM NetView DM/6000 send/tcp netviewdm2 730/udp # IBM NetView DM/6000 send/tcp netviewdm3 731/tcp # IBM NetView DM/6000 receive/tcp netviewdm3 731/udp # IBM NetView DM/6000 receive/tcp netcp 740/tcp # NETscout Control Protocol netcp 740/udp # NETscout Control Protocol netgw 741/tcp # netgw 741/udp # netrcs 742/tcp # Network based Rev. Cont. Sys. netrcs 742/udp # Network based Rev. Cont. Sys. flexlm 744/tcp # Flexible License Manager flexlm 744/udp # Flexible License Manager fujitsu-dev 747/tcp # Fujitsu Device Control fujitsu-dev 747/udp # Fujitsu Device Control ris-cm 748/tcp # Russell Info Sci Calendar Manager ris-cm 748/udp # Russell Info Sci Calendar Manager kerberos-adm 749/tcp # Kerberos 5 admin/changepw kerberos-adm 749/udp # Kerberos 5 admin/changepw kerberos 750/tcp # kdc Kerberos (v4) kerberos 750/udp # kdc Kerberos (v4) kerberos_master 751/tcp # Kerberos `kadmin' (v4) kerberos_master 751/udp # Kerberos `kadmin' (v4) qrh 752/tcp # qrh 752/udp # rrh 753/tcp # rrh 753/udp # krb_prop 754/tcp # kerberos/v5 server propagation nlogin 758/tcp # nlogin 758/udp # con 759/tcp # con 759/udp # krbupdate 760/tcp # kreg Kerberos (v4) registration ns 760/udp # kpasswd 761/tcp # kpwd Kerberos (v4) "passwd" rxe 761/udp # quotad 762/tcp # quotad 762/udp # cycleserv 763/tcp # cycleserv 763/udp # omserv 764/tcp # omserv 764/udp # webster 765/tcp # webster 765/udp # phonebook 767/tcp # phone phonebook 767/udp # phone vid 769/tcp # vid 769/udp # cadlock 770/tcp # cadlock 770/udp # rtip 771/tcp # rtip 771/udp # cycleserv2 772/tcp # cycleserv2 772/udp # submit 773/tcp # notify 773/udp # rpasswd 774/tcp # acmaint_dbd 774/udp # entomb 775/tcp # acmaint_transd 775/udp # wpages 776/tcp # wpages 776/udp # wpgs 780/tcp # wpgs 780/udp # hp-collector 781/tcp # hp performance data collector hp-collector 781/udp # hp performance data collector hp-managed-node 782/tcp # hp performance data managed node hp-managed-node 782/udp # hp performance data managed node hp-alarm-mgr 783/tcp # hp performance data alarm manager hp-alarm-mgr 783/udp # hp performance data alarm manager concert 786/tcp # concert 786/udp # mdbs_daemon 800/tcp # mdbs_daemon 800/udp # device 801/tcp # device 801/udp # supfilesrv 871/tcp # SUP server accessbuilder 888/tcp # or Audio CD Database accessbuilder 888/udp # simap 993/tcp # IMAP over SSL xtreelic 996/tcp # XTREE License Server vsinet 996/udp # maitrd 997/tcp # maitrd 997/udp # busboy 998/tcp # puparp 998/udp # garcon 999/tcp # applix 999/udp # Applix ac cadlock 1000/tcp # ock 1000/udp # ufsd 1008/tcp # ufsd # UFS-aware server ufsd 1008/udp # listen 1025/tcp # listener RFS remote_file_sharing blackjack 1025/udp # network blackjack nterm 1026/tcp # remote_login network_terminal iad1 1030/tcp # BBN IAD iad1 1030/udp # BBN IAD iad2 1031/tcp # BBN IAD iad2 1031/udp # BBN IAD iad3 1032/tcp # BBN IAD iad3 1032/udp # BBN IAD nim 1058/tcp # nim 1058/udp # nimreg 1059/tcp # nimreg 1059/udp # instl_boots 1067/tcp # Installation Bootstrap Proto. Serv. instl_boots 1067/udp # Installation Bootstrap Proto. Serv. instl_bootc 1068/tcp # Installation Bootstrap Proto. Cli. instl_bootc 1068/udp # Installation Bootstrap Proto. Cli. socks 1080/tcp # socks 1080/udp # ansoft-lm-1 1083/tcp # Anasoft License Manager ansoft-lm-1 1083/udp # Anasoft License Manager ansoft-lm-2 1084/tcp # Anasoft License Manager ansoft-lm-2 1084/udp # Anasoft License Manager xaudio 1103/tcp # Xaserver # X Audio Server kpop 1109/tcp # Pop with Kerberos nfsd-status 1110/tcp # Cluster status info nfsd-keepalive 1110/udp # Client status info msql 1112/tcp # mini-sql server supfiledbg 1127/tcp # SUP debugging nfa 1155/tcp # Network File Access nfa 1155/udp # Network File Access phone 1167/udp # conference calling skkserv 1178/tcp # SKK (kanji input) lupa 1212/tcp # lupa 1212/udp # nerv 1222/tcp # SNI R&D network nerv 1222/udp # SNI R&D network msg 1241/tcp # remote message server hermes 1248/tcp # hermes 1248/udp # alta-ana-lm 1346/tcp # Alta Analytics License Manager alta-ana-lm 1346/udp # Alta Analytics License Manager bbn-mmc 1347/tcp # multi media conferencing bbn-mmc 1347/udp # multi media conferencing bbn-mmx 1348/tcp # multi media conferencing bbn-mmx 1348/udp # multi media conferencing sbook 1349/tcp # Registration Network Protocol sbook 1349/udp # Registration Network Protocol editbench 1350/tcp # Registration Network Protocol editbench 1350/udp # Registration Network Protocol equationbuilder 1351/tcp # Digital Tool Works (MIT) equationbuilder 1351/udp # Digital Tool Works (MIT) lotusnote 1352/tcp # Lotus Note lotusnote 1352/udp # Lotus Note relief 1353/tcp # Relief Consulting relief 1353/udp # Relief Consulting rightbrain 1354/tcp # RightBrain Software rightbrain 1354/udp # RightBrain Software intuitive-edge 1355/tcp # Intuitive Edge intuitive-edge 1355/udp # Intuitive Edge cuillamartin 1356/tcp # CuillaMartin Company cuillamartin 1356/udp # CuillaMartin Company pegboard 1357/tcp # Electronic PegBoard pegboard 1357/udp # Electronic PegBoard connlcli 1358/tcp # connlcli 1358/udp # ftsrv 1359/tcp # ftsrv 1359/udp # mimer 1360/tcp # mimer 1360/udp # linx 1361/tcp # linx 1361/udp # timeflies 1362/tcp # timeflies 1362/udp # ndm-requester 1363/tcp # Network DataMover Requester ndm-requester 1363/udp # Network DataMover Requester ndm-server 1364/tcp # Network DataMover Server ndm-server 1364/udp # Network DataMover Server adapt-sna 1365/tcp # Network Software Associates adapt-sna 1365/udp # Network Software Associates netware-csp 1366/tcp # Novell NetWare Comm Service Platform netware-csp 1366/udp # Novell NetWare Comm Service Platform dcs 1367/tcp # dcs 1367/udp # screencast 1368/tcp # screencast 1368/udp # gv-us 1369/tcp # GlobalView to Unix Shell gv-us 1369/udp # GlobalView to Unix Shell us-gv 1370/tcp # Unix Shell to GlobalView us-gv 1370/udp # Unix Shell to GlobalView fc-cli 1371/tcp # Fujitsu Config Protocol fc-cli 1371/udp # Fujitsu Config Protocol fc-ser 1372/tcp # Fujitsu Config Protocol fc-ser 1372/udp # Fujitsu Config Protocol chromagrafx 1373/tcp # chromagrafx 1373/udp # molly 1374/tcp # EPI Software Systems molly 1374/udp # EPI Software Systems bytex 1375/tcp # bytex 1375/udp # ibm-pps 1376/tcp # IBM Person to Person Software ibm-pps 1376/udp # IBM Person to Person Software cichlid 1377/tcp # Cichlid License Manager cichlid 1377/udp # Cichlid License Manager elan 1378/tcp # Elan License Manager elan 1378/udp # Elan License Manager dbreporter 1379/tcp # Integrity Solutions dbreporter 1379/udp # Integrity Solutions telesis-licman 1380/tcp # Telesis Network License Manager telesis-licman 1380/udp # Telesis Network License Manager apple-licman 1381/tcp # Apple Network License Manager apple-licman 1381/udp # Apple Network License Manager gwha 1383/tcp # GW Hannaway Network License Manager gwha 1383/udp # GW Hannaway Network License Manager os-licman 1384/tcp # Objective Solutions License Manager os-licman 1384/udp # Objective Solutions License Manager atex_elmd 1385/tcp # Atex Publishing License Manager atex_elmd 1385/udp # Atex Publishing License Manager checksum 1386/tcp # CheckSum License Manager checksum 1386/udp # CheckSum License Manager cadsi-lm 1387/tcp # Computer Aided Design Software Inc LM cadsi-lm 1387/udp # Computer Aided Design Software Inc LM objective-dbc 1388/tcp # Objective Solutions DataBase Cache objective-dbc 1388/udp # Objective Solutions DataBase Cache iclpv-dm 1389/tcp # Document Manager iclpv-dm 1389/udp # Document Manager iclpv-sc 1390/tcp # Storage Controller iclpv-sc 1390/udp # Storage Controller iclpv-sas 1391/tcp # Storage Access Server iclpv-sas 1391/udp # Storage Access Server iclpv-pm 1392/tcp # Print Manager iclpv-pm 1392/udp # Print Manager iclpv-nls 1393/tcp # Network Log Server iclpv-nls 1393/udp # Network Log Server iclpv-nlc 1394/tcp # Network Log Client iclpv-nlc 1394/udp # Network Log Client iclpv-wsm 1395/tcp # PC Workstation Manager software iclpv-wsm 1395/udp # PC Workstation Manager software dvl-activemail 1396/tcp # DVL Active Mail dvl-activemail 1396/udp # DVL Active Mail audio-activmail 1397/tcp # Audio Active Mail audio-activmail 1397/udp # Audio Active Mail video-activmail 1398/tcp # Video Active Mail video-activmail 1398/udp # Video Active Mail cadkey-licman 1399/tcp # Cadkey License Manager cadkey-licman 1399/udp # Cadkey License Manager cadkey-tablet 1400/tcp # Cadkey Tablet Daemon cadkey-tablet 1400/udp # Cadkey Tablet Daemon goldleaf-licman 1401/tcp # Goldleaf License Manager goldleaf-licman 1401/udp # Goldleaf License Manager prm-sm-np 1402/tcp # Prospero Resource Manager prm-sm-np 1402/udp # Prospero Resource Manager prm-nm-np 1403/tcp # Prospero Resource Manager prm-nm-np 1403/udp # Prospero Resource Manager igi-lm 1404/tcp # Infinite Graphics License Manager igi-lm 1404/udp # Infinite Graphics License Manager ibm-res 1405/tcp # IBM Remote Execution Starter ibm-res 1405/udp # IBM Remote Execution Starter netlabs-lm 1406/tcp # NetLabs License Manager netlabs-lm 1406/udp # NetLabs License Manager dbsa-lm 1407/tcp # DBSA License Manager dbsa-lm 1407/udp # DBSA License Manager sophia-lm 1408/tcp # Sophia License Manager sophia-lm 1408/udp # Sophia License Manager here-lm 1409/tcp # Here License Manager here-lm 1409/udp # Here License Manager hiq 1410/tcp # HiQ License Manager hiq 1410/udp # HiQ License Manager af 1411/tcp # AudioFile af 1411/udp # AudioFile innosys 1412/tcp # innosys 1412/udp # innosys-acl 1413/tcp # innosys-acl 1413/udp # ibm-mqseries 1414/tcp # IBM MQSeries ibm-mqseries 1414/udp # IBM MQSeries dbstar 1415/tcp # dbstar 1415/udp # novell-lu6.2 1416/tcp # Novell LU6.2 novell-lu6.2 1416/udp # Novell LU6.2 timbuktu-srv1 1417/tcp # Timbuktu Service 1 Port timbuktu-srv1 1417/udp # Timbuktu Service 1 Port timbuktu-srv2 1418/tcp # Timbuktu Service 2 Port timbuktu-srv2 1418/udp # Timbuktu Service 2 Port timbuktu-srv3 1419/tcp # Timbuktu Service 3 Port timbuktu-srv3 1419/udp # Timbuktu Service 3 Port timbuktu-srv4 1420/tcp # Timbuktu Service 4 Port timbuktu-srv4 1420/udp # Timbuktu Service 4 Port gandalf-lm 1421/tcp # Gandalf License Manager gandalf-lm 1421/udp # Gandalf License Manager autodesk-lm 1422/tcp # Autodesk License Manager autodesk-lm 1422/udp # Autodesk License Manager essbase 1423/tcp # Essbase Arbor Software essbase 1423/udp # Essbase Arbor Software hybrid 1424/tcp # Hybrid Encryption Protocol hybrid 1424/udp # Hybrid Encryption Protocol zion-lm 1425/tcp # Zion Software License Manager zion-lm 1425/udp # Zion Software License Manager sas-1 1426/tcp # Satellite-data Acquisition System 1 sas-1 1426/udp # Satellite-data Acquisition System 1 mloadd 1427/tcp # mloadd monitoring tool mloadd 1427/udp # mloadd monitoring tool informatik-lm 1428/tcp # Informatik License Manager informatik-lm 1428/udp # Informatik License Manager nms 1429/tcp # Hypercom NMS nms 1429/udp # Hypercom NMS tpdu 1430/tcp # Hypercom TPDU tpdu 1430/udp # Hypercom TPDU rgtp 1431/tcp # Reverse Gossip Transport rgtp 1431/udp # Reverse Gossip Transport blueberry-lm 1432/tcp # Blueberry Software License Manager blueberry-lm 1432/udp # Blueberry Software License Manager ms-sql-s 1433/tcp # Microsoft-SQL-Server ms-sql-s 1433/udp # Microsoft-SQL-Server ms-sql-m 1434/tcp # Microsoft-SQL-Monitor ms-sql-m 1434/udp # Microsoft-SQL-Monitor ibm-cics 1435/tcp # ibm-cics 1435/udp # sas-2 1436/tcp # Satellite-data Acquisition System 2 sas-2 1436/udp # Satellite-data Acquisition System 2 tabula 1437/tcp # tabula 1437/udp # eicon-server 1438/tcp # Eicon Security Agent/Server eicon-server 1438/udp # Eicon Security Agent/Server eicon-x25 1439/tcp # Eicon X25/SNA Gateway eicon-x25 1439/udp # Eicon X25/SNA Gateway eicon-slp 1440/tcp # Eicon Service Location Protocol eicon-slp 1440/udp # Eicon Service Location Protocol cadis-1 1441/tcp # Cadis License Management cadis-1 1441/udp # Cadis License Management cadis-2 1442/tcp # Cadis License Management cadis-2 1442/udp # Cadis License Management ies-lm 1443/tcp # Integrated Engineering Software ies-lm 1443/udp # Integrated Engineering Software marcam-lm 1444/tcp # Marcam License Management marcam-lm 1444/udp # Marcam License Management proxima-lm 1445/tcp # Proxima License Manager proxima-lm 1445/udp # Proxima License Manager ora-lm 1446/tcp # Optical Research Associates License Manager ora-lm 1446/udp # Optical Research Associates License Manager apri-lm 1447/tcp # Applied Parallel Research LM apri-lm 1447/udp # Applied Parallel Research LM oc-lm 1448/tcp # OpenConnect License Manager oc-lm 1448/udp # OpenConnect License Manager peport 1449/tcp # peport 1449/udp # dwf 1450/tcp # Tandem Distributed Workbench Facility dwf 1450/udp # Tandem Distributed Workbench Facility infoman 1451/tcp # IBM Information Management infoman 1451/udp # IBM Information Management gtegsc-lm 1452/tcp # GTE Government Systems License Man gtegsc-lm 1452/udp # GTE Government Systems License Man genie-lm 1453/tcp # Genie License Manager genie-lm 1453/udp # Genie License Manager interhdl_elmd 1454/tcp # interHDL License Manager interhdl_elmd 1454/udp # interHDL License Manager esl-lm 1455/tcp # ESL License Manager esl-lm 1455/udp # ESL License Manager dca 1456/tcp # dca 1456/udp # valisys-lm 1457/tcp # Valisys License Manager valisys-lm 1457/udp # Valisys License Manager nrcabq-lm 1458/tcp # Nichols Research Corp. nrcabq-lm 1458/udp # Nichols Research Corp. proshare1 1459/tcp # Proshare Notebook Application proshare1 1459/udp # Proshare Notebook Application proshare2 1460/tcp # Proshare Notebook Application proshare2 1460/udp # Proshare Notebook Application ibm_wrless_lan 1461/tcp # IBM Wireless LAN ibm_wrless_lan 1461/udp # IBM Wireless LAN world-lm 1462/tcp # World License Manager world-lm 1462/udp # World License Manager nucleus 1463/tcp # nucleus 1463/udp # msl_lmd 1464/tcp # MSL License Manager msl_lmd 1464/udp # MSL License Manager pipes 1465/tcp # Pipes Platform pipes 1465/udp # oceansoft-lm 1466/tcp # Ocean Software License Manager oceansoft-lm 1466/udp # Ocean Software License Manager csdmbase 1467/tcp # csdmbase 1467/udp # csdm 1468/tcp # csdm 1468/udp # aal-lm 1469/tcp # Active Analysis Limited License Manager aal-lm 1469/udp # Active Analysis Limited License Manager uaiact 1470/tcp # Universal Analytics uaiact 1470/udp # Universal Analytics csdmbase 1471/tcp # csdmbase 1471/udp # csdm 1472/tcp # csdm 1472/udp # openmath 1473/tcp # openmath 1473/udp # telefinder 1474/tcp # telefinder 1474/udp # taligent-lm 1475/tcp # Taligent License Manager taligent-lm 1475/udp # Taligent License Manager clvm-cfg 1476/tcp # clvm-cfg 1476/udp # ms-sna-server 1477/tcp # ms-sna-server 1477/udp # ms-sna-base 1478/tcp # ms-sna-base 1478/udp # dberegister 1479/tcp # dberegister 1479/udp # pacerforum 1480/tcp # pacerforum 1480/udp # airs 1481/tcp # airs 1481/udp # miteksys-lm 1482/tcp # Miteksys License Manager miteksys-lm 1482/udp # Miteksys License Manager afs 1483/tcp # AFS License Manager afs 1483/udp # AFS License Manager confluent 1484/tcp # Confluent License Manager confluent 1484/udp # Confluent License Manager lansource 1485/tcp # lansource 1485/udp # nms_topo_serv 1486/tcp # nms_topo_serv 1486/udp # localinfosrvr 1487/tcp # localinfosrvr 1487/udp # docstor 1488/tcp # docstor 1488/udp # dmdocbroker 1489/tcp # dmdocbroker 1489/udp # insitu-conf 1490/tcp # insitu-conf 1490/udp # anynetgateway 1491/tcp # anynetgateway 1491/udp # stone-design-1 1492/tcp # stone-design-1 1492/udp # netmap_lm 1493/tcp # netmap_lm 1493/udp # ica 1494/tcp # ica 1494/udp # cvc 1495/tcp # cvc 1495/udp # liberty-lm 1496/tcp # liberty-lm 1496/udp # rfx-lm 1497/tcp # rfx-lm 1497/udp # watcom-sql 1498/tcp # watcom-sql 1498/udp # fhc 1499/tcp # Federico Heinz Consultora fhc 1499/udp # Federico Heinz Consultora vlsi-lm 1500/tcp # VLSI License Manager vlsi-lm 1500/udp # VLSI License Manager sas-3 1501/tcp # Satellite-data Acquisition System 3 sas-3 1501/udp # Satellite-data Acquisition System 3 shivadiscovery 1502/tcp # Shiva shivadiscovery 1502/udp # Shiva imtc-mcs 1503/tcp # Databeam imtc-mcs 1503/udp # Databeam evb-elm 1504/tcp # EVB Software Engineering License Manager evb-elm 1504/udp # EVB Software Engineering License Manager funkproxy 1505/tcp # Funk Software, Inc. funkproxy 1505/udp # Funk Software, Inc. utcd 1506/tcp # Universal Time daemon (utcd) utcd 1506/udp # Universal Time daemon (utcd) symplex 1507/tcp # symplex 1507/udp # diagmond 1508/tcp # diagmond 1508/udp # robcad-lm 1509/tcp # Robcad, Ltd. License Manager robcad-lm 1509/udp # Robcad, Ltd. License Manager mvx-lm 1510/tcp # Midland Valley Exploration Ltd. Lic. Man. mvx-lm 1510/udp # Midland Valley Exploration Ltd. Lic. Man. 3l-l1 1511/tcp # 3l-l1 1511/udp # wins 1512/tcp # Microsoft's Windows Internet Name Service wins 1512/udp # Microsoft's Windows Internet Name Service fujitsu-dtc 1513/tcp # Fujitsu Systems Business of America, Inc fujitsu-dtc 1513/udp # Fujitsu Systems Business of America, Inc fujitsu-dtcns 1514/tcp # Fujitsu Systems Business of America, Inc fujitsu-dtcns 1514/udp # Fujitsu Systems Business of America, Inc ifor-protocol 1515/tcp # ifor-protocol 1515/udp # vpad 1516/tcp # Virtual Places Audio data vpad 1516/udp # Virtual Places Audio data vpac 1517/tcp # Virtual Places Audio control vpac 1517/udp # Virtual Places Audio control vpvd 1518/tcp # Virtual Places Video data vpvd 1518/udp # Virtual Places Video data vpvc 1519/tcp # Virtual Places Video control vpvc 1519/udp # Virtual Places Video control atm-zip-office 1520/tcp # atm zip office atm-zip-office 1520/udp # atm zip office ncube-lm 1521/tcp # nCube License Manager ncube-lm 1521/udp # nCube License Manager rna-lm 1522/tcp # Ricardo North America License Manager rna-lm 1522/udp # Ricardo North America License Manager cichild-lm 1523/tcp # cichild-lm 1523/udp # ingreslock 1524/tcp # ingres ingreslock 1524/udp # ingres orasrv 1525/tcp # oracle or Prospero Directory Service non-priv orasrv 1525/udp # oracle pdap-np 1526/tcp # Prospero Data Access Prot non-priv pdap-np 1526/udp # Prospero Data Access Prot non-priv tlisrv 1527/tcp # oracle tlisrv 1527/udp # oracle mciautoreg 1528/tcp # mciautoreg 1528/udp # support 1529/tcp # prmsd gnatsd # cygnus bug tracker coauthor 1529/udp # oracle rap-service 1530/tcp # rap-service 1530/udp # rap-listen 1531/tcp # rap-listen 1531/udp # miroconnect 1532/tcp # miroconnect 1532/udp # virtual-places 1533/tcp # Virtual Places Software virtual-places 1533/udp # Virtual Places Software micromuse-lm 1534/tcp # micromuse-lm 1534/udp # ampr-info 1535/tcp # ampr-info 1535/udp # ampr-inter 1536/tcp # ampr-inter 1536/udp # sdsc-lm 1537/tcp # sdsc-lm 1537/udp # 3ds-lm 1538/tcp # 3ds-lm 1538/udp # intellistor-lm 1539/tcp # Intellistor License Manager intellistor-lm 1539/udp # Intellistor License Manager rds 1540/tcp # rds 1540/udp # rds2 1541/tcp # rds2 1541/udp # gridgen-elmd 1542/tcp # gridgen-elmd 1542/udp # simba-cs 1543/tcp # simba-cs 1543/udp # aspeclmd 1544/tcp # aspeclmd 1544/udp # vistium-share 1545/tcp # vistium-share 1545/udp # abbaccuray 1546/tcp # abbaccuray 1546/udp # laplink 1547/tcp # laplink 1547/udp # axon-lm 1548/tcp # Axon License Manager axon-lm 1548/udp # Axon License Manager shivahose 1549/tcp # Shiva Hose shivasound 1549/udp # Shiva Sound 3m-image-lm 1550/tcp # Image Storage license manager 3M Company 3m-image-lm 1550/udp # Image Storage license manager 3M Company hecmtl-db 1551/tcp # hecmtl-db 1551/udp # pciarray 1552/tcp # pciarray 1552/udp # issd 1600/tcp # issd 1600/udp # radius 1645/udp # radius authentication radacct 1646/udp # radius accounting nkd 1650/tcp # nkd 1650/udp # shiva_confsrvr 1651/tcp # shiva_confsrvr 1651/udp # xnmp 1652/tcp # xnmp 1652/udp # netview-aix-1 1661/tcp # netview-aix-1 1661/udp # netview-aix-2 1662/tcp # netview-aix-2 1662/udp # netview-aix-3 1663/tcp # netview-aix-3 1663/udp # netview-aix-4 1664/tcp # netview-aix-4 1664/udp # netview-aix-5 1665/tcp # netview-aix-5 1665/udp # netview-aix-6 1666/tcp # netview-aix-6 1666/udp # netview-aix-7 1667/tcp # netview-aix-7 1667/udp # netview-aix-8 1668/tcp # netview-aix-8 1668/udp # netview-aix-9 1669/tcp # netview-aix-9 1669/udp # netview-aix-10 1670/tcp # netview-aix-10 1670/udp # netview-aix-11 1671/tcp # netview-aix-11 1671/udp # netview-aix-12 1672/tcp # netview-aix-12 1672/udp # pptp 1723/tcp # Point-to-point tunnelling protocol radius 1812/udp # RADIUS authentication protocol (RFC 2138) radacct 1813/udp # RADIUS accounting protocol (RFC 2139) licensedaemon 1986/tcp # cisco license management licensedaemon 1986/udp # cisco license management tr-rsrb-p1 1987/tcp # cisco RSRB Priority 1 port tr-rsrb-p1 1987/udp # cisco RSRB Priority 1 port tr-rsrb-p2 1988/tcp # cisco RSRB Priority 2 port tr-rsrb-p2 1988/udp # cisco RSRB Priority 2 port tr-rsrb-p3 1989/tcp # cisco RSRB Priority 3 port tr-rsrb-p3 1989/udp # cisco RSRB Priority 3 port stun-p1 1990/tcp # cisco STUN Priority 1 port stun-p1 1990/udp # cisco STUN Priority 1 port stun-p2 1991/tcp # cisco STUN Priority 2 port stun-p2 1991/udp # cisco STUN Priority 2 port stun-p3 1992/tcp # cisco STUN Priority 3 port stun-p3 1992/udp # cisco STUN Priority 3 port snmp-tcp-port 1993/tcp # cisco SNMP TCP port snmp-tcp-port 1993/udp # cisco SNMP TCP port stun-port 1994/tcp # cisco serial tunnel port stun-port 1994/udp # cisco serial tunnel port perf-port 1995/tcp # cisco perf port perf-port 1995/udp # cisco perf port tr-rsrb-port 1996/tcp # cisco Remote SRB port tr-rsrb-port 1996/udp # cisco Remote SRB port gdp-port 1997/tcp # cisco Gateway Discovery Protocol gdp-port 1997/udp # cisco Gateway Discovery Protocol x25-svc-port 1998/tcp # cisco X.25 service (XOT) x25-svc-port 1998/udp # cisco X.25 service (XOT) tcp-id-port 1999/tcp # cisco identification port tcp-id-port 1999/udp # cisco identification port callbook 2000/tcp # callbook 2000/udp # dc 2001/tcp # wizard 2001/udp # curry globe 2002/tcp # globe 2002/udp # cfingerd 2003/tcp # GNU finger mailbox 2004/tcp # emce 2004/udp # CCWS mm conf deslogin 2005/tcp # encrypted symmetric telnet/login oracle 2005/udp # invokator 2006/tcp # raid-cc 2006/udp # raid dectalk 2007/tcp # raid-am 2007/udp # conf 2008/tcp # terminaldb 2008/udp # news 2009/tcp # whosockami 2009/udp # search 2010/tcp # pipe_server 2010/udp # raid-cc 2011/tcp # raid servserv 2011/udp # ttyinfo 2012/tcp # raid-ac 2012/udp # raid-am 2013/tcp # raid-cd 2013/udp # troff 2014/tcp # raid-sf 2014/udp # cypress 2015/tcp # raid-cs 2015/udp # bootserver 2016/tcp # bootserver 2016/udp # cypress-stat 2017/tcp # bootclient 2017/udp # terminaldb 2018/tcp # rellpack 2018/udp # whosockami 2019/tcp # about 2019/udp # xinupageserver 2020/tcp # xinupageserver 2020/udp # servexec 2021/tcp # xinuexpansion1 2021/udp # down 2022/tcp # xinuexpansion2 2022/udp # xinuexpansion3 2023/tcp # xinuexpansion3 2023/udp # xinuexpansion4 2024/tcp # xinuexpansion4 2024/udp # ellpack 2025/tcp # xribs 2025/udp # scrabble 2026/tcp # scrabble 2026/udp # shadowserver 2027/tcp # shadowserver 2027/udp # submitserver 2028/tcp # submitserver 2028/udp # device2 2030/tcp # device2 2030/udp # blackboard 2032/tcp # blackboard 2032/udp # glogger 2033/tcp # glogger 2033/udp # scoremgr 2034/tcp # scoremgr 2034/udp # imsldoc 2035/tcp # imsldoc 2035/udp # objectmanager 2038/tcp # objectmanager 2038/udp # lam 2040/tcp # lam 2040/udp # interbase 2041/tcp # interbase 2041/udp # isis 2042/tcp # isis 2042/udp # isis-bcast 2043/tcp # isis-bcast 2043/udp # rimsl 2044/tcp # rimsl 2044/udp # cdfunc 2045/tcp # cdfunc 2045/udp # sdfunc 2046/tcp # sdfunc 2046/udp # dls 2047/tcp # dls 2047/udp # dls-monitor 2048/tcp # dls-monitor 2048/udp # nfs 2049/tcp # networked file system nfs 2049/udp # networked file system dlsrpn 2065/tcp # Data Link Switch Read Port Number dlsrpn 2065/udp # Data Link Switch Read Port Number dlswpn 2067/tcp # Data Link Switch Write Port Number dlswpn 2067/udp # Data Link Switch Write Port Number zephyr-clt 2103/udp # Zephyr serv-hm connection zephyr-hm 2104/udp # Zephyr hostmanager eklogin 2105/tcp # Kerberos (v4) encrypted rlogin eklogin 2105/udp # Kerberos (v4) encrypted rlogin ekshell 2106/tcp # Kerberos (v4) encrypted rshell ekshell 2106/udp # Kerberos (v4) encrypted rshell rkinit 2108/tcp # Kerberos (v4) remote initialization rkinit 2108/udp # Kerberos (v4) remote initialization kx 2111/tcp # X over kerberos kip 2112/tcp # IP over kerberos kauth 2120/tcp # Remote kauth ats 2201/tcp # Advanced Training System Program ats 2201/udp # Advanced Training System Program ivs-video 2232/tcp # IVS Video default ivs-video 2232/udp # IVS Video default ivsd 2241/tcp # IVS Daemon ivsd 2241/udp # IVS Daemon pehelp 2307/tcp # pehelp 2307/udp # cvspserver 2401/tcp # CVS network server cvspserver 2401/udp # CVS network server venus 2430/tcp # venus 2430/udp # venus-se 2431/tcp # venus-se 2431/udp # codasrv 2432/tcp # codasrv 2432/udp # codasrv-se 2433/tcp # codasrv-se 2433/udp # rtsserv 2500/tcp # Resource Tracking system server rtsserv 2500/udp # Resource Tracking system server rtsclient 2501/tcp # Resource Tracking system client rtsclient 2501/udp # Resource Tracking system client hp-3000-telnet 2564/tcp # HP 3000 NS/VT block mode telnet zebrasrv 2600/tcp # zebra service zebra 2601/tcp # zebra vty ripd 2602/tcp # RIPd vty ripngd 2603/tcp # RIPngd vty ospfd 2604/tcp # OSPFd vty bgpd 2605/tcp # BGPd vty webster 2627/tcp # Network dictionary webster 2627/udp # listen 2766/tcp # System V listener port www-dev 2784/tcp # world wide web - development www-dev 2784/udp # world wide web - development ppp 3000/tcp # User-level ppp daemon deslogin 3005/tcp # encrypted symmetric telnet/login deslogind 3006/tcp # cfs 3049/tcp # cryptographic file system (nfs) (proposed) cfs 3049/udp # cryptographic file system (nfs) sj3 3086/tcp # SJ3 (kanji input) squid-http 3128/tcp # squid-ipc 3130/udp # vmodem 3141/tcp # vmodem 3141/udp # ccmail 3264/tcp # cc:mail/lotus ccmail 3264/udp # cc:mail/lotus dec-notes 3333/tcp # DEC Notes dec-notes 3333/udp # DEC Notes bmap 3421/tcp # Bull Apprise portmapper bmap 3421/udp # Bull Apprise portmapper prsvp 3455/tcp # RSVP Port prsvp 3455/udp # RSVP Port vat 3456/tcp # VAT default data vat 3456/udp # VAT default data vat-control 3457/tcp # VAT default control vat-control 3457/udp # VAT default control track 3462/tcp # software distribution udt_os 3900/tcp # Unidata UDT OS udt_os 3900/udp # Unidata UDT OS mapper-nodemgr 3984/tcp # MAPPER network node manager mapper-nodemgr 3984/udp # MAPPER network node manager mapper-mapethd 3985/tcp # MAPPER TCP/IP server mapper-mapethd 3985/udp # MAPPER TCP/IP server mapper-ws_ethd 3986/tcp # MAPPER workstation server mapper-ws_ethd 3986/udp # MAPPER workstation server netcheque 4008/tcp # NetCheque accounting netcheque 4008/udp # NetCheque accounting lockd 4045/tcp # lockd 4045/udp # NFS lock daemon/manager nuts_dem 4132/tcp # NUTS Daemon nuts_dem 4132/udp # NUTS Daemon nuts_bootp 4133/tcp # NUTS Bootp Server nuts_bootp 4133/udp # NUTS Bootp Server wincim 4144/tcp # pc windows compuserve.com protocol rwhois 4321/tcp # Remote Who Is rwhois 4321/udp # Remote Who Is msql 4333/tcp # mini-sql server unicall 4343/tcp # unicall 4343/udp # krb524 4444/tcp # Kerberos 5 to 4 ticket xlator krb524 4444/udp # sae-urn 4500/tcp # sae-urn 4500/udp # fax 4557/tcp # FlexFax FAX transmission service hylafax 4559/tcp # HylaFAX client-server protocol rfa 4672/tcp # remote file access server rfa 4672/udp # remote file access server fics 5000/tcp # Free Internet Chess Server commplex-main 5000/udp # commplex-link 5001/tcp # commplex-link 5001/udp # rfe 5002/tcp # Radio Free Ethernet rfe 5002/udp # Radio Free Ethernet telelpathstart 5010/tcp # telelpathstart 5010/udp # telelpathattack 5011/tcp # telelpathattack 5011/udp # mmcc 5050/tcp # multimedia conference control tool mmcc 5050/udp # multimedia conference control tool rmonitor_secure 5145/tcp # rmonitor_secure 5145/udp # aol 5190/tcp # America-Online aol 5190/udp # America-Online aol-1 5191/tcp # AmericaOnline1 aol-1 5191/udp # AmericaOnline1 aol-2 5192/tcp # AmericaOnline2 aol-2 5192/udp # AmericaOnline2 aol-3 5193/tcp # AmericaOnline3 aol-3 5193/udp # AmericaOnline3 sgi-dgl 5232/tcp # SGI Distributed Graphics padl2sim 5236/tcp # padl2sim 5236/udp # hacl-hb 5300/tcp # HA cluster heartbeat hacl-hb 5300/udp # HA cluster heartbeat hacl-gs 5301/tcp # HA cluster general services hacl-gs 5301/udp # HA cluster general services hacl-cfg 5302/tcp # HA cluster configuration hacl-cfg 5302/udp # HA cluster configuration hacl-probe 5303/tcp # HA cluster probing hacl-probe 5303/udp # HA cluster probing hacl-local 5304/tcp # hacl-local 5304/udp # hacl-test 5305/tcp # hacl-test 5305/udp # cfengine 5308/tcp # cfengine 5308/udp # postgres 5432/tcp # postgres database server rplay 5555/udp # canna 5680/tcp # Canna (Japanese Input) proshareaudio 5713/tcp # proshare conf audio proshareaudio 5713/udp # proshare conf audio prosharevideo 5714/tcp # proshare conf video prosharevideo 5714/udp # proshare conf video prosharedata 5715/tcp # proshare conf data prosharedata 5715/udp # proshare conf data prosharerequest 5716/tcp # proshare conf request prosharerequest 5716/udp # proshare conf request prosharenotify 5717/tcp # proshare conf notify prosharenotify 5717/udp # proshare conf notify ncd-pref-tcp 5977/tcp # NCD preferences tcp port ncd-diag-tcp 5978/tcp # NCD diagnostic tcp port ncd-conf-tcp 5979/tcp # NCD configuration tcp port ncd-pref 5997/tcp # NCD preferences telnet port ncd-diag 5998/tcp # NCD diagnostic telnet port ncd-conf 5999/tcp # NCD configuration telnet port xterm 6000/tcp # X-windows server xwin 6001/tcp # X-windows server xwin 6002/tcp # X-windows server xwin 6003/tcp # X-windows server xwin 6004/tcp # X-windows server xwin 6005/tcp # X-windows server xwin 6006/tcp # X-windows server xwin 6007/tcp # X-windows server softcm 6110/tcp # HP SoftBench CM softcm 6110/udp # HP SoftBench CM spc 6111/tcp # HP SoftBench Sub-Process Control spc 6111/udp # HP SoftBench Sub-Process Control dtspc 6112/tcp # CDE subprocess control meta-corp 6141/tcp # Meta Corporation License Manager meta-corp 6141/udp # Meta Corporation License Manager aspentec-lm 6142/tcp # Aspen Technology License Manager aspentec-lm 6142/udp # Aspen Technology License Manager watershed-lm 6143/tcp # Watershed License Manager watershed-lm 6143/udp # Watershed License Manager statsci1-lm 6144/tcp # StatSci License Manager - 1 statsci1-lm 6144/udp # StatSci License Manager - 1 statsci2-lm 6145/tcp # StatSci License Manager - 2 statsci2-lm 6145/udp # StatSci License Manager - 2 lonewolf-lm 6146/tcp # Lone Wolf Systems License Manager lonewolf-lm 6146/udp # Lone Wolf Systems License Manager montage-lm 6147/tcp # Montage License Manager montage-lm 6147/udp # Montage License Manager ricardo-lm 6148/tcp # Ricardo North America License Manager ricardo-lm 6148/udp # Ricardo North America License Manager xdsxdm 6558/tcp # xdsxdm 6558/udp # irc-serv 6666/tcp # internet relay chat server irc 6667/tcp # Internet Relay Chat irc 6668/tcp # Internet Relay Chat acmsoda 6969/tcp # acmsoda 6969/udp # afs3-fileserver 7000/tcp # file server itself, msdos afs3-fileserver 7000/udp # file server itself afs3-callback 7001/tcp # callbacks to cache managers afs3-callback 7001/udp # callbacks to cache managers afs3-prserver 7002/tcp # users & groups database afs3-prserver 7002/udp # users & groups database afs3-vlserver 7003/tcp # volume location database afs3-vlserver 7003/udp # volume location database afs3-kaserver 7004/tcp # AFS/Kerberos authentication service afs3-kaserver 7004/udp # AFS/Kerberos authentication service afs3-volser 7005/tcp # volume managment server afs3-volser 7005/udp # volume managment server afs3-errors 7006/tcp # error interpretation service afs3-errors 7006/udp # error interpretation service afs3-bos 7007/tcp # basic overseer process afs3-bos 7007/udp # basic overseer process afs3-update 7008/tcp # server-to-server updater afs3-update 7008/udp # server-to-server updater afs3-rmtsys 7009/tcp # remote cache manager service afs3-rmtsys 7009/udp # remote cache manager service ups-onlinet 7010/tcp # onlinet uninterruptable power supplies ups-onlinet 7010/udp # onlinet uninterruptable power supplies font-service 7100/tcp # X Font Service font-service 7100/udp # X Font Service fodms 7200/tcp # FODMS FLIP fodms 7200/udp # FODMS FLIP dlip 7201/tcp # dlip 7201/udp # icb 7326/tcp # Internet Citizen's Band cucme-1 7648/udp # cucme live video/audio server cucme-2 7649/udp # cucme live video/audio server cucme-3 7650/udp # cucme live video/audio server cucme-4 7651/udp # cucme live video/audio server jetdirect 9100/tcp # HP JetDirect card man 9535/tcp # man 9535/udp # sd 9876/tcp # Session Director sd 9876/udp # Session Director stel 10005/tcp # Secure telnet amanda 10080/udp # Amanda Backup Util amandaidx 10082/tcp # Amanda indexing amidxtape 10083/tcp # Amanda tape indexing NetBus 12345/tcp # NetBus backdoor trojan NetBus 12346/tcp # NetBus backdoor trojan isode-dua 17007/tcp # isode-dua 17007/udp # biimenu 18000/tcp # Beckman Instruments, Inc. biimenu 18000/udp # Beckman Instruments, Inc. wnn6 22273/tcp # Wnn6 (Japanese input) wnn6_Cn 22289/tcp # Wnn6 (Chinese input) wnn6_Kr 22305/tcp # Wnn6 (Korean input) wnn6_Tw 22321/tcp # Wnn6 (Taiwanse input) wnn6_DS 26208/tcp # Wnn6 (Dserver) BackOrifice 31337/udp # cDc Back Orifice remote admin tool dbbrowse 47557/tcp # Databeam Corporation dbbrowse 47557/udp # Databeam Corporation nmap-2.08/configure.in100600 764 764 22355 6657432517 14024 0ustar fyodorfyodor if test -d /usr/local/lib; then LDFLAGS="$LDFLAGS -L/usr/local/lib" fi if test -d /usr/local/include; then CFLAGS="$CLFAGS -I/usr/local/include" fi dnl Process this file with autoconf to produce a configure script. AC_INIT(nmap.c) libpcapdir=libpcap-possiblymodified AC_SUBST(libpcapdir) dnl use config.h instad of -D macros AC_CONFIG_HEADER(config.h) dnl Checks for programs. AC_PROG_CC if test -n "$GCC"; then CFLAGS="$CFLAGS -Wall " fi AC_PROG_INSTALL AC_PATH_PROG(MAKEDEPEND, makedepend) AC_SUBST(COMPAT_OBJS) AC_SUBST(COMPAT_SRCS) dnl Host specific hacks AC_CANONICAL_HOST linux=no case "$host" in *-netbsd*) AC_DEFINE(NETBSD) ;; *-openbsd*) AC_DEFINE(OPENBSD) ;; *-sgi-irix5*) AC_DEFINE(IRIX) no_libsocket=yes no_libnsl=yes if test -z "$GCC"; then sgi_cc=yes fi ;; *-sgi-irix6*) AC_DEFINE(IRIX) no_libsocket=yes no_libnsl=yes if test -z "$GCC"; then sgi_cc=yes fi ;; *-solaris2.0*) AC_DEFINE(STUPID_SOLARIS_CHECKSUM_BUG) AC_DEFINE(SOLARIS) ;; *-solaris2.1*) AC_DEFINE(STUPID_SOLARIS_CHECKSUM_BUG) AC_DEFINE(SOLARIS) ;; *-solaris2.2*) AC_DEFINE(STUPID_SOLARIS_CHECKSUM_BUG) AC_DEFINE(SOLARIS) ;; *-solaris2.3*) AC_DEFINE(STUPID_SOLARIS_CHECKSUM_BUG) AC_DEFINE(SOLARIS) ;; *-solaris2.4*) AC_DEFINE(STUPID_SOLARIS_CHECKSUM_BUG) AC_DEFINE(SOLARIS) ;; *-solaris2.5.1) AC_DEFINE(STUPID_SOLARIS_CHECKSUM_BUG) AC_DEFINE(SOLARIS) ;; *-solaris*) AC_DEFINE(SOLARIS) ;; *-sunos4*) AC_DEFINE(SUNOS) AC_DEFINE(SPRINTF_RETURNS_STRING) no_libnsl=yes no_libsocket=yes ;; *-linux*) linux=yes AC_DEFINE(LINUX) AC_DEFINE(PCAP_TIMEOUT_IGNORED) # libpcap doesn't even LOOK at # the timeout you give it under Linux ;; *-freebsd*) AC_DEFINE(FREEBSD) ;; *-bsdi*) AC_DEFINE(BSDI) ;; esac dnl Checks for libraries. dnl AC_CHECK_LIB(m, pow) if test -z "$no_libnsl"; then AC_CHECK_LIB(nsl, inet_ntoa) fi if test -z "$no_libsocket"; then AC_CHECK_LIB(socket, socket) fi dnl need posix4/nanosleep for solaris 2.4 AC_CHECK_LIB(posix4, nanosleep) dnl Check whether libpcap is already available AC_CHECK_LIB(pcap, pcap_datalink, have_libpcap=yes, have_libpcap=no) if test $linux = yes; then have_libpcap=no fi if test $have_libpcap = yes; then AC_MSG_CHECKING(if libpcap version is recent enough) AC_TRY_RUN([ #include extern char pcap_version[]; int main() { int major, minor; sscanf(pcap_version,"%d.%d", &major, &minor); if (major > 0) exit(0); if (minor > 4) exit(0); if (minor < 4) exit(1); if (pcap_version[3] > 'a') exit(0); if (pcap_version[3] == 'a') { if(!sscanf(&pcap_version[4], "%d", &minor)) exit(1); if (minor >= 6) exit(0); else exit(1); } exit(1); }], [AC_MSG_RESULT(yes); have_libpcap=yes], [AC_MSG_RESULT(no); have_libpcap=no], [AC_MSG_RESULT(no); have_libpcap=no]) fi if test $have_libpcap = yes; then PCAP_DEPENDS="" PCAP_CLEAN="" PCAP_DIST_CLEAN="" AC_DEFINE(HAVE_LIBPCAP) else LDFLAGS="$LDFLAGS -L$libpcapdir" CFLAGS="$CFLAGS -I$libpcapdir" PCAP_DEPENDS='$(LIBPCAPDIR)/libpcap.a' PCAP_CLEAN="pcap_clean" PCAP_DIST_CLEAN="pcap_dist_clean" fi AC_SUBST(PCAP_DEPENDS) AC_SUBST(PCAP_CLEAN) AC_SUBST(PCAP_DIST_CLEAN) dnl Checks for header files. AC_HEADER_STDC AC_CHECK_HEADERS(string.h strings.h memory.h sys/param.h sys/sockio.h netinet/if_ether.h bstring.h sys/time.h) AC_HEADER_TIME dnl AC_CHECK_HEADERS(fcntl.h sys/time.h unistd.h) dnl Checks for typedefs, structures, and compiler characteristics. dnl check for void should be put in dnl AC_MSG_CHECKING(for void) dnl AC_TRY_COMPILE(, [void *foo = 0;], dnl [AC_MSG_RESULT(yes); AC_DEFINE(HAVE_VOID)], [AC_MSG_RESULT(no)]) dnl so should check for 'const' dnl AC_MSG_CHECKING(for const) dnl AC_TRY_COMPILE(, [const int foo = 0;], dnl [AC_MSG_RESULT(yes); AC_DEFINE(HAVE_CONST)], [AC_MSG_RESULT(no)]) dnl equiv to '#define inline' to 'inline', '__inline__', '__inline' or '' AC_C_INLINE if test -n "$sgi_cc"; then AC_DEFINE(inline, ) fi dnl AC_HEADER_TIME AC_MSG_CHECKING([struct ip]) AC_TRY_COMPILE([#include #include #include #include ], [struct ip ip;], [AC_MSG_RESULT(yes); bsd_networking=yes], [AC_MSG_RESULT(no); bsd_networking=no]); if test $bsd_networking = yes; then AC_DEFINE(BSD_NETWORKING) AC_MSG_CHECKING([ip_v in struct ip]) AC_TRY_COMPILE([#include #include #include #include ], [struct ip ip; ip.ip_v;], [AC_MSG_RESULT(yes); has_bitfields=yes], [AC_MSG_RESULT(no); has_bitfields=no]) if test $has_bitfields = no; then SAVE_CFLAGS="$CFLAGS" CFLAGS="-D__STDC__=2" AC_MSG_CHECKING([if setting __STDC__=2 gives ip_v]) AC_TRY_COMPILE([#include #include #include #include ], [struct ip ip; ip.ip_v;], [AC_MSG_RESULT(yes); setting_stdc_helps=yes], [AC_MSG_RESULT(no); setting_stdc_helps=no]) CFLAGS="$SAVE_CFLAGS" if test $setting_stdc_helps = yes; then CFLAGS="$CFLAGS -D__STDC__=2" else AC_MSG_RESULT(Can't figure out how to get bitfields - configure failed) exit 1 fi fi fi AC_SUBST(CFLAGS) dnl This test is from the configure.in of Unix Network Programming second dnl edition example code by W. Richard Stevens dnl ################################################################## dnl Check if sockaddr{} has sa_len member. dnl AC_CACHE_CHECK(if sockaddr{} has sa_len member, ac_cv_sockaddr_has_sa_len, AC_TRY_COMPILE([ # include # include ], [unsigned int i = sizeof(((struct sockaddr *)0)->sa_len)], ac_cv_sockaddr_has_sa_len=yes, ac_cv_sockaddr_has_sa_len=no)) if test $ac_cv_sockaddr_has_sa_len = yes ; then AC_DEFINE(HAVE_SOCKADDR_SA_LEN) fi dnl check endedness AC_C_BIGENDIAN AC_MSG_CHECKING([if struct in_addr is a wacky huge structure (some Sun boxes)]) AC_TRY_COMPILE([#include ], struct in_addr i; i._S_un._S_addr;, \ AC_DEFINE(IN_ADDR_DEEPSTRUCT) \ AC_MSG_RESULT(yes) , \ AC_TRY_COMPILE([#include #include ], struct in_addr i; i.S_un.S_addr;, \ AC_DEFINE(IN_ADDR_DEEPSTRUCT) \ AC_MSG_RESULT(yes) , \ AC_MSG_RESULT(no);)) AC_CACHE_CHECK(if struct icmp exists, ac_cv_struct_icmp_exists, AC_TRY_COMPILE([ # include # include # include # include # define __USE_BSD # define __FAVOR_BSD # define __BSD_SOURCE # include # include ], [unsigned int i = sizeof(struct icmp)], ac_cv_struct_icmp_exists=yes, ac_cv_struct_icmp_exists=no)) if test $ac_cv_struct_icmp_exists = yes ; then AC_DEFINE(HAVE_STRUCT_ICMP) fi AC_CACHE_CHECK(if struct ip exists, ac_cv_struct_ip_exists, AC_TRY_COMPILE([ # include # include # include # include # define __USE_BSD # define __FAVOR_BSD # define __BSD_SOURCE # include ], [unsigned int i = sizeof(struct ip)], ac_cv_struct_ip_exists=yes, ac_cv_struct_ip_exists=no)) if test $ac_cv_struct_ip_exists = yes ; then AC_DEFINE(HAVE_STRUCT_IP) fi AC_CACHE_CHECK(if struct ip has ip_sum member, ac_cv_ip_has_ip_sum, AC_TRY_COMPILE([ # include # include # include # include # define __USE_BSD # define __FAVOR_BSD # define __BSD_SOURCE # include # include ], [unsigned int i = sizeof(((struct ip *)0)->ip_sum)], ac_cv_ip_has_ip_sum=yes, ac_cv_ip_has_ip_sum=no)) if test $ac_cv_ip_has_ip_sum = yes ; then AC_DEFINE(HAVE_IP_IP_SUM) fi dnl Checks for library functions. dnl AC_TYPE_SIGNAL AC_CHECK_FUNCS(bzero snprintf memcpy usleep nanosleep strerror) AC_CHECK_FUNC(snprintf, , [ COMPAT_SRCS="$COMPAT_SRCS snprintf.c" COMPAT_OBJS="$COMPAT_OBJS snprintf.o" ]) AC_CHECK_FUNC(inet_aton, , [ COMPAT_SRCS="$COMPAT_SRCS inet_aton.c" COMPAT_OBJS="$COMPAT_OBJS inet_aton.o" ]) dnl AC_CHECK_FUNCS(gethostname gettimeofday select socket strdup strstr ) dnl Configure libpcap if we need to since a lot of lamers don't dnl already have it installed ... dnl if test $have_libpcap = nsadf ; then dnl echo "Have libpcap is set to $have_libpcap "; dnl asdfasdf sdsdf sfd sdfsd dnl AC_CONFIG_SUBDIRS( $libpcapdir ) dnl fi AC_OUTPUT(Makefile) nmap-2.08/config.h.in100600 764 764 1447 6656726376 13525 0ustar fyodorfyodor #undef PCAP_TIMEOUT_IGNORED #undef HAVE_STRUCT_IP #undef HAVE_USLEEP #undef HAVE_NANOSLEEP #undef HAVE_STRUCT_ICMP #undef HAVE_IP_IP_SUM #undef inline #undef STDC_HEADERS #undef HAVE_STRING_H #undef HAVE_STRINGS_H #undef HAVE_BSTRING_H #undef WORDS_BIGENDIAN #undef HAVE_MEMORY_H /* both bzero() and memcpy() are used in the source */ #undef HAVE_BZERO #undef HAVE_MEMCPY #undef HAVE_STRERROR #undef HAVE_SYS_PARAM_H #undef HAVE_SYS_SOCKIO_H #undef BSD_NETWORKING #undef HAVE_SNPRINTF #undef IN_ADDR_DEEPSTRUCT #undef HAVE_NETINET_IN_SYSTEM_H #undef HAVE_SOCKADDR_SA_LEN #undef HAVE_NETINET_IF_ETHER_H #undef STUPID_SOLARIS_CHECKSUM_BUG #undef SPRINTF_RETURNS_STRING #undef LINUX #undef FREEBSD #undef OPENBSD #undef SOLARIS #undef SUNOS #undef BSDI #undef IRIX #undef NETBSD nmap-2.08/Makefile.in100600 764 764 10014 6662341615 13537 0ustar fyodorfyodor prefix = @prefix@ exec_prefix = @exec_prefix@ bindir = @bindir@ sbindir = @sbindir@ mandir = @mandir@ srcdir = @srcdir@ libdir = @libdir@/nmap CC = @CC@ CCOPT = LIBPCAPDIR = @libpcapdir@ INCLS = -I. -I$(LIBPCAPDIR) DEFS = @DEFS@ -DVERSION=\"$(VERSION)\" -DLIBDIR=\"$(libdir)\" CFLAGS = @CFLAGS@ $(CCOPT) $(DEFS) $(INCLS) # CFLAGS = -g -Wall $(DEFS) $(INCLS) STATIC = LDFLAGS = @LDFLAGS@ $(STATIC) LIBS = @LIBS@ -lpcap -lm INSTALL = @INSTALL@ MAKEDEPEND = @MAKEDEPEND@ RPMTDIR=$(HOME)/rpmdir VERSION = 2.08 TARGET = nmap SRCS = nmap.c targets.c tcpip.c error.c utils.c osscan.c charpool.c services.c @COMPAT_SRCS@ OBJS = nmap.o targets.o tcpip.o error.o utils.o osscan.o charpool.o services.o @COMPAT_OBJS@ DEPS = nmap.h error.h targets.h osscan.h tcpip.h utils.h global_structures.h charpool.h services.h all: $(TARGET) $(TARGET): $(DEPS) @PCAP_DEPENDS@ $(OBJS) @echo Compiling nmap rm -f $@ $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(LIBPCAPDIR)/libpcap.a: $(LIBPCAPDIR)/Makefile @echo Compiling libpcap; cd $(LIBPCAPDIR); $(MAKE) $(LIBPCAPDIR)/Makefile: @echo Configuring libpcap; cd $(LIBPCAPDIR); ./configure ci: checkin checkin: ci -u Makefile nmap.c targets.c nmap.h tcpip.c tcpip.h error.c error.h utils.c utils.h inet_aton.c configure.in config.h.in Makefile.in configure install-sh config.guess config.sub # This target is just for me ... don't you get any ideas --Fyodor distro: autoconf rm -f config.cache ./configure cd $(LIBPCAPDIR) && ./configure $(MAKE) clean $(MAKE) static $(MAKE) ./nmap -h > /dev/null #Make sure nmap exists rm -f docs/nmap.usage.txt ./nmap -h > docs/nmap.usage.txt rm -f docs/nmap_manpage.html nroff -man docs/nmap.1 | man2html -title 'Nmap network security scanner man page' > docs/nmap_manpage.html rm -rf /usr/tmp/nmap-$(VERSION) mkdir /usr/tmp/nmap-$(VERSION) # Make the RPM .spec file sed -e s/\@VERSION\@/$(VERSION)/g nmap.spec.in > nmap-$(VERSION)-1.spec $(MAKE) clean rm -f $(LIBPCAPDIR)/config.cache $(LIBPCAPDIR)/Makefile cp -ra $(SRCS) $(DEPS) inet_aton.c snprintf.c nmap-os-fingerprints \ nmap-services \ configure.in config.h.in Makefile.in configure install-sh \ config.guess nmap-$(VERSION)-1.spec config.sub INSTALL docs \ COPYING CHANGELOG \ $(LIBPCAPDIR) /usr/tmp/nmap-$(VERSION) # Kill the CVS crap find /usr/tmp/nmap-$(VERSION) -type d -name CVS | xargs rm -rf cd /usr/tmp; \ tar czf nmap-$(VERSION).tgz nmap-$(VERSION) # Make the actual RPM rpm -ta /usr/tmp/nmap-$(VERSION).tgz cp -f $(RPMTDIR)/RPMS/i386/nmap-$(VERSION)-1.i386.rpm /usr/tmp cp -f $(RPMTDIR)/SRPMS/nmap-$(VERSION)-1.src.rpm /usr/tmp rm -rf /usr/tmp/nmap-$(VERSION) # For distributing the binary static: cd $(LIBPCAPDIR); $(MAKE) $(CC) $(CFLAGS) -static $(LDFLAGS) -o nmap.linux.bin $(SRCS) $(LIBS) strip nmap.linux.bin clean: @PCAP_CLEAN@ my_clean my_clean: rm -f $(OBJS) $(TARGET) pcap_clean: cd $(LIBPCAPDIR); $(MAKE) clean pcap_dist_clean: cd $(LIBPCAPDIR); $(MAKE) distclean distclean: my_clean my_distclean @PCAP_DIST_CLEAN@ my_distclean: rm -f Makefile Makefile.bak config.h stamp-h stamp-h.in \ config.cache config.log config.status depend: $(MAKEDEPEND) $(INCLS) -s "# DO NOT DELETE" -- $(DEFS) -- $(SRCS) install: all $(INSTALL) -d $(bindir) $(INSTALL) -d $(mandir) $(INSTALL) -d $(libdir) $(INSTALL) $(TARGET) $(bindir)/$(TARGET) $(INSTALL) docs/$(TARGET).1 $(mandir)/man1/$(TARGET).1 $(INSTALL) nmap-os-fingerprints $(libdir)/nmap-os-fingerprints $(INSTALL) nmap-services $(libdir)/nmap-services uninstall: rm -f $(bindir)/$(TARGET) ${srcdir}/configure: configure.in cd ${srcdir} && autoconf # autoheader might not change config.h.in, so touch a stamp file. ${srcdir}/config.h.in: stamp-h.in ${srcdir}/stamp-h.in: configure.in acconfig.h \ config.h.top config.h.bot cd ${srcdir} && autoheader echo timestamp > ${srcdir}/stamp-h.in config.h: stamp-h stamp-h: config.h.in config.status ./config.status Makefile: Makefile.in config.status ./config.status config.status: configure ./config.status --recheck # DO NOT DELETE -- Needed by makedepend nmap-2.08/configure100700 764 764 217274 6662341624 13440 0ustar fyodorfyodor#! /bin/sh # Guess values for system-dependent variables and create Makefiles. # Generated automatically using autoconf version 2.13 # Copyright (C) 1992, 93, 94, 95, 96 Free Software Foundation, Inc. # # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. # Defaults: ac_help= ac_default_prefix=/usr/local # Any additions from configure.in: # Initialize some variables set by options. # The variables have the same names as the options, with # dashes changed to underlines. build=NONE cache_file=./config.cache exec_prefix=NONE host=NONE no_create= nonopt=NONE no_recursion= prefix=NONE program_prefix=NONE program_suffix=NONE program_transform_name=s,x,x, silent= site= srcdir= target=NONE verbose= x_includes=NONE x_libraries=NONE bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' datadir='${prefix}/share' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' libdir='${exec_prefix}/lib' includedir='${prefix}/include' oldincludedir='/usr/include' infodir='${prefix}/info' mandir='${prefix}/man' # Initialize some other variables. subdirs= MFLAGS= MAKEFLAGS= SHELL=${CONFIG_SHELL-/bin/sh} # Maximum number of lines to put in a shell here document. ac_max_here_lines=12 ac_prev= for ac_option do # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval "$ac_prev=\$ac_option" ac_prev= continue fi case "$ac_option" in -*=*) ac_optarg=`echo "$ac_option" | sed 's/[-_a-zA-Z0-9]*=//'` ;; *) ac_optarg= ;; esac # Accept the important Cygnus configure options, so we can diagnose typos. case "$ac_option" in -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) bindir="$ac_optarg" ;; -build | --build | --buil | --bui | --bu) ac_prev=build ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) build="$ac_optarg" ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) cache_file="$ac_optarg" ;; -datadir | --datadir | --datadi | --datad | --data | --dat | --da) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=* | --data=* | --dat=* \ | --da=*) datadir="$ac_optarg" ;; -disable-* | --disable-*) ac_feature=`echo $ac_option|sed -e 's/-*disable-//'` # Reject names that are not valid shell variable names. if test -n "`echo $ac_feature| sed 's/[-a-zA-Z0-9_]//g'`"; then { echo "configure: error: $ac_feature: invalid feature name" 1>&2; exit 1; } fi ac_feature=`echo $ac_feature| sed 's/-/_/g'` eval "enable_${ac_feature}=no" ;; -enable-* | --enable-*) ac_feature=`echo $ac_option|sed -e 's/-*enable-//' -e 's/=.*//'` # Reject names that are not valid shell variable names. if test -n "`echo $ac_feature| sed 's/[-_a-zA-Z0-9]//g'`"; then { echo "configure: error: $ac_feature: invalid feature name" 1>&2; exit 1; } fi ac_feature=`echo $ac_feature| sed 's/-/_/g'` case "$ac_option" in *=*) ;; *) ac_optarg=yes ;; esac eval "enable_${ac_feature}='$ac_optarg'" ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ | --exec | --exe | --ex) ac_prev=exec_prefix ;; -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) exec_prefix="$ac_optarg" ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; -help | --help | --hel | --he) # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat << EOF Usage: configure [options] [host] Options: [defaults in brackets after descriptions] Configuration: --cache-file=FILE cache test results in FILE --help print this message --no-create do not create output files --quiet, --silent do not print \`checking...' messages --version print the version of autoconf that created configure Directory and file names: --prefix=PREFIX install architecture-independent files in PREFIX [$ac_default_prefix] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX [same as prefix] --bindir=DIR user executables in DIR [EPREFIX/bin] --sbindir=DIR system admin executables in DIR [EPREFIX/sbin] --libexecdir=DIR program executables in DIR [EPREFIX/libexec] --datadir=DIR read-only architecture-independent data in DIR [PREFIX/share] --sysconfdir=DIR read-only single-machine data in DIR [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data in DIR [PREFIX/com] --localstatedir=DIR modifiable single-machine data in DIR [PREFIX/var] --libdir=DIR object code libraries in DIR [EPREFIX/lib] --includedir=DIR C header files in DIR [PREFIX/include] --oldincludedir=DIR C header files for non-gcc in DIR [/usr/include] --infodir=DIR info documentation in DIR [PREFIX/info] --mandir=DIR man documentation in DIR [PREFIX/man] --srcdir=DIR find the sources in DIR [configure dir or ..] --program-prefix=PREFIX prepend PREFIX to installed program names --program-suffix=SUFFIX append SUFFIX to installed program names --program-transform-name=PROGRAM run sed PROGRAM on installed program names EOF cat << EOF Host type: --build=BUILD configure for building on BUILD [BUILD=HOST] --host=HOST configure for HOST [guessed] --target=TARGET configure for TARGET [TARGET=HOST] Features and packages: --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) --x-includes=DIR X include files are in DIR --x-libraries=DIR X library files are in DIR EOF if test -n "$ac_help"; then echo "--enable and --with options recognized:$ac_help" fi exit 0 ;; -host | --host | --hos | --ho) ac_prev=host ;; -host=* | --host=* | --hos=* | --ho=*) host="$ac_optarg" ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) includedir="$ac_optarg" ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) infodir="$ac_optarg" ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) libdir="$ac_optarg" ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) libexecdir="$ac_optarg" ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst \ | --locals | --local | --loca | --loc | --lo) ac_prev=localstatedir ;; -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* \ | --locals=* | --local=* | --loca=* | --loc=* | --lo=*) localstatedir="$ac_optarg" ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) mandir="$ac_optarg" ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) no_recursion=yes ;; -oldincludedir | --oldincludedir | --oldincludedi | --oldincluded \ | --oldinclude | --oldinclud | --oldinclu | --oldincl | --oldinc \ | --oldin | --oldi | --old | --ol | --o) ac_prev=oldincludedir ;; -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) oldincludedir="$ac_optarg" ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) prefix="$ac_optarg" ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) program_prefix="$ac_optarg" ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) program_suffix="$ac_optarg" ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ | --program-transform-n | --program-transform- \ | --program-transform | --program-transfor \ | --program-transfo | --program-transf \ | --program-trans | --program-tran \ | --progr-tra | --program-tr | --program-t) ac_prev=program_transform_name ;; -program-transform-name=* | --program-transform-name=* \ | --program-transform-nam=* | --program-transform-na=* \ | --program-transform-n=* | --program-transform-=* \ | --program-transform=* | --program-transfor=* \ | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) program_transform_name="$ac_optarg" ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) silent=yes ;; -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) sbindir="$ac_optarg" ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ | --sharedst | --shareds | --shared | --share | --shar \ | --sha | --sh) ac_prev=sharedstatedir ;; -sharedstatedir=* | --sharedstatedir=* | --sharedstatedi=* \ | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) sharedstatedir="$ac_optarg" ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) site="$ac_optarg" ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) srcdir="$ac_optarg" ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) sysconfdir="$ac_optarg" ;; -target | --target | --targe | --targ | --tar | --ta | --t) ac_prev=target ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) target="$ac_optarg" ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; -version | --version | --versio | --versi | --vers) echo "configure generated by autoconf version 2.13" exit 0 ;; -with-* | --with-*) ac_package=`echo $ac_option|sed -e 's/-*with-//' -e 's/=.*//'` # Reject names that are not valid shell variable names. if test -n "`echo $ac_package| sed 's/[-_a-zA-Z0-9]//g'`"; then { echo "configure: error: $ac_package: invalid package name" 1>&2; exit 1; } fi ac_package=`echo $ac_package| sed 's/-/_/g'` case "$ac_option" in *=*) ;; *) ac_optarg=yes ;; esac eval "with_${ac_package}='$ac_optarg'" ;; -without-* | --without-*) ac_package=`echo $ac_option|sed -e 's/-*without-//'` # Reject names that are not valid shell variable names. if test -n "`echo $ac_package| sed 's/[-a-zA-Z0-9_]//g'`"; then { echo "configure: error: $ac_package: invalid package name" 1>&2; exit 1; } fi ac_package=`echo $ac_package| sed 's/-/_/g'` eval "with_${ac_package}=no" ;; --x) # Obsolete; use --with-x. with_x=yes ;; -x-includes | --x-includes | --x-include | --x-includ | --x-inclu \ | --x-incl | --x-inc | --x-in | --x-i) ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) x_includes="$ac_optarg" ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) x_libraries="$ac_optarg" ;; -*) { echo "configure: error: $ac_option: invalid option; use --help to show usage" 1>&2; exit 1; } ;; *) if test -n "`echo $ac_option| sed 's/[-a-z0-9.]//g'`"; then echo "configure: warning: $ac_option: invalid host type" 1>&2 fi if test "x$nonopt" != xNONE; then { echo "configure: error: can only configure for one host and one target at a time" 1>&2; exit 1; } fi nonopt="$ac_option" ;; esac done if test -n "$ac_prev"; then { echo "configure: error: missing argument to --`echo $ac_prev | sed 's/_/-/g'`" 1>&2; exit 1; } fi trap 'rm -fr conftest* confdefs* core core.* *.core $ac_clean_files; exit 1' 1 2 15 # File descriptor usage: # 0 standard input # 1 file creation # 2 errors and warnings # 3 some systems may open it to /dev/tty # 4 used on the Kubota Titan # 6 checking for... messages and results # 5 compiler messages saved in config.log if test "$silent" = yes; then exec 6>/dev/null else exec 6>&1 fi exec 5>./config.log echo "\ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. " 1>&5 # Strip out --no-create and --no-recursion so they do not pile up. # Also quote any args containing shell metacharacters. ac_configure_args= for ac_arg do case "$ac_arg" in -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c) ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) ;; *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?]*) ac_configure_args="$ac_configure_args '$ac_arg'" ;; *) ac_configure_args="$ac_configure_args $ac_arg" ;; esac done # NLS nuisances. # Only set these to C if already set. These must not be set unconditionally # because not all systems understand e.g. LANG=C (notably SCO). # Fixing LC_MESSAGES prevents Solaris sh from translating var values in `set'! # Non-C LC_CTYPE values break the ctype check. if test "${LANG+set}" = set; then LANG=C; export LANG; fi if test "${LC_ALL+set}" = set; then LC_ALL=C; export LC_ALL; fi if test "${LC_MESSAGES+set}" = set; then LC_MESSAGES=C; export LC_MESSAGES; fi if test "${LC_CTYPE+set}" = set; then LC_CTYPE=C; export LC_CTYPE; fi # confdefs.h avoids OS command line length limits that DEFS can exceed. rm -rf conftest* confdefs.h # AIX cpp loses on an empty file, so make sure it contains at least a newline. echo > confdefs.h # A filename unique to this package, relative to the directory that # configure is in, which we can look for to find out if srcdir is correct. ac_unique_file=nmap.c # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then its parent. ac_prog=$0 ac_confdir=`echo $ac_prog|sed 's%/[^/][^/]*$%%'` test "x$ac_confdir" = "x$ac_prog" && ac_confdir=. srcdir=$ac_confdir if test ! -r $srcdir/$ac_unique_file; then srcdir=.. fi else ac_srcdir_defaulted=no fi if test ! -r $srcdir/$ac_unique_file; then if test "$ac_srcdir_defaulted" = yes; then { echo "configure: error: can not find sources in $ac_confdir or .." 1>&2; exit 1; } else { echo "configure: error: can not find sources in $srcdir" 1>&2; exit 1; } fi fi srcdir=`echo "${srcdir}" | sed 's%\([^/]\)/*$%\1%'` # Prefer explicitly selected file to automatically selected ones. if test -z "$CONFIG_SITE"; then if test "x$prefix" != xNONE; then CONFIG_SITE="$prefix/share/config.site $prefix/etc/config.site" else CONFIG_SITE="$ac_default_prefix/share/config.site $ac_default_prefix/etc/config.site" fi fi for ac_site_file in $CONFIG_SITE; do if test -r "$ac_site_file"; then echo "loading site script $ac_site_file" . "$ac_site_file" fi done if test -r "$cache_file"; then echo "loading cache $cache_file" . $cache_file else echo "creating cache $cache_file" > $cache_file fi ac_ext=c # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options. ac_cpp='$CPP $CPPFLAGS' ac_compile='${CC-cc} -c $CFLAGS $CPPFLAGS conftest.$ac_ext 1>&5' ac_link='${CC-cc} -o conftest${ac_exeext} $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS 1>&5' cross_compiling=$ac_cv_prog_cc_cross ac_exeext= ac_objext=o if (echo "testing\c"; echo 1,2,3) | grep c >/dev/null; then # Stardent Vistra SVR4 grep lacks -e, says ghazi@caip.rutgers.edu. if (echo -n testing; echo 1,2,3) | sed s/-n/xn/ | grep xn >/dev/null; then ac_n= ac_c=' ' ac_t=' ' else ac_n=-n ac_c= ac_t= fi else ac_n= ac_c='\c' ac_t= fi libpcapdir=libpcap-possiblymodified # Extract the first word of "gcc", so it can be a program name with args. set dummy gcc; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:534: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" ac_dummy="$PATH" for ac_dir in $ac_dummy; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then ac_cv_prog_CC="gcc" break fi done IFS="$ac_save_ifs" fi fi CC="$ac_cv_prog_CC" if test -n "$CC"; then echo "$ac_t""$CC" 1>&6 else echo "$ac_t""no" 1>&6 fi if test -z "$CC"; then # Extract the first word of "cc", so it can be a program name with args. set dummy cc; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:564: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" ac_prog_rejected=no ac_dummy="$PATH" for ac_dir in $ac_dummy; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then if test "$ac_dir/$ac_word" = "/usr/ucb/cc"; then ac_prog_rejected=yes continue fi ac_cv_prog_CC="cc" break fi done IFS="$ac_save_ifs" if test $ac_prog_rejected = yes; then # We found a bogon in the path, so make sure we never use it. set dummy $ac_cv_prog_CC shift if test $# -gt 0; then # We chose a different compiler from the bogus one. # However, it has the same basename, so the bogon will be chosen # first if we set CC to just the basename; use the full file name. shift set dummy "$ac_dir/$ac_word" "$@" shift ac_cv_prog_CC="$@" fi fi fi fi CC="$ac_cv_prog_CC" if test -n "$CC"; then echo "$ac_t""$CC" 1>&6 else echo "$ac_t""no" 1>&6 fi if test -z "$CC"; then case "`uname -s`" in *win32* | *WIN32*) # Extract the first word of "cl", so it can be a program name with args. set dummy cl; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:615: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" ac_dummy="$PATH" for ac_dir in $ac_dummy; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then ac_cv_prog_CC="cl" break fi done IFS="$ac_save_ifs" fi fi CC="$ac_cv_prog_CC" if test -n "$CC"; then echo "$ac_t""$CC" 1>&6 else echo "$ac_t""no" 1>&6 fi ;; esac fi test -z "$CC" && { echo "configure: error: no acceptable cc found in \$PATH" 1>&2; exit 1; } fi echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works""... $ac_c" 1>&6 echo "configure:647: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5 ac_ext=c # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options. ac_cpp='$CPP $CPPFLAGS' ac_compile='${CC-cc} -c $CFLAGS $CPPFLAGS conftest.$ac_ext 1>&5' ac_link='${CC-cc} -o conftest${ac_exeext} $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS 1>&5' cross_compiling=$ac_cv_prog_cc_cross cat > conftest.$ac_ext << EOF #line 658 "configure" #include "confdefs.h" main(){return(0);} EOF if { (eval echo configure:663: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then ac_cv_prog_cc_works=yes # If we can't run a trivial program, we are probably using a cross compiler. if (./conftest; exit) 2>/dev/null; then ac_cv_prog_cc_cross=no else ac_cv_prog_cc_cross=yes fi else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 ac_cv_prog_cc_works=no fi rm -fr conftest* ac_ext=c # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options. ac_cpp='$CPP $CPPFLAGS' ac_compile='${CC-cc} -c $CFLAGS $CPPFLAGS conftest.$ac_ext 1>&5' ac_link='${CC-cc} -o conftest${ac_exeext} $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS 1>&5' cross_compiling=$ac_cv_prog_cc_cross echo "$ac_t""$ac_cv_prog_cc_works" 1>&6 if test $ac_cv_prog_cc_works = no; then { echo "configure: error: installation or configuration problem: C compiler cannot create executables." 1>&2; exit 1; } fi echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6 echo "configure:689: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5 echo "$ac_t""$ac_cv_prog_cc_cross" 1>&6 cross_compiling=$ac_cv_prog_cc_cross echo $ac_n "checking whether we are using GNU C""... $ac_c" 1>&6 echo "configure:694: checking whether we are using GNU C" >&5 if eval "test \"`echo '$''{'ac_cv_prog_gcc'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.c <&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then ac_cv_prog_gcc=yes else ac_cv_prog_gcc=no fi fi echo "$ac_t""$ac_cv_prog_gcc" 1>&6 if test $ac_cv_prog_gcc = yes; then GCC=yes else GCC= fi ac_test_CFLAGS="${CFLAGS+set}" ac_save_CFLAGS="$CFLAGS" CFLAGS= echo $ac_n "checking whether ${CC-cc} accepts -g""... $ac_c" 1>&6 echo "configure:722: checking whether ${CC-cc} accepts -g" >&5 if eval "test \"`echo '$''{'ac_cv_prog_cc_g'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else echo 'void f(){}' > conftest.c if test -z "`${CC-cc} -g -c conftest.c 2>&1`"; then ac_cv_prog_cc_g=yes else ac_cv_prog_cc_g=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_prog_cc_g" 1>&6 if test "$ac_test_CFLAGS" = set; then CFLAGS="$ac_save_CFLAGS" elif test $ac_cv_prog_cc_g = yes; then if test "$GCC" = yes; then CFLAGS="-g -O2" else CFLAGS="-g" fi else if test "$GCC" = yes; then CFLAGS="-O2" else CFLAGS= fi fi if test -n "$GCC"; then CFLAGS="$CFLAGS -Wall " fi ac_aux_dir= for ac_dir in $srcdir $srcdir/.. $srcdir/../..; do if test -f $ac_dir/install-sh; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install-sh -c" break elif test -f $ac_dir/install.sh; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install.sh -c" break fi done if test -z "$ac_aux_dir"; then { echo "configure: error: can not find install-sh or install.sh in $srcdir $srcdir/.. $srcdir/../.." 1>&2; exit 1; } fi ac_config_guess=$ac_aux_dir/config.guess ac_config_sub=$ac_aux_dir/config.sub ac_configure=$ac_aux_dir/configure # This should be Cygnus configure. # Find a good install program. We prefer a C program (faster), # so one script is as good as another. But avoid the broken or # incompatible versions: # SysV /etc/install, /usr/sbin/install # SunOS /usr/etc/install # IRIX /sbin/install # AIX /bin/install # AIX 4 /usr/bin/installbsd, which doesn't work without a -g flag # AFS /usr/afsws/bin/install, which mishandles nonexistent args # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff" # ./install, which can be erroneously created by make from ./install.sh. echo $ac_n "checking for a BSD compatible install""... $ac_c" 1>&6 echo "configure:787: checking for a BSD compatible install" >&5 if test -z "$INSTALL"; then if eval "test \"`echo '$''{'ac_cv_path_install'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else IFS="${IFS= }"; ac_save_IFS="$IFS"; IFS=":" for ac_dir in $PATH; do # Account for people who put trailing slashes in PATH elements. case "$ac_dir/" in /|./|.//|/etc/*|/usr/sbin/*|/usr/etc/*|/sbin/*|/usr/afsws/bin/*|/usr/ucb/*) ;; *) # OSF1 and SCO ODT 3.0 have their own names for install. # Don't use installbsd from OSF since it installs stuff as root # by default. for ac_prog in ginstall scoinst install; do if test -f $ac_dir/$ac_prog; then if test $ac_prog = install && grep dspmsg $ac_dir/$ac_prog >/dev/null 2>&1; then # AIX install. It has an incompatible calling convention. : else ac_cv_path_install="$ac_dir/$ac_prog -c" break 2 fi fi done ;; esac done IFS="$ac_save_IFS" fi if test "${ac_cv_path_install+set}" = set; then INSTALL="$ac_cv_path_install" else # As a last resort, use the slow shell script. We don't cache a # path for INSTALL within a source directory, because that will # break other packages using the cache if that directory is # removed, or if the path is relative. INSTALL="$ac_install_sh" fi fi echo "$ac_t""$INSTALL" 1>&6 # Use test -z because SunOS4 sh mishandles braces in ${var-val}. # It thinks the first close brace ends the variable substitution. test -z "$INSTALL_PROGRAM" && INSTALL_PROGRAM='${INSTALL}' test -z "$INSTALL_SCRIPT" && INSTALL_SCRIPT='${INSTALL_PROGRAM}' test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644' # Extract the first word of "makedepend", so it can be a program name with args. set dummy makedepend; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:842: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_path_MAKEDEPEND'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else case "$MAKEDEPEND" in /*) ac_cv_path_MAKEDEPEND="$MAKEDEPEND" # Let the user override the test with a path. ;; ?:/*) ac_cv_path_MAKEDEPEND="$MAKEDEPEND" # Let the user override the test with a dos path. ;; *) IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS=":" ac_dummy="$PATH" for ac_dir in $ac_dummy; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then ac_cv_path_MAKEDEPEND="$ac_dir/$ac_word" break fi done IFS="$ac_save_ifs" ;; esac fi MAKEDEPEND="$ac_cv_path_MAKEDEPEND" if test -n "$MAKEDEPEND"; then echo "$ac_t""$MAKEDEPEND" 1>&6 else echo "$ac_t""no" 1>&6 fi # Make sure we can run config.sub. if ${CONFIG_SHELL-/bin/sh} $ac_config_sub sun4 >/dev/null 2>&1; then : else { echo "configure: error: can not run $ac_config_sub" 1>&2; exit 1; } fi echo $ac_n "checking host system type""... $ac_c" 1>&6 echo "configure:885: checking host system type" >&5 host_alias=$host case "$host_alias" in NONE) case $nonopt in NONE) if host_alias=`${CONFIG_SHELL-/bin/sh} $ac_config_guess`; then : else { echo "configure: error: can not guess host type; you must specify one" 1>&2; exit 1; } fi ;; *) host_alias=$nonopt ;; esac ;; esac host=`${CONFIG_SHELL-/bin/sh} $ac_config_sub $host_alias` host_cpu=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\1/'` host_vendor=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\2/'` host_os=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\3/'` echo "$ac_t""$host" 1>&6 linux=no case "$host" in *-netbsd*) cat >> confdefs.h <<\EOF #define NETBSD 1 EOF ;; *-openbsd*) cat >> confdefs.h <<\EOF #define OPENBSD 1 EOF ;; *-sgi-irix5*) cat >> confdefs.h <<\EOF #define IRIX 1 EOF no_libsocket=yes no_libnsl=yes if test -z "$GCC"; then sgi_cc=yes fi ;; *-sgi-irix6*) cat >> confdefs.h <<\EOF #define IRIX 1 EOF no_libsocket=yes no_libnsl=yes if test -z "$GCC"; then sgi_cc=yes fi ;; *-solaris2.0*) cat >> confdefs.h <<\EOF #define STUPID_SOLARIS_CHECKSUM_BUG 1 EOF cat >> confdefs.h <<\EOF #define SOLARIS 1 EOF ;; *-solaris2.1*) cat >> confdefs.h <<\EOF #define STUPID_SOLARIS_CHECKSUM_BUG 1 EOF cat >> confdefs.h <<\EOF #define SOLARIS 1 EOF ;; *-solaris2.2*) cat >> confdefs.h <<\EOF #define STUPID_SOLARIS_CHECKSUM_BUG 1 EOF cat >> confdefs.h <<\EOF #define SOLARIS 1 EOF ;; *-solaris2.3*) cat >> confdefs.h <<\EOF #define STUPID_SOLARIS_CHECKSUM_BUG 1 EOF cat >> confdefs.h <<\EOF #define SOLARIS 1 EOF ;; *-solaris2.4*) cat >> confdefs.h <<\EOF #define STUPID_SOLARIS_CHECKSUM_BUG 1 EOF cat >> confdefs.h <<\EOF #define SOLARIS 1 EOF ;; *-solaris2.5.1) cat >> confdefs.h <<\EOF #define STUPID_SOLARIS_CHECKSUM_BUG 1 EOF cat >> confdefs.h <<\EOF #define SOLARIS 1 EOF ;; *-solaris*) cat >> confdefs.h <<\EOF #define SOLARIS 1 EOF ;; *-sunos4*) cat >> confdefs.h <<\EOF #define SUNOS 1 EOF cat >> confdefs.h <<\EOF #define SPRINTF_RETURNS_STRING 1 EOF no_libnsl=yes no_libsocket=yes ;; *-linux*) linux=yes cat >> confdefs.h <<\EOF #define LINUX 1 EOF cat >> confdefs.h <<\EOF #define PCAP_TIMEOUT_IGNORED 1 EOF # libpcap doesn't even LOOK at # the timeout you give it under Linux ;; *-freebsd*) cat >> confdefs.h <<\EOF #define FREEBSD 1 EOF ;; *-bsdi*) cat >> confdefs.h <<\EOF #define BSDI 1 EOF ;; esac if test -z "$no_libnsl"; then echo $ac_n "checking for inet_ntoa in -lnsl""... $ac_c" 1>&6 echo "configure:1049: checking for inet_ntoa in -lnsl" >&5 ac_lib_var=`echo nsl'_'inet_ntoa | sed 'y%./+-%__p_%'` if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else ac_save_LIBS="$LIBS" LIBS="-lnsl $LIBS" cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_lib_$ac_lib_var=yes" else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_lib_$ac_lib_var=no" fi rm -f conftest* LIBS="$ac_save_LIBS" fi if eval "test \"`echo '$ac_cv_lib_'$ac_lib_var`\" = yes"; then echo "$ac_t""yes" 1>&6 ac_tr_lib=HAVE_LIB`echo nsl | sed -e 's/[^a-zA-Z0-9_]/_/g' \ -e 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/'` cat >> confdefs.h <&6 fi fi if test -z "$no_libsocket"; then echo $ac_n "checking for socket in -lsocket""... $ac_c" 1>&6 echo "configure:1098: checking for socket in -lsocket" >&5 ac_lib_var=`echo socket'_'socket | sed 'y%./+-%__p_%'` if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else ac_save_LIBS="$LIBS" LIBS="-lsocket $LIBS" cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_lib_$ac_lib_var=yes" else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_lib_$ac_lib_var=no" fi rm -f conftest* LIBS="$ac_save_LIBS" fi if eval "test \"`echo '$ac_cv_lib_'$ac_lib_var`\" = yes"; then echo "$ac_t""yes" 1>&6 ac_tr_lib=HAVE_LIB`echo socket | sed -e 's/[^a-zA-Z0-9_]/_/g' \ -e 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/'` cat >> confdefs.h <&6 fi fi echo $ac_n "checking for nanosleep in -lposix4""... $ac_c" 1>&6 echo "configure:1147: checking for nanosleep in -lposix4" >&5 ac_lib_var=`echo posix4'_'nanosleep | sed 'y%./+-%__p_%'` if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else ac_save_LIBS="$LIBS" LIBS="-lposix4 $LIBS" cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_lib_$ac_lib_var=yes" else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_lib_$ac_lib_var=no" fi rm -f conftest* LIBS="$ac_save_LIBS" fi if eval "test \"`echo '$ac_cv_lib_'$ac_lib_var`\" = yes"; then echo "$ac_t""yes" 1>&6 ac_tr_lib=HAVE_LIB`echo posix4 | sed -e 's/[^a-zA-Z0-9_]/_/g' \ -e 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/'` cat >> confdefs.h <&6 fi echo $ac_n "checking for pcap_datalink in -lpcap""... $ac_c" 1>&6 echo "configure:1195: checking for pcap_datalink in -lpcap" >&5 ac_lib_var=`echo pcap'_'pcap_datalink | sed 'y%./+-%__p_%'` if eval "test \"`echo '$''{'ac_cv_lib_$ac_lib_var'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else ac_save_LIBS="$LIBS" LIBS="-lpcap $LIBS" cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_lib_$ac_lib_var=yes" else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_lib_$ac_lib_var=no" fi rm -f conftest* LIBS="$ac_save_LIBS" fi if eval "test \"`echo '$ac_cv_lib_'$ac_lib_var`\" = yes"; then echo "$ac_t""yes" 1>&6 have_libpcap=yes else echo "$ac_t""no" 1>&6 have_libpcap=no fi if test $linux = yes; then have_libpcap=no fi if test $have_libpcap = yes; then echo $ac_n "checking if libpcap version is recent enough""... $ac_c" 1>&6 echo "configure:1240: checking if libpcap version is recent enough" >&5 if test "$cross_compiling" = yes; then echo "$ac_t""no" 1>&6; have_libpcap=no else cat > conftest.$ac_ext < extern char pcap_version[]; int main() { int major, minor; sscanf(pcap_version,"%d.%d", &major, &minor); if (major > 0) exit(0); if (minor > 4) exit(0); if (minor < 4) exit(1); if (pcap_version[3] > 'a') exit(0); if (pcap_version[3] == 'a') { if(!sscanf(&pcap_version[4], "%d", &minor)) exit(1); if (minor >= 6) exit(0); else exit(1); } exit(1); } EOF if { (eval echo configure:1272: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null then echo "$ac_t""yes" 1>&6; have_libpcap=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -fr conftest* echo "$ac_t""no" 1>&6; have_libpcap=no fi rm -fr conftest* fi fi if test $have_libpcap = yes; then PCAP_DEPENDS="" PCAP_CLEAN="" PCAP_DIST_CLEAN="" cat >> confdefs.h <<\EOF #define HAVE_LIBPCAP 1 EOF else LDFLAGS="$LDFLAGS -L$libpcapdir" CFLAGS="$CFLAGS -I$libpcapdir" PCAP_DEPENDS='$(LIBPCAPDIR)/libpcap.a' PCAP_CLEAN="pcap_clean" PCAP_DIST_CLEAN="pcap_dist_clean" fi echo $ac_n "checking how to run the C preprocessor""... $ac_c" 1>&6 echo "configure:1306: checking how to run the C preprocessor" >&5 # On Suns, sometimes $CPP names a directory. if test -n "$CPP" && test -d "$CPP"; then CPP= fi if test -z "$CPP"; then if eval "test \"`echo '$''{'ac_cv_prog_CPP'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else # This must be in double quotes, not single quotes, because CPP may get # substituted into the Makefile and "${CC-cc}" will confuse make. CPP="${CC-cc} -E" # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. cat > conftest.$ac_ext < Syntax Error EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1327: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"` if test -z "$ac_err"; then : else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* CPP="${CC-cc} -E -traditional-cpp" cat > conftest.$ac_ext < Syntax Error EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1344: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"` if test -z "$ac_err"; then : else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* CPP="${CC-cc} -nologo -E" cat > conftest.$ac_ext < Syntax Error EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1361: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"` if test -z "$ac_err"; then : else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* CPP=/lib/cpp fi rm -f conftest* fi rm -f conftest* fi rm -f conftest* ac_cv_prog_CPP="$CPP" fi CPP="$ac_cv_prog_CPP" else ac_cv_prog_CPP="$CPP" fi echo "$ac_t""$CPP" 1>&6 echo $ac_n "checking for ANSI C header files""... $ac_c" 1>&6 echo "configure:1386: checking for ANSI C header files" >&5 if eval "test \"`echo '$''{'ac_cv_header_stdc'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < #include #include #include EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1399: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"` if test -z "$ac_err"; then rm -rf conftest* ac_cv_header_stdc=yes else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_header_stdc=no fi rm -f conftest* if test $ac_cv_header_stdc = yes; then # SunOS 4.x string.h does not declare mem*, contrary to ANSI. cat > conftest.$ac_ext < EOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | egrep "memchr" >/dev/null 2>&1; then : else rm -rf conftest* ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI. cat > conftest.$ac_ext < EOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | egrep "free" >/dev/null 2>&1; then : else rm -rf conftest* ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. if test "$cross_compiling" = yes; then : else cat > conftest.$ac_ext < #define ISLOWER(c) ('a' <= (c) && (c) <= 'z') #define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) #define XOR(e, f) (((e) && !(f)) || (!(e) && (f))) int main () { int i; for (i = 0; i < 256; i++) if (XOR (islower (i), ISLOWER (i)) || toupper (i) != TOUPPER (i)) exit(2); exit (0); } EOF if { (eval echo configure:1466: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null then : else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -fr conftest* ac_cv_header_stdc=no fi rm -fr conftest* fi fi fi echo "$ac_t""$ac_cv_header_stdc" 1>&6 if test $ac_cv_header_stdc = yes; then cat >> confdefs.h <<\EOF #define STDC_HEADERS 1 EOF fi for ac_hdr in string.h strings.h memory.h sys/param.h sys/sockio.h netinet/if_ether.h bstring.h sys/time.h do ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'` echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6 echo "configure:1493: checking for $ac_hdr" >&5 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1503: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"` if test -z "$ac_err"; then rm -rf conftest* eval "ac_cv_header_$ac_safe=yes" else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_header_$ac_safe=no" fi rm -f conftest* fi if eval "test \"`echo '$ac_cv_header_'$ac_safe`\" = yes"; then echo "$ac_t""yes" 1>&6 ac_tr_hdr=HAVE_`echo $ac_hdr | sed 'y%abcdefghijklmnopqrstuvwxyz./-%ABCDEFGHIJKLMNOPQRSTUVWXYZ___%'` cat >> confdefs.h <&6 fi done echo $ac_n "checking whether time.h and sys/time.h may both be included""... $ac_c" 1>&6 echo "configure:1530: checking whether time.h and sys/time.h may both be included" >&5 if eval "test \"`echo '$''{'ac_cv_header_time'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < #include #include int main() { struct tm *tp; ; return 0; } EOF if { (eval echo configure:1544: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_header_time=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_header_time=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_header_time" 1>&6 if test $ac_cv_header_time = yes; then cat >> confdefs.h <<\EOF #define TIME_WITH_SYS_TIME 1 EOF fi echo $ac_n "checking for inline""... $ac_c" 1>&6 echo "configure:1570: checking for inline" >&5 if eval "test \"`echo '$''{'ac_cv_c_inline'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else ac_cv_c_inline=no for ac_kw in inline __inline__ __inline; do cat > conftest.$ac_ext <&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_c_inline=$ac_kw; break else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 fi rm -f conftest* done fi echo "$ac_t""$ac_cv_c_inline" 1>&6 case "$ac_cv_c_inline" in inline | yes) ;; no) cat >> confdefs.h <<\EOF #define inline EOF ;; *) cat >> confdefs.h <> confdefs.h <<\EOF #define inline EOF fi echo $ac_n "checking struct ip""... $ac_c" 1>&6 echo "configure:1618: checking struct ip" >&5 cat > conftest.$ac_ext < #include #include #include int main() { struct ip ip; ; return 0; } EOF if { (eval echo configure:1630: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* echo "$ac_t""yes" 1>&6; bsd_networking=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* echo "$ac_t""no" 1>&6; bsd_networking=no fi rm -f conftest*; if test $bsd_networking = yes; then cat >> confdefs.h <<\EOF #define BSD_NETWORKING 1 EOF echo $ac_n "checking ip_v in struct ip""... $ac_c" 1>&6 echo "configure:1647: checking ip_v in struct ip" >&5 cat > conftest.$ac_ext < #include #include #include int main() { struct ip ip; ip.ip_v; ; return 0; } EOF if { (eval echo configure:1659: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* echo "$ac_t""yes" 1>&6; has_bitfields=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* echo "$ac_t""no" 1>&6; has_bitfields=no fi rm -f conftest* if test $has_bitfields = no; then SAVE_CFLAGS="$CFLAGS" CFLAGS="-D__STDC__=2" echo $ac_n "checking if setting __STDC__=2 gives ip_v""... $ac_c" 1>&6 echo "configure:1675: checking if setting __STDC__=2 gives ip_v" >&5 cat > conftest.$ac_ext < #include #include #include int main() { struct ip ip; ip.ip_v; ; return 0; } EOF if { (eval echo configure:1687: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* echo "$ac_t""yes" 1>&6; setting_stdc_helps=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* echo "$ac_t""no" 1>&6; setting_stdc_helps=no fi rm -f conftest* CFLAGS="$SAVE_CFLAGS" if test $setting_stdc_helps = yes; then CFLAGS="$CFLAGS -D__STDC__=2" else echo "$ac_t""Can't figure out how to get bitfields - configure failed" 1>&6 exit 1 fi fi fi echo $ac_n "checking if sockaddr{} has sa_len member""... $ac_c" 1>&6 echo "configure:1711: checking if sockaddr{} has sa_len member" >&5 if eval "test \"`echo '$''{'ac_cv_sockaddr_has_sa_len'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < # include int main() { unsigned int i = sizeof(((struct sockaddr *)0)->sa_len) ; return 0; } EOF if { (eval echo configure:1725: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_sockaddr_has_sa_len=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_sockaddr_has_sa_len=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_sockaddr_has_sa_len" 1>&6 if test $ac_cv_sockaddr_has_sa_len = yes ; then cat >> confdefs.h <<\EOF #define HAVE_SOCKADDR_SA_LEN 1 EOF fi echo $ac_n "checking whether byte ordering is bigendian""... $ac_c" 1>&6 echo "configure:1746: checking whether byte ordering is bigendian" >&5 if eval "test \"`echo '$''{'ac_cv_c_bigendian'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else ac_cv_c_bigendian=unknown # See if sys/param.h defines the BYTE_ORDER macro. cat > conftest.$ac_ext < #include int main() { #if !BYTE_ORDER || !BIG_ENDIAN || !LITTLE_ENDIAN bogus endian macros #endif ; return 0; } EOF if { (eval echo configure:1764: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* # It does; now see whether it defined to BIG_ENDIAN or not. cat > conftest.$ac_ext < #include int main() { #if BYTE_ORDER != BIG_ENDIAN not big endian #endif ; return 0; } EOF if { (eval echo configure:1779: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_c_bigendian=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_c_bigendian=no fi rm -f conftest* else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 fi rm -f conftest* if test $ac_cv_c_bigendian = unknown; then if test "$cross_compiling" = yes; then { echo "configure: error: can not run test program while cross compiling" 1>&2; exit 1; } else cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null then ac_cv_c_bigendian=no else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -fr conftest* ac_cv_c_bigendian=yes fi rm -fr conftest* fi fi fi echo "$ac_t""$ac_cv_c_bigendian" 1>&6 if test $ac_cv_c_bigendian = yes; then cat >> confdefs.h <<\EOF #define WORDS_BIGENDIAN 1 EOF fi echo $ac_n "checking if struct in_addr is a wacky huge structure (some Sun boxes)""... $ac_c" 1>&6 echo "configure:1837: checking if struct in_addr is a wacky huge structure (some Sun boxes)" >&5 cat > conftest.$ac_ext < int main() { struct in_addr i; i._S_un._S_addr; ; return 0; } EOF if { (eval echo configure:1847: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* \ cat >> confdefs.h <<\EOF #define IN_ADDR_DEEPSTRUCT 1 EOF \ echo "$ac_t""yes" 1>&6 else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* \ cat > conftest.$ac_ext < #include int main() { struct in_addr i; i.S_un.S_addr; ; return 0; } EOF if { (eval echo configure:1869: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* \ cat >> confdefs.h <<\EOF #define IN_ADDR_DEEPSTRUCT 1 EOF \ echo "$ac_t""yes" 1>&6 else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* \ echo "$ac_t""no" 1>&6; fi rm -f conftest* fi rm -f conftest* echo $ac_n "checking if struct icmp exists""... $ac_c" 1>&6 echo "configure:1889: checking if struct icmp exists" >&5 if eval "test \"`echo '$''{'ac_cv_struct_icmp_exists'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < # include # include # include # define __USE_BSD # define __FAVOR_BSD # define __BSD_SOURCE # include # include int main() { unsigned int i = sizeof(struct icmp) ; return 0; } EOF if { (eval echo configure:1910: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_struct_icmp_exists=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_struct_icmp_exists=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_struct_icmp_exists" 1>&6 if test $ac_cv_struct_icmp_exists = yes ; then cat >> confdefs.h <<\EOF #define HAVE_STRUCT_ICMP 1 EOF fi echo $ac_n "checking if struct ip exists""... $ac_c" 1>&6 echo "configure:1931: checking if struct ip exists" >&5 if eval "test \"`echo '$''{'ac_cv_struct_ip_exists'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < # include # include # include # define __USE_BSD # define __FAVOR_BSD # define __BSD_SOURCE # include int main() { unsigned int i = sizeof(struct ip) ; return 0; } EOF if { (eval echo configure:1951: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_struct_ip_exists=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_struct_ip_exists=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_struct_ip_exists" 1>&6 if test $ac_cv_struct_ip_exists = yes ; then cat >> confdefs.h <<\EOF #define HAVE_STRUCT_IP 1 EOF fi echo $ac_n "checking if struct ip has ip_sum member""... $ac_c" 1>&6 echo "configure:1972: checking if struct ip has ip_sum member" >&5 if eval "test \"`echo '$''{'ac_cv_ip_has_ip_sum'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < # include # include # include # define __USE_BSD # define __FAVOR_BSD # define __BSD_SOURCE # include # include int main() { unsigned int i = sizeof(((struct ip *)0)->ip_sum) ; return 0; } EOF if { (eval echo configure:1993: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_ip_has_ip_sum=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_ip_has_ip_sum=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_ip_has_ip_sum" 1>&6 if test $ac_cv_ip_has_ip_sum = yes ; then cat >> confdefs.h <<\EOF #define HAVE_IP_IP_SUM 1 EOF fi for ac_func in bzero snprintf memcpy usleep nanosleep strerror do echo $ac_n "checking for $ac_func""... $ac_c" 1>&6 echo "configure:2016: checking for $ac_func" >&5 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char $ac_func(); int main() { /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_$ac_func) || defined (__stub___$ac_func) choke me #else $ac_func(); #endif ; return 0; } EOF if { (eval echo configure:2044: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_func_$ac_func=yes" else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_func_$ac_func=no" fi rm -f conftest* fi if eval "test \"`echo '$ac_cv_func_'$ac_func`\" = yes"; then echo "$ac_t""yes" 1>&6 ac_tr_func=HAVE_`echo $ac_func | tr 'abcdefghijklmnopqrstuvwxyz' 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'` cat >> confdefs.h <&6 fi done echo $ac_n "checking for snprintf""... $ac_c" 1>&6 echo "configure:2070: checking for snprintf" >&5 if eval "test \"`echo '$''{'ac_cv_func_snprintf'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char snprintf(); int main() { /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_snprintf) || defined (__stub___snprintf) choke me #else snprintf(); #endif ; return 0; } EOF if { (eval echo configure:2098: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_func_snprintf=yes" else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_func_snprintf=no" fi rm -f conftest* fi if eval "test \"`echo '$ac_cv_func_'snprintf`\" = yes"; then echo "$ac_t""yes" 1>&6 : else echo "$ac_t""no" 1>&6 COMPAT_SRCS="$COMPAT_SRCS snprintf.c" COMPAT_OBJS="$COMPAT_OBJS snprintf.o" fi echo $ac_n "checking for inet_aton""... $ac_c" 1>&6 echo "configure:2121: checking for inet_aton" >&5 if eval "test \"`echo '$''{'ac_cv_func_inet_aton'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char inet_aton(); int main() { /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_inet_aton) || defined (__stub___inet_aton) choke me #else inet_aton(); #endif ; return 0; } EOF if { (eval echo configure:2149: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext}; then rm -rf conftest* eval "ac_cv_func_inet_aton=yes" else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_func_inet_aton=no" fi rm -f conftest* fi if eval "test \"`echo '$ac_cv_func_'inet_aton`\" = yes"; then echo "$ac_t""yes" 1>&6 : else echo "$ac_t""no" 1>&6 COMPAT_SRCS="$COMPAT_SRCS inet_aton.c" COMPAT_OBJS="$COMPAT_OBJS inet_aton.o" fi trap '' 1 2 15 cat > confcache <<\EOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure # scripts and configure runs. It is not useful on other systems. # If it contains results you don't want to keep, you may remove or edit it. # # By default, configure uses ./config.cache as the cache file, # creating it if it does not exist already. You can give configure # the --cache-file=FILE option to use a different cache file; that is # what configure does when it calls configure scripts in # subdirectories, so they share the cache. # Giving --cache-file=/dev/null disables caching, for debugging configure. # config.status only pays attention to the cache file if you give it the # --recheck option to rerun configure. # EOF # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, don't put newlines in cache variables' values. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. (set) 2>&1 | case `(ac_space=' '; set | grep ac_space) 2>&1` in *ac_space=\ *) # `set' does not quote correctly, so add quotes (double-quote substitution # turns \\\\ into \\, and sed turns \\ into \). sed -n \ -e "s/'/'\\\\''/g" \ -e "s/^\\([a-zA-Z0-9_]*_cv_[a-zA-Z0-9_]*\\)=\\(.*\\)/\\1=\${\\1='\\2'}/p" ;; *) # `set' quotes correctly as required by POSIX, so do not add quotes. sed -n -e 's/^\([a-zA-Z0-9_]*_cv_[a-zA-Z0-9_]*\)=\(.*\)/\1=${\1=\2}/p' ;; esac >> confcache if cmp -s $cache_file confcache; then : else if test -w $cache_file; then echo "updating cache $cache_file" cat confcache > $cache_file else echo "not updating unwritable cache $cache_file" fi fi rm -f confcache trap 'rm -fr conftest* confdefs* core core.* *.core $ac_clean_files; exit 1' 1 2 15 test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' # Any assignment to VPATH causes Sun make to only execute # the first set of double-colon rules, so remove it if not needed. # If there is a colon in the path, we need to keep it. if test "x$srcdir" = x.; then ac_vpsub='/^[ ]*VPATH[ ]*=[^:]*$/d' fi trap 'rm -f $CONFIG_STATUS conftest*; exit 1' 1 2 15 DEFS=-DHAVE_CONFIG_H # Without the "./", some shells look in PATH for config.status. : ${CONFIG_STATUS=./config.status} echo creating $CONFIG_STATUS rm -f $CONFIG_STATUS cat > $CONFIG_STATUS </dev/null | sed 1q`: # # $0 $ac_configure_args # # Compiler output produced by configure, useful for debugging # configure, is in ./config.log if it exists. ac_cs_usage="Usage: $CONFIG_STATUS [--recheck] [--version] [--help]" for ac_option do case "\$ac_option" in -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) echo "running \${CONFIG_SHELL-/bin/sh} $0 $ac_configure_args --no-create --no-recursion" exec \${CONFIG_SHELL-/bin/sh} $0 $ac_configure_args --no-create --no-recursion ;; -version | --version | --versio | --versi | --vers | --ver | --ve | --v) echo "$CONFIG_STATUS generated by autoconf version 2.13" exit 0 ;; -help | --help | --hel | --he | --h) echo "\$ac_cs_usage"; exit 0 ;; *) echo "\$ac_cs_usage"; exit 1 ;; esac done ac_given_srcdir=$srcdir ac_given_INSTALL="$INSTALL" trap 'rm -fr `echo "Makefile config.h" | sed "s/:[^ ]*//g"` conftest*; exit 1' 1 2 15 EOF cat >> $CONFIG_STATUS < conftest.subs <<\\CEOF $ac_vpsub $extrasub s%@SHELL@%$SHELL%g s%@CFLAGS@%$CFLAGS%g s%@CPPFLAGS@%$CPPFLAGS%g s%@CXXFLAGS@%$CXXFLAGS%g s%@FFLAGS@%$FFLAGS%g s%@DEFS@%$DEFS%g s%@LDFLAGS@%$LDFLAGS%g s%@LIBS@%$LIBS%g s%@exec_prefix@%$exec_prefix%g s%@prefix@%$prefix%g s%@program_transform_name@%$program_transform_name%g s%@bindir@%$bindir%g s%@sbindir@%$sbindir%g s%@libexecdir@%$libexecdir%g s%@datadir@%$datadir%g s%@sysconfdir@%$sysconfdir%g s%@sharedstatedir@%$sharedstatedir%g s%@localstatedir@%$localstatedir%g s%@libdir@%$libdir%g s%@includedir@%$includedir%g s%@oldincludedir@%$oldincludedir%g s%@infodir@%$infodir%g s%@mandir@%$mandir%g s%@libpcapdir@%$libpcapdir%g s%@CC@%$CC%g s%@INSTALL_PROGRAM@%$INSTALL_PROGRAM%g s%@INSTALL_SCRIPT@%$INSTALL_SCRIPT%g s%@INSTALL_DATA@%$INSTALL_DATA%g s%@MAKEDEPEND@%$MAKEDEPEND%g s%@COMPAT_OBJS@%$COMPAT_OBJS%g s%@COMPAT_SRCS@%$COMPAT_SRCS%g s%@host@%$host%g s%@host_alias@%$host_alias%g s%@host_cpu@%$host_cpu%g s%@host_vendor@%$host_vendor%g s%@host_os@%$host_os%g s%@PCAP_DEPENDS@%$PCAP_DEPENDS%g s%@PCAP_CLEAN@%$PCAP_CLEAN%g s%@PCAP_DIST_CLEAN@%$PCAP_DIST_CLEAN%g s%@CPP@%$CPP%g CEOF EOF cat >> $CONFIG_STATUS <<\EOF # Split the substitutions into bite-sized pieces for seds with # small command number limits, like on Digital OSF/1 and HP-UX. ac_max_sed_cmds=90 # Maximum number of lines to put in a sed script. ac_file=1 # Number of current file. ac_beg=1 # First line for current file. ac_end=$ac_max_sed_cmds # Line after last line for current file. ac_more_lines=: ac_sed_cmds="" while $ac_more_lines; do if test $ac_beg -gt 1; then sed "1,${ac_beg}d; ${ac_end}q" conftest.subs > conftest.s$ac_file else sed "${ac_end}q" conftest.subs > conftest.s$ac_file fi if test ! -s conftest.s$ac_file; then ac_more_lines=false rm -f conftest.s$ac_file else if test -z "$ac_sed_cmds"; then ac_sed_cmds="sed -f conftest.s$ac_file" else ac_sed_cmds="$ac_sed_cmds | sed -f conftest.s$ac_file" fi ac_file=`expr $ac_file + 1` ac_beg=$ac_end ac_end=`expr $ac_end + $ac_max_sed_cmds` fi done if test -z "$ac_sed_cmds"; then ac_sed_cmds=cat fi EOF cat >> $CONFIG_STATUS <> $CONFIG_STATUS <<\EOF for ac_file in .. $CONFIG_FILES; do if test "x$ac_file" != x..; then # Support "outfile[:infile[:infile...]]", defaulting infile="outfile.in". case "$ac_file" in *:*) ac_file_in=`echo "$ac_file"|sed 's%[^:]*:%%'` ac_file=`echo "$ac_file"|sed 's%:.*%%'` ;; *) ac_file_in="${ac_file}.in" ;; esac # Adjust a relative srcdir, top_srcdir, and INSTALL for subdirectories. # Remove last slash and all that follows it. Not all systems have dirname. ac_dir=`echo $ac_file|sed 's%/[^/][^/]*$%%'` if test "$ac_dir" != "$ac_file" && test "$ac_dir" != .; then # The file is in a subdirectory. test ! -d "$ac_dir" && mkdir "$ac_dir" ac_dir_suffix="/`echo $ac_dir|sed 's%^\./%%'`" # A "../" for each directory in $ac_dir_suffix. ac_dots=`echo $ac_dir_suffix|sed 's%/[^/]*%../%g'` else ac_dir_suffix= ac_dots= fi case "$ac_given_srcdir" in .) srcdir=. if test -z "$ac_dots"; then top_srcdir=. else top_srcdir=`echo $ac_dots|sed 's%/$%%'`; fi ;; /*) srcdir="$ac_given_srcdir$ac_dir_suffix"; top_srcdir="$ac_given_srcdir" ;; *) # Relative path. srcdir="$ac_dots$ac_given_srcdir$ac_dir_suffix" top_srcdir="$ac_dots$ac_given_srcdir" ;; esac case "$ac_given_INSTALL" in [/$]*) INSTALL="$ac_given_INSTALL" ;; *) INSTALL="$ac_dots$ac_given_INSTALL" ;; esac echo creating "$ac_file" rm -f "$ac_file" configure_input="Generated automatically from `echo $ac_file_in|sed 's%.*/%%'` by configure." case "$ac_file" in *Makefile*) ac_comsub="1i\\ # $configure_input" ;; *) ac_comsub= ;; esac ac_file_inputs=`echo $ac_file_in|sed -e "s%^%$ac_given_srcdir/%" -e "s%:% $ac_given_srcdir/%g"` sed -e "$ac_comsub s%@configure_input@%$configure_input%g s%@srcdir@%$srcdir%g s%@top_srcdir@%$top_srcdir%g s%@INSTALL@%$INSTALL%g " $ac_file_inputs | (eval "$ac_sed_cmds") > $ac_file fi; done rm -f conftest.s* # These sed commands are passed to sed as "A NAME B NAME C VALUE D", where # NAME is the cpp macro being defined and VALUE is the value it is being given. # # ac_d sets the value in "#define NAME VALUE" lines. ac_dA='s%^\([ ]*\)#\([ ]*define[ ][ ]*\)' ac_dB='\([ ][ ]*\)[^ ]*%\1#\2' ac_dC='\3' ac_dD='%g' # ac_u turns "#undef NAME" with trailing blanks into "#define NAME VALUE". ac_uA='s%^\([ ]*\)#\([ ]*\)undef\([ ][ ]*\)' ac_uB='\([ ]\)%\1#\2define\3' ac_uC=' ' ac_uD='\4%g' # ac_e turns "#undef NAME" without trailing blanks into "#define NAME VALUE". ac_eA='s%^\([ ]*\)#\([ ]*\)undef\([ ][ ]*\)' ac_eB='$%\1#\2define\3' ac_eC=' ' ac_eD='%g' if test "${CONFIG_HEADERS+set}" != set; then EOF cat >> $CONFIG_STATUS <> $CONFIG_STATUS <<\EOF fi for ac_file in .. $CONFIG_HEADERS; do if test "x$ac_file" != x..; then # Support "outfile[:infile[:infile...]]", defaulting infile="outfile.in". case "$ac_file" in *:*) ac_file_in=`echo "$ac_file"|sed 's%[^:]*:%%'` ac_file=`echo "$ac_file"|sed 's%:.*%%'` ;; *) ac_file_in="${ac_file}.in" ;; esac echo creating $ac_file rm -f conftest.frag conftest.in conftest.out ac_file_inputs=`echo $ac_file_in|sed -e "s%^%$ac_given_srcdir/%" -e "s%:% $ac_given_srcdir/%g"` cat $ac_file_inputs > conftest.in EOF # Transform confdefs.h into a sed script conftest.vals that substitutes # the proper values into config.h.in to produce config.h. And first: # Protect against being on the right side of a sed subst in config.status. # Protect against being in an unquoted here document in config.status. rm -f conftest.vals cat > conftest.hdr <<\EOF s/[\\&%]/\\&/g s%[\\$`]%\\&%g s%#define \([A-Za-z_][A-Za-z0-9_]*\) *\(.*\)%${ac_dA}\1${ac_dB}\1${ac_dC}\2${ac_dD}%gp s%ac_d%ac_u%gp s%ac_u%ac_e%gp EOF sed -n -f conftest.hdr confdefs.h > conftest.vals rm -f conftest.hdr # This sed command replaces #undef with comments. This is necessary, for # example, in the case of _POSIX_SOURCE, which is predefined and required # on some systems where configure will not decide to define it. cat >> conftest.vals <<\EOF s%^[ ]*#[ ]*undef[ ][ ]*[a-zA-Z_][a-zA-Z_0-9]*%/* & */% EOF # Break up conftest.vals because some shells have a limit on # the size of here documents, and old seds have small limits too. rm -f conftest.tail while : do ac_lines=`grep -c . conftest.vals` # grep -c gives empty output for an empty file on some AIX systems. if test -z "$ac_lines" || test "$ac_lines" -eq 0; then break; fi # Write a limited-size here document to conftest.frag. echo ' cat > conftest.frag <> $CONFIG_STATUS sed ${ac_max_here_lines}q conftest.vals >> $CONFIG_STATUS echo 'CEOF sed -f conftest.frag conftest.in > conftest.out rm -f conftest.in mv conftest.out conftest.in ' >> $CONFIG_STATUS sed 1,${ac_max_here_lines}d conftest.vals > conftest.tail rm -f conftest.vals mv conftest.tail conftest.vals done rm -f conftest.vals cat >> $CONFIG_STATUS <<\EOF rm -f conftest.frag conftest.h echo "/* $ac_file. Generated automatically by configure. */" > conftest.h cat conftest.in >> conftest.h rm -f conftest.in if cmp -s $ac_file conftest.h 2>/dev/null; then echo "$ac_file is unchanged" rm -f conftest.h else # Remove last slash and all that follows it. Not all systems have dirname. ac_dir=`echo $ac_file|sed 's%/[^/][^/]*$%%'` if test "$ac_dir" != "$ac_file" && test "$ac_dir" != .; then # The file is in a subdirectory. test ! -d "$ac_dir" && mkdir "$ac_dir" fi rm -f $ac_file mv conftest.h $ac_file fi fi; done EOF cat >> $CONFIG_STATUS <> $CONFIG_STATUS <<\EOF exit 0 EOF chmod +x $CONFIG_STATUS rm -fr confdefs* $ac_clean_files test "$no_create" = yes || ${CONFIG_SHELL-/bin/sh} $CONFIG_STATUS || exit 1 nmap-2.08/install-sh100755 764 764 12721 6570026751 13514 0ustar fyodorfyodor#! /bin/sh # # install - install a program, script, or datafile # This comes from X11R5 (mit/util/scripts/install.sh). # # Copyright 1991 by the Massachusetts Institute of Technology # # Permission to use, copy, modify, distribute, and sell this software and its # documentation for any purpose is hereby granted without fee, provided that # the above copyright notice appear in all copies and that both that # copyright notice and this permission notice appear in supporting # documentation, and that the name of M.I.T. not be used in advertising or # publicity pertaining to distribution of the software without specific, # written prior permission. M.I.T. makes no representations about the # suitability of this software for any purpose. It is provided "as is" # without express or implied warranty. # # Calling this script install-sh is preferred over install.sh, to prevent # `make' implicit rules from creating a file called install from it # when there is no Makefile. # # This script is compatible with the BSD install script, but was written # from scratch. It can only install one file at a time, a restriction # shared with many OS's install programs. # set DOITPROG to echo to test this script # Don't use :- since 4.3BSD and earlier shells don't like it. doit="${DOITPROG-}" # put in absolute paths if you don't have them in your path; or use env. vars. mvprog="${MVPROG-mv}" cpprog="${CPPROG-cp}" chmodprog="${CHMODPROG-chmod}" chownprog="${CHOWNPROG-chown}" chgrpprog="${CHGRPPROG-chgrp}" stripprog="${STRIPPROG-strip}" rmprog="${RMPROG-rm}" mkdirprog="${MKDIRPROG-mkdir}" transformbasename="" transform_arg="" instcmd="$mvprog" chmodcmd="$chmodprog 0755" chowncmd="" chgrpcmd="" stripcmd="" rmcmd="$rmprog -f" mvcmd="$mvprog" src="" dst="" dir_arg="" while [ x"$1" != x ]; do case $1 in -c) instcmd="$cpprog" shift continue;; -d) dir_arg=true shift continue;; -m) chmodcmd="$chmodprog $2" shift shift continue;; -o) chowncmd="$chownprog $2" shift shift continue;; -g) chgrpcmd="$chgrpprog $2" shift shift continue;; -s) stripcmd="$stripprog" shift continue;; -t=*) transformarg=`echo $1 | sed 's/-t=//'` shift continue;; -b=*) transformbasename=`echo $1 | sed 's/-b=//'` shift continue;; *) if [ x"$src" = x ] then src=$1 else # this colon is to work around a 386BSD /bin/sh bug : dst=$1 fi shift continue;; esac done if [ x"$src" = x ] then echo "install: no input file specified" exit 1 else true fi if [ x"$dir_arg" != x ]; then dst=$src src="" if [ -d $dst ]; then instcmd=: else instcmd=mkdir fi else # Waiting for this to be detected by the "$instcmd $src $dsttmp" command # might cause directories to be created, which would be especially bad # if $src (and thus $dsttmp) contains '*'. if [ -f $src -o -d $src ] then true else echo "install: $src does not exist" exit 1 fi if [ x"$dst" = x ] then echo "install: no destination specified" exit 1 else true fi # If destination is a directory, append the input filename; if your system # does not like double slashes in filenames, you may need to add some logic if [ -d $dst ] then dst="$dst"/`basename $src` else true fi fi ## this sed command emulates the dirname command dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'` # Make sure that the destination directory exists. # this part is taken from Noah Friedman's mkinstalldirs script # Skip lots of stat calls in the usual case. if [ ! -d "$dstdir" ]; then defaultIFS=' ' IFS="${IFS-${defaultIFS}}" oIFS="${IFS}" # Some sh's can't handle IFS=/ for some reason. IFS='%' set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'` IFS="${oIFS}" pathcomp='' while [ $# -ne 0 ] ; do pathcomp="${pathcomp}${1}" shift if [ ! -d "${pathcomp}" ] ; then $mkdirprog "${pathcomp}" else true fi pathcomp="${pathcomp}/" done fi if [ x"$dir_arg" != x ] then $doit $instcmd $dst && if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else true ; fi && if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else true ; fi && if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else true ; fi && if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else true ; fi else # If we're going to rename the final executable, determine the name now. if [ x"$transformarg" = x ] then dstfile=`basename $dst` else dstfile=`basename $dst $transformbasename | sed $transformarg`$transformbasename fi # don't allow the sed command to completely eliminate the filename if [ x"$dstfile" = x ] then dstfile=`basename $dst` else true fi # Make a temp file name in the proper directory. dsttmp=$dstdir/#inst.$$# # Move or copy the file name to the temp name $doit $instcmd $src $dsttmp && trap "rm -f ${dsttmp}" 0 && # and set any options; do chmod last to preserve setuid bits # If any of these fail, we abort the whole thing. If we want to # ignore errors from any of these, just make sure not to ignore # errors from the above "$doit $instcmd $src $dsttmp" command. if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else true;fi && if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else true;fi && if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else true;fi && if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else true;fi && # Now rename the file to the real destination. $doit $rmcmd -f $dstdir/$dstfile && $doit $mvcmd $dsttmp $dstdir/$dstfile fi && exit 0 nmap-2.08/config.guess100755 764 764 47622 6570026711 14034 0ustar fyodorfyodor#! /bin/sh # Attempt to guess a canonical system name. # Copyright (C) 1992, 93, 94, 95, 1996 Free Software Foundation, Inc. # # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. # Written by Per Bothner . # The master version of this file is at the FSF in /home/gd/gnu/lib. # # This script attempts to guess a canonical system name similar to # config.sub. If it succeeds, it prints the system name on stdout, and # exits with 0. Otherwise, it exits with 1. # # The plan is that this can be called by configure scripts if you # don't specify an explicit system type (host/target name). # # Only a few systems have been added to this list; please add others # (but try to keep the structure clean). # # This is needed to find uname on a Pyramid OSx when run in the BSD universe. # (ghazi@noc.rutgers.edu 8/24/94.) if (test -f /.attbin/uname) >/dev/null 2>&1 ; then PATH=$PATH:/.attbin ; export PATH fi UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown trap 'rm -f dummy.c dummy.o dummy; exit 1' 1 2 15 # Note: order is significant - the case branches are not exclusive. case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in alpha:OSF1:*:*) # A Vn.n version is a released version. # A Tn.n version is a released field test version. # A Xn.n version is an unreleased experimental baselevel. # 1.2 uses "1.2" for uname -r. echo alpha-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[VTX]//'` exit 0 ;; 21064:Windows_NT:50:3) echo alpha-dec-winnt3.5 exit 0 ;; Amiga*:UNIX_System_V:4.0:*) echo m68k-cbm-sysv4 exit 0;; amiga:NetBSD:*:*) echo m68k-cbm-netbsd${UNAME_RELEASE} exit 0 ;; amiga:OpenBSD:*:*) echo m68k-cbm-openbsd${UNAME_RELEASE} exit 0 ;; arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*) echo arm-acorn-riscix${UNAME_RELEASE} exit 0;; Pyramid*:OSx*:*:*|MIS*:OSx*:*:*) # akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE. if test "`(/bin/universe) 2>/dev/null`" = att ; then echo pyramid-pyramid-sysv3 else echo pyramid-pyramid-bsd fi exit 0 ;; NILE:*:*:dcosx) echo pyramid-pyramid-svr4 exit 0 ;; sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*) echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit 0 ;; i86pc:SunOS:5.*:*) echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit 0 ;; sun4*:SunOS:6*:*) # According to config.sub, this is the proper way to canonicalize # SunOS6. Hard to guess exactly what SunOS6 will be like, but # it's likely to be more like Solaris than SunOS4. echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit 0 ;; sun4*:SunOS:*:*) case "`/usr/bin/arch -k`" in Series*|S4*) UNAME_RELEASE=`uname -v` ;; esac # Japanese Language versions have a version number like `4.1.3-JL'. echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'` exit 0 ;; sun3*:SunOS:*:*) echo m68k-sun-sunos${UNAME_RELEASE} exit 0 ;; aushp:SunOS:*:*) echo sparc-auspex-sunos${UNAME_RELEASE} exit 0 ;; atari*:NetBSD:*:*) echo m68k-atari-netbsd${UNAME_RELEASE} exit 0 ;; atari*:OpenBSD:*:*) echo m68k-atari-openbsd${UNAME_RELEASE} exit 0 ;; sun3*:NetBSD:*:*) echo m68k-sun-netbsd${UNAME_RELEASE} exit 0 ;; sun3*:OpenBSD:*:*) echo m68k-sun-openbsd${UNAME_RELEASE} exit 0 ;; mac68k:NetBSD:*:*) echo m68k-apple-netbsd${UNAME_RELEASE} exit 0 ;; mac68k:OpenBSD:*:*) echo m68k-apple-openbsd${UNAME_RELEASE} exit 0 ;; powerpc:machten:*:*) echo powerpc-apple-machten${UNAME_RELEASE} exit 0 ;; RISC*:Mach:*:*) echo mips-dec-mach_bsd4.3 exit 0 ;; RISC*:ULTRIX:*:*) echo mips-dec-ultrix${UNAME_RELEASE} exit 0 ;; VAX*:ULTRIX*:*:*) echo vax-dec-ultrix${UNAME_RELEASE} exit 0 ;; mips:*:*:UMIPS | mips:*:*:RISCos) sed 's/^ //' << EOF >dummy.c int main (argc, argv) int argc; char **argv; { #if defined (host_mips) && defined (MIPSEB) #if defined (SYSTYPE_SYSV) printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_SVR4) printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD) printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0); #endif #endif exit (-1); } EOF ${CC-cc} dummy.c -o dummy \ && ./dummy `echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` \ && rm dummy.c dummy && exit 0 rm -f dummy.c dummy echo mips-mips-riscos${UNAME_RELEASE} exit 0 ;; Night_Hawk:Power_UNIX:*:*) echo powerpc-harris-powerunix exit 0 ;; m88k:CX/UX:7*:*) echo m88k-harris-cxux7 exit 0 ;; m88k:*:4*:R4*) echo m88k-motorola-sysv4 exit 0 ;; m88k:*:3*:R3*) echo m88k-motorola-sysv3 exit 0 ;; AViiON:dgux:*:*) # DG/UX returns AViiON for all architectures UNAME_PROCESSOR=`/usr/bin/uname -p` if [ $UNAME_PROCESSOR = mc88100 -o $UNAME_PROCESSOR = mc88110 ] ; then if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx \ -o ${TARGET_BINARY_INTERFACE}x = x ] ; then echo m88k-dg-dgux${UNAME_RELEASE} else echo m88k-dg-dguxbcs${UNAME_RELEASE} fi else echo i586-dg-dgux${UNAME_RELEASE} fi exit 0 ;; M88*:DolphinOS:*:*) # DolphinOS (SVR3) echo m88k-dolphin-sysv3 exit 0 ;; M88*:*:R3*:*) # Delta 88k system running SVR3 echo m88k-motorola-sysv3 exit 0 ;; XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3) echo m88k-tektronix-sysv3 exit 0 ;; Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD) echo m68k-tektronix-bsd exit 0 ;; *:IRIX*:*:*) echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'` exit 0 ;; ????????:AIX?:[12].1:2) # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX. echo romp-ibm-aix # uname -m gives an 8 hex-code CPU id exit 0 ;; # Note that: echo "'`uname -s`'" gives 'AIX ' i?86:AIX:*:*) echo i386-ibm-aix exit 0 ;; *:AIX:2:3) if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then sed 's/^ //' << EOF >dummy.c #include main() { if (!__power_pc()) exit(1); puts("powerpc-ibm-aix3.2.5"); exit(0); } EOF ${CC-cc} dummy.c -o dummy && ./dummy && rm dummy.c dummy && exit 0 rm -f dummy.c dummy echo rs6000-ibm-aix3.2.5 elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then echo rs6000-ibm-aix3.2.4 else echo rs6000-ibm-aix3.2 fi exit 0 ;; *:AIX:*:4) if /usr/sbin/lsattr -EHl proc0 | grep POWER >/dev/null 2>&1; then IBM_ARCH=rs6000 else IBM_ARCH=powerpc fi if [ -x /usr/bin/oslevel ] ; then IBM_REV=`/usr/bin/oslevel` else IBM_REV=4.${UNAME_RELEASE} fi echo ${IBM_ARCH}-ibm-aix${IBM_REV} exit 0 ;; *:AIX:*:*) echo rs6000-ibm-aix exit 0 ;; ibmrt:4.4BSD:*|romp-ibm:BSD:*) echo romp-ibm-bsd4.4 exit 0 ;; ibmrt:*BSD:*|romp-ibm:BSD:*) # covers RT/PC NetBSD and echo romp-ibm-bsd${UNAME_RELEASE} # 4.3 with uname added to exit 0 ;; # report: romp-ibm BSD 4.3 *:BOSX:*:*) echo rs6000-bull-bosx exit 0 ;; DPX/2?00:B.O.S.:*:*) echo m68k-bull-sysv3 exit 0 ;; 9000/[34]??:4.3bsd:1.*:*) echo m68k-hp-bsd exit 0 ;; hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*) echo m68k-hp-bsd4.4 exit 0 ;; 9000/[3478]??:HP-UX:*:*) case "${UNAME_MACHINE}" in 9000/31? ) HP_ARCH=m68000 ;; 9000/[34]?? ) HP_ARCH=m68k ;; 9000/7?? | 9000/8?[1679] ) HP_ARCH=hppa1.1 ;; 9000/8?? ) HP_ARCH=hppa1.0 ;; esac HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'` echo ${HP_ARCH}-hp-hpux${HPUX_REV} exit 0 ;; 3050*:HI-UX:*:*) sed 's/^ //' << EOF >dummy.c #include int main () { long cpu = sysconf (_SC_CPU_VERSION); /* The order matters, because CPU_IS_HP_MC68K erroneously returns true for CPU_PA_RISC1_0. CPU_IS_PA_RISC returns correct results, however. */ if (CPU_IS_PA_RISC (cpu)) { switch (cpu) { case CPU_PA_RISC1_0: puts ("hppa1.0-hitachi-hiuxwe2"); break; case CPU_PA_RISC1_1: puts ("hppa1.1-hitachi-hiuxwe2"); break; case CPU_PA_RISC2_0: puts ("hppa2.0-hitachi-hiuxwe2"); break; default: puts ("hppa-hitachi-hiuxwe2"); break; } } else if (CPU_IS_HP_MC68K (cpu)) puts ("m68k-hitachi-hiuxwe2"); else puts ("unknown-hitachi-hiuxwe2"); exit (0); } EOF ${CC-cc} dummy.c -o dummy && ./dummy && rm dummy.c dummy && exit 0 rm -f dummy.c dummy echo unknown-hitachi-hiuxwe2 exit 0 ;; 9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* ) echo hppa1.1-hp-bsd exit 0 ;; 9000/8??:4.3bsd:*:*) echo hppa1.0-hp-bsd exit 0 ;; hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* ) echo hppa1.1-hp-osf exit 0 ;; hp8??:OSF1:*:*) echo hppa1.0-hp-osf exit 0 ;; i?86:OSF1:*:*) if [ -x /usr/sbin/sysversion ] ; then echo ${UNAME_MACHINE}-unknown-osf1mk else echo ${UNAME_MACHINE}-unknown-osf1 fi exit 0 ;; parisc*:Lites*:*:*) echo hppa1.1-hp-lites exit 0 ;; C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*) echo c1-convex-bsd exit 0 ;; C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*) if getsysinfo -f scalar_acc then echo c32-convex-bsd else echo c2-convex-bsd fi exit 0 ;; C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*) echo c34-convex-bsd exit 0 ;; C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*) echo c38-convex-bsd exit 0 ;; C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*) echo c4-convex-bsd exit 0 ;; CRAY*X-MP:*:*:*) echo xmp-cray-unicos exit 0 ;; CRAY*Y-MP:*:*:*) echo ymp-cray-unicos${UNAME_RELEASE} exit 0 ;; CRAY*[A-Z]90:*:*:*) echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \ | sed -e 's/CRAY.*\([A-Z]90\)/\1/' \ -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ exit 0 ;; CRAY*TS:*:*:*) echo t90-cray-unicos${UNAME_RELEASE} exit 0 ;; CRAY-2:*:*:*) echo cray2-cray-unicos exit 0 ;; F300:UNIX_System_V:*:*) FUJITSU_SYS=`uname -p | tr [A-Z] [a-z] | sed -e 's/\///'` FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'` echo "f300-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit 0 ;; F301:UNIX_System_V:*:*) echo f301-fujitsu-uxpv`echo $UNAME_RELEASE | sed 's/ .*//'` exit 0 ;; hp3[0-9][05]:NetBSD:*:*) echo m68k-hp-netbsd${UNAME_RELEASE} exit 0 ;; hp3[0-9][05]:OpenBSD:*:*) echo m68k-hp-openbsd${UNAME_RELEASE} exit 0 ;; i?86:BSD/386:*:* | *:BSD/OS:*:*) echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE} exit 0 ;; *:FreeBSD:*:*) echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` exit 0 ;; *:NetBSD:*:*) echo ${UNAME_MACHINE}-unknown-netbsd`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'` exit 0 ;; *:OpenBSD:*:*) echo ${UNAME_MACHINE}-unknown-openbsd`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'` exit 0 ;; i*:CYGWIN*:*) echo i386-pc-cygwin32 exit 0 ;; p*:CYGWIN*:*) echo powerpcle-unknown-cygwin32 exit 0 ;; prep*:SunOS:5.*:*) echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit 0 ;; *:GNU:*:*) echo `echo ${UNAME_MACHINE}|sed -e 's,/.*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'` exit 0 ;; *:Linux:*:*) # The BFD linker knows what the default object file format is, so # first see if it will tell us. ld_help_string=`ld --help 2>&1` if echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: elf_i.86"; then echo "${UNAME_MACHINE}-pc-linux-gnu" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: i.86linux"; then echo "${UNAME_MACHINE}-pc-linux-gnuaout" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: i.86coff"; then echo "${UNAME_MACHINE}-pc-linux-gnucoff" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: m68kelf"; then echo "${UNAME_MACHINE}-unknown-linux-gnu" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: m68klinux"; then echo "${UNAME_MACHINE}-unknown-linux-gnuaout" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: elf32ppc"; then echo "powerpc-unknown-linux-gnu" ; exit 0 elif test "${UNAME_MACHINE}" = "alpha" ; then echo alpha-unknown-linux-gnu ; exit 0 elif test "${UNAME_MACHINE}" = "sparc" ; then echo sparc-unknown-linux-gnu ; exit 0 else # Either a pre-BFD a.out linker (linux-gnuoldld) or one that does not give us # useful --help. Gcc wants to distinguish between linux-gnuoldld and linux-gnuaout. test ! -d /usr/lib/ldscripts/. \ && echo "${UNAME_MACHINE}-pc-linux-gnuoldld" && exit 0 # Determine whether the default compiler is a.out or elf cat >dummy.c </dev/null && ./dummy "${UNAME_MACHINE}" && rm dummy.c dummy && exit 0 rm -f dummy.c dummy fi ;; # ptx 4.0 does uname -s correctly, with DYNIX/ptx in there. earlier versions # are messed up and put the nodename in both sysname and nodename. i?86:DYNIX/ptx:4*:*) echo i386-sequent-sysv4 exit 0 ;; i?86:*:4.*:* | i?86:SYSTEM_V:4.*:*) if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then echo ${UNAME_MACHINE}-univel-sysv${UNAME_RELEASE} else echo ${UNAME_MACHINE}-pc-sysv${UNAME_RELEASE} fi exit 0 ;; i?86:*:3.2:*) if test -f /usr/options/cb.name; then UNAME_REL=`sed -n 's/.*Version //p' /dev/null >/dev/null ; then UNAME_REL=`(/bin/uname -X|egrep Release|sed -e 's/.*= //')` (/bin/uname -X|egrep i80486 >/dev/null) && UNAME_MACHINE=i486 (/bin/uname -X|egrep '^Machine.*Pentium' >/dev/null) \ && UNAME_MACHINE=i586 echo ${UNAME_MACHINE}-pc-sco$UNAME_REL else echo ${UNAME_MACHINE}-pc-sysv32 fi exit 0 ;; Intel:Mach:3*:*) echo i386-pc-mach3 exit 0 ;; paragon:*:*:*) echo i860-intel-osf1 exit 0 ;; i860:*:4.*:*) # i860-SVR4 if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4 else # Add other i860-SVR4 vendors below as they are discovered. echo i860-unknown-sysv${UNAME_RELEASE} # Unknown i860-SVR4 fi exit 0 ;; mini*:CTIX:SYS*5:*) # "miniframe" echo m68010-convergent-sysv exit 0 ;; M68*:*:R3V[567]*:*) test -r /sysV68 && echo 'm68k-motorola-sysv' && exit 0 ;; 3[34]??:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 4850:*:4.0:3.0) OS_REL='' test -r /etc/.relid \ && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid` /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && echo i486-ncr-sysv4.3${OS_REL} && exit 0 /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ && echo i586-ncr-sysv4.3${OS_REL} && exit 0 ;; 3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*) /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && echo i486-ncr-sysv4 && exit 0 ;; m68*:LynxOS:2.*:*) echo m68k-unknown-lynxos${UNAME_RELEASE} exit 0 ;; mc68030:UNIX_System_V:4.*:*) echo m68k-atari-sysv4 exit 0 ;; i?86:LynxOS:2.*:*) echo i386-unknown-lynxos${UNAME_RELEASE} exit 0 ;; TSUNAMI:LynxOS:2.*:*) echo sparc-unknown-lynxos${UNAME_RELEASE} exit 0 ;; rs6000:LynxOS:2.*:* | PowerPC:LynxOS:2.*:*) echo rs6000-unknown-lynxos${UNAME_RELEASE} exit 0 ;; SM[BE]S:UNIX_SV:*:*) echo mips-dde-sysv${UNAME_RELEASE} exit 0 ;; RM*:SINIX-*:*:*) echo mips-sni-sysv4 exit 0 ;; *:SINIX-*:*:*) if uname -p 2>/dev/null >/dev/null ; then UNAME_MACHINE=`(uname -p) 2>/dev/null` echo ${UNAME_MACHINE}-sni-sysv4 else echo ns32k-sni-sysv fi exit 0 ;; *:UNIX_System_V:4*:FTX*) # From Gerald Hewes . # How about differentiating between stratus architectures? -djm echo hppa1.1-stratus-sysv4 exit 0 ;; *:*:*:FTX*) # From seanf@swdc.stratus.com. echo i860-stratus-sysv4 exit 0 ;; mc68*:A/UX:*:*) echo m68k-apple-aux${UNAME_RELEASE} exit 0 ;; R3000:*System_V*:*:* | R4000:UNIX_SYSV:*:*) if [ -d /usr/nec ]; then echo mips-nec-sysv${UNAME_RELEASE} else echo mips-unknown-sysv${UNAME_RELEASE} fi exit 0 ;; PENTIUM:CPunix:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort # says echo i586-unisys-sysv4 exit 0 ;; esac #echo '(No uname command or uname output not recognized.)' 1>&2 #echo "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" 1>&2 cat >dummy.c < # include #endif main () { #if defined (sony) #if defined (MIPSEB) /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed, I don't know.... */ printf ("mips-sony-bsd\n"); exit (0); #else #include printf ("m68k-sony-newsos%s\n", #ifdef NEWSOS4 "4" #else "" #endif ); exit (0); #endif #endif #if defined (__arm) && defined (__acorn) && defined (__unix) printf ("arm-acorn-riscix"); exit (0); #endif #if defined (hp300) && !defined (hpux) printf ("m68k-hp-bsd\n"); exit (0); #endif #if defined (NeXT) #if !defined (__ARCHITECTURE__) #define __ARCHITECTURE__ "m68k" #endif int version; version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`; printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version); exit (0); #endif #if defined (MULTIMAX) || defined (n16) #if defined (UMAXV) printf ("ns32k-encore-sysv\n"); exit (0); #else #if defined (CMU) printf ("ns32k-encore-mach\n"); exit (0); #else printf ("ns32k-encore-bsd\n"); exit (0); #endif #endif #endif #if defined (__386BSD__) printf ("i386-pc-bsd\n"); exit (0); #endif #if defined (sequent) #if defined (i386) printf ("i386-sequent-dynix\n"); exit (0); #endif #if defined (ns32000) printf ("ns32k-sequent-dynix\n"); exit (0); #endif #endif #if defined (_SEQUENT_) struct utsname un; uname(&un); if (strncmp(un.version, "V2", 2) == 0) { printf ("i386-sequent-ptx2\n"); exit (0); } if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */ printf ("i386-sequent-ptx1\n"); exit (0); } printf ("i386-sequent-ptx\n"); exit (0); #endif #if defined (vax) #if !defined (ultrix) printf ("vax-dec-bsd\n"); exit (0); #else printf ("vax-dec-ultrix\n"); exit (0); #endif #endif #if defined (alliant) && defined (i860) printf ("i860-alliant-bsd\n"); exit (0); #endif exit (1); } EOF ${CC-cc} dummy.c -o dummy 2>/dev/null && ./dummy && rm dummy.c dummy && exit 0 rm -f dummy.c dummy # Apollos put the system type in the environment. test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit 0; } # Convex versions that predate uname can use getsysinfo(1) if [ -x /usr/convex/getsysinfo ] then case `getsysinfo -f cpu_type` in c1*) echo c1-convex-bsd exit 0 ;; c2*) if getsysinfo -f scalar_acc then echo c32-convex-bsd else echo c2-convex-bsd fi exit 0 ;; c34*) echo c34-convex-bsd exit 0 ;; c38*) echo c38-convex-bsd exit 0 ;; c4*) echo c4-convex-bsd exit 0 ;; esac fi #echo '(Unable to guess system type)' 1>&2 exit 1 nmap-2.08/nmap-2.08-1.spec100600 764 764 5335 6662341757 14025 0ustar fyodorfyodor# This is an RPM (Redhat Package Manager) SPEC file for Fyodor's nmap. # This file can be used with 'rpm -bb [specfile]' to create a binary # package (user-installable RPM) for nmap, from the source TAR file. # Contributors to this .spec file: # Chris Wilson # Fyodor # Oren Tirosh # Riku Meskanen # Ian Macdonald Summary: Network exploration tool and security scanner Name: nmap Version: 2.08 Release: 1 Copyright: GPL Group: Networking/Utilities Source: http://www.insecure.org/nmap/nmap-2.08.tgz URL: http://www.insecure.org/nmap/ BuildRoot: /tmp/%{name}-2.08 # The BuildRoot specifies where RPM will look for the files in the %files # secion (i.e. relative to the BuildRoot), and also sets the value of the # $RPM_BUILD_ROOT variable. The default, '/', causes the nmap utility # to be ACTUALLY INSTALLED on the BUILD system (the system where the RPM # is created). It also requires 'rpm -bb [specfile]' to be run as root. Packager: Fyodor Vendor: Fyodor %changelog * Sun Jan 10 1999 Fyodor - Merged in spec file sent in by Ian Macdonald * Tue Dec 29 1998 Fyodor - Made some changes, and merged in another .spec file sent in by Oren Tirosh * Mon Dec 21 1998 Riku Meskanen - initial build for RH 5.x %description Nmap is a utility for network exploration or security auditing. It supports ping scanning (determine which hosts are up), many port scanning techniques (determine what services the hosts are offering), and TCP/IP fingerprinting (remote host operating system identification). Nmap also offers flexible target and port specification, decoy scanning, determination of TCP sequence predictability characteristics, reverse-identd scanning, and more. %prep %setup %build # CFLAGS="$RPM_OPT_FLAGS" ./configure --prefix=$RPM_BUILD_ROOT/usr/local CFLAGS="$RPM_OPT_FLAGS" ./configure --prefix=/usr/local make STATIC=-static strip nmap %install install -d -m 755 $RPM_BUILD_ROOT/usr/local/bin install -d -m 755 $RPM_BUILD_ROOT/usr/local/man/man1 install -d -m 755 $RPM_BUILD_ROOT/usr/local/lib/nmap #install -m 755 $RPM_BUILD_ROOT/ make install bindir=$RPM_BUILD_ROOT/usr/local/bin mandir=$RPM_BUILD_ROOT/usr/local/man libdir=$RPM_BUILD_ROOT/usr/local/lib/nmap # build directory and file lists find $RPM_BUILD_ROOT -type d | sed -e "s#^$RPM_BUILD_ROOT#%attr(-, root, root) %dir #g" > rpm-files find $RPM_BUILD_ROOT -type f | sed -e "s#^$RPM_BUILD_ROOT#%attr(-, root, root) #g" >> rpm-files # cat <> rpm-files # %attr(644, root, root) %doc INSTALL COPYING docs/* # DOCS %clean rm -rf $RPM_BUILD_ROOT %files -f rpm-files #eof nmap-2.08/config.sub100755 764 764 45444 6570026717 13505 0ustar fyodorfyodor#! /bin/sh # Configuration validation subroutine script, version 1.1. # Copyright (C) 1991, 92, 93, 94, 95, 1996 Free Software Foundation, Inc. # This file is (in principle) common to ALL GNU software. # The presence of a machine in this file suggests that SOME GNU software # can handle that machine. It does not imply ALL GNU software can. # # This file is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, # Boston, MA 02111-1307, USA. # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. # Configuration subroutine to validate and canonicalize a configuration type. # Supply the specified configuration type as an argument. # If it is invalid, we print an error message on stderr and exit with code 1. # Otherwise, we print the canonical config type on stdout and succeed. # This file is supposed to be the same for all GNU packages # and recognize all the CPU types, system types and aliases # that are meaningful with *any* GNU software. # Each package is responsible for reporting which valid configurations # it does not support. The user should be able to distinguish # a failure to support a valid configuration from a meaningless # configuration. # The goal of this file is to map all the various variations of a given # machine specification into a single specification in the form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM # or in some cases, the newer four-part form: # CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM # It is wrong to echo any other type of specification. if [ x$1 = x ] then echo Configuration name missing. 1>&2 echo "Usage: $0 CPU-MFR-OPSYS" 1>&2 echo "or $0 ALIAS" 1>&2 echo where ALIAS is a recognized configuration type. 1>&2 exit 1 fi # First pass through any local machine types. case $1 in *local*) echo $1 exit 0 ;; *) ;; esac # Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any). # Here we must recognize all the valid KERNEL-OS combinations. maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'` case $maybe_os in linux-gnu*) os=-$maybe_os basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'` ;; *) basic_machine=`echo $1 | sed 's/-[^-]*$//'` if [ $basic_machine != $1 ] then os=`echo $1 | sed 's/.*-/-/'` else os=; fi ;; esac ### Let's recognize common machines as not being operating systems so ### that things like config.sub decstation-3100 work. We also ### recognize some manufacturers as not being operating systems, so we ### can provide default operating systems below. case $os in -sun*os*) # Prevent following clause from handling this invalid input. ;; -dec* | -mips* | -sequent* | -encore* | -pc532* | -sgi* | -sony* | \ -att* | -7300* | -3300* | -delta* | -motorola* | -sun[234]* | \ -unicom* | -ibm* | -next | -hp | -isi* | -apollo | -altos* | \ -convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\ -c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \ -harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \ -apple) os= basic_machine=$1 ;; -hiux*) os=-hiuxwe2 ;; -sco5) os=sco3.2v5 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco4) os=-sco3.2v4 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco3.2.[4-9]*) os=`echo $os | sed -e 's/sco3.2./sco3.2v/'` basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco3.2v[4-9]*) # Don't forget version if it is 3.2v4 or newer. basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco*) os=-sco3.2v2 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -isc) os=-isc2.2 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -clix*) basic_machine=clipper-intergraph ;; -isc*) basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -lynx*) os=-lynxos ;; -ptx*) basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'` ;; -windowsnt*) os=`echo $os | sed -e 's/windowsnt/winnt/'` ;; -psos*) os=-psos ;; esac # Decode aliases for certain CPU-COMPANY combinations. case $basic_machine in # Recognize the basic CPU types without company name. # Some are omitted here because they have special meanings below. tahoe | i860 | m68k | m68000 | m88k | ns32k | arm \ | arme[lb] | pyramid \ | tron | a29k | 580 | i960 | h8300 | hppa | hppa1.0 | hppa1.1 \ | alpha | we32k | ns16k | clipper | i370 | sh \ | powerpc | powerpcle | 1750a | dsp16xx | mips64 | mipsel \ | pdp11 | mips64el | mips64orion | mips64orionel \ | sparc | sparclet | sparclite | sparc64) basic_machine=$basic_machine-unknown ;; # We use `pc' rather than `unknown' # because (1) that's what they normally are, and # (2) the word "unknown" tends to confuse beginning users. i[3456]86) basic_machine=$basic_machine-pc ;; # Object if more than one company name word. *-*-*) echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2 exit 1 ;; # Recognize the basic CPU types with company name. vax-* | tahoe-* | i[3456]86-* | i860-* | m68k-* | m68000-* | m88k-* \ | sparc-* | ns32k-* | fx80-* | arm-* | c[123]* \ | mips-* | pyramid-* | tron-* | a29k-* | romp-* | rs6000-* | power-* \ | none-* | 580-* | cray2-* | h8300-* | i960-* | xmp-* | ymp-* \ | hppa-* | hppa1.0-* | hppa1.1-* | alpha-* | we32k-* | cydra-* | ns16k-* \ | pn-* | np1-* | xps100-* | clipper-* | orion-* | sparclite-* \ | pdp11-* | sh-* | powerpc-* | powerpcle-* | sparc64-* | mips64-* | mipsel-* \ | mips64el-* | mips64orion-* | mips64orionel-* | f301-*) ;; # Recognize the various machine names and aliases which stand # for a CPU type and a company and sometimes even an OS. 3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc) basic_machine=m68000-att ;; 3b*) basic_machine=we32k-att ;; alliant | fx80) basic_machine=fx80-alliant ;; altos | altos3068) basic_machine=m68k-altos ;; am29k) basic_machine=a29k-none os=-bsd ;; amdahl) basic_machine=580-amdahl os=-sysv ;; amiga | amiga-*) basic_machine=m68k-cbm ;; amigados) basic_machine=m68k-cbm os=-amigados ;; amigaunix | amix) basic_machine=m68k-cbm os=-sysv4 ;; apollo68) basic_machine=m68k-apollo os=-sysv ;; aux) basic_machine=m68k-apple os=-aux ;; balance) basic_machine=ns32k-sequent os=-dynix ;; convex-c1) basic_machine=c1-convex os=-bsd ;; convex-c2) basic_machine=c2-convex os=-bsd ;; convex-c32) basic_machine=c32-convex os=-bsd ;; convex-c34) basic_machine=c34-convex os=-bsd ;; convex-c38) basic_machine=c38-convex os=-bsd ;; cray | ymp) basic_machine=ymp-cray os=-unicos ;; cray2) basic_machine=cray2-cray os=-unicos ;; [ctj]90-cray) basic_machine=c90-cray os=-unicos ;; crds | unos) basic_machine=m68k-crds ;; da30 | da30-*) basic_machine=m68k-da30 ;; decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn) basic_machine=mips-dec ;; delta | 3300 | motorola-3300 | motorola-delta \ | 3300-motorola | delta-motorola) basic_machine=m68k-motorola ;; delta88) basic_machine=m88k-motorola os=-sysv3 ;; dpx20 | dpx20-*) basic_machine=rs6000-bull os=-bosx ;; dpx2* | dpx2*-bull) basic_machine=m68k-bull os=-sysv3 ;; ebmon29k) basic_machine=a29k-amd os=-ebmon ;; elxsi) basic_machine=elxsi-elxsi os=-bsd ;; encore | umax | mmax) basic_machine=ns32k-encore ;; fx2800) basic_machine=i860-alliant ;; genix) basic_machine=ns32k-ns ;; gmicro) basic_machine=tron-gmicro os=-sysv ;; h3050r* | hiux*) basic_machine=hppa1.1-hitachi os=-hiuxwe2 ;; h8300hms) basic_machine=h8300-hitachi os=-hms ;; harris) basic_machine=m88k-harris os=-sysv3 ;; hp300-*) basic_machine=m68k-hp ;; hp300bsd) basic_machine=m68k-hp os=-bsd ;; hp300hpux) basic_machine=m68k-hp os=-hpux ;; hp9k2[0-9][0-9] | hp9k31[0-9]) basic_machine=m68000-hp ;; hp9k3[2-9][0-9]) basic_machine=m68k-hp ;; hp9k7[0-9][0-9] | hp7[0-9][0-9] | hp9k8[0-9]7 | hp8[0-9]7) basic_machine=hppa1.1-hp ;; hp9k8[0-9][0-9] | hp8[0-9][0-9]) basic_machine=hppa1.0-hp ;; hppa-next) os=-nextstep3 ;; i370-ibm* | ibm*) basic_machine=i370-ibm os=-mvs ;; # I'm not sure what "Sysv32" means. Should this be sysv3.2? i[3456]86v32) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv32 ;; i[3456]86v4*) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv4 ;; i[3456]86v) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv ;; i[3456]86sol2) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-solaris2 ;; iris | iris4d) basic_machine=mips-sgi case $os in -irix*) ;; *) os=-irix4 ;; esac ;; isi68 | isi) basic_machine=m68k-isi os=-sysv ;; m88k-omron*) basic_machine=m88k-omron ;; magnum | m3230) basic_machine=mips-mips os=-sysv ;; merlin) basic_machine=ns32k-utek os=-sysv ;; miniframe) basic_machine=m68000-convergent ;; mips3*-*) basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'` ;; mips3*) basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown ;; ncr3000) basic_machine=i486-ncr os=-sysv4 ;; news | news700 | news800 | news900) basic_machine=m68k-sony os=-newsos ;; news1000) basic_machine=m68030-sony os=-newsos ;; news-3600 | risc-news) basic_machine=mips-sony os=-newsos ;; next | m*-next ) basic_machine=m68k-next case $os in -nextstep* ) ;; -ns2*) os=-nextstep2 ;; *) os=-nextstep3 ;; esac ;; nh3000) basic_machine=m68k-harris os=-cxux ;; nh[45]000) basic_machine=m88k-harris os=-cxux ;; nindy960) basic_machine=i960-intel os=-nindy ;; np1) basic_machine=np1-gould ;; pa-hitachi) basic_machine=hppa1.1-hitachi os=-hiuxwe2 ;; paragon) basic_machine=i860-intel os=-osf ;; pbd) basic_machine=sparc-tti ;; pbb) basic_machine=m68k-tti ;; pc532 | pc532-*) basic_machine=ns32k-pc532 ;; pentium | p5) basic_machine=i586-intel ;; pentiumpro | p6) basic_machine=i686-intel ;; pentium-* | p5-*) basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentiumpro-* | p6-*) basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'` ;; k5) # We don't have specific support for AMD's K5 yet, so just call it a Pentium basic_machine=i586-amd ;; nexen) # We don't have specific support for Nexgen yet, so just call it a Pentium basic_machine=i586-nexgen ;; pn) basic_machine=pn-gould ;; power) basic_machine=rs6000-ibm ;; ppc) basic_machine=powerpc-unknown ;; ppc-*) basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppcle | powerpclittle | ppc-le | powerpc-little) basic_machine=powerpcle-unknown ;; ppcle-* | powerpclittle-*) basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ps2) basic_machine=i386-ibm ;; rm[46]00) basic_machine=mips-siemens ;; rtpc | rtpc-*) basic_machine=romp-ibm ;; sequent) basic_machine=i386-sequent ;; sh) basic_machine=sh-hitachi os=-hms ;; sps7) basic_machine=m68k-bull os=-sysv2 ;; spur) basic_machine=spur-unknown ;; sun2) basic_machine=m68000-sun ;; sun2os3) basic_machine=m68000-sun os=-sunos3 ;; sun2os4) basic_machine=m68000-sun os=-sunos4 ;; sun3os3) basic_machine=m68k-sun os=-sunos3 ;; sun3os4) basic_machine=m68k-sun os=-sunos4 ;; sun4os3) basic_machine=sparc-sun os=-sunos3 ;; sun4os4) basic_machine=sparc-sun os=-sunos4 ;; sun4sol2) basic_machine=sparc-sun os=-solaris2 ;; sun3 | sun3-*) basic_machine=m68k-sun ;; sun4) basic_machine=sparc-sun ;; sun386 | sun386i | roadrunner) basic_machine=i386-sun ;; symmetry) basic_machine=i386-sequent os=-dynix ;; tower | tower-32) basic_machine=m68k-ncr ;; udi29k) basic_machine=a29k-amd os=-udi ;; ultra3) basic_machine=a29k-nyu os=-sym1 ;; vaxv) basic_machine=vax-dec os=-sysv ;; vms) basic_machine=vax-dec os=-vms ;; vpp*|vx|vx-*) basic_machine=f301-fujitsu ;; vxworks960) basic_machine=i960-wrs os=-vxworks ;; vxworks68) basic_machine=m68k-wrs os=-vxworks ;; vxworks29k) basic_machine=a29k-wrs os=-vxworks ;; xmp) basic_machine=xmp-cray os=-unicos ;; xps | xps100) basic_machine=xps100-honeywell ;; none) basic_machine=none-none os=-none ;; # Here we handle the default manufacturer of certain CPU types. It is in # some cases the only manufacturer, in others, it is the most popular. mips) basic_machine=mips-mips ;; romp) basic_machine=romp-ibm ;; rs6000) basic_machine=rs6000-ibm ;; vax) basic_machine=vax-dec ;; pdp11) basic_machine=pdp11-dec ;; we32k) basic_machine=we32k-att ;; sparc) basic_machine=sparc-sun ;; cydra) basic_machine=cydra-cydrome ;; orion) basic_machine=orion-highlevel ;; orion105) basic_machine=clipper-highlevel ;; *) echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2 exit 1 ;; esac # Here we canonicalize certain aliases for manufacturers. case $basic_machine in *-digital*) basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'` ;; *-commodore*) basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'` ;; *) ;; esac # Decode manufacturer-specific aliases for certain operating systems. if [ x"$os" != x"" ] then case $os in # First match some system type aliases # that might get confused with valid system types. # -solaris* is a basic system type, with this one exception. -solaris1 | -solaris1.*) os=`echo $os | sed -e 's|solaris1|sunos4|'` ;; -solaris) os=-solaris2 ;; -unixware* | svr4*) os=-sysv4 ;; -gnu/linux*) os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'` ;; # First accept the basic system types. # The portable systems comes first. # Each alternative MUST END IN A *, to match a version number. # -sysv* is not here because it comes later, after sysvr4. -gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \ | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\ | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \ | -amigados* | -msdos* | -newsos* | -unicos* | -aof* | -aos* \ | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \ | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \ | -hiux* | -386bsd* | -netbsd* | -openbsd* | -freebsd* | -riscix* \ | -lynxos* | -bosx* | -nextstep* | -cxux* | -aout* | -elf* \ | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \ | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \ | -cygwin32* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ | -linux-gnu* | -uxpv*) # Remember, each alternative MUST END IN *, to match a version number. ;; -linux*) os=`echo $os | sed -e 's|linux|linux-gnu|'` ;; -sunos5*) os=`echo $os | sed -e 's|sunos5|solaris2|'` ;; -sunos6*) os=`echo $os | sed -e 's|sunos6|solaris3|'` ;; -osfrose*) os=-osfrose ;; -osf*) os=-osf ;; -utek*) os=-bsd ;; -dynix*) os=-bsd ;; -acis*) os=-aos ;; -ctix* | -uts*) os=-sysv ;; -ns2 ) os=-nextstep2 ;; # Preserve the version number of sinix5. -sinix5.*) os=`echo $os | sed -e 's|sinix|sysv|'` ;; -sinix*) os=-sysv4 ;; -triton*) os=-sysv3 ;; -oss*) os=-sysv3 ;; -svr4) os=-sysv4 ;; -svr3) os=-sysv3 ;; -sysvr4) os=-sysv4 ;; # This must come after -sysvr4. -sysv*) ;; -xenix) os=-xenix ;; -none) ;; *) # Get rid of the `-' at the beginning of $os. os=`echo $os | sed 's/[^-]*-//'` echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2 exit 1 ;; esac else # Here we handle the default operating systems that come with various machines. # The value should be what the vendor currently ships out the door with their # machine or put another way, the most popular os provided with the machine. # Note that if you're going to try to match "-MANUFACTURER" here (say, # "-sun"), then you have to tell the case statement up towards the top # that MANUFACTURER isn't an operating system. Otherwise, code above # will signal an error saying that MANUFACTURER isn't an operating # system, and we'll never get to this point. case $basic_machine in *-acorn) os=-riscix1.2 ;; arm*-semi) os=-aout ;; pdp11-*) os=-none ;; *-dec | vax-*) os=-ultrix4.2 ;; m68*-apollo) os=-domain ;; i386-sun) os=-sunos4.0.2 ;; m68000-sun) os=-sunos3 # This also exists in the configure program, but was not the # default. # os=-sunos4 ;; *-tti) # must be before sparc entry or we get the wrong os. os=-sysv3 ;; sparc-* | *-sun) os=-sunos4.1.1 ;; *-ibm) os=-aix ;; *-hp) os=-hpux ;; *-hitachi) os=-hiux ;; i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent) os=-sysv ;; *-cbm) os=-amigados ;; *-dg) os=-dgux ;; *-dolphin) os=-sysv3 ;; m68k-ccur) os=-rtu ;; m88k-omron*) os=-luna ;; *-next ) os=-nextstep ;; *-sequent) os=-ptx ;; *-crds) os=-unos ;; *-ns) os=-genix ;; i370-*) os=-mvs ;; *-next) os=-nextstep3 ;; *-gould) os=-sysv ;; *-highlevel) os=-bsd ;; *-encore) os=-bsd ;; *-sgi) os=-irix ;; *-siemens) os=-sysv4 ;; *-masscomp) os=-rtu ;; f301-fujitsu) os=-uxpv ;; *) os=-none ;; esac fi # Here we handle the case where we know the os, and the CPU type, but not the # manufacturer. We pick the logical manufacturer. vendor=unknown case $basic_machine in *-unknown) case $os in -riscix*) vendor=acorn ;; -sunos*) vendor=sun ;; -aix*) vendor=ibm ;; -hpux*) vendor=hp ;; -hiux*) vendor=hitachi ;; -unos*) vendor=crds ;; -dgux*) vendor=dg ;; -luna*) vendor=omron ;; -genix*) vendor=ns ;; -mvs*) vendor=ibm ;; -ptx*) vendor=sequent ;; -vxsim* | -vxworks*) vendor=wrs ;; -aux*) vendor=apple ;; esac basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"` ;; esac echo $basic_machine$os nmap-2.08/INSTALL100644 764 764 734 6632274153 12502 0ustar fyodorfyodorIdeally, you should be able to just type: ./configure make make install You may also need to install flex and bison (ftp://ftp.prep.ai.mit.edu/pub/gnu) prior to the compile on systems that have broken lex and yacc (Irix 5.3, others?). If you have questions, comments or problems feel free to email me (with detailed information on the platform you are running on and all the output from ./configure and make as well as config.log if one was generated)-- fyodor@dhp.com nmap-2.08/docs/ 40700 764 764 0 6662341762 12312 5ustar fyodorfyodornmap-2.08/docs/copying.html100644 764 764 44140 6570027036 14773 0ustar fyodorfyodorGNU General Public License

GNU General Public License
Version 2, June 1991


Copyright (C) 1989, 1991 Free Software Foundation, Inc.
675 Mass Ave, Cambridge, MA 02139, USA

Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.

Preamble

The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too.

When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things.

To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it.

For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.

We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software.

Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations.

Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all.

The precise terms and conditions for copying, distribution and modification follow.

GNU General Public License
Terms and Conditions for Copying, Distribution and Modification

0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you".

Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does.

1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.

You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.

2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:

a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change.

b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.

c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.)

These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.

Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program.

In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.

3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code.

4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.

5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it.

6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License.

7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program.

If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances.

It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.

This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.

8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.

9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.

Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation.

10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.

No Warranty

11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

End of Terms and Conditions

Appendix: How to Apply These Terms to Your New Programs

If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.

To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.

<one line to give the program's name and a brief idea of what it does.>
Copyright (C) 19yy name of author

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

Also add information on how to contact you by electronic and paper mail.

If the program is interactive, make it output a short notice like this when it starts in an interactive mode:

Gnomovision version 69, Copyright (C) 19yy name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.

The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program.

You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names:

Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker.

<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice

This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. nmap-2.08/docs/README100644 764 764 501 6570027032 13242 0ustar fyodorfyodorHere are the docs for nmap. You would be better off checking the website at http://www.insecure.org/nmap for the latest information. Also if the man page is installed correctly you should be able to 'man nmap'. The man page is more up-to-date than the article. See nmap-manpage.txt for a txt version of it. -Fyodor nmap-2.08/docs/.swp100600 764 764 30000 6636446447 13243 0ustar fyodorfyodorb0VIM 4.6Efyodorplayground.yuma.net3210#"! Utp ad  mIH^ Erik Parker (sent a ton of them), Sten Kalenda , Chris Tobkin (sent a ton of them)alligator 427 , Thomas Walter ,Peter van Dijk , Gustavo Molina , Filipe Jorge Marques de Almeida (sent a bunch), } else strcpy(AVs[1].value, "N"); strcpy(AVs[1].value,"Y"); if(ip->ip_off && 0x4000) { AVs[1].attribute = "DF"; /* Next we check whether the Don't Fragment bit is set */nmap-2.08/docs/nmap.1100644 764 764 60034 6661363064 13457 0ustar fyodorfyodor.\" This definition swiped from the gcc(1) man page .de Sp .if n .sp .if t .sp 0.4 .. .TH NMAP 1 .SH NAME nmap \- Network exploration tool and security scanner .SH SYNOPSIS .B nmap [Scan Type(s)] [Options] .SH DESCRIPTION .I Nmap is designed to allow system administrators and curious individuals to scan large networks to determine which hosts are up and what services they are offering. .I nmap supports a large number of scanning techniques such as: UDP, TCP connect(), TCP SYN (half open), ftp proxy (bounce attack), Reverse-ident, ICMP (ping sweep), FIN, ACK sweep, Xmas Tree, SYN sweep, and Null scan. See the .I Scan Types section for more details. nmap also offers a number of advanced features such as remote OS detection via TCP/IP fingerprinting, stealth scanning, dynamic delay and retransmission calculations, parallel scanning, detection of down hosts via parallel pings, decoy scanning, port filtering detection, fragmentation scanning, and flexible target and port specification. .PP Significant effort has been put into decent nmap performance for non-root users. Unfortunately, many critical kernel interfaces (such as raw sockets) require root privileges. nmap should be run as root whenever possible. .PP The result of running nmap is usually a list of interesting ports on the machine(s) being scanned (if any). Nmap always gives the port's "well known" service name (if any), number, state, and protocol. The state is either 'open', 'filtered', or 'unfiltered'. Open means that the target machine will accept() connections on that port. Filtered means that a firewall, filter, or other network obstacle is covering the port and preventing nmap from determining whether the port is open. Unfiltered means that the port is known by nmap to be closed and no firewall/filter seems to be interfering with nmap's attempts to determine this. Unfiltered ports are the common case and are only shown when most of the scanned ports are in the filtered state. .PP Depending on options used, nmap may also report the following characteristics of the remote host: OS in use, TCP sequencability, usernames running the programs which have bound to each port, the DNS name, whether the host is a smurf address, and a few others. .SH OPTIONS Options that make sense together can generally be combined. Some options are specific to certain scan modes. .I nmap tries to catch and warn the user about psychotic or unsupported option combinations. .Sp If you are impatient, you can skip to the .I examples section at the end, which demonstrates common usage. You can also run .B nmap -h for a quick reference page listing all the options. .TP .B Scan Types .TP .B \-sT TCP connect() scan: This is the most basic form of TCP scanning. The connect() system call provided by your operating system is used to open a connection to every interesting port on the machine. If the port is listening, connect() will succeed, otherwise the port isn't reachable. One strong advantage to this technique is that you don't need any special privileges. Any user on most UNIX boxes is free to use this call. .Sp This sort of scan is easily detectable as target host logs will show a bunch of connection and error messages for the services which accept() the connection just to have it immediately shutdown. .TP .B \-sS TCP SYN scan: This technique is often referred to as "half-open" scanning, because you don't open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and you wait for a response. A SYN|ACK indicates the port is listening. A RST is indicative of a non\-listener. If a SYN|ACK is received, a RST is immediately sent to tear down the connection (actually our OS kernel does this for us). The primary advantage to this scanning technique is that fewer sites will log it. Unfortunately you need root privileges to build these custom SYN packets. .TP .B \-sF \-sX \-sN Stealth FIN, Xmas Tree, or Null scan modes: There are times when even SYN scanning isn't clandestine enough. Some firewalls and packet filters watch for SYNs to restricted ports, and programs like Synlogger and Courtney are available to detect these scans. These advanced scans, on the other hand, may be able to pass through unmolested. .Sp The idea is that closed ports are required to reply to your probe packet with an RST, while open ports must ignore the packets in question (see RFC 794 pp 64). The FIN scan uses a bare (surprise) FIN packet as the probe, while the Xmas tree scan turns on the FIN, URG, and PUSH flags. The Null scan turns off all flags. Unfortunately Microsoft (like usual) decided to completely ignore the standard and do things their own way. Thus this scan type will not work against systems running Windows95/NT. On the positive side, this is a good way to distinguish between the two platforms. If the scan finds open ports, you know the machine is not a Windows box. If a -sF,-sX,or -sN scan shows all ports closed, yet a SYN (-sS) scan shows ports being opened, you are probably looking at a Windows box. This is less useful now that nmap has proper OS detection built in. There are also a few other systems that are broken in the same way Windows is. They include Cisco, BSDI, HP/UX, MVS, and IRIX. All of the above send resets from the open ports when they should just drop the packet. .TP .B \-sP Ping scanning: Sometimes you only want to know which hosts on a network are up. Nmap can do this by sending ICMP echo request packets to every IP address on the networks you specify. Hosts that respond are up. Unfortunately, some sites such as microsoft.com block echo request packets. Thus nmap can also send a TCP ack packet to (by default) port 80. If we get an RST back, that machine is up. A third technique involves sending a SYN packet and waiting for a RST or a SYN/ACK. For non-root users, a connect() method is used. .Sp By default (for root users), nmap uses both the ICMP and ACK techniques in parallel. You can change the .B \-P option described later. .Sp Note that pinging is done by default anyway, and only hosts that respond are scanned. Only use this option if you wish to ping sweep .B without doing any actual port scans. .TP .B \-sU UDP scans: This method is used to determine which UDP (User Datagram Protocol, RFC 768) ports are open on a host. The technique is to send 0 byte udp packets to each port on the target machine. If we receive an ICMP port unreachable message, then the port is closed. Otherwise we assume it is open. .Sp Some people think UDP scanning is pointless. I usually remind them of the recent Solaris rcpbind hole. Rpcbind can be found hiding on an undocumented UDP port somewhere above 32770. So it doesn't matter that 111 is blocked by the firewall. But can you find which of the more than 30,000 high ports it is listening on? With a UDP scanner you can! There is also the cDc Back Orifice backdoor program which hides on a configurable UDP port on Windows machines. Not to mention the many commonly vulnerable services that utilize UDP such as snmp, tftp, NFS, etc. .Sp Unfortunately UDP scanning is sometimes painfully slow since most hosts impliment a suggestion in RFC 1812 (section 4.3.2.8) of limiting the ICMP error message rate. For example, the Linux kernel (in net/ipv4/icmp.h) limits destination unreachable message generation to 80 per 4 seconds, with a 1/4 second penalty if that is exceeded. Solaris has much more strict limits (about 2 messages per second) and thus takes even longer to scan. .I nmap detects this rate limiting and slows down accordingly, rather than flood the network with useless packets that will be ignored by the target machine. .Sp As is typical, Microsoft ignored the suggestion of the RFC and does not seem to do any rate limiting at all on Win95 and NT machines. Thus we can scan all 65K ports of a Windows machine .B very quickly. Woop! .TP .B \-b FTP bounce attack: An interesting "feature" of the ftp protocol (RFC 959) is support for "proxy" ftp connections. In other words, I should be able to connect from evil.com to the FTP server of target.com and request that the server send a file ANYWHERE on the internet! Now this may have worked well in 1985 when the RFC was written. But in today's Internet, we can't have people hijacking ftp servers and requesting that data be spit out to arbitrary points on the internet. As *Hobbit* wrote back in 1995, this protocol flaw "can be used to post virtually untraceable mail and news, hammer on servers at various sites, fill up disks, try to hop firewalls, and generally be annoying and hard to track down at the same time." What we will exploit this for is to (surprise, surprise) scan TCP ports from a "proxy" ftp server. Thus you could connect to an ftp server behind a firewall, and then scan ports that are more likely to be blocked (139 is a good one). If the ftp server allows reading from and writing to some directory (such as /incoming), you can send arbitrary data to ports that you do find open (nmap doesn't do this for you though). .Sp The argument passed to the 'b' option is the host you want to use as a proxy, in standard URL notation. The format is: .I username:password@server:port. Everything but .I server is optional. To determine what servers are vulnerable to this attack, you can see my article in .I Phrack 51. And updated version is available at the .I nmap URL (http://www.insecure.org/nmap). .TP .B General Options None of these are required but some can be quite useful. .TP .B \-P0 Do not try and ping hosts at all before scanning them. This allows the scanning of networks that don't allow ICMP echo requests (or responses) through their firewall. microsoft.com is an example of such a network, and thus you should always use .B \-P0 or .B \-PT80 when portscanning microsoft.com. .TP .B \-PT Use TCP "ping" to determine what hosts are up. Instead of sending ICMP echo request packets and waiting for a response, we spew out TCP ACK packets throughout the target network (or to a single machine) and then watt for responses to trickle back. Hosts that are up should respond with a RST. This option preserves the efficiency of only scanning hosts that are up while still allowing you to scan networks/hosts that block ping packets. For non root users, we use connect(). To set the destination port of the probe packets use -PT. The default port is 80, since this port is often not filtered out. .B \-PS This option uses SYN (connection request) packets instead of ACK packets for root users. Hosts that are up should respond with a RST (or, rarely, a SYN|ACK). .TP .B \-PI This option uses a true ping (ICMP echo request) packet. It finds hosts that are up and also looks for subnet-directed broadcast addresses on your network. These are IP addresses which are externally reachable and translate to a broadcast of incomming IP packets to a subnet of computers. These should be eliminated if found as they allow for numerous denial of service attacks (Smurf is the most common). .TP .B \-PB This is the default ping type. It uses both the ACK ( .B \-PT ) and ICMP ( .B \-PI ) sweeps in parallel. This way you can get firewalls that filter either one (but not both). .TP .B \-O This option activates remote host identification via TCP/IP fingerprinting. In other words, it uses a bunch of techniques to detect subtleties in the underlying operating system network stack of the computers you are scanning. It uses this information to create a 'fingerprint' which it compares with its database of known OS fingerprints (the nmap-os-fingerprints file) to decide what type of system you are scanning. .Sp If you find a machine that is misdiagnosed and has at least one port open, it would be useful if you mail me the details (ie OS blah version foo was detected as OS blah version bar). If you find a machine with at least one port open for which nmap says 'unknown operating system', then it would be useful if you send me the IP address along with the OS name and version number. If you can't send the IP address, the next best thing is to run nmap with the .B \-d option and send me the three fingerprints that should result along with the OS name and version number. By doing this you contribute to the pool of operating systems known to nmap and thus it will be more accurate for everyone. .TP .B \-I This turns on TCP reverse ident scanning. As noted by Dave Goldsmith in a 1996 Bugtraq post, the ident protocol (rfc 1413) allows for the disclosure of the username that owns any process connected via TCP, even if that process didn't initiate the connection. So you can, for example, connect to the http port and then use identd to find out whether the server is running as root. This can only be done with a full TCP connection to the target port (i.e. the -sT scanning option). When .B \-I is used, the remote host's identd is queried for each open port found. Obviously this won't work if the host is not running identd. .TP .B \-f This option causes the requested SYN, FIN, XMAS, or NULL scan to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing. Be careful with this! Some programs have trouble handling these tiny packets. My favorite sniffer segmentation faulted immediately upon receiving the first 36-byte fragment. After that comes a 24 byte one! While this method won't get by packet filters and firewalls that queue all IP fragments (like the CONFIG_IP_ALWAYS_DEFRAG option in the Linux kernel), some networks can't afford the performance hit this causes and thus leave it disabled. .Sp Note that I do not yet have this option working on all systems. It works fine for my Linux, FreeBSD, and OpenBSD boxes and some people have reported success with other *NIX variants. .TP .B \-v Verbose mode. This is a highly recommended option and it gives out more information about what is going on. You can use it twice for greater effect. Use .B \-d a couple of times if you really want to get crazy with scrolling the screen! .TP .B \-h This handy option display a quick reference screen of nmap usage options. As you may have noticed, this man page is not exactly a 'quick reference' :) .TP .B \-o This logs the results of your scans in a .B human readable form into the file you specify as an argument. .TP .B \-m This logs the results of your scans in a .B machine parseable form into the file you specify as an argument. .TP .B \-i Reads target specifications from the file specified RATHER than from the command line. The file should contain a list of host or network expressions seperated by spaces, tabs, or newlines. Use a hyphen (-) as .I inputfilename if you want nmap to read host expressions from stdin (like at the end of a pipe). See the section .I target specification for more information on the expressions you fill the file with. .TP .B \-p This option specifies what ports you want to specify. For example '-p 23' will only try port 23 of the target host(s). '-p 20-30,139,60000-' scans ports between 20 and 30, port 139, and all ports greater than 60000. The default is to scan all ports between 1 and 1024 as well as any ports listed in your /etc/services. .TP .B \-F Fast scan mode. Specifies that you only wish to scan for ports listed in /etc/services. This is obviously much faster than scanning all 65535 ports on a host. .TP .B \-D Causes a decoy scan to be performed which makes it appear to the remote host that the host(s) you specify as decoys are scanning the target network too. Thus their IDS might report 5-10 port scans from unique IP addresses, but they won't know which IP was scanning them and which were innocent decoys. .Sp Separate each decoy host with commas, and you can optionally use 'ME' as one of the decoys to represent the position you want your IP address to be used. If your put 'ME' in the 6th position or later, some common port scan detectors (such as Solar Designer's excellent scanlogd) are unlikeley to show your IP address at all. If you don't use 'ME', nmap will put you in a random position. .Sp Note that the hosts you use as decoys should be up or you might accidently SYN flood your targets. Also it will be pretty easy to determine which host is scanning if only one is actually up on the network. .Sp Also note that some (stupid) "port scan detectors" will firewall/deny routing to hosts that attempt port scans. Thus you might inadvertantly cause the machine you scan to lose connectivity with the decoy machines you are using. This could cause the target machines major problems if the decoy is, say, its internet gateway or even "localhost". Thus you might want to be careful of this option. The real moral of the story is that detectors of spoofable port scans should not take action against the machine that seems like it is port scanning them. It could just be a decoy! .Sp Decoys are used both in the initial ping scan (using ICMP, SYN, ACK, or whatever) as well as the actual port scanning phase. Decoys are also used during remote OS detection ( .B \-O ). .Sp It is worth noting that using too many decoys may slow your scan and potentially even make it less accurate. Also, some ISPs will filter out your spoofed packets, although many (currently most) do not restrict spoofed IP packets at all. .TP .B \-S In some circumstances, .I nmap may not be able to determine your source address ( .I nmap will tell you if this is the case). In this situation, use -S with your IP address (of the interface you wish to send packets through). .Sp Another possible use of this flag is to spoof the scan to make the targets think that .B someone else is scanning them. Imagine a company being repeatedly port scanned by a competitor! This is not a supported usage (or the main purpose) of this flag. I just think it raises an interesting possibility that people should be aware of before they go accusing others of port scanning them. .B \-e would generally be required for this sort of usage. .TP .B \-e Tells nmap what interface to send and receive packets on. Nmap should be able to detect this but it will tell you if it cannot. .TP .B \-g Sets the source port number used in scans. Many naive firewall and packet filter installations make an exception in their ruleset to allow DNS (53) or FTP-DATA (20) packets to come through and establish a connection. Obviously this completely subverts the security advantages of the firewall since intruders can just masquerade as FTP or DNS by modifying their source port. Obviously for a UDP scan you should try 53 first and TCP scans should try 20 before 53. Note that this is only a request -- nmap will honor it only if and when it is able to. For example, you can't do TCP ISN sampling all from one host:port to one host:port, so nmap changes the source port even if you used -g. .Sp Be aware that there is a small performance penalty on some scans for using this option, because I sometimes store useful information in the source port number. .TP .B \-M Sets the maximum number of sockets that will be used in parallel for a TCP connect() scan (the default). This is useful to slow down the scan a little bit and avoid crashing remote machines. Another approach is to use \-sS, which is generally easier for machines to handle. .TP .B Target specification Everything that isn't an option (or option argument) in nmap is treated as a target host specification. The simplest case is listing single hostnames or IP addresses on the command line. If you want to scan a subnet of IP addresses, you can append .B '/mask' to the hostname or IP address. .B mask must be between 0 (scan the whole internet) and 32 (scan the single host specified). Use /24 to scan a class 'C' address and /16 for a class 'B'. .Sp Nmap also has a more powerful notation which lets you specify an IP address using lists/ranges for each element. Thus you can scan the whole class 'B' network 128.210.*.* by specifying '128.210.*.*' or '128.210.0-255.0-255' or even '128.210.1-50,51-255.1,2,3,4,5-255'. And of course you can use the mask notation: '128.210.0.0/16'. These are all equivalent. If you use astericts ('*'), remember that most shells require you to escape them with back slashes or protect them with quotes. .Sp Another interesting thing to do is slice the Internet the other way. Instead of scanning all the hosts in a class 'B', scan '*.*.5.6-7' to scan every IP address that ends in .5.6 or .5.7 Pick your own numbers. For more information on specifying hosts to scan, see the .I examples section. .SH EXAMPLES Here are some examples of using nmap, from simple and normal to a little more complex/esoteric. Note that actual numbers and some actual domain names are used to make things more concrete. In their place you should substitute addresses/names from .B your own network. I do not think portscanning other networks is illegal; nor should portscans be construed by others as an attack. I have scanned hundreds of thousands of machines and have received only one complaint. But I am not a lawyer and some (anal) people may be annoyed by .I nmap probes. Get permission first or use at your own risk. .Sp .B nmap -v target.example.com .Sp This option scans all reserved TCP ports on the machine target.example.com . The \-v means turn on verbose mode. .Sp .B nmap -sS -O target.example.com/24 .Sp Launches a stealth SYN scan against each machine that is up out of the 255 machines on class 'C' where target.example.com resides. It also tries to determine what operating system is running on each host that is up and running. This requires root privileges because of the SYN scan and the OS detection. .Sp .B nmap -sX -p 22,53,110,143,4564 "128.210.*.1-127" .Sp Sends an Xmas tree scan to the first half of each of the 255 possible 8 bit subnets in the 128.210 class 'B' address space. We are testing whether the systems run sshd, DNS, pop3d, imapd, or port 4564. Note that Xmas scan doesn't work on Microsoft boxes due to their deficient TCP stack. Same goes with CISCO, IRIX, HP/UX, and BSDI boxes. .Sp .B nmap -v -p 80 '*.*.2.3-5' .Sp Rather than focus on a specific IP range, it is sometimes interesting to slice up the entire Internet and scan a small sample from each slice. This command finds all web servers on machines with IP addresses ending in .2.3, .2.4, or .2.5 . If you are root you might as well add -sS. Also you will find more interesting machines starting at 127. so you might want to use '127-222' instead of the first asterict because that section has a greater density of interesting machines (IMHO). .Sp .B host -l company.com | cut '-d ' -f 4 | ./nmap -v -i - .Sp Do a DNS zone transfer to find the hosts in company.com and then feed the IP addresses to .I nmap. The above commands are for my GNU/Linux box. You may need different commands/options on other operating systems. .SH BUGS Bugs? What bugs? Send me any that you find. Patches are nice too :) Remember to also send in new OS fingerprints so we can grow the database. .SH AUTHOR .Sp Fyodor .I .SH DISTRIBUTION The newest version of .I nmap can be obtained from .I http://www.insecure.org/nmap .Sp .I nmap is (C) 1997,1998,1999 by Fyodor (fyodor@dhp.com, fyodor@insecure.org) .Sp .I libpcap is also distributed along with nmap. It is copyrighted by Van Jacobson, Craig Leres and Steven McCanne, all of the Lawrence Berkeley National Laboratory, University of California, Berkeley, CA. The version distributed with nmap may be modified, pristine sources are available from ftp://ftp.ee.lbl.gov/libpcap.tar.Z . .Sp This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; Version 2. If you want to license nmap under terms other than the GPL, you can write Fyodor and plead your case, but none of the (2-3) attempts at this have been successful. .Sp This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details (it is in the COPYING file of the .I nmap distribution). nmap-2.08/docs/nmap.usage.txt100600 764 764 5506 6662341754 15217 0ustar fyodorfyodor Starting nmap V. 2.08 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/) nmap V. 2.08 usage: nmap [Scan Type(s)] [Options] Scan types -sT tcp connect() port scan -sS tcp SYN stealth port scan (must be root) -sF,-sX,-sN Stealth FIN, Xmas, or Null scan (only works against UNIX). -sP ping "scan". Find which hosts on specified network(s) are up but don't port scan them -sU UDP port scan, must be r00t -b ftp "bounce attack" port scan Options (none are required, most can be combined): -f use tiny fragmented packets for SYN, FIN, Xmas, or NULL scan. -P0 Don't ping hosts (needed to scan www.microsoft.com and others) -PT Use "TCP Ping" to see what hosts are up (for normal and ping scans). -PT21 Use "TCP Ping" scan with probe destination port of 21 (or whatever). -PI Use ICMP ping packet to determines hosts that are up -PB Do BOTH TCP & ICMP scans in parallel (TCP dest port can be specified after the 'B') -PS Use TCP SYN sweep rather than the default ACK sweep used in "TCP ping" -O Use TCP/IP fingerprinting to guess what OS the remote host is running -p ports: ex: '-p 23' will only try port 23 of the host(s) '-p 20-30,63000-' scans 20-30 and 63000-65535. default: 1-1024 + /etc/services -Ddecoy_host1,decoy2,ME,decoy3[,...] Launch scans from decoy host(s) along with the real one. If you care about the order your real IP appears, stick "ME" somewhere in the list. Even if the target detects the scan, they are unlikely to know which IP is scanning them and which are decoys. -F fast scan. Only scans ports in /etc/services, a la strobe(1). -I Get identd (rfc 1413) info on listening TCP processes. -n Don't DNS resolve anything unless we have to (makes ping scans faster) -R Try to resolve all hosts, even down ones (can take a lot of time) -o Output scan logs to in human readable. -m Output scan logs to in machine parseable format. -i Grab IP numbers or hostnames from file. Use '-' for stdin -g Sets the source port used for scans. 20 and 53 are good choices. -S If you want to specify the source address of SYN or FYN scan. -v Verbose. Its use is recommended. Use twice for greater effect. -h help, print this junk. Also see http://www.insecure.org/nmap/ -V Print version number and exit. -e . Send packets on interface (eth0,ppp0,etc.). -q quash argv to something benign, currently set to "pine". (deprecated) Hostnames specified as internet hostname or IP address. Optional '/mask' specifies subnet. For example: cert.org/24 or 192.88.209.5/24 or 192.88.209.0-255 or '128.88.209.*' all scan CERT's Class C. SEE THE MAN PAGE FOR MORE THOROUGH EXPLANATIONS AND EXAMPLES. nmap-2.08/docs/nmap.deprecated.txt100644 764 764 50436 6570027055 16236 0ustar fyodorfyodor .oO Phrack 51 Oo. Volume Seven, Issue Fifty One xx of xx The Art of Port Scanning by Fyodor (fyodor@dhp.com) [ Abstract ] This paper details many of the techniques used to determine what ports (or similar protocol abstraction) of a host are listening for connections. These ports represent potential communication channels. Mapping their existence facilitates the exchange of information with the host, and thus it is quite useful for anyone wishing to explore their networked environment, including hackers. Despite what you have heard from the media, the Internet is NOT all about TCP port 80. Anyone who relies exclusively on the WWW for information gathering is likely to gain the same level of proficiency as your average AOLer, who does the same. This paper is also meant to serve as an introduction to and ancillary documentation for a coding project I have been working on. It is a full featured, robust port scanner which (I hope) solves some of the problems I have encountered when dealing with other scanners and when working to scan massive networks. The tool, nmap, supports the following: - vanilla TCP connect() scanning, - TCP SYN (half open) scanning, - TCP FIN (stealth) scanning, - TCP ftp proxy (bounce attack) scanning - SYN/FIN scanning using IP fragments (bypasses packet filters), - UDP recvfrom() scanning, - UDP raw ICMP port unreachable scanning, - ICMP scanning (ping-sweep), and - reverse-ident scanning. The freely distributable source code is appended to this paper. [ Introduction ] Scanning, as a method for discovering exploitable communication channels, has been around for ages. The idea is to probe as many listeners as possible, and keep track of the ones which are receptive or useful to your particular need. Much of the field of advertising is based on this paradigm, and the "to current resident" brute force style of bulk mail is an almost perfect parallel to what we will discuss. Just stick a message in every mailbox and wait for the responses to trickle back. Scanning entered the h/p world along with the phone systems. Here we have this tremendous global telecommunications network, all reachable through codes on our telephone. Millions of numbers are reachable locally, yet we may only be interested in 0.5% of these numbers, perhaps those that answer with a carrier. The logical solution to finding those numbers that interest us is to try them all. Thus the field of "wardialing" arose. Excellent programs like Toneloc were developed to facilitate the probing of entire exchanges and more. The basic idea is simple. If you dial a number and your modem gives you a CONNECT, you record it. Otherwise the computer hangs up and tirelessly dials the next one. While wardialing is still useful, we are now finding that many of the computers we wish to communicate with are connected through networks such as the Internet rather than analog phone dialups. Scanning these machines involves the same brute force technique. We send a blizzard of packets for various protocols, and we deduce which services are listening from the responses we receive (or don't receive). [ Techniques ] Over time, a number of techniques have been developed for surveying the protocols and ports on which a target machine is listening. They all offer different benefits and problems. Here is a line up of the most common: - TCP connect() scanning : This is the most basic form of tcp scanning. The connect() system call provided by your operating system is used to open a connection to every interesting port on the machine. If the port is listening, connect() will succeed, otherwise the port isn't reachable. One strong advantage to this technique is that you don't need any special privileges. Any user on most UNIX boxes is free to use this call. Another advantage is speed. While making a separate connect() call for every targeted port in a linear fashion would take ages over a slow connection, you can hasten the scan by using many sockets in parallel. Using non-blocking I/O allows you to set a low time-out period and watch all the sockets at once. This is the fastest scanning method supported by nmap, and is available with the -t (TCP) option. The big downside is that this sort of scan is easily detectable and filterable. The target hosts logs will show a bunch of connection and error messages for the services which take the connection and then have it immediately shutdown. - TCP SYN scanning : This technique is often referred to as "half-open" scanning, because you don't open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and wait for a response. A SYN|ACK indicates the port is listening. A RST is indicative of a non- listener. If a SYN|ACK is received, you immediately send a RST to tear down the connection (actually the kernel does this for us). The primary advantage to this scanning technique is that fewer sites will log it. Unfortunately you need root privileges to build these custom SYN packets. SYN scanning is the -s option of nmap. - TCP FIN scanning : There are times when even SYN scanning isn't clandestine enough. Some firewalls and packet filters watch for SYNs to an unallowed port, and programs like synlogger and courtney are available to detect these scans. FIN packets, on the other hand, may be able to pass through unmolested. This scanning technique was featured in detail by Uriel Maimon in Phrack 49, article 15. The idea is that closed ports tend to reply to your FIN packet with the proper RST. Open ports, on the other hand, tend to ignore the packet in question. This is a bug in TCP implementations and so it isn't 100% reliable (some systems, notably Micro$oft boxes, seem to be immune). It works well on most other systems I've tried. FIN scanning is the -U (Uriel) option of nmap. - Fragmentation scanning : This is not a new scanning method in and of itself, but a modification of other techniques. Instead of just sending the probe packet, you break it into a couple of small IP fragments. You are splitting up the TCP header over several packets to make it harder for packet filters and so forth to detect what you are doing. Be careful with this! Some programs have trouble handling these tiny packets. My favorite sniffer segmentation faulted immediately upon receiving the first 36-byte fragment. After that comes a 24 byte one! While this method won't get by packet filters and firewalls that queue all IP fragments (like the CONFIG_IP_ALWAYS_DEFRAG option in Linux), a lot of networks can't afford the performance hit this causes. This feature is rather unique to scanners (at least I haven't seen any others that do this). Thanks to daemon9 for suggesting it. The -f instructs the specified SYN or FIN scan to use tiny fragmented packets. - TCP reverse ident scanning : As noted by Dave Goldsmith in a 1996 Bugtraq post, the ident protocol (rfc1413) allows for the disclosure of the username of the owner of any process connected via TCP, even if that process didn't initiate the connection. So you can, for example, connect to the http port and then use identd to find out whether the server is running as root. This can only be done with a full TCP connection to the target port (ie the -t option). nmap's -i option queries identd for the owner of all listen()ing ports. - FTP bounce attack : An interesting "feature" of the ftp protocol (RFC 959) is support for "proxy" ftp connections. In other words, I should be able to connect from evil.com to the FTP server-PI (protocol interpreter) of target.com to establish the control communication connection. Then I should be able to request that the server-PI initiate an active server-DTP (data transfer process) to send a file ANYWHERE on the internet! Presumably to a User-DTP, although the rfc specifically states that asking one server to send a file to another is OK. Now this may have worked well in 1985, when the rfc was written. But nowadays, we can't have people hijacking ftp servers and requesting that data be spit out to arbitrary points on the internet. As *Hobbit* wrote back in 1995, this protocol flaw "can be used to post virtually untraceable mail and news, hammer on servers at various sites, fill up disks, try to hop firewalls, and generally be annoying and hard to track down at the same time." What we will exploit this for is to (surprise, surprise) scan TCP ports from a "proxy" ftp server. Thus you could connect to an ftp server behind a firwall, and then scan ports that are more likely to be blocked (139 is a good one). If the ftp server allows reading from and writing to a directory (such as /incoming), you can send arbitrary data to ports that you do find open. For port scanning, our technique is to use the PORT command to declare that our passive "User-DTP" is listening on the target box at a certain port number. Then we try to LIST the current directory, and the result is sent over the Server-DTP channel. If our target host is listening on the specified port, the transfer will be successful (generating a 150 and a 226 response). Otherwise we will get "425 Can't build data connection: Connection refused." Then we issue another PORT command to try the next port on the target host. The advantages to this approach are obvious (harder to trace, potential to bypass firewalls). The main disadvantages are that it is slow, and that some FTP servers have finally got a clue and disabled the proxy "feature". For what it is worth, here is a list of benners from sites where it does/doesn't work: *Bounce attacks worked:* 220 xxxxxxx.com FTP server (Version wu-2.4(3) Wed Dec 14 ...) ready. 220 xxx.xxx.xxx.edu FTP server ready. 220 xx.Telcom.xxxx.EDU FTP server (Version wu-2.4(3) Tue Jun 11 ...) ready. 220 lem FTP server (SunOS 4.1) ready. 220 xxx.xxx.es FTP server (Version wu-2.4(11) Sat Apr 27 ...) ready. 220 elios FTP server (SunOS 4.1) ready *Bounce attack failed:* 220 wcarchive.cdrom.com FTP server (Version DG-2.0.39 Sun May 4 ...) ready. 220 xxx.xx.xxxxx.EDU Version wu-2.4.2-academ[BETA-12](1) Fri Feb 7 220 ftp Microsoft FTP Service (Version 3.0). 220 xxx FTP server (Version wu-2.4.2-academ[BETA-11](1) Tue Sep 3 ...) ready. 220 xxx.unc.edu FTP server (Version wu-2.4.2-academ[BETA-13](6) ...) ready. The 'x's are partly there to protect those guilty of running a flawed server, but mostly just to make the lines fit in 80 columns. Same thing with the ellipse points. The bounce attack is avalable with the -b option of nmap. proxy_server can be specified in standard URL format, username:password@server:port , with everything but server being optional. - UDP ICMP port unreachable scanning : This scanning method varies from the above in that we are using the UDP protocol instead of TCP. While this protocol is simpler, scanning it is actually significantly more difficult. This is because open ports don't have to send an acknowledgement in response to our probe, and closed ports aren't even required to send an error packet. Fortunately, most hosts do send an ICMP_PORT_UNREACH error when you send a packet to a closed UDP port. Thus you can find out if a port is NOT open, and by exclusion determine which ports which are. Neither UDP packets, nor the ICMP errors are guaranteed to arrive, so UDP scanners of this sort must also implement retransmission of packets that appear to be lost (or you will get a bunch of false positives). Also, this scanning technique is slow because of compensation for machines that took RFC 1812 section 4.3.2.8 to heart and limit ICMP error message rate. For example, the Linux kernel (in net/ipv4/icmp.h) limits destination unreachable message generation to 80 per 4 seconds, with a 1/4 second penalty if that is exceeded. At some point I will add a better algorithm to nmap for detecting this. Also, you will need to be root for access to the raw ICMP socket necessary for reading the port unreachable. The -u (UDP) option of nmap implements this scanning method for root users. Some people think UDP scanning is lame and pointless. I usually remind them of the recent Solaris rcpbind hole. Rcpbind can be found hiding on an undocumented UDP port somewhere above 32770. So it doesn't matter that 111 is blocked by the firewall. But can you find which of the more than 30,000 high ports it is listening on? With a UDP scanner you can! - UDP recvfrom() and write() scanning : While non-root users can't read port unreachable errors directly, Linux is cool enough to inform the user indirectly when they have been received. For example a second write() call to a closed port will usually fail. A lot of scanners such as netcat and Pluvius' pscan.c do this. I have also noticed that recvfrom() on non-blocking UDP sockets usually return EAGAIN ("Try Again", errno 13) if the ICMP error hasn't been received, and ECONNREFUSED ("Connection refused", errno 111) if it has. This is the technique used for determining open ports when non-root users use -u (UDP). Root users can also use the -l (lamer UDP scan) options to force this, but it is a really dumb idea. - ICMP echo scanning : This isn't really port scanning, since ICMP doesn't have a port abstraction. But it is sometimes useful to determine what hosts in a network are up by pinging them all. the -P option does this. Also you might want to adjust the PING_TIMEOUT #define if you are scanning a large network. nmap supports a host/bitmask notation to make this sort of thing easier. For example 'nmap -P cert.org/24 152.148.0.0/16' would scan CERT's class C network and whatever class B entity 152.148.* represents. Host/26 is useful for 6-bit subnets within an organization. [ Features ] Prior to writing nmap, I spent a lot of time with other scanners exploring the Internet and various private networks (note the avoidance of the "intranet" buzzword). I have used many of the top scanners available today, including strobe by Julian Assange, netcat by *Hobbit*, stcp by Uriel Maimon, pscan by Pluvius, ident-scan by Dave Goldsmith, and the SATAN tcp/udp scanners by Wietse Venema. These are all excellent scanners! In fact, I ended up hacking most of them to support the best features of the others. Finally I decided to write a whole new scanner, rather than rely on hacked versions of a dozen different scanners in my /usr/local/sbin. While I wrote all the code, nmap uses a lot of good ideas from its predecessors. I also incorporated some new stuff like fragmentation scanning and options which were on my "wish list" for other scanners. Here are some of the (IMHO) useful features of nmap: - dynamic delay time calculations: Some scanners require that you supply a delay time between sending packets. Well how should I know what to use? Sure, I can ping them, but that is a pain, and plus the response time of many hosts changes dramatically when they are being flooded with requests. nmap tries to determine the best delay time for you. It also tries to keep track of packet retransmissions, etc. so that it can modify this delay time during the course of the scan. For root users, the primary technique for finding an initial delay is to time the internal "ping" function. For non-root users, it times an attempted connect() to a closed port on the target. It can also pick a reasonable default value. Again, people who want to specify a delay themselves can do so with -w (wait), but you shouldn't have to. - retransmission: Some scanners just send out all the query packets, and collect the responses. But this can lead to false positives or negatives in the case where packets are dropped. This is especially important for "negative" style scans like UDP and FIN, where what you are looking for is a port that does NOT respond. In most cases, nmap implements a configurable number of retransmissions for ports that don't respond. - parallel port scanning: Some scanners simply scan ports linearly, one at a time, until they do all 65535. This actually works for TCP on a very fast local network, but the speed of this is not at all acceptable on a wide area network like the Internet. nmap uses non-blocking i/o and parallel scanning in all TCP and UDP modes. The number of scans in parallel is configurable with the -M (Max sockets) option. On a very fast network you will actually decrease performance if you do more than 18 or so. On slow networks, high values increase performance dramatically. - Flexible port specification: I don't always want to just scan all 65535 ports. Also, the scanners which only allow you to scan ports 1 - N sometimes fall short of my need. The -p option allows you to specify an arbitrary number of ports and ranges for scanning. For example, '-p 21-25,80,113, 60000-' does what you would expect (a trailing hyphen means up to 65536, a leading hyphen means 1 through). You can also use the -F (fast) option, which scans all the ports registered in your /etc/services (a la strobe). - Flexible target specification: I often want to scan more then one host, and I certainly don't want to list every single host on a large network to scan. Everything that isn't an option (or option argument) in nmap is treated as a target host. As mentioned before, you can optionally append /mask to a hostname or IP address in order to scan all hosts with the same initial bits of the 32 bit IP address. - detection of down hosts: Some scanners allow you to scan large networks, but they waste a huge amount of time scanning 65535 ports of a dead host! By default, nmap pings each host to make sure it is up before wasting time on it. It is also capable of bailing on hosts which seem down based on strange port scanning errors. It is also meant to be tolerant of people who accidently scan network addresses, broadcast addresses, etc. - detection of your IP address: For some reason, a lot of scanners ask you to type in your IP address as one of the parameters. Jeez, I don't want to have to 'ifconfig' and figure out my current address every time I scan. Of course, this is better then the scanners I've seen which require recompilation every time you change your address! nmap first tries to detect your address during the ping stage. It uses the address that the echo response is received on, as that is the interface it should almost always be routed through. If it can't do this (like if you don't have host pinging enabled), nmap tries to detect your primary interface and uses that address. You can also use -S to specify it directly, but you shouldn't have to (unless you want to make it look like someone ELSE is SYN or FIN scanning a host. Some other, more minor options: -v (verbose): This is highly recommended for interactive use. Among other useful messages, you will see ports come up as they are found, rather than having to wait for the sorted summary list. -r (randomize): This will randomize the order in which the target host's ports are scanned. -q (quash argv): This changes argv[0] to FAKE_ARGV ("pine" by default). It also eliminates all other arguments, so you won't look too suspicious in 'w' or 'ps' listings. -h for an options summary. Also look for http://www.dhp.com/~fyodor/nmap/, which is the web site I plan to put future versions and more information on. In fact, you would be well advised to check there right now. [ Greets ] Of course this paper would not be complete without a shout out to all the people who made it possible. * Congratulations to the people at Phrack for getting this thing going again! * Greets to the whole dc-stuff crew. * Greets to the STUPH, Turntec, L0pht, TACD, the Guild, cDc, and all the other groups who help keep the scene alive. * Shout out to _eci for disclosing the coolest Windows bug in recent history. * Thanks to the Data Haven Project (dhp.com) admins for providing such great service for $10/month. * And a special shout out goes to all my friends. You know who you are and some of you (wisely) stay out of the spotlight, so I'll keep you anonymous ... except of course for Ken and Jay, and Avenger, Grog, Cash Monies, Ethernet Kid, Zos, JuICe, Mother Prednisone, and Karen. And finally, we get to ... [ The code ] This should compile fine on any Linux box with 'gcc -O6 -o nmap nmap.c -lm'. It is distrubuted under the terms of the GNU GENERAL PUBLIC LICENSE. If you have problems or comments, feel free to mail me (fyodor@dhp.com). nmap-2.08/docs/nmap_doc.html100644 764 764 56313 6635577176 15131 0ustar fyodorfyodor Nmap: The Art of Port Scanning

The Art of Port Scanning

by Fyodor <fyodor@dhp.com>

(Last significant update: Sat Sep 6 03:24:53 GMT 1997)


Warning, the interface to nmap has changed a bit and so not all the flags and options mentioned in this paper are still accurate. The authoritative documentation is now the man page (html version). This article still contains a lot of information on port scanning though and so I recommend that nmap users read it.

Abstract

This paper details many of the techniques used to determine what ports (or similar protocol abstraction) of a host are listening for connections. These ports represent potential communication channels. Mapping their existence facilitates the exchange of information with the host, and thus it is quite useful for anyone wishing to explore their networked environment, including hackers. Despite what you have heard from the media, the Internet is NOT all about TCP port 80. Anyone who relies exclusively on the WWW for information gathering is likely to gain the same level of proficiency as your average AOLer, who does the same. This paper is also meant to serve as an introduction to and ancillary documentation for a coding project I have been working on. It is a full featured, robust port scanner which (I hope) solves some of the problems I have encountered when dealing with other scanners and when working to scan massive networks. The tool, nmap, supports the following:



The freely distributable source code is available at http://www.insecure.org/nmap/

Introduction

Scanning, as a method for discovering exploitable communication channels, has been around for ages. The idea is to probe as many listeners as possible, and keep track of the ones that are receptive or useful to your particular need. Much of the field of advertising is based on this paradigm, and the "to current resident" brute force style of bulk mail is an almost perfect parallel to what we will discuss. Just stick a message in every mailbox and wait for the responses to trickle back.

Scanning entered the h/p world along with the phone systems. Here we have this tremendous global telecommunications network, all reachable through codes on our telephone. Millions of numbers are reachable locally, yet we may only be interested in 0.5% of these numbers, perhaps those that answer with a carrier.

The logical solution to finding those numbers that interest us is to try them all. Thus the field of "wardialing" arose. Excellent programs like Toneloc were developed to facilitate the probing of entire exchanges and more. The basic idea is simple. If you dial a number and your modem gives you a CONNECT, you record it. Otherwise the computer hangs up and tirelessly dials the next one.

While wardialing is still useful, we are now finding that many of the computers we wish to communicate with are connected through networks such as the Internet rather than analog phone dialups. Scanning these machines involves the same brute force technique. We send a blizzard of packets for various protocols, and we deduce which services are listening from the responses we receive (or don't receive).

Techniques

Over time, a number of techniques have been developed for surveying the protocols and ports on which a target machine is listening. They all offer different benefits and problems. Here is a line up of the most common:



Features

Prior to writing nmap, I spent a lot of time with other scanners exploring the Internet and various private networks (note the avoidance of the "intranet" buzzword). I have used many of the top scanners available today, including strobe by Julian Assange, netcat by *Hobbit*, stcp by Uriel Maimon, pscan by Pluvius, ident-scan by Dave Goldsmith, and the SATAN tcp/udp scanners by Wietse Venema. These are all excellent scanners! In fact, I ended up hacking most of them to support the best features of the others. Finally I decided to write a whole new scanner, rather than rely on hacked versions of a dozen different scanners in my /usr/local/sbin. While I wrote all the code, nmap uses a lot of good ideas from its predecessors. I also incorporated some new stuff like fragmentation scanning and options that were on my "wish list" for other scanners. Here are some of the (IMHO) useful features of nmap:

  • dynamic delay time calculations: Some scanners require that you supply a delay time between sending packets. Well how should I know what to use? Sure, I can ping them, but that is a pain, and plus the response time of many hosts changes dramatically when they are being flooded with requests. nmap tries to determine the best delay time for you. It also tries to keep track of packet retransmissions, etc. so that it can modify this delay time during the course of the scan. For root users, the primary technique for finding an initial delay is to time the internal "ping" function. For non-root users, it times an attempted connect() to a closed port on the target. It can also pick a reasonable default value. Again, people who want to specify a delay themselves can do so with -w (wait), but you shouldn't have to.

  • retransmission: Some scanners just send out all the query packets, and collect the responses. But this can lead to false positives or negatives in the case where packets are dropped. This is especially important for "negative" style scans like UDP and FIN, where what you are looking for is a port that does NOT respond. In most cases, nmap implements a configurable number of retransmissions for ports that don't respond.

  • parallel port scanning: Some scanners simply scan ports linearly, one at a time, until they do all 65535. This actually works for TCP on a very fast local network, but the speed of this is not at all acceptable on a wide area network like the Internet. nmap uses non-blocking i/o and parallel scanning in all TCP and UDP modes. The number of scans in parallel is configurable with the -M (Max sockets) option. On a very fast network you will actually decrease performance if you do more than 18 or so. On slow networks, high values increase performance dramatically.

  • Flexible port specification: I don't always want to just scan all 65535 ports. Also, the scanners which only allow you to scan ports 1 - N sometimes fall short of my need. The -p option allows you to specify an arbitrary number of ports and ranges for scanning. For example, '-p 21-25,80,113, 60000-' does what you would expect (a trailing hyphen means up to 65536, a leading hyphen means 1 through). You can also use the -F (fast) option, which scans all the ports registered in your /etc/services (a la strobe).

  • Flexible target specification: I often want to scan more then one host, and I certainly don't want to list every single host on a large network to scan. Everything that isn't an option (or option argument) in nmap is treated as a target host. As mentioned before, you can optionally append /mask to a hostname or IP address in order to scan all hosts with the same initial bits of the 32 bit IP address. You can use the same powerful syntax as the port specifications to specify targets like '150.12.17.71-79.7.*'. '*' is just a shortcut for 0-255, remember to escape it from your shell if used.

  • detection of down hosts: Some scanners allow you to scan large networks, but they waste a huge amount of time scanning 65535 ports of a dead host! By default, nmap pings each host to make sure it is up before wasting time on it. It also does thin in parallel, to speed things up. You can change the parrallel ping lookahead with '-L' and the ping timeout with '-T'. You can turn pinging off completely with the '-D' command line option. This is useful for scanning networks like microsoft.com where ICMP echo requests can't get through. Nmap is also capable of bailing on hosts that seem down based on strange port scanning errors. It is also meant to be tolerant of people who accidentally scan network addresses, broadcast addresses, etc.

  • detection of your IP address: For some reason, a lot of scanners ask you to type in your IP address as one of the parameters. Jeez, I don't want to have to 'ifconfig' and figure out my current address every time I scan. Of course, this is better then the scanners I've seen which require recompilation every time you change your address! nmap first tries to detect your address during the ping stage. It uses the address that the echo response is received on, as that is the interface it should almost always be routed through. If it can't do this (like if you don't have host pinging enabled), nmap tries to detect your primary interface and uses that address. You can also use -S to specify it directly, but you shouldn't have to (unless you want to make it look like someone ELSE is SYN or FIN scanning a host.

Some other, more minor options:
 -v (verbose): This is highly recommended for interactive use.  Among other
useful messages, you will see ports come up as they are found, rather than
having to wait for the sorted summary list.

 -r (randomize): This will randomize the order in which the target host's
ports are scanned.

 -q (quash argv): This changes argv[0] to FAKE_ARGV ("pine" by default).
It also eliminates all other arguments, so you won't look too suspicious in
'w' or 'ps' listings.

 -h for an options summary.

 -R show and resolve all hosts, even down ones.
Also look for http://www.dhp.com/~fyodor/nmap/, which is the web site I plan to put future versions and more information on. In fact, you would be well advised to check there right now. (If that isn't where you are reading this).
Example Usage


To launch a stealth scan of the entire class 'B' networks 166.66.0.0 and 166.67.0.0 for the popularly exploitable imapd daemon:
# nmap -Up 143 166.66.0.0/16 166.67.0.0/16
To do a standard tcp scan on the reserved ports of host <target>:
> nmap target
To check the class 'C' network on which warez.com sits for popular services (via fragmented SIN scan):
# nmap -fsp 21,22,23,25,80,110 warez.com/24
To scan the same network for all the services in your /etc/services via (very fast) tcp scan:
> nmap -F warez.com/24
To scan secret.pathetic.net using the ftp bounce attack off of ftp.pathetic.net:
> nmap -Db ftp.pathetic.net secret.pathetic.net
To find hosts that are up in the the adjacent class C's 193.14.12, .13, .14, .15, ... , .30:
> nmap -P '193.14.[12-30].*'
If you don't want to have to quote it to avoid shell interpretation, this does the same thing:
> nmap -P 193.14.12-30.0-255
nmap-2.08/docs/nmap_manpage.html100600 764 764 75170 6662341756 15757 0ustar fyodorfyodor Nmap network security scanner man page

Nmap network security scanner man page


       nmap - Network exploration tool and security scanner

SYNOPSIS

       nmap [Scan Type(s)] [Options] <host or net #1 ... [#N]>

DESCRIPTION

       Nmap  is designed to allow system administrators and curi-
       ous individuals to scan large networks to determine  which
       hosts  are  up  and what services they are offering.  nmap
       supports a large number of scanning  techniques  such  as:
       UDP, TCP connect(), TCP SYN (half open), ftp proxy (bounce
       attack), Reverse-ident, ICMP (ping sweep), FIN, ACK sweep,
       Xmas  Tree,  SYN sweep, and Null scan.  See the Scan Types
       section for more details.  nmap also offers  a  number  of
       advanced  features  such as remote OS detection via TCP/IP
       fingerprinting,  stealth  scanning,  dynamic   delay   and
       retransmission  calculations, parallel scanning, detection
       of down hosts via parallel  pings,  decoy  scanning,  port
       filtering  detection, fragmentation scanning, and flexible
       target and port specification.

       Significant effort has been put into decent  nmap  perfor-
       mance  for  non-root  users.  Unfortunately, many critical
       kernel interfaces (such as raw sockets) require root priv-
       ileges.  nmap should be run as root whenever possible.

       The  result of running nmap is usually a list of interest-
       ing ports on the machine(s) being scanned (if any).   Nmap
       always  gives  the  port's  "well  known" service name (if
       any), number, state, and protocol.  The  state  is  either
       'open',  'filtered', or 'unfiltered'.  Open means that the
       target machine will accept()  connections  on  that  port.
       Filtered  means  that a firewall, filter, or other network
       obstacle is covering the port  and  preventing  nmap  from
       determining  whether  the  port is open.  Unfiltered means
       that the port is known by nmap to be closed and  no  fire-
       wall/filter  seems  to be interfering with nmap's attempts
       to determine this.  Unfiltered ports are the  common  case
       and  are  only shown when most of the scanned ports are in
       the filtered state.

       Depending on options used, nmap may also report  the  fol-
       lowing  characteristics of the remote host: OS in use, TCP
       sequencability, usernames running the programs which  have
       bound  to  each  port, the DNS name, whether the host is a
       smurf address, and a few others.

OPTIONS

       Options that make sense together  can  generally  be  com-
       bined.   Some  options are specific to certain scan modes.
       nmap tries to catch and warn the user about  psychotic  or
       unsupported option combinations.
       at the end, which demonstrates common usage.  You can also
       run  nmap  -h  for  a quick reference page listing all the
       options.

       Scan Types

       -sT    TCP connect() scan:  This is the most basic form of
              TCP scanning. The connect() system call provided by
              your operating system is used to open a  connection
              to  every  interesting  port on the machine. If the
              port is listening, connect() will  succeed,  other-
              wise the port isn't reachable. One strong advantage
              to this technique is that you don't need  any  spe-
              cial  privileges.  Any  user  on most UNIX boxes is
              free to use this call.

              This sort of scan is easily  detectable  as  target
              host logs will show a bunch of connection and error
              messages for the services which accept()  the  con-
              nection just to have it immediately shutdown.

       -sS    TCP  SYN  scan: This technique is often referred to
              as "half-open" scanning, because you don't  open  a
              full  TCP  connection. You send a SYN packet, as if
              you are going to open a  real  connection  and  you
              wait  for  a response. A SYN|ACK indicates the port
              is listening. A RST is  indicative  of  a  non-lis-
              tener.   If a SYN|ACK is received, a RST is immedi-
              ately sent to tear down  the  connection  (actually
              our OS kernel does this for us). The primary advan-
              tage to this scanning technique is that fewer sites
              will  log  it.   Unfortunately you need root privi-
              leges to build these custom SYN packets.

       -sF -sX -sN
              Stealth FIN, Xmas Tree, or Null scan  modes:  There
              are  times when even SYN scanning isn't clandestine
              enough. Some firewalls and packet filters watch for
              SYNs to restricted ports, and programs like Synlog-
              ger and Courtney  are  available  to  detect  these
              scans. These advanced scans, on the other hand, may
              be able to pass through unmolested.

              The idea is that closed ports are required to reply
              to  your probe packet with an RST, while open ports
              must ignore the packets in question (see RFC 794 pp
              64).   The  FIN  scan  uses  a  bare (surprise) FIN
              packet as the probe, while the Xmas tree scan turns
              on  the  FIN,  URG,  and PUSH flags.  The Null scan
              turns off all flags.  Unfortunately Microsoft (like
              usual)  decided  to  completely ignore the standard
              and do things their own way.  Thus this  scan  type
              guish between the two platforms.  If the scan finds
              open ports, you know the machine is not  a  Windows
              box.   If  a  -sF,-sX,or  -sN  scan shows all ports
              closed, yet a SYN  (-sS)  scan  shows  ports  being
              opened,  you are probably looking at a Windows box.
              This is less useful now that  nmap  has  proper  OS
              detection  built  in.   There  are also a few other
              systems that are broken in the same way Windows is.
              They  include  Cisco,  BSDI,  HP/UX, MVS, and IRIX.
              All of the above send resets from  the  open  ports
              when they should just drop the packet.

       -sP    Ping  scanning:  Sometimes  you  only  want to know
              which hosts on a network are up.  Nmap can do  this
              by  sending  ICMP  echo request packets to every IP
              address on the networks you  specify.   Hosts  that
              respond  are up.  Unfortunately, some sites such as
              microsoft.com block  echo  request  packets.   Thus
              nmap can also send a TCP ack packet to (by default)
              port 80.  If we get an RST back,  that  machine  is
              up.   A  third  technique  involves  sending  a SYN
              packet and waiting for a RST  or  a  SYN/ACK.   For
              non-root users, a connect() method is used.

              By  default  (for  root  users), nmap uses both the
              ICMP and  ACK  techniques  in  parallel.   You  can
              change the -P option described later.

              Note  that  pinging  is done by default anyway, and
              only hosts that respond are scanned.  Only use this
              option  if you wish to ping sweep without doing any
              actual port scans.

       -sU    UDP scans: This method is used to  determine  which
              UDP  (User  Datagram  Protocol,  RFC 768) ports are
              open on a host.  The technique is to  send  0  byte
              udp packets to each port on the target machine.  If
              we receive an ICMP port unreachable  message,  then
              the  port  is  closed.   Otherwise  we assume it is
              open.

              Some people think UDP scanning is pointless. I usu-
              ally  remind  them  of  the  recent Solaris rcpbind
              hole. Rpcbind can be found  hiding  on  an  undocu-
              mented  UDP  port  somewhere  above  32770.  So  it
              doesn't matter that 111 is blocked by the firewall.
              But can you find which of the more than 30,000 high
              ports it is listening on? With a  UDP  scanner  you
              can!   There  is also the cDc Back Orifice backdoor
              program which hides on a configurable UDP  port  on
              Windows  machines.    Not  to mention the many com-
              monly vulnerable services that utilize UDP such  as
              slow since most hosts impliment a suggestion in RFC
              1812  (section  4.3.2.8) of limiting the ICMP error
              message rate.  For example, the  Linux  kernel  (in
              net/ipv4/icmp.h)   limits  destination  unreachable
              message generation to 80 per 4 seconds, with a  1/4
              second  penalty  if  that is exceeded.  Solaris has
              much more strict limits (about 2 messages per  sec-
              ond)  and  thus  takes  even  longer to scan.  nmap
              detects this rate limiting and slows  down  accord-
              ingly,  rather  than flood the network with useless
              packets that will be ignored by the target machine.

              As  is typical, Microsoft ignored the suggestion of
              the RFC and does not seem to do any  rate  limiting
              at  all on Win95 and NT machines.  Thus we can scan
              all 65K ports of a Windows  machine  very  quickly.
              Woop!

       -b <ftp relay host>
              FTP  bounce attack: An interesting "feature" of the
              ftp protocol (RFC 959) is support for  "proxy"  ftp
              connections.  In  other  words, I should be able to
              connect from evil.com to the  FTP  server  of  tar-
              get.com  and  request  that  the server send a file
              ANYWHERE on the internet!  Now this may have worked
              well  in  1985  when  the  RFC  was written. But in
              today's Internet, we can't  have  people  hijacking
              ftp servers and requesting that data be spit out to
              arbitrary points on the internet. As *Hobbit* wrote
              back  in  1995,  this protocol flaw "can be used to
              post virtually untraceable mail and news, hammer on
              servers at various sites, fill up disks, try to hop
              firewalls, and generally be annoying  and  hard  to
              track  down at the same time." What we will exploit
              this for is to (surprise, surprise) scan TCP  ports
              from  a  "proxy" ftp server. Thus you could connect
              to an ftp server behind a firewall, and  then  scan
              ports  that are more likely to be blocked (139 is a
              good one). If the ftp server  allows  reading  from
              and  writing to some directory (such as /incoming),
              you can send arbitrary data to ports  that  you  do
              find open (nmap doesn't do this for you though).

              The  argument  passed to the 'b' option is the host
              you want to use as a proxy, in standard  URL  nota-
              tion.      The     format     is:    username:pass-
              word@server:port.    Everything   but   server   is
              optional.  To determine what servers are vulnerable
              to this attack, you can see my  article  in  Phrack
              51.   And  updated version is available at the nmap
              URL (http://www.insecure.org/nmap).

              None of these are required but some  can  be  quite
              useful.

       -P0    Do  not  try  and ping hosts at all before scanning
              them.  This allows the scanning  of  networks  that
              don't  allow  ICMP  echo  requests  (or  responses)
              through their firewall.  microsoft.com is an  exam-
              ple  of  such a network, and thus you should always
              use -P0 or -PT80 when portscanning microsoft.com.

       -PT    Use TCP "ping" to  determine  what  hosts  are  up.
              Instead  of  sending  ICMP echo request packets and
              waiting for a response, we spew out TCP ACK packets
              throughout  the  target  network  (or  to  a single
              machine) and then watt  for  responses  to  trickle
              back.  Hosts that are up should respond with a RST.
              This option preserves the efficiency of only  scan-
              ning  hosts that are up while still allowing you to
              scan networks/hosts that block ping  packets.   For
              non  root users, we use connect().  To set the des-
              tination port of the  probe  packets  use  -PT<port
              number>.   The  default port is 80, since this port
              is often not filtered out.  -PS  This  option  uses
              SYN  (connection  request)  packets  instead of ACK
              packets for root users.  Hosts that are  up  should
              respond with a RST (or, rarely, a SYN|ACK).

       -PI    This  option  uses  a true ping (ICMP echo request)
              packet.  It finds hosts that are up and also  looks
              for  subnet-directed  broadcast  addresses  on your
              network.  These are IP addresses which  are  exter-
              nally  reachable  and  translate  to a broadcast of
              incomming IP packets  to  a  subnet  of  computers.
              These  should  be eliminated if found as they allow
              for numerous denial of service  attacks  (Smurf  is
              the most common).

       -PB    This  is  the  default ping type.  It uses both the
              ACK ( -PT ) and ICMP ( -PI )  sweeps  in  parallel.
              This  way  you can get firewalls that filter either
              one (but not both).

       -O     This option activates  remote  host  identification
              via TCP/IP fingerprinting.  In other words, it uses
              a bunch of techniques to detect subtleties  in  the
              underlying  operating  system  network stack of the
              computers you are scanning.  It uses this  informa-
              tion  to  create  a 'fingerprint' which it compares
              with its database of  known  OS  fingerprints  (the
              nmap-os-fingerprints  file)  to decide what type of
              system you are scanning.

              mail me the details (ie OS  blah  version  foo  was
              detected  as  OS  blah version bar).  If you find a
              machine with at least one port open for which  nmap
              says  'unknown  operating system', then it would be
              useful if you send me the IP address along with the
              OS  name and version number.  If you can't send the
              IP address, the next best thing is to run nmap with
              the  -d  option  and send me the three fingerprints
              that should result along with the OS name and  ver-
              sion  number.   By doing this you contribute to the
              pool of operating systems known to nmap and thus it
              will be more accurate for everyone.

       -I     This  turns on TCP reverse ident scanning. As noted
              by Dave Goldsmith in a 1996 Bugtraq post, the ident
              protocol  (rfc  1413)  allows for the disclosure of
              the username that owns any  process  connected  via
              TCP,  even if that process didn't initiate the con-
              nection. So you can, for example,  connect  to  the
              http  port  and then use identd to find out whether
              the server is running as root.  This  can  only  be
              done  with a full TCP connection to the target port
              (i.e. the -sT scanning option).  When -I  is  used,
              the  remote  host's identd is queried for each open
              port found.  Obviously this won't work if the  host
              is not running identd.

       -f     This option causes the requested SYN, FIN, XMAS, or
              NULL scan to use tiny fragmented IP  packets.   The
              idea  is  to  split  up the TCP header over several
              packets to  make  it  harder  for  packet  filters,
              intrusion  detection  systems, and other annoyances
              to detect what you are doing. Be careful with this!
              Some  programs  have  trouble  handling  these tiny
              packets. My favorite sniffer  segmentation  faulted
              immediately  upon receiving the first 36-byte frag-
              ment. After that comes a 24 byte  one!  While  this
              method  won't  get  by packet filters and firewalls
              that  queue  all  IP  fragments  (like   the   CON-
              FIG_IP_ALWAYS_DEFRAG  option  in the Linux kernel),
              some networks can't afford the performance hit this
              causes and thus leave it disabled.

              Note  that I do not yet have this option working on
              all systems.  It works fine for my Linux,  FreeBSD,
              and  OpenBSD  boxes  and  some people have reported
              success with other *NIX variants.

       -v     Verbose mode.  This is a highly recommended  option
              and  it  gives  out  more information about what is
              going on.  You can use it twice for greater effect.
              Use  -d a couple of times if you really want to get
              of  nmap  usage  options.  As you may have noticed,
              this man page is not exactly a 'quick reference' :)

       -o <logfilename>
              This  logs  the  results  of  your scans in a human
              readable form into the file you specify as an argu-
              ment.

       -m <logfilename>
              This  logs  the  results of your scans in a machine
              parseable form into the  file  you  specify  as  an
              argument.

       -i <inputfilename>
              Reads target specifications from the file specified
              RATHER than from the command line.  The file should
              contain  a  list  of  host  or  network expressions
              seperated by spaces,  tabs,  or  newlines.   Use  a
              hyphen  (-)  as  inputfilename  if you want nmap to
              read host expressions from stdin (like at  the  end
              of  a  pipe).  See the section target specification
              for more information on the  expressions  you  fill
              the file with.

       -p <port ranges>
              This  option specifies what ports you want to spec-
              ify. For example '-p 23' will only try port  23  of
              the target host(s).  ports greater than 60000.  The
              default is to scan all ports between 1 and 1024  as
              well as any ports listed in your /etc/services.

       -F Fast scan mode.
              Specifies  that  you  only  wish  to scan for ports
              listed in /etc/services.  This  is  obviously  much
              faster than scanning all 65535 ports on a host.

       -D <decoy1 [,decoy2][,ME],...>
              Causes  a decoy scan to be performed which makes it
              appear to the remote  host  that  the  host(s)  you
              specify  as  decoys are scanning the target network
              too.  Thus their IDS might report 5-10  port  scans
              from unique IP addresses, but they won't know which
              IP  was  scanning  them  and  which  were  innocent
              decoys.

              Separate  each  decoy host with commas, and you can
              optionally use 'ME' as one of the decoys to  repre-
              sent  the  position  you want your IP address to be
              used.  If your put 'ME'  in  the  6th  position  or
              later,  some  common  port  scan detectors (such as
              Solar Designer's excellent scanlogd) are  unlikeley
              to  show  your IP address at all.  If you don't use
              or  you  might  accidently  SYN flood your targets.
              Also it will be pretty easy to determine which host
              is  scanning if only one is actually up on the net-
              work.

              Also note that some (stupid) "port scan  detectors"
              will  firewall/deny  routing  to hosts that attempt
              port scans.  Thus you might inadvertantly cause the
              machine  you  scan  to  lose  connectivity with the
              decoy machines you are using.  This could cause the
              target  machines  major  problems  if the decoy is,
              say, its  internet  gateway  or  even  "localhost".
              Thus  you  might want to be careful of this option.
              The real moral of the story is  that  detectors  of
              spoofable port scans should not take action against
              the machine that seems like  it  is  port  scanning
              them.  It could just be a decoy!

              Decoys  are  used  both  in  the  initial ping scan
              (using ICMP, SYN, ACK, or whatever) as well as  the
              actual  port  scanning phase.  Decoys are also used
              during remote OS detection ( -O ).

              It is worth noting that using too many  decoys  may
              slow  your  scan  and potentially even make it less
              accurate.  Also, some ISPs  will  filter  out  your
              spoofed  packets, although many (currently most) do
              not restrict spoofed IP packets at all.

       -S <IP_Address>
              In some circumstances, nmap  may  not  be  able  to
              determine  your source address ( nmap will tell you
              if this is the case).  In this  situation,  use  -S
              with  your IP address (of the interface you wish to
              send packets through).

              Another possible use of this flag is to  spoof  the
              scan to make the targets think that someone else is
              scanning them.  Imagine a company being  repeatedly
              port  scanned  by a competitor!  This is not a sup-
              ported usage (or the main purpose) of this flag.  I
              just  think  it  raises  an interesting possibility
              that people should  be  aware  of  before  they  go
              accusing  others  of  port scanning them.  -e would
              generally be required for this sort of usage.

       -e <interface>
              Tells nmap what interface to send and receive pack-
              ets  on.  Nmap should be able to detect this but it
              will tell you if it cannot.

       -g <portnumber>
              an exception in their ruleset to allow DNS (53)  or
              FTP-DATA (20) packets to come through and establish
              a connection.  Obviously this  completely  subverts
              the  security  advantages  of  the  firewall  since
              intruders can just masquerade as FTP or DNS by mod-
              ifying their source port.  Obviously for a UDP scan
              you should try 53 first and TCP scans should try 20
              before  53.   Note  that  this is only a request --
              nmap will honor it only if and when it is able  to.
              For example, you can't do TCP ISN sampling all from
              one host:port to one host:port, so nmap changes the
              source port even if you used -g.

              Be  aware that there is a small performance penalty
              on some scans for  using  this  option,  because  I
              sometimes  store  useful  information in the source
              port number.

       -M <max sockets>
              Sets the maximum number of  sockets  that  will  be
              used  in  parallel  for  a  TCP connect() scan (the
              default).  This is useful to slow down the  scan  a
              little  bit  and  avoid  crashing  remote machines.
              Another approach is to use -sS, which is  generally
              easier for machines to handle.

       Target specification
              Everything  that  isn't  an option (or option argu-
              ment) in nmap is treated as a target host  specifi-
              cation.   The simplest case is listing single host-
              names or IP addresses on the command line.  If  you
              want  to  scan  a  subnet  of IP addresses, you can
              append '/mask' to the hostname or IP address.  mask
              must  be between 0 (scan the whole internet) and 32
              (scan the single host specified).  Use /24 to  scan
              a class 'C' address and /16 for a class 'B'.

              Nmap  also  has a more powerful notation which lets
              you specify an IP address  using  lists/ranges  for
              each  element.   Thus  you can scan the whole class
              'B' network 128.210.*.* by specifying '128.210.*.*'
              or        '128.210.0-255.0-255'       or       even
              '128.210.1-50,51-255.1,2,3,4,5-255'.  And of course
              you  can  use  the mask notation: '128.210.0.0/16'.
              These are all equivalent.   If  you  use  astericts
              ('*'),  remember  that  most  shells require you to
              escape them with back slashes or protect them  with
              quotes.

              Another interesting thing to do is slice the Inter-
              net the other way.  Instead  of  scanning  all  the
              hosts  in  a  class  'B',  scan '*.*.5.6-7' to scan
              ing hosts to scan, see the examples section.

EXAMPLES

       Here are some examples of using nmap, from simple and nor-
       mal  to  a little more complex/esoteric.  Note that actual
       numbers and some actual domain  names  are  used  to  make
       things  more  concrete.  In their place you should substi-
       tute addresses/names from your  own  network.   I  do  not
       think  portscanning  other networks is illegal; nor should
       portscans be construed by others as  an  attack.   I  have
       scanned   hundreds  of  thousands  of  machines  and  have
       received only one complaint.  But I am not  a  lawyer  and
       some  (anal)  people  may  be annoyed by nmap probes.  Get
       permission first or use at your own risk.

       nmap -v target.example.com

       This option scans all reserved TCP ports  on  the  machine
       target.example.com .  The -v means turn on verbose mode.

       nmap -sS -O target.example.com/24

       Launches  a  stealth SYN scan against each machine that is
       up out of the 255 machines on class 'C' where target.exam-
       ple.com  resides.  It also tries to determine what operat-
       ing system is running on each host that is up and running.
       This  requires root privileges because of the SYN scan and
       the OS detection.

       nmap -sX -p 22,53,110,143,4564 128.210.*.1-127

       Sends an Xmas tree scan to the first half of each  of  the
       255  possible  8  bit  subnets  in  the  128.210 class 'B'
       address space.  We are testing  whether  the  systems  run
       sshd,  DNS,  pop3d,  imapd,  or port 4564.  Note that Xmas
       scan doesn't work on Microsoft boxes due  to  their  defi-
       cient  TCP  stack.  Same goes with CISCO, IRIX, HP/UX, and
       BSDI boxes.

       nmap -v -p 80 '*.*.2.3-5'

       Rather than focus on a specific IP range, it is  sometimes
       interesting  to  slice  up  the entire Internet and scan a
       small sample from each slice.  This command finds all  web
       servers  on  machines  with  IP  addresses ending in .2.3,
       .2.4, or .2.5 .  If you are root you  might  as  well  add
       -sS.   Also you will find more interesting machines start-
       ing at 127. so you might want to use '127-222' instead  of
       the first asterict because that section has a greater den-
       sity of interesting machines (IMHO).

       and  then  feed  the IP addresses to nmap.  The above com-
       mands are for my GNU/Linux box.  You  may  need  different
       commands/options on other operating systems.

BUGS

       Bugs?  What bugs?  Send me any that you find.  Patches are
       nice too :) Remember to also send in new  OS  fingerprints
       so we can grow the database.

AUTHOR

       Fyodor <fyodor@dhp.com>

DISTRIBUTION

       The   newest   version   of  nmap  can  be  obtained  from
       http://www.insecure.org/nmap

       nmap is (C) 1997,1998,1999 by Fyodor (fyodor@dhp.com, fyo-
       dor@insecure.org)

       libpcap  is also distributed along with nmap.  It is copy-
       righted by Van Jacobson, Craig Leres and  Steven  McCanne,
       all   of   the Lawrence Berkeley National Laboratory, Uni-
       versity of California, Berkeley,  CA.   The  version  dis-
       tributed  with  nmap may be modified, pristine sources are
       available from ftp://ftp.ee.lbl.gov/libpcap.tar.Z .

       This program is free software;  you  can  redistribute  it
       and/or modify it under the terms of the GNU General Public
       License as published by the Free Software Foundation; Ver-
       sion  2.   If  you  want to license nmap under terms other
       than the GPL, you can write Fyodor and  plead  your  case,
       but  none of the (2-3) attempts at this have been success-
       ful.

       This program is distributed in the hope that  it  will  be
       useful, but WITHOUT ANY WARRANTY; without even the implied
       warranty of MERCHANTABILITY or FITNESS  FOR  A  PARTICULAR
       PURPOSE.  See  the  GNU  General  Public  License for more
       details (it is in the COPYING file of the  nmap  distribu-
       tion).
Man(1) output converted with man2html
nmap-2.08/docs/nmap-fingerprinting-article.txt100600 764 764 71517 6657366442 20612 0ustar fyodorfyodor Remote OS detection via TCP/IP Stack FingerPrinting by Fyodor (www.insecure.org) October 18, 1998 ABSTRACT This paper discusses how to glean precious information about a host by querying its TCP/IP stack. I first present some of the "classical" methods of determining host OS which do not involve stack fingerprinting. Then I describe the current "state of the art" in stack fingerprinting tools. Next comes a description of many techniques for causing the remote host to leak information about itself. Finally I detail my (nmap) implementation of this, followed by a snapshot gained from nmap which discloses what OS is running on many popular Internet sites. REASONS I think the usefulness of determining what OS a system is running is pretty obvious, so I'll make this section short. One of the strongest examples of this usefulness is that many security holes are dependent on OS version. Lets say you are doing a penetration test and you find port 53 open. If this is a vulnerable version of Bind, you only get one chance to exploit it since a failed attempt will crash the daemon. With a good TCP/IP fingerprinter, you will quickly find that this machine is running 'Solaris 2.51' or 'Linux 2.0.35' and you can adjust your shellcode accordingly. A worse possibility is someone scanning 500,000 hosts in advance to see what OS is running and what ports are open. Then when someone posts (say) a root hole in Sun's comsat daemon, our little cracker could grep his list for 'UDP/512' and 'Solaris 2.6' and he immediately has pages and pages of rootable boxes. It should be noted that this is SCRIPT KIDDIE behavior. You have demonstrated no skill and nobody is even remotely impressed that you were able to find some vulnerable .edu that had not patched the hole in time. Also, people will be even _less_ impressed if you use your newfound access to deface the department's web site with a self-aggrandizing rant about how damn good you are and how stupid the sysadmins must be. Another possible use is for social engineering. Lets say that you are scanning your target company and nmap reports a 'Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06'. The hacker might now call up as 'Datavoice support' and discuss some issues about their PRISM 3000. "We are going to announce a security hole soon, but first we want all our current customers to install the patch -- I just mailed it to you ..." Some naive administrators might assume that only an authorized engineer from Datavoice would know so much about their CSU/DSU. Another potential use of this capability is evaluation of companies you may want to do business with. Before you choose a new ISP, scan them and see what equipment is in use. Those "$99/year" deals don't sound nearly so good when you find out they have crappy routers and offer PPP services off a bunch of Windows boxes. CLASSICAL TECHNIQUES Stack fingerprinting solves the problem of OS identification in a unique way. I think this technique holds the most promise, but there are currently many other solutions. Sadly, this is still one the most effective of those techniques: playground~> telnet hpux.u-aizu.ac.jp Trying 163.143.103.12... Connected to hpux.u-aizu.ac.jp. Escape character is '^]'. HP-UX hpux B.10.01 A 9000/715 (ttyp2) login: There is no point going to all this trouble of fingerprinting if the machine will blatantly announce to the world exactly what it is running! Sadly, many vendors ship _current_ systems with these kind of banners and many admins do not turn them off. Just because there are other ways to figure out what OS is running (such as fingerprinting), does not mean we should just announce our OS and architecture to every schmuck who tries to connect. The problems with relying on this technique are that an increasing number of people are turning banners off, many systems don't give much information, and it is trivial for someone to "lie" in their banners. Nevertheless, banner reading is all you get for OS and OS Version checking if you spend $thousands on the commercial ISS scanner. Download nmap or queso instead and save your money :). Even if you turn off the banners, many applications will happily give away this kind of information when asked. For example lets look at an FTP server: payfonez> telnet ftp.netscape.com 21 Trying 207.200.74.26... Connected to ftp.netscape.com. Escape character is '^]'. 220 ftp29 FTP server (UNIX(r) System V Release 4.0) ready. SYST 215 UNIX Type: L8 Version: SUNOS First of all, it gives us system details in its default banner. Then if we give the 'SYST' command it happily feeds back even more information. If anon FTP is supported, we can often download /bin/ls or other binaries and determine what architecture it was built for. Many other applications are too free with information. Take web servers for example: playground> echo 'GET / HTTP/1.0\n' | nc hotbot.com 80 | egrep '^Server:' Server: Microsoft-IIS/4.0 playground> Hmmm ... I wonder what OS those lamers are running. Other classic techniques include DNS host info records (rarely effective) and social engineering. If the machine is listening on 161/udp (snmp), you are almost guaranteed a bunch of detailed info using 'snmpwalk' from the CMU SNMP tools distribution and the 'public' community name. CURRENT FINGERPRINTING PROGRAMS Nmap is not the first OS recognition program to use TCP/IP fingerprinting. The common IRC spoofer sirc by Johan has included very rudimentary fingerprinting techniques since version 3 (or earlier). It attempts to place a host in the classes "Linux", "4.4BSD", "Win95", or "Unknown" using a few simple TCP flag tests. Another such program is checkos, released publicly in January of this year by Shok in Confidence Remains High Issue #7. The fingerprinting techniques are exactly the same as SIRC, and even the _code_ is identical in many places. Checkos was privately available for a long time prior to the public release, so I have no idea who swiped code from whom. But neither seems to credit the other. One thing checkos does add is telnet banner checking, which is useful but has the problems described earlier. [ Update: Shok wrote in to say that chekos was never intended to be public and this is why he didn't bother to credit SIRC for some of the code. ] Su1d also wrote an OS checking program. His is called SS and as of Version 3.11 it can identify 12 different OS types. I am somewhat partial to this one since he credits my nmap program for some of the networking code :). Then there is queso. This program is the newest and it is a huge leap forward from the other programs. Not only do they introduce a couple new tests, but they were the first (that I have seen) to move the OS fingerprints _out_ of the code. The other scanners included code like: /* from ss */ if ((flagsfour & TH_RST) && (flagsfour & TH_ACK) && (winfour == 0) && (flagsthree & TH_ACK)) reportos(argv[2],argv[3],"Livingston Portmaster ComOS"); Instead, queso moves this into a configuration file which obviously scales much better and makes adding an OS as easy as appending a few lines to a fingerprint file. Queso was written by Savage, one of the fine folks at Apostols.org . One problem with all the programs describe above is that they are very limited in the number of fingerprinting tests which limits the granularity of answers. I want to know more than just 'this machine is OpenBSD, FreeBSD, or NetBSD', I wish to know exactly which of those it is as well as some idea of the release version number. In the same way, I would rather see 'Solaris 2.6' than simply 'Solaris'. To achieve this response granularity, I worked on a number of fingerprinting techniques which are described in the next section. FINGERPRINTING METHODOLOGY There are many, many techniques which can be used to fingerprint networking stacks. Basically, you just look for things that differ among operating systems and write a probe for the difference. If you combine enough of these, you can narrow down the OS very tightly. For example nmap can reliably distinguish Solaris 2.4 vs. Solaris 2.5-2.51 vs Solaris 2.6. It can also tell Linux kernel 2.0.30 from 2.0.31-34 or 2.0.35. Here are some techniques: The FIN probe -- Here we send a FIN packet (or any packet without an ACK or SYN flag) to an open port and wait for a response. The correct RFC793 behavior is to NOT respond, but many broken implementations such as MS Windows, BSDI, CISCO, HP/UX, MVS, and IRIX send a RESET back. Most current tools utilize this technique. The BOGUS flag probe -- Queso is the first scanner I have seen to use this clever test. The idea is to set an undefined TCP "flag" ( 64 or 128) in the TCP header of a SYN packet. Linux boxes prior to 2.0.35 keep the flag set in their response. I have not found any other OS to have this bug. However, some operating systems seem to reset the connection when they get a SYN+BOGUS packet. This behavior could be useful in identifying them. TCP ISN Sampling -- The idea here is to find patterns in the initial sequence numbers chosen by TCP implementations when responding to a connection request. These can be categorized in to many groups such as the traditional 64K (many old UNIX boxes), Random increments (newer versions of Solaris, IRIX, FreeBSD, Digital UNIX, Cray, and many others), True "random" (Linux 2.0.*, OpenVMS, newer AIX, etc). Windows boxes (and a few others) use a "time dependent" model where the ISN is incremented by a small fixed amount each time period. Needless to say, this is almost as easily defeated as the old 64K behavior. Of course my favorite technique is "constant". The machines ALWAYS use the exact same ISN :). I've seen this on some 3Com hubs (uses 0x803) and Apple LaserWriter printers (uses 0xC7001). You can also subclass groups such as random incremental by computing variances, greatest common divisors, and other functions on the set of sequence numbers and the differences between the numbers. It should be noted that ISN generation has important security implications. For more information on this, contact "security expert" Tsutomu "Shimmy" Shimomura at SDSC and ask him how he was owned. Nmap is the first program I have seen to use this for OS identification. Don't Fragment bit -- Many operating systems are starting to set the IP "Don't Fragment" bit on some of the packets they send. This gives various performance benefits (though it can also be annoying -- this is why nmap fragmentation scans do not work from Solaris boxes). In any case, not all OS's do this and some do it in different cases, so by paying attention to this bit we can glean even more information about the target OS. I haven't seen this one before either. TCP Initial Window -- This simply involves checking the window size on returned packets. Older scanners simply used a non-zero window on a RST packet to mean "BSD 4.4 derived". Newer scanners such as queso and nmap keep track of the exact window since it is actually pretty constant by OS type. This test actually gives us a lot of information, since some operating systems can be uniquely identified by the window alone (for example, AIX is the only OS I have seen which uses 0x3F25). In their "completely rewritten" TCP stack for NT5, Microsoft uses 0x402E. Interestingly, that is exactly the number used by OpenBSD and FreeBSD. ACK Value -- Although you would think this would be completely standard, implementations differ in what value they use for the ACK field in some cases. For example, lets say you send a FIN|PSH|URG to a closed TCP port. Most implementations will set the ACK to be the same as your initial sequence number, though Windows and some stupid printers will send your seq + 1. If you send a SYN|FIN|URG|PSH to an open port, Windows is very inconsistent. Sometimes it sends back your seq, other times it sends S++, and still other times is sends back a seemingly random value. One has to wonder what kind of code MS is writing that changes its mind like this. ICMP Error Message Quenching -- Some (smart) operating systems follow the RFC 1812 suggestion to limit the rate at which various error messages are sent. For example, the Linux kernel (in net/ipv4/icmp.h) limits destination unreachable message generation to 80 per 4 seconds, with a 1/4 second penalty if that is exceeded. One way to test this is to send a bunch of packets to some random high UDP port and count the number of unreachables received. I have not seen this used before, and in fact I have not added this to nmap (except for use in UDP port scanning). This test would make the OS detection take a bit longer since you need to send a bunch of packets and wait for them to return. Also dealing with the possibility of packets dropped on the network would be a pain. ICMP Message Quoting -- The RFCs specify that ICMP error messages quote some small amount of an ICMP message that causes various errors. For a port unreachable message, almost all implementations send only the required IP header + 8 bytes back. However, Solaris sends back a bit more and Linux sends back even more than that. The beauty with this is it allows nmap to recognize Linux and Solaris hosts even if they don't have any ports listening. ICMP Error message echoing integrity -- I got this idea from something Theo De Raadt (lead OpenBSD developer) posted to comp.security.unix. As mentioned before, machines have to send back part of your original message along with a port unreachable error. Yet some machines tend to use your headers as 'scratch space' during initial processing and so they are a bit warped by the time you get them back. For example, AIX and BSDI send back an IP 'total length' field that is 20 bytes too high. Some BSDI, FreeBSD, OpenBSD, ULTRIX, and VAXen fuck up the IP ID that you sent them. While the checksum is going to change due to the changed TTL anyway, there are some machines (AIX, FreeBSD, etc.) which send back an inconsistent or 0 checksum. Same thing goes with the UDP checksum. All in all, nmap does nine different tests on the ICMP errors to sniff out subtle differences like these. Type of Service -- For the ICMP port unreachable messages I look at the type of service (TOS) value of the packet sent back. Almost all implementations use 0 for this ICMP error although Linux uses 0xC0. This does not indicate one of the standard TOS values, but instead is part of the unused (AFAIK) precedence field. I do not know why this is set, but if they change to 0 we will be able to keep identifying the old versions _and_ we will be able to identify between old and new. Fragmentation Handling -- This is a favorite technique of Thomas H. Ptacek of Secure Networks, Inc (now owned by a bunch of Windows users at NAI). This takes advantage of the fact that different implementations often handle overlapping IP fragments differently. Some will overwrite the old portions with the new, and in other cases the old stuff has precedence. There are many different probes you can use to determine how the packet was reassembled. I did not add this capability since I know of no portable way to send IP fragments (in particular, it is a bitch on Solaris). For more information on overlapping fragments, you can read their IDS paper (www.secnet.com). TCP Options -- These are truly a gold mine in terms of leaking information. The beauty of these options is that: 1) They are generally optional (duh!) :) so not all hosts implement them. 2) You know if a host implements them by sending a query with an option set. The target generally show support of the option by setting it on the reply. 3) You can stuff a whole bunch of options on one packet to test everything at once. Nmap sends these options along with almost every probe packet: Window Scale=10; NOP; Max Segment Size = 265; Timestamp; End of Ops; When you get your response, you take a look at which options were returned and thus are supported. Some operating systems such as recent FreeBSD boxes support all of the above, while others, such as Linux 2.0.X support very few. The latest Linux 2.1.x kernels do support all of the above. On the other hand, they are more vulnerable to TCP sequence prediction. Go figure. Even if several operating systems support the same set of options, you can sometimes distinguish them by the _values_ of the options. For example, if you send a small MSS value to a Linux box, it will generally echo that MSS back to you. Other hosts will give you different values. And even if you get the same set of supported options AND the same values, you can still differentiate via the _order_ that the options are given, and where padding is applied. For example Solaris returns 'NNTNWME' which means: While Linux 2.1.122 returns MENNTNW. Same options, same values, but different order! I have not seen any other OS detection tools utilizes TCP options, but it is very useful. There are a few other useful options I might probe for at some point, such as those that support T/TCP and selective acknowledgements. Exploit Chronology -- Even with all the tests above, nmap is unable to distinguish between the TCP stacks of Win95, WinNT, or Win98. This is rather surprising, especially since Win98 came out about 4 years after Win95. You would think they would have bothered to improve the stack in some way (like supporting more TCP options) and so we would be able to detect the change and distinguish the operating systems. Unfortunately, this is not the case. The NT stack is apparently the same crappy stack they put into '95. And they didn't bother to upgrade it for '98. But do not give up hope, for there is a solution. You can simply start with early Windows DOS attacks (Ping of Death, Winnuke, etc) and move up a little further to attacks such as Teardrop and Land. After each attack, ping them to see whether they have crashed. When you finally crash them, you will likely have narrowed what they are running down to one service pack or hotfix. I have not added this functionality to nmap, although I must admit it is very tempting :). SYN Flood Resistance -- Some operating systems will stop accepting new connections if you send too many forged SYN packets at them (forging the packets avoids trouble with your kernel resetting the connections). Many operating systems can only handle 8 packets. Recent Linux kernels (among other operating systems) allow various methods such as SYN cookies to prevent this from being a serious problem. Thus you can learn something about your target OS by sending 8 packets from a forged source to an open port and then testing whether you can establish a connection to that port yourself. This was not implemented in nmap since some people get upset when you SYN flood them. Even explaining that you were simply trying to determine what OS they are running might not help calm them. NMAP IMPLEMENTATION AND RESULTS I have created a reference implementation of the OS detection techniques mentioned above (except those I said were excluded). I have added this to my Nmap scanner which has the advantage that it already _knows_ what ports are open and closed for fingerprinting so you do not have to tell it. It is also portable among Linux, *BSD, and Solaris 2.51 and 2.6, and some other operating systems. The new version of nmap reads a file filled with Fingerprint templates that follow a simple grammar. Here is an example: FingerPrint IRIX 6.2 - 6.4 # Thanks to Lamont Granquist TSeq(Class=i800) T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Lets look at the first line (I'm adding '>' quote markers): > FingerPrint IRIX 6.2 - 6.3 # Thanks to Lamont Granquist This simply says that the fingerprint covers IRIX versions 6.2 through 6.3 and the comment states that Lamont Granquist kindly sent me the IP addresses or fingerprints of the IRIX boxes tested. > TSeq(Class=i800) This means that ISN sampling put it in the "i800 class". This means that each new sequence number is a multiple of 800 greater than the last one. > T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) The test is named T1 (for test1, clever eh?). In this test we send a SYN packet with a bunch of TCP options to an open port. DF=N means that the "Don't fragment" bit of the response must not be set. W=C000|EF2A means that the window advertisement we received must be 0xC000 or EF2A. ACK=S++ means the acknowledgement we receive must be our initial sequence number plus 1. Flags = AS means the ACK and SYN flags were sent in the response. Ops = MNWNNT means the options in the response must be (in this order): > T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) Test 2 involves a NULL with the same options to an open port. Resp=Y means we must get a response. Ops= means that there must not be any options included in the response packet. If we took out '%Ops=' entirely then any options sent would match. > T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) Test 3 is a SYN|FIN|URG|PSH w/options to an open port. > T4(DF=N%W=0%ACK=O%Flags=R%Ops=) This is an ACK to an open port. Note that we do not have a Resp= here. This means that lack of a response (such as the packet being dropped on the network or an evil firewall) will not disqualify a match as long as all the other tests match. We do this because virtually any OS will send a response, so a lack of response is generally an attribute of the network conditions and not the OS itself. We put the Resp tag in tests 2 and 3 because some operating systems _do_ drop those without responding. > T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) > T6(DF=N%W=0%ACK=O%Flags=R%Ops=) > T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) These tests are a SYN, ACK, and FIN|PSH|URG, respectively, to a closed port. The same options as always are set. Of course this is all probably obvious given the descriptive names 'T5', 'T6', and 'T7' :). > PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) This big sucker is the 'port unreachable' message test. You should recognize the DF=N by now. TOS=0 means that IP type of service field was 0. The next two fields give the (hex) values of the IP total length field of the message IP header and the total length given in the IP header they are echoing back to us. RID=E means the RID value we got back in the copy of our original UDP packet was expected (ie the same as we sent). RIPCK=E means they didn't fuck up the checksum (if they did, it would say RIPCK=F). UCK=E means the UDP checksum is also correct. Next comes the UDP length which was 0x134 and DAT=E means they echoed our UDP data correctly. Since most implementations (including this one) do not send any of our UDP data back, they get DAT=E by default. The version of nmap with this functionality is currently in the 6th private beta cycle. It may be out by the time you read this in Phrack. Then again, it might not. See http://www.insecure.org/nmap/ for the latest version. POPULAR SITE SNAPSHOTS Here is the fun result of all our effort. We can now take random Internet sites and determine what OS they are using. A lot of these people have eliminated telnet banners, etc. to keep this information private. But this is of no use with our new fingerprinter! Also this is a good way to expose the users as the lamers that they are :)! The command used in these examples was: nmap -sS -p 80 -O -v Also note that most of these scans were done on 10/18/98. Some of these folks may have upgraded/changed servers since then. Note that I do not like every site on here. # "Hacker" sites or (in a couple cases) sites that think they are www.l0pht.com => OpenBSD 2.2 - 2.4 www.insecure.org => Linux 2.0.31-34 www.rhino9.ml.org => Windows 95/NT # No comment :) www.technotronic.com => Linux 2.0.31-34 www.nmrc.org => FreeBSD 2.2.6 - 3.0 www.cultdeadcow.com => OpenBSD 2.2 - 2.4 www.kevinmitnick.com => Linux 2.0.31-34 # Free Kevin! www.2600.com => FreeBSD 2.2.6 - 3.0 Beta www.antionline.com => FreeBSD 2.2.6 - 3.0 Beta www.rootshell.com => Linux 2.0.35 # Changed to OpenBSD after # they got owned. # Security vendors, consultants, etc. www.repsec.com => Linux 2.0.35 www.iss.net => Linux 2.0.31-34 www.checkpoint.com => Solaris 2.5 - 2.51 www.infowar.com => Win95/NT # Vendor loyalty to their OS www.li.org => Linux 2.0.35 # Linux International www.redhat.com => Linux 2.0.31-34 # I wonder what distribution :) www.debian.org => Linux 2.0.35 www.linux.org => Linux 2.1.122 - 2.1.126 www.sgi.com => IRIX 6.2 - 6.4 www.netbsd.org => NetBSD 1.3X www.openbsd.org => Solaris 2.6 # Ahem :) www.freebsd.org => FreeBSD 2.2.6-3.0 Beta # Ivy league www.harvard.edu => Solaris 2.6 www.yale.edu => Solaris 2.5 - 2.51 www.caltech.edu => SunOS 4.1.2-4.1.4 # Hello! This is the 90's :) www.stanford.edu => Solaris 2.6 www.mit.edu => Solaris 2.5 - 2.51 # Coincidence that so many good # schools seem to like Sun? # Perhaps it is the 40% # .edu discount :) www.berkeley.edu => UNIX OSF1 V 4.0,4.0B,4.0D www.oxford.edu => Linux 2.0.33-34 # Rock on! # Lamer sites www.aol.com => IRIX 6.2 - 6.4 # No wonder they are so insecure :) www.happyhacker.org => OpenBSD 2.2-2.4 # Sick of being owned, Carolyn? # Even the most secure OS is # useless in the hands of an # incompetent admin. # Misc www.lwn.net => Linux 2.0.31-34 # This Linux news site rocks! www.slashdot.org => Linux 2.1.122 - 2.1.126 www.whitehouse.gov => IRIX 5.3 sunsite.unc.edu => Solaris 2.6 Notes: In their security white paper, Microsoft said about their lax security: "this assumption has changed over the years as Windows NT gains popularity largely because of its security features.". Hmm, from where I stand it doesn't look like Windows is very popular among the security community :). I only see 2 Windows boxes from the whole group, and Windows is _easy_ for nmap to distinguish since it is so broken (standards wise). And of course, there is one more site we must check. This is the web site of the ultra-secret Transmeta corporation. Interestingly the company was funded largely by Paul Allen of Microsoft, but it employs Linus Torvalds. So do they stick with Paul and run NT or do they side with the rebels and join the Linux revolution? Let us see: We use the command: nmap -sS -F -o transmeta.log -v -O www.transmeta.com/24 This says SYN scan for known ports (from /etc/services), log the results to 'transmeta.log', be verbose about it, do an OS scan, and scan the class 'C' where www.transmeta.com resides. Here is the gist of the results: neon-best.transmeta.com (206.184.214.10) => Linux 2.0.33-34 www.transmeta.com (206.184.214.11) => Linux 2.0.30 neosilicon.transmeta.com (206.184.214.14) => Linux 2.0.33-34 ssl.transmeta.com (206.184.214.15) => Linux unknown version linux.kernel.org (206.184.214.34) => Linux 2.0.35 www.linuxbase.org (206.184.214.35) => Linux 2.0.35 ( possibly the same machine as above ) Well, I think this answers our question pretty clearly :). ACKNOWLEDGEMENTS The only reason Nmap is currently able to detect so many different operating systems is that many people on the private beta team went to a lot of effort to search out new and exciting boxes to fingerprint! In particular, Jan Koum, van Hauser, Dmess0r, David O'Brien, James W. Abendschan, Solar Designer, Chris Wilson, Stuart Stock, Mea Culpa, Lamont Granquist, Dr. Who, Jordan Ritter, Brett Eldridge, and Pluvius sent in tons of IP addresses of wacky boxes and/or fingerprints of machines not reachable through the Internet. Thanks to Richard Stallman for writing GNU Emacs. This article would not be so well word-wrapped if I was using vi or cat and ^D. Questions and comments can be sent to fyodor@DHP.com (if that doesn't work for some reason, use fyodor@insecure.org). Nmap can be obtained from http://www.insecure.org/nmap . nmap-2.08/COPYING100644 764 764 44065 6570026641 12547 0ustar fyodorfyodorGNU General Public License ---------------------------------------------------------------------------- Table of Contents * GNU GENERAL PUBLIC LICENSE o Preamble o TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION o How to Apply These Terms to Your New Programs ---------------------------------------------------------------------------- GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: * a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. * b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. * c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: * a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, * b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, * c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. one line to give the program's name and an idea of what it does. Copyright (C) 19yy name of author This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) 19yy name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. signature of Ty Coon, 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. nmap-2.08/CHANGELOG100600 764 764 6147 6657702233 12701 0ustar fyodorfyodor# Nmap Changelog *** Version 2.07 Changes *** -- Fixed a lockup on Solaris (and perhaps other proprietary UNIX systems) caused by a lack of /dev/random & /dev/urandom and a rand() that only returns values up to 65535. Users of Free operating systems like Linux, FreeBSD, or OpenBSD probably shouldn't bother upgrading. ***Version 2.06 Changes*** -- Fixed compile problems on machines which lack snprintf() (found by Ken Williams ) -- Added the squid proxy to nmap-services (suggested by Holger Heimann) -- Fixed a problem where the new memory allocation system was handing out misaligned pointers. -- Fixed another memory allocation bug which probably doesn't cause any real-life problems. -- Made nmap look in more places for nmap-os-fingerprints ***Version 2.05 Changes*** -- Tons of new fingerprints. The number has grown by more than 25%. In particular, Charles M. Hannum fixed several problems with NetBSD that made it easy to fingerprint and he sent me a huge new batch of fingerprints for various NetBSD releases down to 1.2. Other people sent NetBSD fingerprints down to 1.0. I finally got some early Linux fingerprints in (down to 1.09). -- Nmap now comes with its own nmap-services which I created by merging the /etc/services from a bunch of OS' and then adding Netbus, Back Orifice, etc. -- Random number generation now takes advantage of the /dev/urandom or /dev/random that most free operating systems offer. -- Increased the maximum number of OS guesses nmap will make, told nmap never to give you two matches where the OS names are byte-to-byte equivalent. Fixed nmap to differentiate between "no OS matches found" and "too many OS matches to list". -- Fixed an information leak in the packet TTL values (found by HD Moore ) -- Fixed the problem noted by Savva Uspensky about offsets used for various operating systems' PPP/SLIP headers. Due to lack of responses regarding other operating systems, I have made assumptions about what works for BSDI, NetBSD, and SOLARIS. If this version no longer works on your modem, please let me know (and tell me whether you are using SLIP/PPP and what OS you are running). -- Machine parseable logs are now more machine parseable (I now use a tab to seperate test result fields rather than the more ambiguous spaces. This may break a few things which rely on the old format. Sorry. They should be easy to fix. -- Added my nmap-fingerprintinting-article.txt to the distribution in the docs directory. -- Added a CHANGELOG file to the distribution. -- Fixed problem where nmap -sS would not correctly scan localhost (due to the kernel rerouting the traffic through localhost). Nmap should now detect and work around this behavior. -- Applied patch sent to my by Bill Fenner which fixes various SunOS compatibility problems. -- Changed the makefile 'all' target to use install-sh rather than mkdir -p (doesn't work on some systems) -- Documentation updated and clarified slightly. nmap-2.08/libpcap-possiblymodified/ 40755 764 764 0 6662341762 16351 5ustar fyodorfyodornmap-2.08/libpcap-possiblymodified/CHANGES100644 764 764 21327 6611214616 17455 0ustar fyodorfyodor@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/CHANGES,v 1.1 1998/10/15 04:39:57 fyodor Exp $ (LBL) v0.4 Sat Jul 25 12:40:09 PDT 1998 - Fix endian problem with DLT_NULL devices. From FreeBSD via Bill Fenner (fenner@parc.xerox.com) - Fix alignment problem with FDDI under DLPI. This was causing core dumps under Solaris. - Added configure options to disable flex and bison. Resulted from a bug report by barnett@grymoire.crd.ge.com (Bruce Barnett). Also added options to disable gcc and to force a particular packet capture type. - Added support for Fore ATM interfaces (qaa and fa) under IRIX. Thanks to John Hawkinson (jhawk@mit.edu) - Change Linux PPP and SLIP to use DLT_RAW since the kernel does not supply any "link layer" data. - Change Linux to use SIOCGIFHWADDR ioctl to determine link layer type. Thanks to Thomas Sailer (sailer@ife.ee.ethz.ch) - Change IRIX PPP to use DLT_RAW since the kernel does not supply any "link layer" data. - Modified to support the new BSD/OS 2.1 PPP and SLIP link layer header formats. - Added some new SGI snoop interface types. Thanks to Steve Alexander (sca@refugee.engr.sgi.com) - Fixes for HP-UX 10.20 (which is similar to HP-UX 9). Thanks to Richard Allen (ra@hp.is) and Steinar Haug (sthaug@nethelp.no) - Fddi supports broadcast as reported by Jeff Macdonald (jeff@iacnet.com). Also correct ieee802 and arcnet. - Determine Linux pcap buffer size at run time or else it might not be big enough for some interface types (e.g. FDDI). Thanks to Jes Sorensen (Jes.Sorensen@cern.ch) - Fix some linux alignment problems. - Document promisc argument to pcap_open_live(). Reported by Ian Marsh (ianm@sics.se) - Support Metricom radio packets under Linux. Thanks to Kevin Lai (laik@gunpowder.stanford.edu) - Bind to interface name under Linux to avoid packets from multiple interfaces on multi-homed hosts. Thanks to Kevin Lai (laik@gunpowder.stanford.edu) - Change L_SET to SEEK_SET for HP-UX. Thanks to Roland Roberts (rroberts@muller.com) - Fixed an uninitialized memory reference found by Kent Vander Velden (graphix@iastate.edu) - Fixed lex pattern for IDs to allow leading digits. As reported by Theo de Raadt (deraadt@cvs.openbsd.org) - Fixed Linux include file problems when using GNU libc. - Ifdef ARPHRD_FDDI since not all versions of the Linux kernel have it. Reported reported by Eric Jacksch (jacksch@tenebris.ca) - Fixed bug in pcap_dispatch() that kept it from returning on packet timeouts. - Changed ISLOOPBACK() macro when IFF_LOOPBACK isn't available to check for "lo" followed by an eos or digit (newer versions of Linux apparently call the loopback "lo" instead of "lo0"). - Fixed Linux networking include files to use ints instead of longs to avoid problems with 64 bit longs on the alpha. Thanks to Cristian Gafton (gafton@redhat.com) v0.3 Sat Nov 30 20:56:27 PST 1996 - Added Linux support. - Fixed savefile bugs. - Solaris x86 fix from Tim Rylance (t.rylance@elsevier.nl) - Add support for bpf kernel port filters. - Remove duplicate atalk protocol table entry. Thanks to Christian Hopps (chopps@water.emich.edu) - Fixed pcap_lookupdev() to ignore nonexistent devices. This was reported to happen under BSD/OS by David Vincenzetti (vince@cryptonet.it) - Avoid solaris compiler warnings. Thanks to Bruce Barnett (barnett@grymoire.crd.ge.com) v0.2.1 Sun Jul 14 03:02:26 PDT 1996 - Fixes for HP-UX 10. Thanks in part to to Thomas Wolfram (wolf@prz.tu-berlin.de) and Rick Jones (raj@hpisrdq.cup.hp.com) - Added support for SINIX. Thanks to Andrej Borsenkow (borsenkow.msk@sni.de) - Fixes for AIX (although this system is not yet supported). Thanks to John Hawkinson (jhawk@mit.edu) - Use autoconf's idea of the top level directory in install targets. Thanks to John Hawkinson. - Add missing autoconf packet capture result message. Thanks to Bill Fenner (fenner@parc.xerox.com) - Fixed padding problems in the pf module. - Fixed some more alignment problems on the alpha. - Added explicit netmask support. Thanks to Steve Nuchia (steve@research.oknet.com) - Fixed to handle raw ip addresses such as 0.0.0.1 without "left justifing" - Add "sca" keyword (for DEC cluster services) as suggested by Terry Kennedy (terry@spcvxa.spc.edu) - Add "atalk" keyword as suggested by John Hawkinson. - Add "igrp" keyword. - Fixed HID definition in grammar.y to be a string, not a value. - Use $CC when checking gcc version. Thanks to Carl Lindberg (carl_lindberg@blacksmith.com) - Removed obsolete reference to pcap_immediate() from the man page. Michael Stolarchuk (mts@terminator.rs.itd.umich.edu) - DLT_NULL has a 4 byte family header. Thanks to Jeffrey Honig (jch@bsdi.com) v0.2 Sun Jun 23 02:28:42 PDT 1996 - Add support for HP-UX. Resulted from code contributed by Tom Murray (tmurray@hpindck.cup.hp.com) and Philippe-Andri Prindeville (philipp@res.enst.fr) - Update INSTALL with a reminder to install include files. Thanks to Mark Andrews (mandrews@aw.sgi.com) - Fix bpf compiler alignment bug on the alpha. - Use autoconf to detect architectures that can't handle misaligned accesses. - Added loopback support for snoop. Resulted from report Steve Alexander (sca@engr.sgi.com) v0.1 Fri Apr 28 18:11:03 PDT 1995 - Fixed compiler and optimizer bugs. The BPF filter engine uses unsigned comparison operators, while the code generator and optimizer assumed signed semantics in several places. Thanks to Charlie Slater (cslater@imatek.com) for pointing this out. - Removed FDDI ifdef's, they aren't really needed. Resulted from report by Gary Veum (veum@boa.gsfc.nasa.gov). - Add pcap-null.c which allows offline use of libpcap on systems that don't support live package capture. This feature resulting from a request from Jan van Oorschot (j.p.m.voorschot@et.tudelft.nl). - Make bpf_compile() reentrant. Fix thanks to Pascal Hennequin (Pascal.Hennequin@hugo.int-evry.fr). - Port to GNU autoconf. - Fix pcap-dlpi.c to work with isdn. Resulted from report by Flemming Johansen (fsj@csd.cri.dk). - Handle multi-digit interface unit numbers (aka ppa's) under dlpi. Resulted from report by Daniel Ehrlich (ehrlich@cse.psu.edu). - Fix pcap-dlpi.c to work in non-promiscuous mode. Resulted from report by Jeff Murphy (jcmurphy@acsu.buffalo.edu). - Add support for "long jumps". Thanks to Jeffrey Mogul (mogul@pa.dec.com). - Fix minor problems when compiling with BDEBUG as noticed by Scott Bertilson (scott@unet.umn.edu). - Declare sys_errlist "const char *const" to avoid problems under FreeBSD. Resulted from report by jher@eden.com. v0.0.6 Fri Apr 28 04:07:13 PDT 1995 - Add missing variable declaration missing from 0.0.6 v0.0.5 Fri Apr 28 00:22:21 PDT 1995 - Workaround for problems when pcap_read() returns 0 due to the timeout expiring. v0.0.4 Thu Apr 20 20:41:48 PDT 1995 - Change configuration to not use gcc v2 flags with gcc v1. - Fixed a bug in pcap_next(); if pcap_dispatch() returns 0, pcap_next() should also return 0. Thanks to Richard Stevens (rstevens@noao.edu). - Fixed configure to test for snoop before dlpi to avoid problems under IRIX 5. Thanks to J. Eric Townsend (jet@abulafia.genmagic.com). - Hack around deficiency in Ultrix's make. - Fix two bugs related to the Solaris pre-5.3.2 bufmod bug; handle savefiles that have more than snapshot bytes of data in them (so we can read old savefiles) and avoid writing such files. - Added checkioctl which is used with gcc to check that the "fixincludes" script has been run. v0.0.3 Tue Oct 18 18:13:46 PDT 1994 - Fixed configure to test for snoop before dlpi to avoid problems under IRIX 5. Thanks to J. Eric Townsend (jet@abulafia.genmagic.com). v0.0.2 Wed Oct 12 20:56:37 PDT 1994 - Implement timeout in the dlpi pcap_open_live(). Thanks to Richard Stevens. - Determine pcap link type from dlpi media type. Resulted from report by Mahesh Jethanandani (mahesh@npix.com). v0.0.1 Fri Jun 24 14:50:57 PDT 1994 - Fixed bug in nit_setflags() in pcap-snit.c. The streams ioctl timeout wasn't being initialized sometimes resulting in an "NIOCSFLAGS: Invalid argument" error under OSF/1. Reported by Matt Day (mday@artisoft.com) and Danny Mitzel (dmitzel@whitney.hitc.com). - Turn on FDDI support by default. v0.0 Mon Jun 20 19:20:16 PDT 1994 - Initial release. - Fixed bug with greater/less keywords, reported by Mark Andrews (mandrews@alias.com). - Fix bug where '|' was defined as BPF_AND instead of BPF_OR, reported by Elan Amir (elan@leeb.cs.berkeley.edu). - Machines with little-endian byte ordering are supported thanks to Jeff Mogul. - Add hack for version 2.3 savefiles which don't have caplen and len swapped thanks to Vern Paxson. - Added "&&" and "||" aliases for "and" and "or" thanks to Vern Paxson. - Added length, inbound and outbound keywords. nmap-2.08/libpcap-possiblymodified/FILES100444 764 764 1114 6342423025 17212 0ustar fyodorfyodorCHANGES FILES INSTALL Makefile.in README SUNOS4 VERSION aclocal.m4 bpf/net/bpf.h bpf/net/bpf_filter.c bpf_image.c config.guess config.sub configure configure.in etherent.c ethertype.h gencode.c gencode.h grammar.y inet.c install-sh lbl/gnuc.h lbl/os-solaris2.h lbl/os-sunos4.h lbl/os-ultrix4.h linux-include/netinet/if_ether.h linux-include/netinet/ip_var.h mkdep nametoaddr.c optimize.c pcap-bpf.c pcap-dlpi.c pcap-enet.c pcap-int.h pcap-linux.c pcap-namedb.h pcap-nit.c pcap-nit.h pcap-null.c pcap-pf.c pcap-pf.h pcap-snit.c pcap-snoop.c pcap.3 pcap.c pcap.h ppp.h savefile.c scanner.l nmap-2.08/libpcap-possiblymodified/INSTALL100644 764 764 32647 6611214621 17516 0ustar fyodorfyodor@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/INSTALL,v 1.1 1998/10/15 04:39:57 fyodor Exp $ (LBL) To build libpcap, first customize any paths in Makefile.in, then run "./configure" (a shell script). The configure script will determine your system attributes and generate an appropriate Makefile from Makefile.in. Next run "make". If everything goes well you can su to root and run "make install", "make install-incl" and "make install-man". However, you need not install libpcap if you just want to build tcpdump; just make sure the tcpdump and libpcap directory trees have the same parent directory. If configure says: configure: warning: cannot determine packet capture interface configure: warning: (see INSTALL for more info) then your system either does not support packet capture or your system does support packet capture but libpcap does not support that particular type. (If you have HP-UX, see below.) If your system uses a packet capture not supported by libpcap, please send us patches; don't forget to include an autoconf fragment suitable for use in configure.in. It is possible to override the default packet capture type, although the circumstance where this works are limited. For example if you have installed bpf under SunOS 4 and wish to build a snit libpcap: ./configure --with-pcap=snit Another example is to force a supported packet capture type in the case where the configure scripts fails to detect it. You will need an ANSI C compiler to build libpcap. The configure script will abort if your compiler is not ANSI compliant. If this happens, use the GNU C compiler, available via anonymous ftp: ftp://prep.ai.mit.edu/pub/gnu/gcc-*.tar.gz Note well: If you use gcc, you may need to run its "fixincludes" script. Running fixincludes is not required with later versions of gcc and in some cases (e.g. Solaris 2.5) causes problems when run. The configure script will abort with: checking for ANSI ioctl definitions... yes configure: error: see the INSTALL for more info if it detects if the fixincludes needs to be run. If the fixincludes test in configure passes, you're probably ok. If you use flex, you must use version 2.4.6 or higher. The configure script automatically detects the version of flex and will not use it unless it is new enough. You can use "flex -V" to see what version you have (unless it's really old). The current version of flex is available via anonymous ftp: ftp://ftp.ee.lbl.gov/flex-*.tar.Z As of this writing, the current version is 2.5.4. If you use bison, you must use flex (and visa versa). The configure script automatically falls back to lex and yacc if both flex and bison are not found. Sometimes the stock C compiler does not interact well with flex and bison. The list of problems includes undefined references for alloca. You can get around this by installing gcc or manually disabling flex and bison with: ./configure --without-flex --without-bison If your system only has AT&T lex, this is okay unless your libpcap program uses other lex/yacc generated code. (Although it's possible to map the yy* identifiers with a script, we use flex and bison so we don't feel this is necessary.) Some systems support the Berkeley Packet Filter natively; for example out of the box OSF and BSD/OS have bpf. If your system does not support bpf, you will need to pick up: ftp://ftp.ee.lbl.gov/bpf-*.tar.Z Note well: you MUST have kernel source for your operating system in order to install bpf. An exception is SunOS 4; the bpf distribution includes replacement kernel objects for some of the standard SunOS 4 network device drivers. See the bpf INSTALL document for more information. If you use Solaris, there is a bug with bufmod(7) that is fixed in Solaris 2.3.2 (aka SunOS 5.3.2). Setting a snapshot length with the broken bufmod(7) results in data be truncated from the FRONT of the packet instead of the end. The work around is to not set a snapshot length but this results in performance problems since the entire packet is copied to user space. If you must run an older version of Solaris, there is a patch available from Sun; ask for bugid 1149065. After installing the patch, use "setenv BUFMOD_FIXED" to enable use of bufmod(7). However, we recommend you run a more current release of Solaris. If you use the SPARCompiler, you must be careful to not use the /usr/ucb/cc interface. If you do, you will get bogus warnings and perhaps errors. Either make sure your path has /opt/SUNWspro/bin before /usr/ucb or else: setenv CC /opt/SUNWspro/bin/cc before running configure. (You might have to do a "make distclean" if you already ran configure once). Also note that "make depend" won't work; while all of the known universe uses -M, the SPARCompiler uses -xM to generate makefile dependencies. If you are trying to do packet capture with a FORE ATM card, you may or may not be able to. They usually only release their driver in object code so unless their driver supports packet capture, there's not much libpcap can do. If you get an error like: tcpdump: recv_ack: bind error 0x??? when using DLPI, look for the DL_ERROR_ACK error return values, usually in /usr/include/sys/dlpi.h, and find the corresponding value. Under OSF, packet capture must be enabled before it can be used. For instructions on how to enable packet filter support, see: ftp://ftp.digital.com/pub/Digital/dec-faq/Digital-UNIX Once you enable packet filter support, your OSF system will support bpf natively. Under Ultrix, packet capture must be enabled before it can be used. For instructions on how to enable packet filter support, see: ftp://ftp.digital.com/pub/Digital/dec-faq/ultrix If you use HP-UX, you must have at least version 9 and either the version of cc that supports ANSI C (cc -Aa) or else use the GNU C compiler. You must also buy the optional streams package. If you don't have: /usr/include/sys/dlpi.h /usr/include/sys/dlpi_ext.h then you don't have the streams package. In addition, we believe you need to install the "9.X LAN and DLPI drivers cumulative" patch (PHNE_6855) to make the version 9 DLPI work with libpcap. It's been reported that the DLPI streams package is standard starting with HP-UX 10. The HP implementation of DLPI is a little bit eccentric. Unlike Solaris, you must attach /dev/dlpi instead of the specific /dev/* network pseudo device entry in order to capture packets. The ppa is based on the ifnet "index" number. Under HP-UX 9, it is necessary to read /dev/kmem and the kernel symbol file (/hp-ux). Under HP-UX 10, dlpi can provide information for determining the ppa. It does not seem to be possible to trace the loopback interface. Unlike other DLPI implementations, PHYS implies MULTI and SAP and you get an error if you try to enable more than one promiscous more than one promiscuous mode at a time. Finally, testing shows that there can't be more than one simultaneous dlpi user per network interface and you cannot capture outbound packets. If you use Linux, this version of libpcap is known to compile and run under Red Hat 4.0 with the 2.0.25 kernel. It may work with earlier 2.X versions but is guaranteed not to work with 1.X kernels. Running more than one libpcap program at a time can cause problems since promiscuous mode is implemented by twiddlin the interface flags from the libpcap application. Also, packet timestamps aren't very good. This appears to be due to haphazard handling of the timestamp in the kernel. Note well: there is rumoured to be a version of tcpdump floating around called 3.0.3 that includes libpcap and is supposed to support Linux. You should be advised that the Network Research Group at LBNL never generated a release with this version number. We note with interest that a standard cracker trick to get people to install trojans is to distribute bogus packages that have a version number higher than the current release. We also note with annoyance that 90% of the Linux related bug reports we get are due to changes made to unofficial versions of our page. If you are having trouble but aren't using a version that came from ftp.ee.lbl.gov, please try that before submitting a bug report! If you use AIX, you may not be able to build libpcap from this release. Although AIX 4 ships with tcpdump, it is an old version that predates libpcap. We do not have an AIX system in house so it's impossible for us to test AIX patches submitted to us. We are told that you must link against /lib/pse.exp, that you must use AIX cc or a GNU C compiler newer than 2.7.2 and that you may need to run strload before running a libpcap application. Also, it may be necessary to run the configure script as root in order for it to detect that bpf is available. Another workaround is to use: ./configure --with-pcap=bpf If you use NeXTSTEP, you will not be able to build libpcap from this release. We hope to support this operating system in some future release of libpcap. If you use SINIX, you should be able to build libpcap from this release. It is known to compile and run on SINIX-Y/N 5.42 with the C-DS V1.0 or V1.1 compiler. But note that in some releases of SINIX, yacc emits incorrect code; if grammar.y fails to compile, change every occurence of: #ifdef YYDEBUG to: #if YYDEBUG Another workaround is to use flex and bison. If you use SCO, you might have trouble building libpcap from this release. We do not have a machine running SCO and have not had reports of anyone successfully building on it. Since SCO apparently supports dlpi, it's possible the current version works. Meanwhile, sco provides a tcpdump binary as part of their "Network/Security Tools" package: http://www.sco.com/technology/internet/goodies/#SECURITY There is also a README that explains how to enable packet capture. If you use UnixWare, you will not be able to build libpcap from this release. We hope to support this operating system in some future release of libpcap. Meanwhile, there appears to be an UnixWare port of libpcap 0.0 (and tcpdump 3.0) in: ftp://ftp1.freebird.org/pub/mirror/freebird/internet/systools/ UnixWare appears to use a hacked version of DLPI. If linking tcpdump fails with "Undefined: _alloca" when using bison on a Sun4, your version of bison is broken. In any case version 1.16 or higher is recommended (1.14 is known to cause problems 1.16 is known to work). Either pick up a current version from: ftp://prep.ai.mit.edu/pub/gnu/bison.tar.gz or hack around it by inserting the lines: #ifdef __GNUC__ #define alloca __builtin_alloca #else #ifdef sparc #include #else char *alloca (); #endif #endif right after the (100 line!) GNU license comment in bison.simple, remove grammar.[co] and fire up make again. If you use SunOS 4, your kernel must support streams NIT. If you run a libpcap program and it dies with: /dev/nit: No such device You must add streams NIT support to your kernel configuration, run config and boot the new kernel. If you are running a version of SunOS earlier than 4.1, you will need to replace the Sun supplied /sys/sun{3,4,4c}/OBJ/nit_if.o with the appropriate version from this distribution's SUNOS4 subdirectory and build a new kernel: nit_if.o.sun3-sunos4 (any flavor of sun3) nit_if.o.sun4c-sunos4.0.3c (SS1, SS1+, IPC, SLC, etc.) nit_if.o.sun4-sunos4 (Sun4's not covered by nit_if.o.sun4c-sunos4.0.3c) These nit replacements fix a bug that makes nit essentially unusable in pre-SunOS 4.1. In addition, our sun4c-sunos4.0.3c nit gives you timestamps to the resolution of the SS-1 clock (1 us) rather than the lousy 20ms timestamps Sun gives you (tcpdump will print out the full timestamp resolution if it finds it's running on a SS-1). FILES ----- CHANGES - description of differences between releases FILES - list of files exported as part of the distribution INSTALL - this file Makefile.in - compilation rules (input to the configure script) README - description of distribution SUNOS4 - pre-SunOS 4.1 replacement kernel nit modules VERSION - version of this release aclocal.m4 - autoconf macros bpf/net - copies of bpf_filter.c and bpf.h bpf_filter.c - symlink to bpf/net/bpf_filter.c bpf_image.c - bpf disassembly routine config.guess - autoconf support config.sub - autoconf support configure - configure script (run this first) configure.in - configure script source etherent.c - /etc/ethers support routines ethertype.h - ethernet protocol types and names definitions gencode.c - bpf code generation routines gencode.h - bpf code generation definitions grammar.y - filter string grammar inet.c - network routines install-sh - BSD style install script lbl/gnuc.h - gcc macros and defines lbl/os-*.h - os dependent defines and prototypes linux-include/* - network include files missing on Linux mkdep - construct Makefile dependency list nametoaddr.c - hostname to address routines net - symlink to bpf/net optimize.c - bpf optimization routines pcap-bpf.c - BSD Packet Filter support pcap-dlpi.c - Data Link Provider Interface support pcap-enet.c - enet support pcap-int.h - internal libpcap definitions pcap-namedb.h - public libpcap name database definitions pcap-nit.c - Network Interface Tap support pcap-nit.h - Network Interface Tap definitions pcap-null.c - dummy monitor support (allows offline use of libpcap) pcap-pf.c - Packet Filter support pcap-pf.h - Packet Filter definitions pcap-snit.c - Streams based Network Interface Tap support pcap-snoop.c - Snoop network monitoring support pcap.3 - manual entry pcap.c - pcap utility routines pcap.h - public libpcap definitions ppp.h - Point to Point Protocol definitions savefile.c - offline support scanner.l - filter string scanner nmap-2.08/libpcap-possiblymodified/Makefile.in100644 764 764 11406 6611214623 20522 0ustar fyodorfyodor# Copyright (c) 1993, 1994, 1995, 1996 # The Regents of the University of California. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that: (1) source code distributions # retain the above copyright notice and this paragraph in its entirety, (2) # distributions including binary code include the above copyright notice and # this paragraph in its entirety in the documentation or other materials # provided with the distribution, and (3) all advertising materials mentioning # features or use of this software display the following acknowledgement: # ``This product includes software developed by the University of California, # Lawrence Berkeley Laboratory and its contributors.'' Neither the name of # the University nor the names of its contributors may be used to endorse # or promote products derived from this software without specific prior # written permission. # THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED # WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF # MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. # # @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/Makefile.in,v 1.1 1998/10/15 04:39:57 fyodor Exp $ (LBL) # # Various configurable paths (remember to edit Makefile.in, not Makefile) # # Top level hierarchy prefix = @prefix@ exec_prefix = @exec_prefix@ # Pathname of directory to install the include files INCLDEST = @includedir@ # Pathname of directory to install the library LIBDEST = @libdir@ # Pathname of directory to install the man page MANDEST = @mandir@ # VPATH srcdir = @srcdir@ VPATH = @srcdir@ # # You shouldn't need to edit anything below. # CC = @CC@ CCOPT = @V_CCOPT@ INCLS = -I. @V_INCLS@ DEFS = @DEFS@ # Standard CFLAGS CFLAGS = $(CCOPT) $(INCLS) $(DEFS) INSTALL = @INSTALL@ RANLIB = @V_RANLIB@ # # Flex and bison allow you to specify the prefixes of the global symbols # used by the generated parser. This allows programs to use lex/yacc # and link against libpcap. If you don't have flex or bison, get them. # LEX = @V_LEX@ YACC = @V_YACC@ # Explicitly define compilation rule since SunOS 4's make doesn't like gcc. # Also, gcc does not remove the .o before forking 'as', which can be a # problem if you don't own the file but can write to the directory. .c.o: @rm -f $@ $(CC) $(CFLAGS) -c $(srcdir)/$*.c PSRC = pcap-@V_PCAP@.c CSRC = pcap.c inet.c gencode.c optimize.c nametoaddr.c \ etherent.c savefile.c bpf_filter.c bpf_image.c GENSRC = scanner.c grammar.c version.c SRC = $(PSRC) $(CSRC) $(GENSRC) # We would like to say "OBJ = $(SRC:.c=.o)" but Ultrix's make cannot # hack the extra indirection OBJ = $(PSRC:.c=.o) $(CSRC:.c=.o) $(GENSRC:.c=.o) HDR = pcap.h pcap-int.h pcap-namedb.h pcap-nit.h pcap-pf.h \ ethertype.h gencode.h gnuc.h GENHDR = \ tokdefs.h TAGHDR = \ bpf/net/bpf.h TAGFILES = \ $(SRC) $(HDR) $(TAGHDR) CLEANFILES = $(OBJ) libpcap.a $(GENSRC) $(GENHDR) lex.yy.c all: libpcap.a libpcap.a: $(OBJ) @rm -f $@ ar rc $@ $(OBJ) $(RANLIB) $@ scanner.c: $(srcdir)/scanner.l @rm -f $@ $(LEX) -t $< > $$$$.$@; mv $$$$.$@ $@ scanner.o: scanner.c tokdefs.h tokdefs.h: grammar.c grammar.c: $(srcdir)/grammar.y @rm -f grammar.c tokdefs.h $(YACC) -d $< mv y.tab.c grammar.c mv y.tab.h tokdefs.h grammar.o: grammar.c @rm -f $@ $(CC) $(CFLAGS) -Dyylval=pcap_lval -c grammar.c version.o: version.c version.c: $(srcdir)/VERSION @rm -f $@ sed -e 's/.*/char pcap_version[] = "&";/' $(srcdir)/VERSION > $@ install: force $(INSTALL) -m 444 -o bin -g bin libpcap.a $(DESTDIR)$(LIBDEST)/libpcap.a $(RANLIB) $(DESTDIR)$(LIBDEST)/libpcap.a install-incl: force $(INSTALL) -m 444 -o bin -g bin $(srcdir)/pcap.h \ $(DESTDIR)$(INCLDEST)/pcap.h $(INSTALL) -m 444 -o bin -g bin $(srcdir)/pcap-namedb.h \ $(DESTDIR)$(INCLDEST)/pcap-namedb.h $(INSTALL) -m 444 -o bin -g bin $(srcdir)/net/bpf.h \ $(DESTDIR)$(INCLDEST)/net/bpf.h install-man: force $(INSTALL) -m 444 -o bin -g bin $(srcdir)/pcap.3 \ $(DESTDIR)$(MANDEST)/man3/pcap.3 clean: rm -f $(CLEANFILES) distclean: rm -f $(CLEANFILES) Makefile config.cache config.log config.status \ gnuc.h os-proto.h bpf_filter.c net tags: $(TAGFILES) ctags -wtd $(TAGFILES) tar: force @cwd=`pwd` ; dir=`basename $$cwd` ; name=libpcap-`cat VERSION` ; \ list="" ; tar="tar chFFf" ; \ for i in `cat FILES` ; do list="$$list $$name/$$i" ; done; \ echo \ "rm -f ../$$name; ln -s $$dir ../$$name" ; \ rm -f ../$$name; ln -s $$dir ../$$name ; \ echo \ "(cd .. ; $$tar - [lots of files]) | compress > /tmp/$$name.tar.Z" ; \ (cd .. ; $$tar - $$list) | compress > /tmp/$$name.tar.Z ; \ echo \ "rm -f ../$$name" ; \ rm -f ../$$name force: /tmp depend: $(GENSRC) force ./mkdep -c $(CC) $(DEFS) $(INCLS) $(SRC) nmap-2.08/libpcap-possiblymodified/README100644 764 764 4263 6611214623 17320 0ustar fyodorfyodor@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/README,v 1.1 1998/10/15 04:39:57 fyodor Exp $ (LBL) LIBPCAP 0.4 Lawrence Berkeley National Laboratory Network Research Group libpcap@ee.lbl.gov ftp://ftp.ee.lbl.gov/libpcap.tar.Z This directory contains source code for libpcap, a system-independent interface for user-level packet capture. libpcap provides a portable framework for low-level network monitoring. Applications include network statistics collection, security monitoring, network debugging, etc. Since almost every system vendor provides a different interface for packet capture, and since we've developed several tools that require this functionality, we've created this system-independent API to ease in porting and to alleviate the need for several system-dependent packet capture modules in each application. Note well: this interface is new and is likely to change. The libpcap interface supports a filtering mechanism based on the architecture in the BSD packet filter. BPF is described in the 1993 Winter Usenix paper ``The BSD Packet Filter: A New Architecture for User-level Packet Capture''. A compressed postscript version is in: ftp://ftp.ee.lbl.gov/papers/bpf-usenix93.ps.Z. Although most packet capture interfaces support in-kernel filtering, libpcap utilizes in-kernel filtering only for the BPF interface. On systems that don't have BPF, all packets are read into user-space and the BPF filters are evaluated in the libpcap library, incurring added overhead (especially, for selective filters). Ideally, libpcap would translate BPF filters into a filter program that is compatible with the underlying kernel subsystem, but this is not yet implemented. BPF is standard in 4.4BSD, BSD/386, NetBSD, and FreeBSD. DEC OSF/1 uses the packetfilter interface but has been extended to accept BPF filters (which libpcap utilizes). Also, you can add BPF filter support to Ultrix using the kernel source and/or object patches available in: ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z. Problems, bugs, questions, desirable enhancements, source code contributions, etc., should be sent to the email address "libpcap@ee.lbl.gov". - Steve McCanne Craig Leres Van Jacobson nmap-2.08/libpcap-possiblymodified/VERSION100444 764 764 4 6556432246 17426 0ustar fyodorfyodor0.4 nmap-2.08/libpcap-possiblymodified/aclocal.m4100644 764 764 45017 6611214627 20326 0ustar fyodorfyodordnl @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/aclocal.m4,v 1.1 1998/10/15 04:39:57 fyodor Exp $ (LBL) dnl dnl Copyright (c) 1995, 1996, 1997, 1998 dnl The Regents of the University of California. All rights reserved. dnl dnl Redistribution and use in source and binary forms, with or without dnl modification, are permitted provided that: (1) source code distributions dnl retain the above copyright notice and this paragraph in its entirety, (2) dnl distributions including binary code include the above copyright notice and dnl this paragraph in its entirety in the documentation or other materials dnl provided with the distribution, and (3) all advertising materials mentioning dnl features or use of this software display the following acknowledgement: dnl ``This product includes software developed by the University of California, dnl Lawrence Berkeley Laboratory and its contributors.'' Neither the name of dnl the University nor the names of its contributors may be used to endorse dnl or promote products derived from this software without specific prior dnl written permission. dnl THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED dnl WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF dnl MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. dnl dnl LBL autoconf macros dnl dnl dnl Determine which compiler we're using (cc or gcc) dnl If using gcc, determine the version number dnl If using cc, require that it support ansi prototypes dnl If using gcc, use -O2 (otherwise use -O) dnl If using cc, explicitly specify /usr/local/include dnl dnl usage: dnl dnl AC_LBL_C_INIT(copt, incls) dnl dnl results: dnl dnl $1 (copt set) dnl $2 (incls set) dnl CC dnl LDFLAGS dnl ac_cv_lbl_gcc_vers dnl LBL_CFLAGS dnl AC_DEFUN(AC_LBL_C_INIT, [AC_PREREQ(2.12) AC_BEFORE([$0], [AC_PROG_CC]) AC_BEFORE([$0], [AC_LBL_FIXINCLUDES]) AC_BEFORE([$0], [AC_LBL_DEVEL]) AC_ARG_WITH(gcc, [ --without-gcc don't use gcc]) $1="-O" $2="" if test "${srcdir}" != "." ; then $2="-I\$\(srcdir\)" fi if test "${CFLAGS+set}" = set; then LBL_CFLAGS="$CFLAGS" fi if test -z "$CC" ; then case "$target_os" in bsdi*) AC_CHECK_PROG(SHLICC2, shlicc2, yes, no) if test $SHLICC2 = yes ; then CC=shlicc2 export CC fi ;; esac fi if test -z "$CC" -a "$with_gcc" = no ; then CC=cc export CC fi AC_PROG_CC if test "$GCC" = yes ; then if test "$SHLICC2" = yes ; then ac_cv_lbl_gcc_vers=2 $1="-O2" else AC_MSG_CHECKING(gcc version) AC_CACHE_VAL(ac_cv_lbl_gcc_vers, ac_cv_lbl_gcc_vers=`$CC -v 2>&1 | \ sed -e '/^gcc version /!d' \ -e 's/^gcc version //' \ -e 's/ .*//' -e 's/^[[[^0-9]]]*//' \ -e 's/\..*//'`) AC_MSG_RESULT($ac_cv_lbl_gcc_vers) if test $ac_cv_lbl_gcc_vers -gt 1 ; then $1="-O2" fi fi else AC_MSG_CHECKING(that $CC handles ansi prototypes) AC_CACHE_VAL(ac_cv_lbl_cc_ansi_prototypes, AC_TRY_COMPILE( [#include ], [int frob(int, char *)], ac_cv_lbl_cc_ansi_prototypes=yes, ac_cv_lbl_cc_ansi_prototypes=no)) AC_MSG_RESULT($ac_cv_lbl_cc_ansi_prototypes) if test $ac_cv_lbl_cc_ansi_prototypes = no ; then case "$target_os" in hpux*) AC_MSG_CHECKING(for HP-UX ansi compiler ($CC -Aa -D_HPUX_SOURCE)) savedcflags="$CFLAGS" CFLAGS="-Aa -D_HPUX_SOURCE $CFLAGS" AC_CACHE_VAL(ac_cv_lbl_cc_hpux_cc_aa, AC_TRY_COMPILE( [#include ], [int frob(int, char *)], ac_cv_lbl_cc_hpux_cc_aa=yes, ac_cv_lbl_cc_hpux_cc_aa=no)) AC_MSG_RESULT($ac_cv_lbl_cc_hpux_cc_aa) if test $ac_cv_lbl_cc_hpux_cc_aa = no ; then AC_MSG_ERROR(see the INSTALL doc for more info) fi CFLAGS="$savedcflags" V_CCOPT="-Aa $V_CCOPT" AC_DEFINE(_HPUX_SOURCE) ;; *) AC_MSG_ERROR(see the INSTALL doc for more info) ;; esac fi $2="$$2 -I/usr/local/include" LDFLAGS="$LDFLAGS -L/usr/local/lib" case "$target_os" in irix*) V_CCOPT="$V_CCOPT -xansi -signed -g3" ;; osf*) V_CCOPT="$V_CCOPT -std1 -g3" ;; ultrix*) AC_MSG_CHECKING(that Ultrix $CC hacks const in prototypes) AC_CACHE_VAL(ac_cv_lbl_cc_const_proto, AC_TRY_COMPILE( [#include ], [struct a { int b; }; void c(const struct a *)], ac_cv_lbl_cc_const_proto=yes, ac_cv_lbl_cc_const_proto=no)) AC_MSG_RESULT($ac_cv_lbl_cc_const_proto) if test $ac_cv_lbl_cc_const_proto = no ; then AC_DEFINE(const,) fi ;; esac fi ]) dnl dnl Use pfopen.c if available and pfopen() not in standard libraries dnl Require libpcap dnl Look for libpcap in .. dnl Use the installed libpcap if there is no local version dnl dnl usage: dnl dnl AC_LBL_LIBPCAP(pcapdep, incls) dnl dnl results: dnl dnl $1 (pcapdep set) dnl $2 (incls appended) dnl LIBS dnl LBL_LIBS dnl AC_DEFUN(AC_LBL_LIBPCAP, [AC_REQUIRE([AC_LBL_LIBRARY_NET]) dnl dnl save a copy before locating libpcap.a dnl LBL_LIBS="$LIBS" pfopen=/usr/examples/packetfilter/pfopen.c if test -f $pfopen ; then AC_CHECK_FUNCS(pfopen) if test $ac_cv_func_pfopen = "no" ; then AC_MSG_RESULT(Using $pfopen) LIBS="$LIBS $pfopen" fi fi AC_MSG_CHECKING(for local pcap library) libpcap=FAIL lastdir=FAIL places=`ls .. | sed -e 's,/$,,' -e 's,^,../,' | \ egrep '/libpcap-[[0-9]]*\.[[0-9]]*(\.[[0-9]]*)?([[ab]][[0-9]]*)?$'` for dir in $places ../libpcap libpcap ; do basedir=`echo $dir | sed -e 's/[[ab]][[0-9]]*$//'` if test $lastdir = $basedir ; then dnl skip alphas when an actual release is present continue; fi lastdir=$dir if test -r $dir/pcap.c ; then libpcap=$dir/libpcap.a d=$dir dnl continue and select the last one that exists fi done if test $libpcap = FAIL ; then AC_MSG_RESULT(not found) AC_CHECK_LIB(pcap, main, libpcap="-lpcap") if test $libpcap = FAIL ; then AC_MSG_ERROR(see the INSTALL doc for more info) fi else $1=$libpcap $2="-I$d $$2" AC_MSG_RESULT($libpcap) fi LIBS="$libpcap $LIBS" case "$target_os" in aix*) pseexe="/lib/pse.exp" AC_MSG_CHECKING(for $pseexe) if test -f $pseexe ; then AC_MSG_RESULT(yes) LIBS="$LIBS -I:$pseexe" fi ;; esac]) dnl dnl Define RETSIGTYPE and RETSIGVAL dnl dnl usage: dnl dnl AC_LBL_TYPE_SIGNAL dnl dnl results: dnl dnl RETSIGTYPE (defined) dnl RETSIGVAL (defined) dnl AC_DEFUN(AC_LBL_TYPE_SIGNAL, [AC_BEFORE([$0], [AC_LBL_LIBPCAP]) AC_TYPE_SIGNAL if test "$ac_cv_type_signal" = void ; then AC_DEFINE(RETSIGVAL,) else AC_DEFINE(RETSIGVAL,(0)) fi case "$target_os" in irix*) AC_DEFINE(_BSD_SIGNALS) ;; *) dnl prefer sigset() to sigaction() AC_CHECK_FUNCS(sigset) if test $ac_cv_func_sigset = no ; then AC_CHECK_FUNCS(sigaction) fi ;; esac]) dnl dnl If using gcc, make sure we have ANSI ioctl definitions dnl dnl usage: dnl dnl AC_LBL_FIXINCLUDES dnl AC_DEFUN(AC_LBL_FIXINCLUDES, [if test "$GCC" = yes ; then AC_MSG_CHECKING(for ANSI ioctl definitions) AC_CACHE_VAL(ac_cv_lbl_gcc_fixincludes, AC_TRY_COMPILE( [/* * This generates a "duplicate case value" when fixincludes * has not be run. */ # include # include # include # ifdef HAVE_SYS_IOCCOM_H # include # endif], [switch (0) { case _IO('A', 1):; case _IO('B', 1):; }], ac_cv_lbl_gcc_fixincludes=yes, ac_cv_lbl_gcc_fixincludes=no)) AC_MSG_RESULT($ac_cv_lbl_gcc_fixincludes) if test $ac_cv_lbl_gcc_fixincludes = no ; then # Don't cache failure unset ac_cv_lbl_gcc_fixincludes AC_MSG_ERROR(see the INSTALL for more info) fi fi]) dnl dnl Check for flex, default to lex dnl Require flex 2.4 or higher dnl Check for bison, default to yacc dnl Default to lex/yacc if both flex and bison are not available dnl Define the yy prefix string if using flex and bison dnl dnl usage: dnl dnl AC_LBL_LEX_AND_YACC(lex, yacc, yyprefix) dnl dnl results: dnl dnl $1 (lex set) dnl $2 (yacc appended) dnl $3 (optional flex and bison -P prefix) dnl AC_DEFUN(AC_LBL_LEX_AND_YACC, [AC_ARG_WITH(flex, [ --without-flex don't use flex]) AC_ARG_WITH(bison, [ --without-bison don't use bison]) if test "$with_flex" = no ; then $1=lex else AC_CHECK_PROGS($1, flex, lex) fi if test "$$1" = flex ; then # The -V flag was added in 2.4 AC_MSG_CHECKING(for flex 2.4 or higher) AC_CACHE_VAL(ac_cv_lbl_flex_v24, if flex -V >/dev/null 2>&1; then ac_cv_lbl_flex_v24=yes else ac_cv_lbl_flex_v24=no fi) AC_MSG_RESULT($ac_cv_lbl_flex_v24) if test $ac_cv_lbl_flex_v24 = no ; then s="2.4 or higher required" AC_MSG_WARN(ignoring obsolete flex executable ($s)) $1=lex fi fi if test "$with_bison" = no ; then $2=yacc else AC_CHECK_PROGS($2, bison, yacc) fi if test "$$2" = bison ; then $2="$$2 -y" fi if test "$$1" != lex -a "$$2" = yacc -o "$$1" = lex -a "$$2" != yacc ; then AC_MSG_WARN(don't have both flex and bison; reverting to lex/yacc) $1=lex $2=yacc fi if test "$$1" = flex -a -n "$3" ; then $1="$$1 -P$3" $2="$$2 -p $3" fi]) dnl dnl Checks to see if union wait is used with WEXITSTATUS() dnl dnl usage: dnl dnl AC_LBL_UNION_WAIT dnl dnl results: dnl dnl DECLWAITSTATUS (defined) dnl AC_DEFUN(AC_LBL_UNION_WAIT, [AC_MSG_CHECKING(if union wait is used) AC_CACHE_VAL(ac_cv_lbl_union_wait, AC_TRY_COMPILE([ # include # include ], [int status; u_int i = WEXITSTATUS(status); u_int j = waitpid(0, &status, 0);], ac_cv_lbl_union_wait=no, ac_cv_lbl_union_wait=yes)) AC_MSG_RESULT($ac_cv_lbl_union_wait) if test $ac_cv_lbl_union_wait = yes ; then AC_DEFINE(DECLWAITSTATUS,union wait) else AC_DEFINE(DECLWAITSTATUS,int) fi]) dnl dnl Checks to see if the sockaddr struct has the 4.4 BSD sa_len member dnl dnl usage: dnl dnl AC_LBL_SOCKADDR_SA_LEN dnl dnl results: dnl dnl HAVE_SOCKADDR_SA_LEN (defined) dnl AC_DEFUN(AC_LBL_SOCKADDR_SA_LEN, [AC_MSG_CHECKING(if sockaddr struct has sa_len member) AC_CACHE_VAL(ac_cv_lbl_sockaddr_has_sa_len, AC_TRY_COMPILE([ # include # include ], [u_int i = sizeof(((struct sockaddr *)0)->sa_len)], ac_cv_lbl_sockaddr_has_sa_len=yes, ac_cv_lbl_sockaddr_has_sa_len=no)) AC_MSG_RESULT($ac_cv_lbl_sockaddr_has_sa_len) if test $ac_cv_lbl_sockaddr_has_sa_len = yes ; then AC_DEFINE(HAVE_SOCKADDR_SA_LEN) fi]) dnl dnl Checks to see if -R is used dnl dnl usage: dnl dnl AC_LBL_HAVE_RUN_PATH dnl dnl results: dnl dnl ac_cv_lbl_have_run_path (yes or no) dnl AC_DEFUN(AC_LBL_HAVE_RUN_PATH, [AC_MSG_CHECKING(for ${CC-cc} -R) AC_CACHE_VAL(ac_cv_lbl_have_run_path, [echo 'main(){}' > conftest.c ${CC-cc} -o conftest conftest.c -R/a1/b2/c3 >conftest.out 2>&1 if test ! -s conftest.out ; then ac_cv_lbl_have_run_path=yes else ac_cv_lbl_have_run_path=no fi rm -f conftest*]) AC_MSG_RESULT($ac_cv_lbl_have_run_path) ]) dnl dnl Due to the stupid way it's implemented, AC_CHECK_TYPE is nearly useless. dnl dnl usage: dnl dnl AC_LBL_CHECK_TYPE dnl dnl results: dnl dnl int32_t (defined) dnl u_int32_t (defined) dnl AC_DEFUN(AC_LBL_CHECK_TYPE, [AC_MSG_CHECKING(for $1 using $CC) AC_CACHE_VAL(ac_cv_lbl_have_$1, AC_TRY_COMPILE([ # include "confdefs.h" # include # if STDC_HEADERS # include # include # endif], [$1 i], ac_cv_lbl_have_$1=yes, ac_cv_lbl_have_$1=no)) AC_MSG_RESULT($ac_cv_lbl_have_$1) if test $ac_cv_lbl_have_$1 = no ; then AC_DEFINE($1, $2) fi]) dnl dnl Checks to see if unaligned memory accesses fail dnl dnl usage: dnl dnl AC_LBL_UNALIGNED_ACCESS dnl dnl results: dnl dnl LBL_ALIGN (DEFINED) dnl AC_DEFUN(AC_LBL_UNALIGNED_ACCESS, [AC_MSG_CHECKING(if unaligned accesses fail) AC_CACHE_VAL(ac_cv_lbl_unaligned_fail, [case "$target_cpu" in alpha|hp*|mips|sparc) ac_cv_lbl_unaligned_fail=yes ;; *) cat >conftest.c < # include # include unsigned char a[[5]] = { 1, 2, 3, 4, 5 }; main() { unsigned int i; pid_t pid; int status; /* avoid "core dumped" message */ pid = fork(); if (pid < 0) exit(2); if (pid > 0) { /* parent */ pid = waitpid(pid, &status, 0); if (pid < 0) exit(3); exit(!WIFEXITED(status)); } /* child */ i = *(unsigned int *)&a[[1]]; printf("%d\n", i); exit(0); } EOF ${CC-cc} -o conftest $CFLAGS $CPPFLAGS $LDFLAGS \ conftest.c $LIBS >/dev/null 2>&1 if test ! -x conftest ; then dnl failed to compile for some reason ac_cv_lbl_unaligned_fail=yes else ./conftest >conftest.out if test ! -s conftest.out ; then ac_cv_lbl_unaligned_fail=yes else ac_cv_lbl_unaligned_fail=no fi fi rm -f conftest* core core.conftest ;; esac]) AC_MSG_RESULT($ac_cv_lbl_unaligned_fail) if test $ac_cv_lbl_unaligned_fail = yes ; then AC_DEFINE(LBL_ALIGN) fi]) dnl dnl If using gcc and the file .devel exists: dnl Compile with -g (if supported) and -Wall dnl If using gcc 2, do extra prototype checking dnl If an os prototype include exists, symlink os-proto.h to it dnl dnl usage: dnl dnl AC_LBL_DEVEL(copt) dnl dnl results: dnl dnl $1 (copt appended) dnl HAVE_OS_PROTO_H (defined) dnl os-proto.h (symlinked) dnl AC_DEFUN(AC_LBL_DEVEL, [rm -f os-proto.h if test "${LBL_CFLAGS+set}" = set; then $1="$$1 ${LBL_CFLAGS}" fi if test -f .devel ; then if test "$GCC" = yes ; then if test "${LBL_CFLAGS+set}" != set; then if test "$ac_cv_prog_cc_g" = yes ; then $1="-g $$1" fi $1="$$1 -Wall" if test $ac_cv_lbl_gcc_vers -gt 1 ; then $1="$$1 -Wmissing-prototypes -Wstrict-prototypes" fi fi else case "$target_os" in irix6*) V_CCOPT="$V_CCOPT -n32" ;; *) ;; esac fi os=`echo $target_os | sed -e 's/\([[0-9]][[0-9]]*\)[[^0-9]].*$/\1/'` name="lbl/os-$os.h" if test -f $name ; then ln -s $name os-proto.h AC_DEFINE(HAVE_OS_PROTO_H) else AC_MSG_WARN(can't find $name) fi fi]) dnl dnl Improved version of AC_CHECK_LIB dnl dnl Thanks to John Hawkinson (jhawk@mit.edu) dnl dnl usage: dnl dnl AC_LBL_CHECK_LIB(LIBRARY, FUNCTION [, ACTION-IF-FOUND [, dnl ACTION-IF-NOT-FOUND [, OTHER-LIBRARIES]]]) dnl dnl results: dnl dnl LIBS dnl define(AC_LBL_CHECK_LIB, [AC_MSG_CHECKING([for $2 in -l$1]) dnl Use a cache variable name containing both the library and function name, dnl because the test really is for library $1 defining function $2, not dnl just for library $1. Separate tests with the same $1 and different $2's dnl may have different results. ac_lib_var=`echo $1['_']$2['_']$5 | sed 'y%./+- %__p__%'` AC_CACHE_VAL(ac_cv_lbl_lib_$ac_lib_var, [ac_save_LIBS="$LIBS" LIBS="-l$1 $5 $LIBS" AC_TRY_LINK(dnl ifelse([$2], [main], , dnl Avoid conflicting decl of main. [/* Override any gcc2 internal prototype to avoid an error. */ ]ifelse(AC_LANG, CPLUSPLUS, [#ifdef __cplusplus extern "C" #endif ])dnl [/* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char $2(); ]), [$2()], eval "ac_cv_lbl_lib_$ac_lib_var=yes", eval "ac_cv_lbl_lib_$ac_lib_var=no") LIBS="$ac_save_LIBS" ])dnl if eval "test \"`echo '$ac_cv_lbl_lib_'$ac_lib_var`\" = yes"; then AC_MSG_RESULT(yes) ifelse([$3], , [changequote(, )dnl ac_tr_lib=HAVE_LIB`echo $1 | sed -e 's/[^a-zA-Z0-9_]/_/g' \ -e 'y/abcdefghijklmnopqrstuvwxyz/ABCDEFGHIJKLMNOPQRSTUVWXYZ/'` changequote([, ])dnl AC_DEFINE_UNQUOTED($ac_tr_lib) LIBS="-l$1 $LIBS" ], [$3]) else AC_MSG_RESULT(no) ifelse([$4], , , [$4 ])dnl fi ]) dnl dnl AC_LBL_LIBRARY_NET dnl dnl This test is for network applications that need socket() and dnl gethostbyname() -ish functions. Under Solaris, those applications dnl need to link with "-lsocket -lnsl". Under IRIX, they need to link dnl with "-lnsl" but should *not* link with "-lsocket" because dnl libsocket.a breaks a number of things (for instance: dnl gethostbyname() under IRIX 5.2, and snoop sockets under most dnl versions of IRIX). dnl dnl Unfortunately, many application developers are not aware of this, dnl and mistakenly write tests that cause -lsocket to be used under dnl IRIX. It is also easy to write tests that cause -lnsl to be used dnl under operating systems where neither are necessary (or useful), dnl such as SunOS 4.1.4, which uses -lnsl for TLI. dnl dnl This test exists so that every application developer does not test dnl this in a different, and subtly broken fashion. dnl It has been argued that this test should be broken up into two dnl seperate tests, one for the resolver libraries, and one for the dnl libraries necessary for using Sockets API. Unfortunately, the two dnl are carefully intertwined and allowing the autoconf user to use dnl them independantly potentially results in unfortunate ordering dnl dependancies -- as such, such component macros would have to dnl carefully use indirection and be aware if the other components were dnl executed. Since other autoconf macros do not go to this trouble, dnl and almost no applications use sockets without the resolver, this dnl complexity has not been implemented. dnl dnl The check for libresolv is in case you are attempting to link dnl statically and happen to have a libresolv.a lying around (and no dnl libnsl.a). dnl AC_DEFUN(AC_LBL_LIBRARY_NET, [ # Most operating systems have gethostbyname() in the default searched # libraries (i.e. libc): AC_CHECK_FUNC(gethostbyname, , # Some OSes (eg. Solaris) place it in libnsl: AC_LBL_CHECK_LIB(nsl, gethostbyname, , # Some strange OSes (SINIX) have it in libsocket: AC_LBL_CHECK_LIB(socket, gethostbyname, , # Unfortunately libsocket sometimes depends on libnsl. # AC_CHECK_LIB's API is essentially broken so the # following ugliness is necessary: AC_LBL_CHECK_LIB(socket, gethostbyname, LIBS="-lsocket -lnsl $LIBS", AC_CHECK_LIB(resolv, gethostbyname), -lnsl)))) AC_CHECK_FUNC(socket, , AC_CHECK_LIB(socket, socket, , AC_LBL_CHECK_LIB(socket, socket, LIBS="-lsocket -lnsl $LIBS", , -lnsl))) # DLPI needs putmsg under HPUX so test for -lstr while we're at it AC_CHECK_LIB(str, putmsg) ]) nmap-2.08/libpcap-possiblymodified/bpf/ 40755 764 764 0 6662341762 17120 5ustar fyodorfyodornmap-2.08/libpcap-possiblymodified/bpf/net/ 40755 764 764 0 6662341762 17706 5ustar fyodorfyodornmap-2.08/libpcap-possiblymodified/bpf/net/bpf.h100644 764 764 20464 6611213464 20740 0ustar fyodorfyodor/*- * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 * The Regents of the University of California. All rights reserved. * * This code is derived from the Stanford/CMU enet packet filter, * (net/enet.c) distributed as part of 4.3BSD, and code contributed * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence * Berkeley Laboratory. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the University of * California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)bpf.h 7.1 (Berkeley) 5/7/91 * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/bpf/net/bpf.h,v 1.1 1998/10/15 04:30:01 fyodor Exp $ (LBL) */ #ifndef BPF_MAJOR_VERSION /* BSD style release date */ #define BPF_RELEASE 199606 typedef int bpf_int32; typedef u_int bpf_u_int32; /* * Alignment macros. BPF_WORDALIGN rounds up to the next * even multiple of BPF_ALIGNMENT. */ #define BPF_ALIGNMENT sizeof(bpf_int32) #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1)) #define BPF_MAXINSNS 512 #define BPF_MAXBUFSIZE 0x8000 #define BPF_MINBUFSIZE 32 /* * Structure for BIOCSETF. */ struct bpf_program { u_int bf_len; struct bpf_insn *bf_insns; }; /* * Struct returned by BIOCGSTATS. */ struct bpf_stat { u_int bs_recv; /* number of packets received */ u_int bs_drop; /* number of packets dropped */ }; /* * Struct return by BIOCVERSION. This represents the version number of * the filter language described by the instruction encodings below. * bpf understands a program iff kernel_major == filter_major && * kernel_minor >= filter_minor, that is, if the value returned by the * running kernel has the same major number and a minor number equal * equal to or less than the filter being downloaded. Otherwise, the * results are undefined, meaning an error may be returned or packets * may be accepted haphazardly. * It has nothing to do with the source code version. */ struct bpf_version { u_short bv_major; u_short bv_minor; }; /* Current version number of filter architecture. */ #define BPF_MAJOR_VERSION 1 #define BPF_MINOR_VERSION 1 /* * BPF ioctls * * The first set is for compatibility with Sun's pcc style * header files. If your using gcc, we assume that you * have run fixincludes so the latter set should work. */ #if (defined(sun) || defined(ibm032)) && !defined(__GNUC__) #define BIOCGBLEN _IOR(B,102, u_int) #define BIOCSBLEN _IOWR(B,102, u_int) #define BIOCSETF _IOW(B,103, struct bpf_program) #define BIOCFLUSH _IO(B,104) #define BIOCPROMISC _IO(B,105) #define BIOCGDLT _IOR(B,106, u_int) #define BIOCGETIF _IOR(B,107, struct ifreq) #define BIOCSETIF _IOW(B,108, struct ifreq) #define BIOCSRTIMEOUT _IOW(B,109, struct timeval) #define BIOCGRTIMEOUT _IOR(B,110, struct timeval) #define BIOCGSTATS _IOR(B,111, struct bpf_stat) #define BIOCIMMEDIATE _IOW(B,112, u_int) #define BIOCVERSION _IOR(B,113, struct bpf_version) #define BIOCSTCPF _IOW(B,114, struct bpf_program) #define BIOCSUDPF _IOW(B,115, struct bpf_program) #else #define BIOCGBLEN _IOR('B',102, u_int) #define BIOCSBLEN _IOWR('B',102, u_int) #define BIOCSETF _IOW('B',103, struct bpf_program) #define BIOCFLUSH _IO('B',104) #define BIOCPROMISC _IO('B',105) #define BIOCGDLT _IOR('B',106, u_int) #define BIOCGETIF _IOR('B',107, struct ifreq) #define BIOCSETIF _IOW('B',108, struct ifreq) #define BIOCSRTIMEOUT _IOW('B',109, struct timeval) #define BIOCGRTIMEOUT _IOR('B',110, struct timeval) #define BIOCGSTATS _IOR('B',111, struct bpf_stat) #define BIOCIMMEDIATE _IOW('B',112, u_int) #define BIOCVERSION _IOR('B',113, struct bpf_version) #define BIOCSTCPF _IOW('B',114, struct bpf_program) #define BIOCSUDPF _IOW('B',115, struct bpf_program) #endif /* * Structure prepended to each packet. */ struct bpf_hdr { struct timeval bh_tstamp; /* time stamp */ bpf_u_int32 bh_caplen; /* length of captured portion */ bpf_u_int32 bh_datalen; /* original length of packet */ u_short bh_hdrlen; /* length of bpf header (this struct plus alignment padding) */ }; /* * Because the structure above is not a multiple of 4 bytes, some compilers * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work. * Only the kernel needs to know about it; applications use bh_hdrlen. */ #ifdef KERNEL #define SIZEOF_BPF_HDR 18 #endif /* * Data-link level type codes. */ #define DLT_NULL 0 /* no link-layer encapsulation */ #define DLT_EN10MB 1 /* Ethernet (10Mb) */ #define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */ #define DLT_AX25 3 /* Amateur Radio AX.25 */ #define DLT_PRONET 4 /* Proteon ProNET Token Ring */ #define DLT_CHAOS 5 /* Chaos */ #define DLT_IEEE802 6 /* IEEE 802 Networks */ #define DLT_ARCNET 7 /* ARCNET */ #define DLT_SLIP 8 /* Serial Line IP */ #define DLT_PPP 9 /* Point-to-point Protocol */ #define DLT_FDDI 10 /* FDDI */ #define DLT_ATM_RFC1483 11 /* LLC/SNAP encapsulated atm */ #define DLT_RAW 12 /* raw IP */ #define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */ #define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */ /* * The instruction encondings. */ /* instruction classes */ #define BPF_CLASS(code) ((code) & 0x07) #define BPF_LD 0x00 #define BPF_LDX 0x01 #define BPF_ST 0x02 #define BPF_STX 0x03 #define BPF_ALU 0x04 #define BPF_JMP 0x05 #define BPF_RET 0x06 #define BPF_MISC 0x07 /* ld/ldx fields */ #define BPF_SIZE(code) ((code) & 0x18) #define BPF_W 0x00 #define BPF_H 0x08 #define BPF_B 0x10 #define BPF_MODE(code) ((code) & 0xe0) #define BPF_IMM 0x00 #define BPF_ABS 0x20 #define BPF_IND 0x40 #define BPF_MEM 0x60 #define BPF_LEN 0x80 #define BPF_MSH 0xa0 /* alu/jmp fields */ #define BPF_OP(code) ((code) & 0xf0) #define BPF_ADD 0x00 #define BPF_SUB 0x10 #define BPF_MUL 0x20 #define BPF_DIV 0x30 #define BPF_OR 0x40 #define BPF_AND 0x50 #define BPF_LSH 0x60 #define BPF_RSH 0x70 #define BPF_NEG 0x80 #define BPF_JA 0x00 #define BPF_JEQ 0x10 #define BPF_JGT 0x20 #define BPF_JGE 0x30 #define BPF_JSET 0x40 #define BPF_SRC(code) ((code) & 0x08) #define BPF_K 0x00 #define BPF_X 0x08 /* ret - BPF_K and BPF_X also apply */ #define BPF_RVAL(code) ((code) & 0x18) #define BPF_A 0x10 /* misc */ #define BPF_MISCOP(code) ((code) & 0xf8) #define BPF_TAX 0x00 #define BPF_TXA 0x80 /* * The instruction data structure. */ struct bpf_insn { u_short code; u_char jt; u_char jf; bpf_int32 k; }; /* * Macros for insn array initializers. */ #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k } #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k } #ifdef KERNEL extern u_int bpf_filter(); extern void bpfattach(); extern void bpf_tap(); extern void bpf_mtap(); #else #if __STDC__ extern u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int); #endif #endif /* * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST). */ #define BPF_MEMWORDS 16 #endif nmap-2.08/libpcap-possiblymodified/bpf/net/bpf_filter.c100644 764 764 25132 6611213466 22277 0ustar fyodorfyodor/*- * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 * The Regents of the University of California. All rights reserved. * * This code is derived from the Stanford/CMU enet packet filter, * (net/enet.c) distributed as part of 4.3BSD, and code contributed * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence * Berkeley Laboratory. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the University of * California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)bpf.c 7.5 (Berkeley) 7/15/91 */ #if !(defined(lint) || defined(KERNEL)) static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/bpf/net/bpf_filter.c,v 1.1 1998/10/15 04:30:01 fyodor Exp $ (LBL)"; #endif #include #include #include #include #ifndef KERNEL #include #endif #define int32 bpf_int32 #define u_int32 bpf_u_int32 #ifndef LBL_ALIGN #if defined(sparc) || defined(mips) || defined(ibm032) || \ defined(__alpha) || defined(__hpux) #define LBL_ALIGN #endif #endif #ifndef LBL_ALIGN #include #define EXTRACT_SHORT(p) ((u_short)ntohs(*(u_short *)p)) #define EXTRACT_LONG(p) (ntohl(*(u_int32 *)p)) #else #define EXTRACT_SHORT(p)\ ((u_short)\ ((u_short)*((u_char *)p+0)<<8|\ (u_short)*((u_char *)p+1)<<0)) #define EXTRACT_LONG(p)\ ((u_int32)*((u_char *)p+0)<<24|\ (u_int32)*((u_char *)p+1)<<16|\ (u_int32)*((u_char *)p+2)<<8|\ (u_int32)*((u_char *)p+3)<<0) #endif #ifdef KERNEL #include #define MINDEX(len, m, k) \ { \ len = m->m_len; \ while (k >= len) { \ k -= len; \ m = m->m_next; \ if (m == 0) \ return 0; \ len = m->m_len; \ } \ } static int m_xword(m, k, err) register struct mbuf *m; register int k, *err; { register int len; register u_char *cp, *np; register struct mbuf *m0; MINDEX(len, m, k); cp = mtod(m, u_char *) + k; if (len - k >= 4) { *err = 0; return EXTRACT_LONG(cp); } m0 = m->m_next; if (m0 == 0 || m0->m_len + len - k < 4) goto bad; *err = 0; np = mtod(m0, u_char *); switch (len - k) { case 1: return (cp[0] << 24) | (np[0] << 16) | (np[1] << 8) | np[2]; case 2: return (cp[0] << 24) | (cp[1] << 16) | (np[0] << 8) | np[1]; default: return (cp[0] << 24) | (cp[1] << 16) | (cp[2] << 8) | np[0]; } bad: *err = 1; return 0; } static int m_xhalf(m, k, err) register struct mbuf *m; register int k, *err; { register int len; register u_char *cp; register struct mbuf *m0; MINDEX(len, m, k); cp = mtod(m, u_char *) + k; if (len - k >= 2) { *err = 0; return EXTRACT_SHORT(cp); } m0 = m->m_next; if (m0 == 0) goto bad; *err = 0; return (cp[0] << 8) | mtod(m0, u_char *)[0]; bad: *err = 1; return 0; } #endif /* * Execute the filter program starting at pc on the packet p * wirelen is the length of the original packet * buflen is the amount of data present */ u_int bpf_filter(pc, p, wirelen, buflen) register struct bpf_insn *pc; register u_char *p; u_int wirelen; register u_int buflen; { register u_int32 A, X; register int k; int32 mem[BPF_MEMWORDS]; if (pc == 0) /* * No filter means accept all. */ return (u_int)-1; A = 0; X = 0; --pc; while (1) { ++pc; switch (pc->code) { default: #ifdef KERNEL return 0; #else abort(); #endif case BPF_RET|BPF_K: return (u_int)pc->k; case BPF_RET|BPF_A: return (u_int)A; case BPF_LD|BPF_W|BPF_ABS: k = pc->k; if (k + sizeof(int32) > buflen) { #ifdef KERNEL int merr; if (buflen != 0) return 0; A = m_xword((struct mbuf *)p, k, &merr); if (merr != 0) return 0; continue; #else return 0; #endif } A = EXTRACT_LONG(&p[k]); continue; case BPF_LD|BPF_H|BPF_ABS: k = pc->k; if (k + sizeof(short) > buflen) { #ifdef KERNEL int merr; if (buflen != 0) return 0; A = m_xhalf((struct mbuf *)p, k, &merr); continue; #else return 0; #endif } A = EXTRACT_SHORT(&p[k]); continue; case BPF_LD|BPF_B|BPF_ABS: k = pc->k; if (k >= buflen) { #ifdef KERNEL register struct mbuf *m; register int len; if (buflen != 0) return 0; m = (struct mbuf *)p; MINDEX(len, m, k); A = mtod(m, u_char *)[k]; continue; #else return 0; #endif } A = p[k]; continue; case BPF_LD|BPF_W|BPF_LEN: A = wirelen; continue; case BPF_LDX|BPF_W|BPF_LEN: X = wirelen; continue; case BPF_LD|BPF_W|BPF_IND: k = X + pc->k; if (k + sizeof(int32) > buflen) { #ifdef KERNEL int merr; if (buflen != 0) return 0; A = m_xword((struct mbuf *)p, k, &merr); if (merr != 0) return 0; continue; #else return 0; #endif } A = EXTRACT_LONG(&p[k]); continue; case BPF_LD|BPF_H|BPF_IND: k = X + pc->k; if (k + sizeof(short) > buflen) { #ifdef KERNEL int merr; if (buflen != 0) return 0; A = m_xhalf((struct mbuf *)p, k, &merr); if (merr != 0) return 0; continue; #else return 0; #endif } A = EXTRACT_SHORT(&p[k]); continue; case BPF_LD|BPF_B|BPF_IND: k = X + pc->k; if (k >= buflen) { #ifdef KERNEL register struct mbuf *m; register int len; if (buflen != 0) return 0; m = (struct mbuf *)p; MINDEX(len, m, k); A = mtod(m, u_char *)[k]; continue; #else return 0; #endif } A = p[k]; continue; case BPF_LDX|BPF_MSH|BPF_B: k = pc->k; if (k >= buflen) { #ifdef KERNEL register struct mbuf *m; register int len; if (buflen != 0) return 0; m = (struct mbuf *)p; MINDEX(len, m, k); X = (mtod(m, char *)[k] & 0xf) << 2; continue; #else return 0; #endif } X = (p[pc->k] & 0xf) << 2; continue; case BPF_LD|BPF_IMM: A = pc->k; continue; case BPF_LDX|BPF_IMM: X = pc->k; continue; case BPF_LD|BPF_MEM: A = mem[pc->k]; continue; case BPF_LDX|BPF_MEM: X = mem[pc->k]; continue; case BPF_ST: mem[pc->k] = A; continue; case BPF_STX: mem[pc->k] = X; continue; case BPF_JMP|BPF_JA: pc += pc->k; continue; case BPF_JMP|BPF_JGT|BPF_K: pc += (A > pc->k) ? pc->jt : pc->jf; continue; case BPF_JMP|BPF_JGE|BPF_K: pc += (A >= pc->k) ? pc->jt : pc->jf; continue; case BPF_JMP|BPF_JEQ|BPF_K: pc += (A == pc->k) ? pc->jt : pc->jf; continue; case BPF_JMP|BPF_JSET|BPF_K: pc += (A & pc->k) ? pc->jt : pc->jf; continue; case BPF_JMP|BPF_JGT|BPF_X: pc += (A > X) ? pc->jt : pc->jf; continue; case BPF_JMP|BPF_JGE|BPF_X: pc += (A >= X) ? pc->jt : pc->jf; continue; case BPF_JMP|BPF_JEQ|BPF_X: pc += (A == X) ? pc->jt : pc->jf; continue; case BPF_JMP|BPF_JSET|BPF_X: pc += (A & X) ? pc->jt : pc->jf; continue; case BPF_ALU|BPF_ADD|BPF_X: A += X; continue; case BPF_ALU|BPF_SUB|BPF_X: A -= X; continue; case BPF_ALU|BPF_MUL|BPF_X: A *= X; continue; case BPF_ALU|BPF_DIV|BPF_X: if (X == 0) return 0; A /= X; continue; case BPF_ALU|BPF_AND|BPF_X: A &= X; continue; case BPF_ALU|BPF_OR|BPF_X: A |= X; continue; case BPF_ALU|BPF_LSH|BPF_X: A <<= X; continue; case BPF_ALU|BPF_RSH|BPF_X: A >>= X; continue; case BPF_ALU|BPF_ADD|BPF_K: A += pc->k; continue; case BPF_ALU|BPF_SUB|BPF_K: A -= pc->k; continue; case BPF_ALU|BPF_MUL|BPF_K: A *= pc->k; continue; case BPF_ALU|BPF_DIV|BPF_K: A /= pc->k; continue; case BPF_ALU|BPF_AND|BPF_K: A &= pc->k; continue; case BPF_ALU|BPF_OR|BPF_K: A |= pc->k; continue; case BPF_ALU|BPF_LSH|BPF_K: A <<= pc->k; continue; case BPF_ALU|BPF_RSH|BPF_K: A >>= pc->k; continue; case BPF_ALU|BPF_NEG: A = -A; continue; case BPF_MISC|BPF_TAX: X = A; continue; case BPF_MISC|BPF_TXA: A = X; continue; } } } #ifdef KERNEL /* * Return true if the 'fcode' is a valid filter program. * The constraints are that each jump be forward and to a valid * code. The code must terminate with either an accept or reject. * 'valid' is an array for use by the routine (it must be at least * 'len' bytes long). * * The kernel needs to be able to verify an application's filter code. * Otherwise, a bogus program could easily crash the system. */ int bpf_validate(f, len) struct bpf_insn *f; int len; { register int i; register struct bpf_insn *p; for (i = 0; i < len; ++i) { /* * Check that that jumps are forward, and within * the code block. */ p = &f[i]; if (BPF_CLASS(p->code) == BPF_JMP) { register int from = i + 1; if (BPF_OP(p->code) == BPF_JA) { if (from + p->k >= (unsigned)len) return 0; } else if (from + p->jt >= len || from + p->jf >= len) return 0; } /* * Check that memory operations use valid addresses. */ if ((BPF_CLASS(p->code) == BPF_ST || (BPF_CLASS(p->code) == BPF_LD && (p->code & 0xe0) == BPF_MEM)) && (p->k >= BPF_MEMWORDS || p->k < 0)) return 0; /* * Check for constant division by 0. */ if (p->code == (BPF_ALU|BPF_DIV|BPF_K) && p->k == 0) return 0; } return BPF_CLASS(f[len - 1].code) == BPF_RET; } #endif nmap-2.08/libpcap-possiblymodified/bpf_image.c100644 764 764 11546 6611214630 20535 0ustar fyodorfyodor/* * Copyright (c) 1990, 1991, 1992, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/bpf_image.c,v 1.1 1998/10/15 04:39:57 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif char * bpf_image(p, n) struct bpf_insn *p; int n; { int v; char *fmt, *op; static char image[256]; char operand[64]; v = p->k; switch (p->code) { default: op = "unimp"; fmt = "0x%x"; v = p->code; break; case BPF_RET|BPF_K: op = "ret"; fmt = "#%d"; break; case BPF_RET|BPF_A: op = "ret"; fmt = ""; break; case BPF_LD|BPF_W|BPF_ABS: op = "ld"; fmt = "[%d]"; break; case BPF_LD|BPF_H|BPF_ABS: op = "ldh"; fmt = "[%d]"; break; case BPF_LD|BPF_B|BPF_ABS: op = "ldb"; fmt = "[%d]"; break; case BPF_LD|BPF_W|BPF_LEN: op = "ld"; fmt = "#pktlen"; break; case BPF_LD|BPF_W|BPF_IND: op = "ld"; fmt = "[x + %d]"; break; case BPF_LD|BPF_H|BPF_IND: op = "ldh"; fmt = "[x + %d]"; break; case BPF_LD|BPF_B|BPF_IND: op = "ldb"; fmt = "[x + %d]"; break; case BPF_LD|BPF_IMM: op = "ld"; fmt = "#0x%x"; break; case BPF_LDX|BPF_IMM: op = "ldx"; fmt = "#0x%x"; break; case BPF_LDX|BPF_MSH|BPF_B: op = "ldxb"; fmt = "4*([%d]&0xf)"; break; case BPF_LD|BPF_MEM: op = "ld"; fmt = "M[%d]"; break; case BPF_LDX|BPF_MEM: op = "ldx"; fmt = "M[%d]"; break; case BPF_ST: op = "st"; fmt = "M[%d]"; break; case BPF_STX: op = "stx"; fmt = "M[%d]"; break; case BPF_JMP|BPF_JA: op = "ja"; fmt = "%d"; v = n + 1 + p->k; break; case BPF_JMP|BPF_JGT|BPF_K: op = "jgt"; fmt = "#0x%x"; break; case BPF_JMP|BPF_JGE|BPF_K: op = "jge"; fmt = "#0x%x"; break; case BPF_JMP|BPF_JEQ|BPF_K: op = "jeq"; fmt = "#0x%x"; break; case BPF_JMP|BPF_JSET|BPF_K: op = "jset"; fmt = "#0x%x"; break; case BPF_JMP|BPF_JGT|BPF_X: op = "jgt"; fmt = "x"; break; case BPF_JMP|BPF_JGE|BPF_X: op = "jge"; fmt = "x"; break; case BPF_JMP|BPF_JEQ|BPF_X: op = "jeq"; fmt = "x"; break; case BPF_JMP|BPF_JSET|BPF_X: op = "jset"; fmt = "x"; break; case BPF_ALU|BPF_ADD|BPF_X: op = "add"; fmt = "x"; break; case BPF_ALU|BPF_SUB|BPF_X: op = "sub"; fmt = "x"; break; case BPF_ALU|BPF_MUL|BPF_X: op = "mul"; fmt = "x"; break; case BPF_ALU|BPF_DIV|BPF_X: op = "div"; fmt = "x"; break; case BPF_ALU|BPF_AND|BPF_X: op = "and"; fmt = "x"; break; case BPF_ALU|BPF_OR|BPF_X: op = "or"; fmt = "x"; break; case BPF_ALU|BPF_LSH|BPF_X: op = "lsh"; fmt = "x"; break; case BPF_ALU|BPF_RSH|BPF_X: op = "rsh"; fmt = "x"; break; case BPF_ALU|BPF_ADD|BPF_K: op = "add"; fmt = "#%d"; break; case BPF_ALU|BPF_SUB|BPF_K: op = "sub"; fmt = "#%d"; break; case BPF_ALU|BPF_MUL|BPF_K: op = "mul"; fmt = "#%d"; break; case BPF_ALU|BPF_DIV|BPF_K: op = "div"; fmt = "#%d"; break; case BPF_ALU|BPF_AND|BPF_K: op = "and"; fmt = "#0x%x"; break; case BPF_ALU|BPF_OR|BPF_K: op = "or"; fmt = "#0x%x"; break; case BPF_ALU|BPF_LSH|BPF_K: op = "lsh"; fmt = "#%d"; break; case BPF_ALU|BPF_RSH|BPF_K: op = "rsh"; fmt = "#%d"; break; case BPF_ALU|BPF_NEG: op = "neg"; fmt = ""; break; case BPF_MISC|BPF_TAX: op = "tax"; fmt = ""; break; case BPF_MISC|BPF_TXA: op = "txa"; fmt = ""; break; } (void)sprintf(operand, fmt, v); (void)sprintf(image, (BPF_CLASS(p->code) == BPF_JMP && BPF_OP(p->code) != BPF_JA) ? "(%03d) %-8s %-16s jt %d\tjf %d" : "(%03d) %-8s %s", n, op, operand, n + 1 + p->jt, n + 1 + p->jf); return image; } nmap-2.08/libpcap-possiblymodified/config.guess100555 764 764 47622 6247662777 21032 0ustar fyodorfyodor#! /bin/sh # Attempt to guess a canonical system name. # Copyright (C) 1992, 93, 94, 95, 1996 Free Software Foundation, Inc. # # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. # # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. # Written by Per Bothner . # The master version of this file is at the FSF in /home/gd/gnu/lib. # # This script attempts to guess a canonical system name similar to # config.sub. If it succeeds, it prints the system name on stdout, and # exits with 0. Otherwise, it exits with 1. # # The plan is that this can be called by configure scripts if you # don't specify an explicit system type (host/target name). # # Only a few systems have been added to this list; please add others # (but try to keep the structure clean). # # This is needed to find uname on a Pyramid OSx when run in the BSD universe. # (ghazi@noc.rutgers.edu 8/24/94.) if (test -f /.attbin/uname) >/dev/null 2>&1 ; then PATH=$PATH:/.attbin ; export PATH fi UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown UNAME_SYSTEM=`(uname -s) 2>/dev/null` || UNAME_SYSTEM=unknown UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown trap 'rm -f dummy.c dummy.o dummy; exit 1' 1 2 15 # Note: order is significant - the case branches are not exclusive. case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in alpha:OSF1:*:*) # A Vn.n version is a released version. # A Tn.n version is a released field test version. # A Xn.n version is an unreleased experimental baselevel. # 1.2 uses "1.2" for uname -r. echo alpha-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[VTX]//'` exit 0 ;; 21064:Windows_NT:50:3) echo alpha-dec-winnt3.5 exit 0 ;; Amiga*:UNIX_System_V:4.0:*) echo m68k-cbm-sysv4 exit 0;; amiga:NetBSD:*:*) echo m68k-cbm-netbsd${UNAME_RELEASE} exit 0 ;; amiga:OpenBSD:*:*) echo m68k-cbm-openbsd${UNAME_RELEASE} exit 0 ;; arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*) echo arm-acorn-riscix${UNAME_RELEASE} exit 0;; Pyramid*:OSx*:*:*|MIS*:OSx*:*:*) # akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE. if test "`(/bin/universe) 2>/dev/null`" = att ; then echo pyramid-pyramid-sysv3 else echo pyramid-pyramid-bsd fi exit 0 ;; NILE:*:*:dcosx) echo pyramid-pyramid-svr4 exit 0 ;; sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*) echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit 0 ;; i86pc:SunOS:5.*:*) echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit 0 ;; sun4*:SunOS:6*:*) # According to config.sub, this is the proper way to canonicalize # SunOS6. Hard to guess exactly what SunOS6 will be like, but # it's likely to be more like Solaris than SunOS4. echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit 0 ;; sun4*:SunOS:*:*) case "`/usr/bin/arch -k`" in Series*|S4*) UNAME_RELEASE=`uname -v` ;; esac # Japanese Language versions have a version number like `4.1.3-JL'. echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'` exit 0 ;; sun3*:SunOS:*:*) echo m68k-sun-sunos${UNAME_RELEASE} exit 0 ;; aushp:SunOS:*:*) echo sparc-auspex-sunos${UNAME_RELEASE} exit 0 ;; atari*:NetBSD:*:*) echo m68k-atari-netbsd${UNAME_RELEASE} exit 0 ;; atari*:OpenBSD:*:*) echo m68k-atari-openbsd${UNAME_RELEASE} exit 0 ;; sun3*:NetBSD:*:*) echo m68k-sun-netbsd${UNAME_RELEASE} exit 0 ;; sun3*:OpenBSD:*:*) echo m68k-sun-openbsd${UNAME_RELEASE} exit 0 ;; mac68k:NetBSD:*:*) echo m68k-apple-netbsd${UNAME_RELEASE} exit 0 ;; mac68k:OpenBSD:*:*) echo m68k-apple-openbsd${UNAME_RELEASE} exit 0 ;; powerpc:machten:*:*) echo powerpc-apple-machten${UNAME_RELEASE} exit 0 ;; RISC*:Mach:*:*) echo mips-dec-mach_bsd4.3 exit 0 ;; RISC*:ULTRIX:*:*) echo mips-dec-ultrix${UNAME_RELEASE} exit 0 ;; VAX*:ULTRIX*:*:*) echo vax-dec-ultrix${UNAME_RELEASE} exit 0 ;; mips:*:*:UMIPS | mips:*:*:RISCos) sed 's/^ //' << EOF >dummy.c int main (argc, argv) int argc; char **argv; { #if defined (host_mips) && defined (MIPSEB) #if defined (SYSTYPE_SYSV) printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_SVR4) printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0); #endif #if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD) printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0); #endif #endif exit (-1); } EOF ${CC-cc} dummy.c -o dummy \ && ./dummy `echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` \ && rm dummy.c dummy && exit 0 rm -f dummy.c dummy echo mips-mips-riscos${UNAME_RELEASE} exit 0 ;; Night_Hawk:Power_UNIX:*:*) echo powerpc-harris-powerunix exit 0 ;; m88k:CX/UX:7*:*) echo m88k-harris-cxux7 exit 0 ;; m88k:*:4*:R4*) echo m88k-motorola-sysv4 exit 0 ;; m88k:*:3*:R3*) echo m88k-motorola-sysv3 exit 0 ;; AViiON:dgux:*:*) # DG/UX returns AViiON for all architectures UNAME_PROCESSOR=`/usr/bin/uname -p` if [ $UNAME_PROCESSOR = mc88100 -o $UNAME_PROCESSOR = mc88110 ] ; then if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx \ -o ${TARGET_BINARY_INTERFACE}x = x ] ; then echo m88k-dg-dgux${UNAME_RELEASE} else echo m88k-dg-dguxbcs${UNAME_RELEASE} fi else echo i586-dg-dgux${UNAME_RELEASE} fi exit 0 ;; M88*:DolphinOS:*:*) # DolphinOS (SVR3) echo m88k-dolphin-sysv3 exit 0 ;; M88*:*:R3*:*) # Delta 88k system running SVR3 echo m88k-motorola-sysv3 exit 0 ;; XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3) echo m88k-tektronix-sysv3 exit 0 ;; Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD) echo m68k-tektronix-bsd exit 0 ;; *:IRIX*:*:*) echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'` exit 0 ;; ????????:AIX?:[12].1:2) # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX. echo romp-ibm-aix # uname -m gives an 8 hex-code CPU id exit 0 ;; # Note that: echo "'`uname -s`'" gives 'AIX ' i?86:AIX:*:*) echo i386-ibm-aix exit 0 ;; *:AIX:2:3) if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then sed 's/^ //' << EOF >dummy.c #include main() { if (!__power_pc()) exit(1); puts("powerpc-ibm-aix3.2.5"); exit(0); } EOF ${CC-cc} dummy.c -o dummy && ./dummy && rm dummy.c dummy && exit 0 rm -f dummy.c dummy echo rs6000-ibm-aix3.2.5 elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then echo rs6000-ibm-aix3.2.4 else echo rs6000-ibm-aix3.2 fi exit 0 ;; *:AIX:*:4) if /usr/sbin/lsattr -EHl proc0 | grep POWER >/dev/null 2>&1; then IBM_ARCH=rs6000 else IBM_ARCH=powerpc fi if [ -x /usr/bin/oslevel ] ; then IBM_REV=`/usr/bin/oslevel` else IBM_REV=4.${UNAME_RELEASE} fi echo ${IBM_ARCH}-ibm-aix${IBM_REV} exit 0 ;; *:AIX:*:*) echo rs6000-ibm-aix exit 0 ;; ibmrt:4.4BSD:*|romp-ibm:BSD:*) echo romp-ibm-bsd4.4 exit 0 ;; ibmrt:*BSD:*|romp-ibm:BSD:*) # covers RT/PC NetBSD and echo romp-ibm-bsd${UNAME_RELEASE} # 4.3 with uname added to exit 0 ;; # report: romp-ibm BSD 4.3 *:BOSX:*:*) echo rs6000-bull-bosx exit 0 ;; DPX/2?00:B.O.S.:*:*) echo m68k-bull-sysv3 exit 0 ;; 9000/[34]??:4.3bsd:1.*:*) echo m68k-hp-bsd exit 0 ;; hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*) echo m68k-hp-bsd4.4 exit 0 ;; 9000/[3478]??:HP-UX:*:*) case "${UNAME_MACHINE}" in 9000/31? ) HP_ARCH=m68000 ;; 9000/[34]?? ) HP_ARCH=m68k ;; 9000/7?? | 9000/8?[1679] ) HP_ARCH=hppa1.1 ;; 9000/8?? ) HP_ARCH=hppa1.0 ;; esac HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'` echo ${HP_ARCH}-hp-hpux${HPUX_REV} exit 0 ;; 3050*:HI-UX:*:*) sed 's/^ //' << EOF >dummy.c #include int main () { long cpu = sysconf (_SC_CPU_VERSION); /* The order matters, because CPU_IS_HP_MC68K erroneously returns true for CPU_PA_RISC1_0. CPU_IS_PA_RISC returns correct results, however. */ if (CPU_IS_PA_RISC (cpu)) { switch (cpu) { case CPU_PA_RISC1_0: puts ("hppa1.0-hitachi-hiuxwe2"); break; case CPU_PA_RISC1_1: puts ("hppa1.1-hitachi-hiuxwe2"); break; case CPU_PA_RISC2_0: puts ("hppa2.0-hitachi-hiuxwe2"); break; default: puts ("hppa-hitachi-hiuxwe2"); break; } } else if (CPU_IS_HP_MC68K (cpu)) puts ("m68k-hitachi-hiuxwe2"); else puts ("unknown-hitachi-hiuxwe2"); exit (0); } EOF ${CC-cc} dummy.c -o dummy && ./dummy && rm dummy.c dummy && exit 0 rm -f dummy.c dummy echo unknown-hitachi-hiuxwe2 exit 0 ;; 9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* ) echo hppa1.1-hp-bsd exit 0 ;; 9000/8??:4.3bsd:*:*) echo hppa1.0-hp-bsd exit 0 ;; hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* ) echo hppa1.1-hp-osf exit 0 ;; hp8??:OSF1:*:*) echo hppa1.0-hp-osf exit 0 ;; i?86:OSF1:*:*) if [ -x /usr/sbin/sysversion ] ; then echo ${UNAME_MACHINE}-unknown-osf1mk else echo ${UNAME_MACHINE}-unknown-osf1 fi exit 0 ;; parisc*:Lites*:*:*) echo hppa1.1-hp-lites exit 0 ;; C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*) echo c1-convex-bsd exit 0 ;; C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*) if getsysinfo -f scalar_acc then echo c32-convex-bsd else echo c2-convex-bsd fi exit 0 ;; C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*) echo c34-convex-bsd exit 0 ;; C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*) echo c38-convex-bsd exit 0 ;; C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*) echo c4-convex-bsd exit 0 ;; CRAY*X-MP:*:*:*) echo xmp-cray-unicos exit 0 ;; CRAY*Y-MP:*:*:*) echo ymp-cray-unicos${UNAME_RELEASE} exit 0 ;; CRAY*[A-Z]90:*:*:*) echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \ | sed -e 's/CRAY.*\([A-Z]90\)/\1/' \ -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ exit 0 ;; CRAY*TS:*:*:*) echo t90-cray-unicos${UNAME_RELEASE} exit 0 ;; CRAY-2:*:*:*) echo cray2-cray-unicos exit 0 ;; F300:UNIX_System_V:*:*) FUJITSU_SYS=`uname -p | tr [A-Z] [a-z] | sed -e 's/\///'` FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'` echo "f300-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}" exit 0 ;; F301:UNIX_System_V:*:*) echo f301-fujitsu-uxpv`echo $UNAME_RELEASE | sed 's/ .*//'` exit 0 ;; hp3[0-9][05]:NetBSD:*:*) echo m68k-hp-netbsd${UNAME_RELEASE} exit 0 ;; hp3[0-9][05]:OpenBSD:*:*) echo m68k-hp-openbsd${UNAME_RELEASE} exit 0 ;; i?86:BSD/386:*:* | *:BSD/OS:*:*) echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE} exit 0 ;; *:FreeBSD:*:*) echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` exit 0 ;; *:NetBSD:*:*) echo ${UNAME_MACHINE}-unknown-netbsd`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'` exit 0 ;; *:OpenBSD:*:*) echo ${UNAME_MACHINE}-unknown-openbsd`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'` exit 0 ;; i*:CYGWIN*:*) echo i386-pc-cygwin32 exit 0 ;; p*:CYGWIN*:*) echo powerpcle-unknown-cygwin32 exit 0 ;; prep*:SunOS:5.*:*) echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'` exit 0 ;; *:GNU:*:*) echo `echo ${UNAME_MACHINE}|sed -e 's,/.*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'` exit 0 ;; *:Linux:*:*) # The BFD linker knows what the default object file format is, so # first see if it will tell us. ld_help_string=`ld --help 2>&1` if echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: elf_i.86"; then echo "${UNAME_MACHINE}-pc-linux-gnu" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: i.86linux"; then echo "${UNAME_MACHINE}-pc-linux-gnuaout" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: i.86coff"; then echo "${UNAME_MACHINE}-pc-linux-gnucoff" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: m68kelf"; then echo "${UNAME_MACHINE}-unknown-linux-gnu" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: m68klinux"; then echo "${UNAME_MACHINE}-unknown-linux-gnuaout" ; exit 0 elif echo "$ld_help_string" | grep >/dev/null 2>&1 "supported emulations: elf32ppc"; then echo "powerpc-unknown-linux-gnu" ; exit 0 elif test "${UNAME_MACHINE}" = "alpha" ; then echo alpha-unknown-linux-gnu ; exit 0 elif test "${UNAME_MACHINE}" = "sparc" ; then echo sparc-unknown-linux-gnu ; exit 0 else # Either a pre-BFD a.out linker (linux-gnuoldld) or one that does not give us # useful --help. Gcc wants to distinguish between linux-gnuoldld and linux-gnuaout. test ! -d /usr/lib/ldscripts/. \ && echo "${UNAME_MACHINE}-pc-linux-gnuoldld" && exit 0 # Determine whether the default compiler is a.out or elf cat >dummy.c </dev/null && ./dummy "${UNAME_MACHINE}" && rm dummy.c dummy && exit 0 rm -f dummy.c dummy fi ;; # ptx 4.0 does uname -s correctly, with DYNIX/ptx in there. earlier versions # are messed up and put the nodename in both sysname and nodename. i?86:DYNIX/ptx:4*:*) echo i386-sequent-sysv4 exit 0 ;; i?86:*:4.*:* | i?86:SYSTEM_V:4.*:*) if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then echo ${UNAME_MACHINE}-univel-sysv${UNAME_RELEASE} else echo ${UNAME_MACHINE}-pc-sysv${UNAME_RELEASE} fi exit 0 ;; i?86:*:3.2:*) if test -f /usr/options/cb.name; then UNAME_REL=`sed -n 's/.*Version //p' /dev/null >/dev/null ; then UNAME_REL=`(/bin/uname -X|egrep Release|sed -e 's/.*= //')` (/bin/uname -X|egrep i80486 >/dev/null) && UNAME_MACHINE=i486 (/bin/uname -X|egrep '^Machine.*Pentium' >/dev/null) \ && UNAME_MACHINE=i586 echo ${UNAME_MACHINE}-pc-sco$UNAME_REL else echo ${UNAME_MACHINE}-pc-sysv32 fi exit 0 ;; Intel:Mach:3*:*) echo i386-pc-mach3 exit 0 ;; paragon:*:*:*) echo i860-intel-osf1 exit 0 ;; i860:*:4.*:*) # i860-SVR4 if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4 else # Add other i860-SVR4 vendors below as they are discovered. echo i860-unknown-sysv${UNAME_RELEASE} # Unknown i860-SVR4 fi exit 0 ;; mini*:CTIX:SYS*5:*) # "miniframe" echo m68010-convergent-sysv exit 0 ;; M68*:*:R3V[567]*:*) test -r /sysV68 && echo 'm68k-motorola-sysv' && exit 0 ;; 3[34]??:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 4850:*:4.0:3.0) OS_REL='' test -r /etc/.relid \ && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid` /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && echo i486-ncr-sysv4.3${OS_REL} && exit 0 /bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \ && echo i586-ncr-sysv4.3${OS_REL} && exit 0 ;; 3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*) /bin/uname -p 2>/dev/null | grep 86 >/dev/null \ && echo i486-ncr-sysv4 && exit 0 ;; m68*:LynxOS:2.*:*) echo m68k-unknown-lynxos${UNAME_RELEASE} exit 0 ;; mc68030:UNIX_System_V:4.*:*) echo m68k-atari-sysv4 exit 0 ;; i?86:LynxOS:2.*:*) echo i386-unknown-lynxos${UNAME_RELEASE} exit 0 ;; TSUNAMI:LynxOS:2.*:*) echo sparc-unknown-lynxos${UNAME_RELEASE} exit 0 ;; rs6000:LynxOS:2.*:* | PowerPC:LynxOS:2.*:*) echo rs6000-unknown-lynxos${UNAME_RELEASE} exit 0 ;; SM[BE]S:UNIX_SV:*:*) echo mips-dde-sysv${UNAME_RELEASE} exit 0 ;; RM*:SINIX-*:*:*) echo mips-sni-sysv4 exit 0 ;; *:SINIX-*:*:*) if uname -p 2>/dev/null >/dev/null ; then UNAME_MACHINE=`(uname -p) 2>/dev/null` echo ${UNAME_MACHINE}-sni-sysv4 else echo ns32k-sni-sysv fi exit 0 ;; *:UNIX_System_V:4*:FTX*) # From Gerald Hewes . # How about differentiating between stratus architectures? -djm echo hppa1.1-stratus-sysv4 exit 0 ;; *:*:*:FTX*) # From seanf@swdc.stratus.com. echo i860-stratus-sysv4 exit 0 ;; mc68*:A/UX:*:*) echo m68k-apple-aux${UNAME_RELEASE} exit 0 ;; R3000:*System_V*:*:* | R4000:UNIX_SYSV:*:*) if [ -d /usr/nec ]; then echo mips-nec-sysv${UNAME_RELEASE} else echo mips-unknown-sysv${UNAME_RELEASE} fi exit 0 ;; PENTIUM:CPunix:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort # says echo i586-unisys-sysv4 exit 0 ;; esac #echo '(No uname command or uname output not recognized.)' 1>&2 #echo "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" 1>&2 cat >dummy.c < # include #endif main () { #if defined (sony) #if defined (MIPSEB) /* BFD wants "bsd" instead of "newsos". Perhaps BFD should be changed, I don't know.... */ printf ("mips-sony-bsd\n"); exit (0); #else #include printf ("m68k-sony-newsos%s\n", #ifdef NEWSOS4 "4" #else "" #endif ); exit (0); #endif #endif #if defined (__arm) && defined (__acorn) && defined (__unix) printf ("arm-acorn-riscix"); exit (0); #endif #if defined (hp300) && !defined (hpux) printf ("m68k-hp-bsd\n"); exit (0); #endif #if defined (NeXT) #if !defined (__ARCHITECTURE__) #define __ARCHITECTURE__ "m68k" #endif int version; version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`; printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version); exit (0); #endif #if defined (MULTIMAX) || defined (n16) #if defined (UMAXV) printf ("ns32k-encore-sysv\n"); exit (0); #else #if defined (CMU) printf ("ns32k-encore-mach\n"); exit (0); #else printf ("ns32k-encore-bsd\n"); exit (0); #endif #endif #endif #if defined (__386BSD__) printf ("i386-pc-bsd\n"); exit (0); #endif #if defined (sequent) #if defined (i386) printf ("i386-sequent-dynix\n"); exit (0); #endif #if defined (ns32000) printf ("ns32k-sequent-dynix\n"); exit (0); #endif #endif #if defined (_SEQUENT_) struct utsname un; uname(&un); if (strncmp(un.version, "V2", 2) == 0) { printf ("i386-sequent-ptx2\n"); exit (0); } if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */ printf ("i386-sequent-ptx1\n"); exit (0); } printf ("i386-sequent-ptx\n"); exit (0); #endif #if defined (vax) #if !defined (ultrix) printf ("vax-dec-bsd\n"); exit (0); #else printf ("vax-dec-ultrix\n"); exit (0); #endif #endif #if defined (alliant) && defined (i860) printf ("i860-alliant-bsd\n"); exit (0); #endif exit (1); } EOF ${CC-cc} dummy.c -o dummy 2>/dev/null && ./dummy && rm dummy.c dummy && exit 0 rm -f dummy.c dummy # Apollos put the system type in the environment. test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit 0; } # Convex versions that predate uname can use getsysinfo(1) if [ -x /usr/convex/getsysinfo ] then case `getsysinfo -f cpu_type` in c1*) echo c1-convex-bsd exit 0 ;; c2*) if getsysinfo -f scalar_acc then echo c32-convex-bsd else echo c2-convex-bsd fi exit 0 ;; c34*) echo c34-convex-bsd exit 0 ;; c38*) echo c38-convex-bsd exit 0 ;; c4*) echo c4-convex-bsd exit 0 ;; esac fi #echo '(Unable to guess system type)' 1>&2 exit 1 nmap-2.08/libpcap-possiblymodified/config.sub100555 764 764 45444 6247663000 20451 0ustar fyodorfyodor#! /bin/sh # Configuration validation subroutine script, version 1.1. # Copyright (C) 1991, 92, 93, 94, 95, 1996 Free Software Foundation, Inc. # This file is (in principle) common to ALL GNU software. # The presence of a machine in this file suggests that SOME GNU software # can handle that machine. It does not imply ALL GNU software can. # # This file is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, # Boston, MA 02111-1307, USA. # As a special exception to the GNU General Public License, if you # distribute this file as part of a program that contains a # configuration script generated by Autoconf, you may include it under # the same distribution terms that you use for the rest of that program. # Configuration subroutine to validate and canonicalize a configuration type. # Supply the specified configuration type as an argument. # If it is invalid, we print an error message on stderr and exit with code 1. # Otherwise, we print the canonical config type on stdout and succeed. # This file is supposed to be the same for all GNU packages # and recognize all the CPU types, system types and aliases # that are meaningful with *any* GNU software. # Each package is responsible for reporting which valid configurations # it does not support. The user should be able to distinguish # a failure to support a valid configuration from a meaningless # configuration. # The goal of this file is to map all the various variations of a given # machine specification into a single specification in the form: # CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM # or in some cases, the newer four-part form: # CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM # It is wrong to echo any other type of specification. if [ x$1 = x ] then echo Configuration name missing. 1>&2 echo "Usage: $0 CPU-MFR-OPSYS" 1>&2 echo "or $0 ALIAS" 1>&2 echo where ALIAS is a recognized configuration type. 1>&2 exit 1 fi # First pass through any local machine types. case $1 in *local*) echo $1 exit 0 ;; *) ;; esac # Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any). # Here we must recognize all the valid KERNEL-OS combinations. maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'` case $maybe_os in linux-gnu*) os=-$maybe_os basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'` ;; *) basic_machine=`echo $1 | sed 's/-[^-]*$//'` if [ $basic_machine != $1 ] then os=`echo $1 | sed 's/.*-/-/'` else os=; fi ;; esac ### Let's recognize common machines as not being operating systems so ### that things like config.sub decstation-3100 work. We also ### recognize some manufacturers as not being operating systems, so we ### can provide default operating systems below. case $os in -sun*os*) # Prevent following clause from handling this invalid input. ;; -dec* | -mips* | -sequent* | -encore* | -pc532* | -sgi* | -sony* | \ -att* | -7300* | -3300* | -delta* | -motorola* | -sun[234]* | \ -unicom* | -ibm* | -next | -hp | -isi* | -apollo | -altos* | \ -convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\ -c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \ -harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \ -apple) os= basic_machine=$1 ;; -hiux*) os=-hiuxwe2 ;; -sco5) os=sco3.2v5 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco4) os=-sco3.2v4 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco3.2.[4-9]*) os=`echo $os | sed -e 's/sco3.2./sco3.2v/'` basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco3.2v[4-9]*) # Don't forget version if it is 3.2v4 or newer. basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -sco*) os=-sco3.2v2 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -isc) os=-isc2.2 basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -clix*) basic_machine=clipper-intergraph ;; -isc*) basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'` ;; -lynx*) os=-lynxos ;; -ptx*) basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'` ;; -windowsnt*) os=`echo $os | sed -e 's/windowsnt/winnt/'` ;; -psos*) os=-psos ;; esac # Decode aliases for certain CPU-COMPANY combinations. case $basic_machine in # Recognize the basic CPU types without company name. # Some are omitted here because they have special meanings below. tahoe | i860 | m68k | m68000 | m88k | ns32k | arm \ | arme[lb] | pyramid \ | tron | a29k | 580 | i960 | h8300 | hppa | hppa1.0 | hppa1.1 \ | alpha | we32k | ns16k | clipper | i370 | sh \ | powerpc | powerpcle | 1750a | dsp16xx | mips64 | mipsel \ | pdp11 | mips64el | mips64orion | mips64orionel \ | sparc | sparclet | sparclite | sparc64) basic_machine=$basic_machine-unknown ;; # We use `pc' rather than `unknown' # because (1) that's what they normally are, and # (2) the word "unknown" tends to confuse beginning users. i[3456]86) basic_machine=$basic_machine-pc ;; # Object if more than one company name word. *-*-*) echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2 exit 1 ;; # Recognize the basic CPU types with company name. vax-* | tahoe-* | i[3456]86-* | i860-* | m68k-* | m68000-* | m88k-* \ | sparc-* | ns32k-* | fx80-* | arm-* | c[123]* \ | mips-* | pyramid-* | tron-* | a29k-* | romp-* | rs6000-* | power-* \ | none-* | 580-* | cray2-* | h8300-* | i960-* | xmp-* | ymp-* \ | hppa-* | hppa1.0-* | hppa1.1-* | alpha-* | we32k-* | cydra-* | ns16k-* \ | pn-* | np1-* | xps100-* | clipper-* | orion-* | sparclite-* \ | pdp11-* | sh-* | powerpc-* | powerpcle-* | sparc64-* | mips64-* | mipsel-* \ | mips64el-* | mips64orion-* | mips64orionel-* | f301-*) ;; # Recognize the various machine names and aliases which stand # for a CPU type and a company and sometimes even an OS. 3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc) basic_machine=m68000-att ;; 3b*) basic_machine=we32k-att ;; alliant | fx80) basic_machine=fx80-alliant ;; altos | altos3068) basic_machine=m68k-altos ;; am29k) basic_machine=a29k-none os=-bsd ;; amdahl) basic_machine=580-amdahl os=-sysv ;; amiga | amiga-*) basic_machine=m68k-cbm ;; amigados) basic_machine=m68k-cbm os=-amigados ;; amigaunix | amix) basic_machine=m68k-cbm os=-sysv4 ;; apollo68) basic_machine=m68k-apollo os=-sysv ;; aux) basic_machine=m68k-apple os=-aux ;; balance) basic_machine=ns32k-sequent os=-dynix ;; convex-c1) basic_machine=c1-convex os=-bsd ;; convex-c2) basic_machine=c2-convex os=-bsd ;; convex-c32) basic_machine=c32-convex os=-bsd ;; convex-c34) basic_machine=c34-convex os=-bsd ;; convex-c38) basic_machine=c38-convex os=-bsd ;; cray | ymp) basic_machine=ymp-cray os=-unicos ;; cray2) basic_machine=cray2-cray os=-unicos ;; [ctj]90-cray) basic_machine=c90-cray os=-unicos ;; crds | unos) basic_machine=m68k-crds ;; da30 | da30-*) basic_machine=m68k-da30 ;; decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn) basic_machine=mips-dec ;; delta | 3300 | motorola-3300 | motorola-delta \ | 3300-motorola | delta-motorola) basic_machine=m68k-motorola ;; delta88) basic_machine=m88k-motorola os=-sysv3 ;; dpx20 | dpx20-*) basic_machine=rs6000-bull os=-bosx ;; dpx2* | dpx2*-bull) basic_machine=m68k-bull os=-sysv3 ;; ebmon29k) basic_machine=a29k-amd os=-ebmon ;; elxsi) basic_machine=elxsi-elxsi os=-bsd ;; encore | umax | mmax) basic_machine=ns32k-encore ;; fx2800) basic_machine=i860-alliant ;; genix) basic_machine=ns32k-ns ;; gmicro) basic_machine=tron-gmicro os=-sysv ;; h3050r* | hiux*) basic_machine=hppa1.1-hitachi os=-hiuxwe2 ;; h8300hms) basic_machine=h8300-hitachi os=-hms ;; harris) basic_machine=m88k-harris os=-sysv3 ;; hp300-*) basic_machine=m68k-hp ;; hp300bsd) basic_machine=m68k-hp os=-bsd ;; hp300hpux) basic_machine=m68k-hp os=-hpux ;; hp9k2[0-9][0-9] | hp9k31[0-9]) basic_machine=m68000-hp ;; hp9k3[2-9][0-9]) basic_machine=m68k-hp ;; hp9k7[0-9][0-9] | hp7[0-9][0-9] | hp9k8[0-9]7 | hp8[0-9]7) basic_machine=hppa1.1-hp ;; hp9k8[0-9][0-9] | hp8[0-9][0-9]) basic_machine=hppa1.0-hp ;; hppa-next) os=-nextstep3 ;; i370-ibm* | ibm*) basic_machine=i370-ibm os=-mvs ;; # I'm not sure what "Sysv32" means. Should this be sysv3.2? i[3456]86v32) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv32 ;; i[3456]86v4*) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv4 ;; i[3456]86v) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-sysv ;; i[3456]86sol2) basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'` os=-solaris2 ;; iris | iris4d) basic_machine=mips-sgi case $os in -irix*) ;; *) os=-irix4 ;; esac ;; isi68 | isi) basic_machine=m68k-isi os=-sysv ;; m88k-omron*) basic_machine=m88k-omron ;; magnum | m3230) basic_machine=mips-mips os=-sysv ;; merlin) basic_machine=ns32k-utek os=-sysv ;; miniframe) basic_machine=m68000-convergent ;; mips3*-*) basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'` ;; mips3*) basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown ;; ncr3000) basic_machine=i486-ncr os=-sysv4 ;; news | news700 | news800 | news900) basic_machine=m68k-sony os=-newsos ;; news1000) basic_machine=m68030-sony os=-newsos ;; news-3600 | risc-news) basic_machine=mips-sony os=-newsos ;; next | m*-next ) basic_machine=m68k-next case $os in -nextstep* ) ;; -ns2*) os=-nextstep2 ;; *) os=-nextstep3 ;; esac ;; nh3000) basic_machine=m68k-harris os=-cxux ;; nh[45]000) basic_machine=m88k-harris os=-cxux ;; nindy960) basic_machine=i960-intel os=-nindy ;; np1) basic_machine=np1-gould ;; pa-hitachi) basic_machine=hppa1.1-hitachi os=-hiuxwe2 ;; paragon) basic_machine=i860-intel os=-osf ;; pbd) basic_machine=sparc-tti ;; pbb) basic_machine=m68k-tti ;; pc532 | pc532-*) basic_machine=ns32k-pc532 ;; pentium | p5) basic_machine=i586-intel ;; pentiumpro | p6) basic_machine=i686-intel ;; pentium-* | p5-*) basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'` ;; pentiumpro-* | p6-*) basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'` ;; k5) # We don't have specific support for AMD's K5 yet, so just call it a Pentium basic_machine=i586-amd ;; nexen) # We don't have specific support for Nexgen yet, so just call it a Pentium basic_machine=i586-nexgen ;; pn) basic_machine=pn-gould ;; power) basic_machine=rs6000-ibm ;; ppc) basic_machine=powerpc-unknown ;; ppc-*) basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ppcle | powerpclittle | ppc-le | powerpc-little) basic_machine=powerpcle-unknown ;; ppcle-* | powerpclittle-*) basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'` ;; ps2) basic_machine=i386-ibm ;; rm[46]00) basic_machine=mips-siemens ;; rtpc | rtpc-*) basic_machine=romp-ibm ;; sequent) basic_machine=i386-sequent ;; sh) basic_machine=sh-hitachi os=-hms ;; sps7) basic_machine=m68k-bull os=-sysv2 ;; spur) basic_machine=spur-unknown ;; sun2) basic_machine=m68000-sun ;; sun2os3) basic_machine=m68000-sun os=-sunos3 ;; sun2os4) basic_machine=m68000-sun os=-sunos4 ;; sun3os3) basic_machine=m68k-sun os=-sunos3 ;; sun3os4) basic_machine=m68k-sun os=-sunos4 ;; sun4os3) basic_machine=sparc-sun os=-sunos3 ;; sun4os4) basic_machine=sparc-sun os=-sunos4 ;; sun4sol2) basic_machine=sparc-sun os=-solaris2 ;; sun3 | sun3-*) basic_machine=m68k-sun ;; sun4) basic_machine=sparc-sun ;; sun386 | sun386i | roadrunner) basic_machine=i386-sun ;; symmetry) basic_machine=i386-sequent os=-dynix ;; tower | tower-32) basic_machine=m68k-ncr ;; udi29k) basic_machine=a29k-amd os=-udi ;; ultra3) basic_machine=a29k-nyu os=-sym1 ;; vaxv) basic_machine=vax-dec os=-sysv ;; vms) basic_machine=vax-dec os=-vms ;; vpp*|vx|vx-*) basic_machine=f301-fujitsu ;; vxworks960) basic_machine=i960-wrs os=-vxworks ;; vxworks68) basic_machine=m68k-wrs os=-vxworks ;; vxworks29k) basic_machine=a29k-wrs os=-vxworks ;; xmp) basic_machine=xmp-cray os=-unicos ;; xps | xps100) basic_machine=xps100-honeywell ;; none) basic_machine=none-none os=-none ;; # Here we handle the default manufacturer of certain CPU types. It is in # some cases the only manufacturer, in others, it is the most popular. mips) basic_machine=mips-mips ;; romp) basic_machine=romp-ibm ;; rs6000) basic_machine=rs6000-ibm ;; vax) basic_machine=vax-dec ;; pdp11) basic_machine=pdp11-dec ;; we32k) basic_machine=we32k-att ;; sparc) basic_machine=sparc-sun ;; cydra) basic_machine=cydra-cydrome ;; orion) basic_machine=orion-highlevel ;; orion105) basic_machine=clipper-highlevel ;; *) echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2 exit 1 ;; esac # Here we canonicalize certain aliases for manufacturers. case $basic_machine in *-digital*) basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'` ;; *-commodore*) basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'` ;; *) ;; esac # Decode manufacturer-specific aliases for certain operating systems. if [ x"$os" != x"" ] then case $os in # First match some system type aliases # that might get confused with valid system types. # -solaris* is a basic system type, with this one exception. -solaris1 | -solaris1.*) os=`echo $os | sed -e 's|solaris1|sunos4|'` ;; -solaris) os=-solaris2 ;; -unixware* | svr4*) os=-sysv4 ;; -gnu/linux*) os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'` ;; # First accept the basic system types. # The portable systems comes first. # Each alternative MUST END IN A *, to match a version number. # -sysv* is not here because it comes later, after sysvr4. -gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \ | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\ | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \ | -amigados* | -msdos* | -newsos* | -unicos* | -aof* | -aos* \ | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \ | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \ | -hiux* | -386bsd* | -netbsd* | -openbsd* | -freebsd* | -riscix* \ | -lynxos* | -bosx* | -nextstep* | -cxux* | -aout* | -elf* \ | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \ | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \ | -cygwin32* | -pe* | -psos* | -moss* | -proelf* | -rtems* \ | -linux-gnu* | -uxpv*) # Remember, each alternative MUST END IN *, to match a version number. ;; -linux*) os=`echo $os | sed -e 's|linux|linux-gnu|'` ;; -sunos5*) os=`echo $os | sed -e 's|sunos5|solaris2|'` ;; -sunos6*) os=`echo $os | sed -e 's|sunos6|solaris3|'` ;; -osfrose*) os=-osfrose ;; -osf*) os=-osf ;; -utek*) os=-bsd ;; -dynix*) os=-bsd ;; -acis*) os=-aos ;; -ctix* | -uts*) os=-sysv ;; -ns2 ) os=-nextstep2 ;; # Preserve the version number of sinix5. -sinix5.*) os=`echo $os | sed -e 's|sinix|sysv|'` ;; -sinix*) os=-sysv4 ;; -triton*) os=-sysv3 ;; -oss*) os=-sysv3 ;; -svr4) os=-sysv4 ;; -svr3) os=-sysv3 ;; -sysvr4) os=-sysv4 ;; # This must come after -sysvr4. -sysv*) ;; -xenix) os=-xenix ;; -none) ;; *) # Get rid of the `-' at the beginning of $os. os=`echo $os | sed 's/[^-]*-//'` echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2 exit 1 ;; esac else # Here we handle the default operating systems that come with various machines. # The value should be what the vendor currently ships out the door with their # machine or put another way, the most popular os provided with the machine. # Note that if you're going to try to match "-MANUFACTURER" here (say, # "-sun"), then you have to tell the case statement up towards the top # that MANUFACTURER isn't an operating system. Otherwise, code above # will signal an error saying that MANUFACTURER isn't an operating # system, and we'll never get to this point. case $basic_machine in *-acorn) os=-riscix1.2 ;; arm*-semi) os=-aout ;; pdp11-*) os=-none ;; *-dec | vax-*) os=-ultrix4.2 ;; m68*-apollo) os=-domain ;; i386-sun) os=-sunos4.0.2 ;; m68000-sun) os=-sunos3 # This also exists in the configure program, but was not the # default. # os=-sunos4 ;; *-tti) # must be before sparc entry or we get the wrong os. os=-sysv3 ;; sparc-* | *-sun) os=-sunos4.1.1 ;; *-ibm) os=-aix ;; *-hp) os=-hpux ;; *-hitachi) os=-hiux ;; i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent) os=-sysv ;; *-cbm) os=-amigados ;; *-dg) os=-dgux ;; *-dolphin) os=-sysv3 ;; m68k-ccur) os=-rtu ;; m88k-omron*) os=-luna ;; *-next ) os=-nextstep ;; *-sequent) os=-ptx ;; *-crds) os=-unos ;; *-ns) os=-genix ;; i370-*) os=-mvs ;; *-next) os=-nextstep3 ;; *-gould) os=-sysv ;; *-highlevel) os=-bsd ;; *-encore) os=-bsd ;; *-sgi) os=-irix ;; *-siemens) os=-sysv4 ;; *-masscomp) os=-rtu ;; f301-fujitsu) os=-uxpv ;; *) os=-none ;; esac fi # Here we handle the case where we know the os, and the CPU type, but not the # manufacturer. We pick the logical manufacturer. vendor=unknown case $basic_machine in *-unknown) case $os in -riscix*) vendor=acorn ;; -sunos*) vendor=sun ;; -aix*) vendor=ibm ;; -hpux*) vendor=hp ;; -hiux*) vendor=hitachi ;; -unos*) vendor=crds ;; -dgux*) vendor=dg ;; -luna*) vendor=omron ;; -genix*) vendor=ns ;; -mvs*) vendor=ibm ;; -ptx*) vendor=sequent ;; -vxsim* | -vxworks*) vendor=wrs ;; -aux*) vendor=apple ;; esac basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"` ;; esac echo $basic_machine$os nmap-2.08/libpcap-possiblymodified/configure100755 764 764 172270 6556432377 20433 0ustar fyodorfyodor#! /bin/sh # Guess values for system-dependent variables and create Makefiles. # Generated automatically using autoconf version 2.12 # Copyright (C) 1992, 93, 94, 95, 96 Free Software Foundation, Inc. # # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. # Defaults: ac_help= ac_default_prefix=/usr/local # Any additions from configure.in: ac_help="$ac_help --without-gcc don't use gcc" ac_help="$ac_help --with-pcap=TYPE use packet capture TYPE" ac_help="$ac_help --without-flex don't use flex" ac_help="$ac_help --without-bison don't use bison" # Initialize some variables set by options. # The variables have the same names as the options, with # dashes changed to underlines. build=NONE cache_file=./config.cache exec_prefix=NONE host=NONE no_create= nonopt=NONE no_recursion= prefix=NONE program_prefix=NONE program_suffix=NONE program_transform_name=s,x,x, silent= site= srcdir= target=NONE verbose= x_includes=NONE x_libraries=NONE bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' datadir='${prefix}/share' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' libdir='${exec_prefix}/lib' includedir='${prefix}/include' oldincludedir='/usr/include' infodir='${prefix}/info' mandir='${prefix}/man' # Initialize some other variables. subdirs= MFLAGS= MAKEFLAGS= # Maximum number of lines to put in a shell here document. ac_max_here_lines=12 ac_prev= for ac_option do # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval "$ac_prev=\$ac_option" ac_prev= continue fi case "$ac_option" in -*=*) ac_optarg=`echo "$ac_option" | sed 's/[-_a-zA-Z0-9]*=//'` ;; *) ac_optarg= ;; esac # Accept the important Cygnus configure options, so we can diagnose typos. case "$ac_option" in -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) bindir="$ac_optarg" ;; -build | --build | --buil | --bui | --bu) ac_prev=build ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) build="$ac_optarg" ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) cache_file="$ac_optarg" ;; -datadir | --datadir | --datadi | --datad | --data | --dat | --da) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=* | --data=* | --dat=* \ | --da=*) datadir="$ac_optarg" ;; -disable-* | --disable-*) ac_feature=`echo $ac_option|sed -e 's/-*disable-//'` # Reject names that are not valid shell variable names. if test -n "`echo $ac_feature| sed 's/[-a-zA-Z0-9_]//g'`"; then { echo "configure: error: $ac_feature: invalid feature name" 1>&2; exit 1; } fi ac_feature=`echo $ac_feature| sed 's/-/_/g'` eval "enable_${ac_feature}=no" ;; -enable-* | --enable-*) ac_feature=`echo $ac_option|sed -e 's/-*enable-//' -e 's/=.*//'` # Reject names that are not valid shell variable names. if test -n "`echo $ac_feature| sed 's/[-_a-zA-Z0-9]//g'`"; then { echo "configure: error: $ac_feature: invalid feature name" 1>&2; exit 1; } fi ac_feature=`echo $ac_feature| sed 's/-/_/g'` case "$ac_option" in *=*) ;; *) ac_optarg=yes ;; esac eval "enable_${ac_feature}='$ac_optarg'" ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ | --exec | --exe | --ex) ac_prev=exec_prefix ;; -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) exec_prefix="$ac_optarg" ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; -help | --help | --hel | --he) # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat << EOF Usage: configure [options] [host] Options: [defaults in brackets after descriptions] Configuration: --cache-file=FILE cache test results in FILE --help print this message --no-create do not create output files --quiet, --silent do not print \`checking...' messages --version print the version of autoconf that created configure Directory and file names: --prefix=PREFIX install architecture-independent files in PREFIX [$ac_default_prefix] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX [same as prefix] --bindir=DIR user executables in DIR [EPREFIX/bin] --sbindir=DIR system admin executables in DIR [EPREFIX/sbin] --libexecdir=DIR program executables in DIR [EPREFIX/libexec] --datadir=DIR read-only architecture-independent data in DIR [PREFIX/share] --sysconfdir=DIR read-only single-machine data in DIR [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data in DIR [PREFIX/com] --localstatedir=DIR modifiable single-machine data in DIR [PREFIX/var] --libdir=DIR object code libraries in DIR [EPREFIX/lib] --includedir=DIR C header files in DIR [PREFIX/include] --oldincludedir=DIR C header files for non-gcc in DIR [/usr/include] --infodir=DIR info documentation in DIR [PREFIX/info] --mandir=DIR man documentation in DIR [PREFIX/man] --srcdir=DIR find the sources in DIR [configure dir or ..] --program-prefix=PREFIX prepend PREFIX to installed program names --program-suffix=SUFFIX append SUFFIX to installed program names --program-transform-name=PROGRAM run sed PROGRAM on installed program names EOF cat << EOF Host type: --build=BUILD configure for building on BUILD [BUILD=HOST] --host=HOST configure for HOST [guessed] --target=TARGET configure for TARGET [TARGET=HOST] Features and packages: --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) --x-includes=DIR X include files are in DIR --x-libraries=DIR X library files are in DIR EOF if test -n "$ac_help"; then echo "--enable and --with options recognized:$ac_help" fi exit 0 ;; -host | --host | --hos | --ho) ac_prev=host ;; -host=* | --host=* | --hos=* | --ho=*) host="$ac_optarg" ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) includedir="$ac_optarg" ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) infodir="$ac_optarg" ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) libdir="$ac_optarg" ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) libexecdir="$ac_optarg" ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst \ | --locals | --local | --loca | --loc | --lo) ac_prev=localstatedir ;; -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* \ | --locals=* | --local=* | --loca=* | --loc=* | --lo=*) localstatedir="$ac_optarg" ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) mandir="$ac_optarg" ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) no_recursion=yes ;; -oldincludedir | --oldincludedir | --oldincludedi | --oldincluded \ | --oldinclude | --oldinclud | --oldinclu | --oldincl | --oldinc \ | --oldin | --oldi | --old | --ol | --o) ac_prev=oldincludedir ;; -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) oldincludedir="$ac_optarg" ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) prefix="$ac_optarg" ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) program_prefix="$ac_optarg" ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) program_suffix="$ac_optarg" ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ | --program-transform-n | --program-transform- \ | --program-transform | --program-transfor \ | --program-transfo | --program-transf \ | --program-trans | --program-tran \ | --progr-tra | --program-tr | --program-t) ac_prev=program_transform_name ;; -program-transform-name=* | --program-transform-name=* \ | --program-transform-nam=* | --program-transform-na=* \ | --program-transform-n=* | --program-transform-=* \ | --program-transform=* | --program-transfor=* \ | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) program_transform_name="$ac_optarg" ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) silent=yes ;; -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) sbindir="$ac_optarg" ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ | --sharedst | --shareds | --shared | --share | --shar \ | --sha | --sh) ac_prev=sharedstatedir ;; -sharedstatedir=* | --sharedstatedir=* | --sharedstatedi=* \ | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) sharedstatedir="$ac_optarg" ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) site="$ac_optarg" ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) srcdir="$ac_optarg" ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) sysconfdir="$ac_optarg" ;; -target | --target | --targe | --targ | --tar | --ta | --t) ac_prev=target ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) target="$ac_optarg" ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; -version | --version | --versio | --versi | --vers) echo "configure generated by autoconf version 2.12" exit 0 ;; -with-* | --with-*) ac_package=`echo $ac_option|sed -e 's/-*with-//' -e 's/=.*//'` # Reject names that are not valid shell variable names. if test -n "`echo $ac_package| sed 's/[-_a-zA-Z0-9]//g'`"; then { echo "configure: error: $ac_package: invalid package name" 1>&2; exit 1; } fi ac_package=`echo $ac_package| sed 's/-/_/g'` case "$ac_option" in *=*) ;; *) ac_optarg=yes ;; esac eval "with_${ac_package}='$ac_optarg'" ;; -without-* | --without-*) ac_package=`echo $ac_option|sed -e 's/-*without-//'` # Reject names that are not valid shell variable names. if test -n "`echo $ac_package| sed 's/[-a-zA-Z0-9_]//g'`"; then { echo "configure: error: $ac_package: invalid package name" 1>&2; exit 1; } fi ac_package=`echo $ac_package| sed 's/-/_/g'` eval "with_${ac_package}=no" ;; --x) # Obsolete; use --with-x. with_x=yes ;; -x-includes | --x-includes | --x-include | --x-includ | --x-inclu \ | --x-incl | --x-inc | --x-in | --x-i) ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) x_includes="$ac_optarg" ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) x_libraries="$ac_optarg" ;; -*) { echo "configure: error: $ac_option: invalid option; use --help to show usage" 1>&2; exit 1; } ;; *) if test -n "`echo $ac_option| sed 's/[-a-z0-9.]//g'`"; then echo "configure: warning: $ac_option: invalid host type" 1>&2 fi if test "x$nonopt" != xNONE; then { echo "configure: error: can only configure for one host and one target at a time" 1>&2; exit 1; } fi nonopt="$ac_option" ;; esac done if test -n "$ac_prev"; then { echo "configure: error: missing argument to --`echo $ac_prev | sed 's/_/-/g'`" 1>&2; exit 1; } fi trap 'rm -fr conftest* confdefs* core core.* *.core $ac_clean_files; exit 1' 1 2 15 # File descriptor usage: # 0 standard input # 1 file creation # 2 errors and warnings # 3 some systems may open it to /dev/tty # 4 used on the Kubota Titan # 6 checking for... messages and results # 5 compiler messages saved in config.log if test "$silent" = yes; then exec 6>/dev/null else exec 6>&1 fi exec 5>./config.log echo "\ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. " 1>&5 # Strip out --no-create and --no-recursion so they do not pile up. # Also quote any args containing shell metacharacters. ac_configure_args= for ac_arg do case "$ac_arg" in -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c) ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) ;; *" "*|*" "*|*[\[\]\~\#\$\^\&\*\(\)\{\}\\\|\;\<\>\?]*) ac_configure_args="$ac_configure_args '$ac_arg'" ;; *) ac_configure_args="$ac_configure_args $ac_arg" ;; esac done # NLS nuisances. # Only set these to C if already set. These must not be set unconditionally # because not all systems understand e.g. LANG=C (notably SCO). # Fixing LC_MESSAGES prevents Solaris sh from translating var values in `set'! # Non-C LC_CTYPE values break the ctype check. if test "${LANG+set}" = set; then LANG=C; export LANG; fi if test "${LC_ALL+set}" = set; then LC_ALL=C; export LC_ALL; fi if test "${LC_MESSAGES+set}" = set; then LC_MESSAGES=C; export LC_MESSAGES; fi if test "${LC_CTYPE+set}" = set; then LC_CTYPE=C; export LC_CTYPE; fi # confdefs.h avoids OS command line length limits that DEFS can exceed. rm -rf conftest* confdefs.h # AIX cpp loses on an empty file, so make sure it contains at least a newline. echo > confdefs.h # A filename unique to this package, relative to the directory that # configure is in, which we can look for to find out if srcdir is correct. ac_unique_file=pcap.c # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then its parent. ac_prog=$0 ac_confdir=`echo $ac_prog|sed 's%/[^/][^/]*$%%'` test "x$ac_confdir" = "x$ac_prog" && ac_confdir=. srcdir=$ac_confdir if test ! -r $srcdir/$ac_unique_file; then srcdir=.. fi else ac_srcdir_defaulted=no fi if test ! -r $srcdir/$ac_unique_file; then if test "$ac_srcdir_defaulted" = yes; then { echo "configure: error: can not find sources in $ac_confdir or .." 1>&2; exit 1; } else { echo "configure: error: can not find sources in $srcdir" 1>&2; exit 1; } fi fi srcdir=`echo "${srcdir}" | sed 's%\([^/]\)/*$%\1%'` # Prefer explicitly selected file to automatically selected ones. if test -z "$CONFIG_SITE"; then if test "x$prefix" != xNONE; then CONFIG_SITE="$prefix/share/config.site $prefix/etc/config.site" else CONFIG_SITE="$ac_default_prefix/share/config.site $ac_default_prefix/etc/config.site" fi fi for ac_site_file in $CONFIG_SITE; do if test -r "$ac_site_file"; then echo "loading site script $ac_site_file" . "$ac_site_file" fi done if test -r "$cache_file"; then echo "loading cache $cache_file" . $cache_file else echo "creating cache $cache_file" > $cache_file fi ac_ext=c # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options. ac_cpp='$CPP $CPPFLAGS' ac_compile='${CC-cc} -c $CFLAGS $CPPFLAGS conftest.$ac_ext 1>&5' ac_link='${CC-cc} -o conftest $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS 1>&5' cross_compiling=$ac_cv_prog_cc_cross if (echo "testing\c"; echo 1,2,3) | grep c >/dev/null; then # Stardent Vistra SVR4 grep lacks -e, says ghazi@caip.rutgers.edu. if (echo -n testing; echo 1,2,3) | sed s/-n/xn/ | grep xn >/dev/null; then ac_n= ac_c=' ' ac_t=' ' else ac_n=-n ac_c= ac_t= fi else ac_n= ac_c='\c' ac_t= fi ac_aux_dir= for ac_dir in $srcdir $srcdir/.. $srcdir/../..; do if test -f $ac_dir/install-sh; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install-sh -c" break elif test -f $ac_dir/install.sh; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install.sh -c" break fi done if test -z "$ac_aux_dir"; then { echo "configure: error: can not find install-sh or install.sh in $srcdir $srcdir/.. $srcdir/../.." 1>&2; exit 1; } fi ac_config_guess=$ac_aux_dir/config.guess ac_config_sub=$ac_aux_dir/config.sub ac_configure=$ac_aux_dir/configure # This should be Cygnus configure. # Do some error checking and defaulting for the host and target type. # The inputs are: # configure --host=HOST --target=TARGET --build=BUILD NONOPT # # The rules are: # 1. You are not allowed to specify --host, --target, and nonopt at the # same time. # 2. Host defaults to nonopt. # 3. If nonopt is not specified, then host defaults to the current host, # as determined by config.guess. # 4. Target and build default to nonopt. # 5. If nonopt is not specified, then target and build default to host. # The aliases save the names the user supplied, while $host etc. # will get canonicalized. case $host---$target---$nonopt in NONE---*---* | *---NONE---* | *---*---NONE) ;; *) { echo "configure: error: can only configure for one host and one target at a time" 1>&2; exit 1; } ;; esac # Make sure we can run config.sub. if $ac_config_sub sun4 >/dev/null 2>&1; then : else { echo "configure: error: can not run $ac_config_sub" 1>&2; exit 1; } fi echo $ac_n "checking host system type""... $ac_c" 1>&6 echo "configure:578: checking host system type" >&5 host_alias=$host case "$host_alias" in NONE) case $nonopt in NONE) if host_alias=`$ac_config_guess`; then : else { echo "configure: error: can not guess host type; you must specify one" 1>&2; exit 1; } fi ;; *) host_alias=$nonopt ;; esac ;; esac host=`$ac_config_sub $host_alias` host_cpu=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\1/'` host_vendor=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\2/'` host_os=`echo $host | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\3/'` echo "$ac_t""$host" 1>&6 echo $ac_n "checking target system type""... $ac_c" 1>&6 echo "configure:599: checking target system type" >&5 target_alias=$target case "$target_alias" in NONE) case $nonopt in NONE) target_alias=$host_alias ;; *) target_alias=$nonopt ;; esac ;; esac target=`$ac_config_sub $target_alias` target_cpu=`echo $target | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\1/'` target_vendor=`echo $target | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\2/'` target_os=`echo $target | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\3/'` echo "$ac_t""$target" 1>&6 echo $ac_n "checking build system type""... $ac_c" 1>&6 echo "configure:617: checking build system type" >&5 build_alias=$build case "$build_alias" in NONE) case $nonopt in NONE) build_alias=$host_alias ;; *) build_alias=$nonopt ;; esac ;; esac build=`$ac_config_sub $build_alias` build_cpu=`echo $build | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\1/'` build_vendor=`echo $build | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\2/'` build_os=`echo $build | sed 's/^\([^-]*\)-\([^-]*\)-\(.*\)$/\3/'` echo "$ac_t""$build" 1>&6 test "$host_alias" != "$target_alias" && test "$program_prefix$program_suffix$program_transform_name" = \ NONENONEs,x,x, && program_prefix=${target_alias}- umask 002 if test -z "$PWD" ; then PWD=`pwd` fi # Check whether --with-gcc or --without-gcc was given. if test "${with_gcc+set}" = set; then withval="$with_gcc" : fi V_CCOPT="-O" V_INCLS="" if test "${srcdir}" != "." ; then V_INCLS="-I\$\(srcdir\)" fi if test "${CFLAGS+set}" = set; then LBL_CFLAGS="$CFLAGS" fi if test -z "$CC" ; then case "$target_os" in bsdi*) # Extract the first word of "shlicc2", so it can be a program name with args. set dummy shlicc2; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:671: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_prog_SHLICC2'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if test -n "$SHLICC2"; then ac_cv_prog_SHLICC2="$SHLICC2" # Let the user override the test. else IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS="${IFS}:" for ac_dir in $PATH; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then ac_cv_prog_SHLICC2="yes" break fi done IFS="$ac_save_ifs" test -z "$ac_cv_prog_SHLICC2" && ac_cv_prog_SHLICC2="no" fi fi SHLICC2="$ac_cv_prog_SHLICC2" if test -n "$SHLICC2"; then echo "$ac_t""$SHLICC2" 1>&6 else echo "$ac_t""no" 1>&6 fi if test $SHLICC2 = yes ; then CC=shlicc2 export CC fi ;; esac fi if test -z "$CC" -a "$with_gcc" = no ; then CC=cc export CC fi # Extract the first word of "gcc", so it can be a program name with args. set dummy gcc; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:711: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS="${IFS}:" for ac_dir in $PATH; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then ac_cv_prog_CC="gcc" break fi done IFS="$ac_save_ifs" fi fi CC="$ac_cv_prog_CC" if test -n "$CC"; then echo "$ac_t""$CC" 1>&6 else echo "$ac_t""no" 1>&6 fi if test -z "$CC"; then # Extract the first word of "cc", so it can be a program name with args. set dummy cc; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:740: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_prog_CC'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS="${IFS}:" ac_prog_rejected=no for ac_dir in $PATH; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then if test "$ac_dir/$ac_word" = "/usr/ucb/cc"; then ac_prog_rejected=yes continue fi ac_cv_prog_CC="cc" break fi done IFS="$ac_save_ifs" if test $ac_prog_rejected = yes; then # We found a bogon in the path, so make sure we never use it. set dummy $ac_cv_prog_CC shift if test $# -gt 0; then # We chose a different compiler from the bogus one. # However, it has the same basename, so the bogon will be chosen # first if we set CC to just the basename; use the full file name. shift set dummy "$ac_dir/$ac_word" "$@" shift ac_cv_prog_CC="$@" fi fi fi fi CC="$ac_cv_prog_CC" if test -n "$CC"; then echo "$ac_t""$CC" 1>&6 else echo "$ac_t""no" 1>&6 fi test -z "$CC" && { echo "configure: error: no acceptable cc found in \$PATH" 1>&2; exit 1; } fi echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works""... $ac_c" 1>&6 echo "configure:788: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) works" >&5 ac_ext=c # CFLAGS is not in ac_cpp because -g, -O, etc. are not valid cpp options. ac_cpp='$CPP $CPPFLAGS' ac_compile='${CC-cc} -c $CFLAGS $CPPFLAGS conftest.$ac_ext 1>&5' ac_link='${CC-cc} -o conftest $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS 1>&5' cross_compiling=$ac_cv_prog_cc_cross cat > conftest.$ac_ext <&5; (eval $ac_link) 2>&5; } && test -s conftest; then ac_cv_prog_cc_works=yes # If we can't run a trivial program, we are probably using a cross compiler. if (./conftest; exit) 2>/dev/null; then ac_cv_prog_cc_cross=no else ac_cv_prog_cc_cross=yes fi else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 ac_cv_prog_cc_works=no fi rm -fr conftest* echo "$ac_t""$ac_cv_prog_cc_works" 1>&6 if test $ac_cv_prog_cc_works = no; then { echo "configure: error: installation or configuration problem: C compiler cannot create executables." 1>&2; exit 1; } fi echo $ac_n "checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler""... $ac_c" 1>&6 echo "configure:822: checking whether the C compiler ($CC $CFLAGS $LDFLAGS) is a cross-compiler" >&5 echo "$ac_t""$ac_cv_prog_cc_cross" 1>&6 cross_compiling=$ac_cv_prog_cc_cross echo $ac_n "checking whether we are using GNU C""... $ac_c" 1>&6 echo "configure:827: checking whether we are using GNU C" >&5 if eval "test \"`echo '$''{'ac_cv_prog_gcc'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.c <&5; (eval $ac_try) 2>&5; }; } | egrep yes >/dev/null 2>&1; then ac_cv_prog_gcc=yes else ac_cv_prog_gcc=no fi fi echo "$ac_t""$ac_cv_prog_gcc" 1>&6 if test $ac_cv_prog_gcc = yes; then GCC=yes ac_test_CFLAGS="${CFLAGS+set}" ac_save_CFLAGS="$CFLAGS" CFLAGS= echo $ac_n "checking whether ${CC-cc} accepts -g""... $ac_c" 1>&6 echo "configure:851: checking whether ${CC-cc} accepts -g" >&5 if eval "test \"`echo '$''{'ac_cv_prog_cc_g'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else echo 'void f(){}' > conftest.c if test -z "`${CC-cc} -g -c conftest.c 2>&1`"; then ac_cv_prog_cc_g=yes else ac_cv_prog_cc_g=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_prog_cc_g" 1>&6 if test "$ac_test_CFLAGS" = set; then CFLAGS="$ac_save_CFLAGS" elif test $ac_cv_prog_cc_g = yes; then CFLAGS="-g -O2" else CFLAGS="-O2" fi else GCC= test "${CFLAGS+set}" = set || CFLAGS="-g" fi if test "$GCC" = yes ; then if test "$SHLICC2" = yes ; then ac_cv_lbl_gcc_vers=2 V_CCOPT="-O2" else echo $ac_n "checking gcc version""... $ac_c" 1>&6 echo "configure:884: checking gcc version" >&5 if eval "test \"`echo '$''{'ac_cv_lbl_gcc_vers'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else ac_cv_lbl_gcc_vers=`$CC -v 2>&1 | \ sed -e '/^gcc version /!d' \ -e 's/^gcc version //' \ -e 's/ .*//' -e 's/^[^0-9]*//' \ -e 's/\..*//'` fi echo "$ac_t""$ac_cv_lbl_gcc_vers" 1>&6 if test $ac_cv_lbl_gcc_vers -gt 1 ; then V_CCOPT="-O2" fi fi else echo $ac_n "checking that $CC handles ansi prototypes""... $ac_c" 1>&6 echo "configure:902: checking that $CC handles ansi prototypes" >&5 if eval "test \"`echo '$''{'ac_cv_lbl_cc_ansi_prototypes'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < int main() { int frob(int, char *) ; return 0; } EOF if { (eval echo configure:914: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_lbl_cc_ansi_prototypes=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_lbl_cc_ansi_prototypes=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_lbl_cc_ansi_prototypes" 1>&6 if test $ac_cv_lbl_cc_ansi_prototypes = no ; then case "$target_os" in hpux*) echo $ac_n "checking for HP-UX ansi compiler ($CC -Aa -D_HPUX_SOURCE)""... $ac_c" 1>&6 echo "configure:932: checking for HP-UX ansi compiler ($CC -Aa -D_HPUX_SOURCE)" >&5 savedcflags="$CFLAGS" CFLAGS="-Aa -D_HPUX_SOURCE $CFLAGS" if eval "test \"`echo '$''{'ac_cv_lbl_cc_hpux_cc_aa'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < int main() { int frob(int, char *) ; return 0; } EOF if { (eval echo configure:946: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_lbl_cc_hpux_cc_aa=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_lbl_cc_hpux_cc_aa=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_lbl_cc_hpux_cc_aa" 1>&6 if test $ac_cv_lbl_cc_hpux_cc_aa = no ; then { echo "configure: error: see the INSTALL doc for more info" 1>&2; exit 1; } fi CFLAGS="$savedcflags" V_CCOPT="-Aa $V_CCOPT" cat >> confdefs.h <<\EOF #define _HPUX_SOURCE 1 EOF ;; *) { echo "configure: error: see the INSTALL doc for more info" 1>&2; exit 1; } ;; esac fi V_INCLS="$V_INCLS -I/usr/local/include" LDFLAGS="$LDFLAGS -L/usr/local/lib" case "$target_os" in irix*) V_CCOPT="$V_CCOPT -xansi -signed -g3" ;; osf*) V_CCOPT="$V_CCOPT -std1 -g3" ;; ultrix*) echo $ac_n "checking that Ultrix $CC hacks const in prototypes""... $ac_c" 1>&6 echo "configure:990: checking that Ultrix $CC hacks const in prototypes" >&5 if eval "test \"`echo '$''{'ac_cv_lbl_cc_const_proto'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < int main() { struct a { int b; }; void c(const struct a *) ; return 0; } EOF if { (eval echo configure:1003: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_lbl_cc_const_proto=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_lbl_cc_const_proto=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_lbl_cc_const_proto" 1>&6 if test $ac_cv_lbl_cc_const_proto = no ; then cat >> confdefs.h <<\EOF #define const EOF fi ;; esac fi echo $ac_n "checking how to run the C preprocessor""... $ac_c" 1>&6 echo "configure:1028: checking how to run the C preprocessor" >&5 # On Suns, sometimes $CPP names a directory. if test -n "$CPP" && test -d "$CPP"; then CPP= fi if test -z "$CPP"; then if eval "test \"`echo '$''{'ac_cv_prog_CPP'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else # This must be in double quotes, not single quotes, because CPP may get # substituted into the Makefile and "${CC-cc}" will confuse make. CPP="${CC-cc} -E" # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. cat > conftest.$ac_ext < Syntax Error EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1049: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out` if test -z "$ac_err"; then : else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* CPP="${CC-cc} -E -traditional-cpp" cat > conftest.$ac_ext < Syntax Error EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1066: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out` if test -z "$ac_err"; then : else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* CPP=/lib/cpp fi rm -f conftest* fi rm -f conftest* ac_cv_prog_CPP="$CPP" fi CPP="$ac_cv_prog_CPP" else ac_cv_prog_CPP="$CPP" fi echo "$ac_t""$CPP" 1>&6 for ac_hdr in malloc.h sys/ioccom.h sys/sockio.h do ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'` echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6 echo "configure:1092: checking for $ac_hdr" >&5 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1102: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out` if test -z "$ac_err"; then rm -rf conftest* eval "ac_cv_header_$ac_safe=yes" else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_header_$ac_safe=no" fi rm -f conftest* fi if eval "test \"`echo '$ac_cv_header_'$ac_safe`\" = yes"; then echo "$ac_t""yes" 1>&6 ac_tr_hdr=HAVE_`echo $ac_hdr | sed 'y%abcdefghijklmnopqrstuvwxyz./-%ABCDEFGHIJKLMNOPQRSTUVWXYZ___%'` cat >> confdefs.h <&6 fi done if test "$GCC" = yes ; then echo $ac_n "checking for ANSI ioctl definitions""... $ac_c" 1>&6 echo "configure:1131: checking for ANSI ioctl definitions" >&5 if eval "test \"`echo '$''{'ac_cv_lbl_gcc_fixincludes'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < # include # include # ifdef HAVE_SYS_IOCCOM_H # include # endif int main() { switch (0) { case _IO('A', 1):; case _IO('B', 1):; } ; return 0; } EOF if { (eval echo configure:1155: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_lbl_gcc_fixincludes=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_lbl_gcc_fixincludes=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_lbl_gcc_fixincludes" 1>&6 if test $ac_cv_lbl_gcc_fixincludes = no ; then # Don't cache failure unset ac_cv_lbl_gcc_fixincludes { echo "configure: error: see the INSTALL for more info" 1>&2; exit 1; } fi fi for ac_func in ether_hostton strerror do echo $ac_n "checking for $ac_func""... $ac_c" 1>&6 echo "configure:1178: checking for $ac_func" >&5 if eval "test \"`echo '$''{'ac_cv_func_$ac_func'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < /* Override any gcc2 internal prototype to avoid an error. */ /* We use char because int might match the return type of a gcc2 builtin and then its argument prototype would still apply. */ char $ac_func(); int main() { /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined (__stub_$ac_func) || defined (__stub___$ac_func) choke me #else $ac_func(); #endif ; return 0; } EOF if { (eval echo configure:1206: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest; then rm -rf conftest* eval "ac_cv_func_$ac_func=yes" else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_func_$ac_func=no" fi rm -f conftest* fi if eval "test \"`echo '$ac_cv_func_'$ac_func`\" = yes"; then echo "$ac_t""yes" 1>&6 ac_tr_func=HAVE_`echo $ac_func | tr 'abcdefghijklmnopqrstuvwxyz' 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'` cat >> confdefs.h <&6 fi done # Check whether --with-pcap or --without-pcap was given. if test "${with_pcap+set}" = set; then withval="$with_pcap" : fi echo $ac_n "checking packet capture type""... $ac_c" 1>&6 echo "configure:1238: checking packet capture type" >&5 if test ! -z "$with_pcap" ; then V_PCAP="$withval" elif test -r /dev/bpf0 ; then V_PCAP=bpf elif test -r /usr/include/net/pfilt.h ; then V_PCAP=pf elif test -r /dev/enet ; then V_PCAP=enet elif test -r /dev/nit ; then V_PCAP=snit elif test -r /usr/include/sys/net/nit.h ; then V_PCAP=nit elif test -r /usr/include/net/raw.h ; then V_PCAP=snoop elif test -r /usr/include/sys/dlpi.h ; then V_PCAP=dlpi elif test -r /usr/include/linux/socket.h ; then V_PCAP=linux elif test -c /dev/bpf0 ; then # check again in case not readable V_PCAP=bpf elif test -c /dev/enet ; then # check again in case not readable V_PCAP=enet elif test -c /dev/nit ; then # check again in case not readable V_PCAP=snit else V_PCAP=null fi echo "$ac_t""$V_PCAP" 1>&6 case "$V_PCAP" in dlpi) for ac_hdr in sys/bufmod.h sys/dlpi_ext.h do ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'` echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6 echo "configure:1275: checking for $ac_hdr" >&5 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1285: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out` if test -z "$ac_err"; then rm -rf conftest* eval "ac_cv_header_$ac_safe=yes" else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_header_$ac_safe=no" fi rm -f conftest* fi if eval "test \"`echo '$ac_cv_header_'$ac_safe`\" = yes"; then echo "$ac_t""yes" 1>&6 ac_tr_hdr=HAVE_`echo $ac_hdr | sed 'y%abcdefghijklmnopqrstuvwxyz./-%ABCDEFGHIJKLMNOPQRSTUVWXYZ___%'` cat >> confdefs.h <&6 fi done echo $ac_n "checking for /dev/dlpi device""... $ac_c" 1>&6 echo "configure:1312: checking for /dev/dlpi device" >&5 if test -c /dev/dlpi ; then echo "$ac_t""yes" 1>&6 cat >> confdefs.h <<\EOF #define HAVE_DEV_DLPI 1 EOF else echo "$ac_t""no" 1>&6 dir="/dev/dlpi" echo $ac_n "checking for $dir directory""... $ac_c" 1>&6 echo "configure:1323: checking for $dir directory" >&5 if test -d $dir ; then echo "$ac_t""yes" 1>&6 cat >> confdefs.h <&6 fi fi ;; linux) for ac_hdr in net/if_arp.h do ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'` echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6 echo "configure:1341: checking for $ac_hdr" >&5 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < EOF ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out" { (eval echo configure:1351: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; } ac_err=`grep -v '^ *+' conftest.out` if test -z "$ac_err"; then rm -rf conftest* eval "ac_cv_header_$ac_safe=yes" else echo "$ac_err" >&5 echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* eval "ac_cv_header_$ac_safe=no" fi rm -f conftest* fi if eval "test \"`echo '$ac_cv_header_'$ac_safe`\" = yes"; then echo "$ac_t""yes" 1>&6 ac_tr_hdr=HAVE_`echo $ac_hdr | sed 'y%abcdefghijklmnopqrstuvwxyz./-%ABCDEFGHIJKLMNOPQRSTUVWXYZ___%'` cat >> confdefs.h <&6 fi done echo $ac_n "checking Linux kernel version""... $ac_c" 1>&6 echo "configure:1378: checking Linux kernel version" >&5 if eval "test \"`echo '$''{'ac_cv_linux_vers'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else ac_cv_linux_vers=`uname -r 2>&1 | \ sed -n -e '$s/.* //' -e '$s/\..*//p'` fi echo "$ac_t""$ac_cv_linux_vers" 1>&6 if test $ac_cv_linux_vers -lt 2 ; then { echo "configure: error: version 2 or higher required; see the INSTALL doc for more info" 1>&2; exit 1; } fi ;; null) echo "configure: warning: cannot determine packet capture interface" 1>&2 echo "configure: warning: (see the INSTALL doc for more info)" 1>&2 ;; esac # Check whether --with-flex or --without-flex was given. if test "${with_flex+set}" = set; then withval="$with_flex" : fi # Check whether --with-bison or --without-bison was given. if test "${with_bison+set}" = set; then withval="$with_bison" : fi if test "$with_flex" = no ; then V_LEX=lex else for ac_prog in flex do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:1419: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_prog_V_LEX'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if test -n "$V_LEX"; then ac_cv_prog_V_LEX="$V_LEX" # Let the user override the test. else IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS="${IFS}:" for ac_dir in $PATH; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then ac_cv_prog_V_LEX="$ac_prog" break fi done IFS="$ac_save_ifs" fi fi V_LEX="$ac_cv_prog_V_LEX" if test -n "$V_LEX"; then echo "$ac_t""$V_LEX" 1>&6 else echo "$ac_t""no" 1>&6 fi test -n "$V_LEX" && break done test -n "$V_LEX" || V_LEX="lex" fi if test "$V_LEX" = flex ; then # The -V flag was added in 2.4 echo $ac_n "checking for flex 2.4 or higher""... $ac_c" 1>&6 echo "configure:1452: checking for flex 2.4 or higher" >&5 if eval "test \"`echo '$''{'ac_cv_lbl_flex_v24'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if flex -V >/dev/null 2>&1; then ac_cv_lbl_flex_v24=yes else ac_cv_lbl_flex_v24=no fi fi echo "$ac_t""$ac_cv_lbl_flex_v24" 1>&6 if test $ac_cv_lbl_flex_v24 = no ; then s="2.4 or higher required" echo "configure: warning: ignoring obsolete flex executable ($s)" 1>&2 V_LEX=lex fi fi if test "$with_bison" = no ; then V_YACC=yacc else for ac_prog in bison do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:1478: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_prog_V_YACC'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if test -n "$V_YACC"; then ac_cv_prog_V_YACC="$V_YACC" # Let the user override the test. else IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS="${IFS}:" for ac_dir in $PATH; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then ac_cv_prog_V_YACC="$ac_prog" break fi done IFS="$ac_save_ifs" fi fi V_YACC="$ac_cv_prog_V_YACC" if test -n "$V_YACC"; then echo "$ac_t""$V_YACC" 1>&6 else echo "$ac_t""no" 1>&6 fi test -n "$V_YACC" && break done test -n "$V_YACC" || V_YACC="yacc" fi if test "$V_YACC" = bison ; then V_YACC="$V_YACC -y" fi if test "$V_LEX" != lex -a "$V_YACC" = yacc -o "$V_LEX" = lex -a "$V_YACC" != yacc ; then echo "configure: warning: don't have both flex and bison; reverting to lex/yacc" 1>&2 V_LEX=lex V_YACC=yacc fi if test "$V_LEX" = flex -a -n "pcap_" ; then V_LEX="$V_LEX -Ppcap_" V_YACC="$V_YACC -p pcap_" fi case "$target_os" in aix*) cat >> confdefs.h <<\EOF #define _SUN 1 EOF ;; hpux9*) cat >> confdefs.h <<\EOF #define HAVE_HPUX9 1 EOF ;; hpux10.0*) ;; hpux10.1*) ;; hpux*) cat >> confdefs.h <<\EOF #define HAVE_HPUX10_20 1 EOF ;; sinix*) echo $ac_n "checking if SINIX compiler defines sinix""... $ac_c" 1>&6 echo "configure:1552: checking if SINIX compiler defines sinix" >&5 if eval "test \"`echo '$''{'ac_cv_cc_sinix_defined'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext <&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_cc_sinix_defined=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_cc_sinix_defined=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_cc_sinix_defined" 1>&6 if test $ac_cv_cc_sinix_defined = no ; then cat >> confdefs.h <<\EOF #define sinix 1 EOF fi ;; solaris*) cat >> confdefs.h <<\EOF #define HAVE_SOLARIS 1 EOF ;; linux*) V_INCLS="$V_INCLS -Ilinux-include" ;; esac for ac_prog in ranlib do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 echo $ac_n "checking for $ac_word""... $ac_c" 1>&6 echo "configure:1602: checking for $ac_word" >&5 if eval "test \"`echo '$''{'ac_cv_prog_V_RANLIB'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else if test -n "$V_RANLIB"; then ac_cv_prog_V_RANLIB="$V_RANLIB" # Let the user override the test. else IFS="${IFS= }"; ac_save_ifs="$IFS"; IFS="${IFS}:" for ac_dir in $PATH; do test -z "$ac_dir" && ac_dir=. if test -f $ac_dir/$ac_word; then ac_cv_prog_V_RANLIB="$ac_prog" break fi done IFS="$ac_save_ifs" fi fi V_RANLIB="$ac_cv_prog_V_RANLIB" if test -n "$V_RANLIB"; then echo "$ac_t""$V_RANLIB" 1>&6 else echo "$ac_t""no" 1>&6 fi test -n "$V_RANLIB" && break done test -n "$V_RANLIB" || V_RANLIB="@true" rm -f os-proto.h if test "${LBL_CFLAGS+set}" = set; then V_CCOPT="$V_CCOPT ${LBL_CFLAGS}" fi if test -f .devel ; then if test "$GCC" = yes ; then if test "${LBL_CFLAGS+set}" != set; then if test "$ac_cv_prog_cc_g" = yes ; then V_CCOPT="-g $V_CCOPT" fi V_CCOPT="$V_CCOPT -Wall" if test $ac_cv_lbl_gcc_vers -gt 1 ; then V_CCOPT="$V_CCOPT -Wmissing-prototypes -Wstrict-prototypes" fi fi else case "$target_os" in irix6*) V_CCOPT="$V_CCOPT -n32" ;; *) ;; esac fi os=`echo $target_os | sed -e 's/\([0-9][0-9]*\)[^0-9].*$/\1/'` name="lbl/os-$os.h" if test -f $name ; then ln -s $name os-proto.h cat >> confdefs.h <<\EOF #define HAVE_OS_PROTO_H 1 EOF else echo "configure: warning: can't find $name" 1>&2 fi fi echo $ac_n "checking if sockaddr struct has sa_len member""... $ac_c" 1>&6 echo "configure:1672: checking if sockaddr struct has sa_len member" >&5 if eval "test \"`echo '$''{'ac_cv_lbl_sockaddr_has_sa_len'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else cat > conftest.$ac_ext < # include int main() { u_int i = sizeof(((struct sockaddr *)0)->sa_len) ; return 0; } EOF if { (eval echo configure:1686: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>&5; }; then rm -rf conftest* ac_cv_lbl_sockaddr_has_sa_len=yes else echo "configure: failed program was:" >&5 cat conftest.$ac_ext >&5 rm -rf conftest* ac_cv_lbl_sockaddr_has_sa_len=no fi rm -f conftest* fi echo "$ac_t""$ac_cv_lbl_sockaddr_has_sa_len" 1>&6 if test $ac_cv_lbl_sockaddr_has_sa_len = yes ; then cat >> confdefs.h <<\EOF #define HAVE_SOCKADDR_SA_LEN 1 EOF fi echo $ac_n "checking if unaligned accesses fail""... $ac_c" 1>&6 echo "configure:1707: checking if unaligned accesses fail" >&5 if eval "test \"`echo '$''{'ac_cv_lbl_unaligned_fail'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else case "$target_cpu" in alpha|hp*|mips|sparc) ac_cv_lbl_unaligned_fail=yes ;; *) cat >conftest.c < # include # include unsigned char a[5] = { 1, 2, 3, 4, 5 }; main() { unsigned int i; pid_t pid; int status; /* avoid "core dumped" message */ pid = fork(); if (pid < 0) exit(2); if (pid > 0) { /* parent */ pid = waitpid(pid, &status, 0); if (pid < 0) exit(3); exit(!WIFEXITED(status)); } /* child */ i = *(unsigned int *)&a[1]; printf("%d\n", i); exit(0); } EOF ${CC-cc} -o conftest $CFLAGS $CPPFLAGS $LDFLAGS \ conftest.c $LIBS >/dev/null 2>&1 if test ! -x conftest ; then ac_cv_lbl_unaligned_fail=yes else ./conftest >conftest.out if test ! -s conftest.out ; then ac_cv_lbl_unaligned_fail=yes else ac_cv_lbl_unaligned_fail=no fi fi rm -f conftest* core core.conftest ;; esac fi echo "$ac_t""$ac_cv_lbl_unaligned_fail" 1>&6 if test $ac_cv_lbl_unaligned_fail = yes ; then cat >> confdefs.h <<\EOF #define LBL_ALIGN 1 EOF fi if test "${srcdir}" = "." ; then srcdirprefix="" else srcdirprefix="./" fi if test -r ${srcdirprefix}lbl/gnuc.h ; then rm -f gnuc.h ln -s ${srcdirprefix}lbl/gnuc.h gnuc.h fi rm -f bpf_filter.c ln -s ${srcdirprefix}bpf/net/bpf_filter.c bpf_filter.c rm -f net ln -s ${srcdirprefix}bpf/net net # Find a good install program. We prefer a C program (faster), # so one script is as good as another. But avoid the broken or # incompatible versions: # SysV /etc/install, /usr/sbin/install # SunOS /usr/etc/install # IRIX /sbin/install # AIX /bin/install # AFS /usr/afsws/bin/install, which mishandles nonexistent args # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff" # ./install, which can be erroneously created by make from ./install.sh. echo $ac_n "checking for a BSD compatible install""... $ac_c" 1>&6 echo "configure:1803: checking for a BSD compatible install" >&5 if test -z "$INSTALL"; then if eval "test \"`echo '$''{'ac_cv_path_install'+set}'`\" = set"; then echo $ac_n "(cached) $ac_c" 1>&6 else IFS="${IFS= }"; ac_save_IFS="$IFS"; IFS="${IFS}:" for ac_dir in $PATH; do # Account for people who put trailing slashes in PATH elements. case "$ac_dir/" in /|./|.//|/etc/*|/usr/sbin/*|/usr/etc/*|/sbin/*|/usr/afsws/bin/*|/usr/ucb/*) ;; *) # OSF1 and SCO ODT 3.0 have their own names for install. for ac_prog in ginstall installbsd scoinst install; do if test -f $ac_dir/$ac_prog; then if test $ac_prog = install && grep dspmsg $ac_dir/$ac_prog >/dev/null 2>&1; then # AIX install. It has an incompatible calling convention. # OSF/1 installbsd also uses dspmsg, but is usable. : else ac_cv_path_install="$ac_dir/$ac_prog -c" break 2 fi fi done ;; esac done IFS="$ac_save_IFS" fi if test "${ac_cv_path_install+set}" = set; then INSTALL="$ac_cv_path_install" else # As a last resort, use the slow shell script. We don't cache a # path for INSTALL within a source directory, because that will # break other packages using the cache if that directory is # removed, or if the path is relative. INSTALL="$ac_install_sh" fi fi echo "$ac_t""$INSTALL" 1>&6 # Use test -z because SunOS4 sh mishandles braces in ${var-val}. # It thinks the first close brace ends the variable substitution. test -z "$INSTALL_PROGRAM" && INSTALL_PROGRAM='${INSTALL}' test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644' trap '' 1 2 15 cat > confcache <<\EOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure # scripts and configure runs. It is not useful on other systems. # If it contains results you don't want to keep, you may remove or edit it. # # By default, configure uses ./config.cache as the cache file, # creating it if it does not exist already. You can give configure # the --cache-file=FILE option to use a different cache file; that is # what configure does when it calls configure scripts in # subdirectories, so they share the cache. # Giving --cache-file=/dev/null disables caching, for debugging configure. # config.status only pays attention to the cache file if you give it the # --recheck option to rerun configure. # EOF # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, don't put newlines in cache variables' values. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. (set) 2>&1 | case `(ac_space=' '; set) 2>&1` in *ac_space=\ *) # `set' does not quote correctly, so add quotes (double-quote substitution # turns \\\\ into \\, and sed turns \\ into \). sed -n \ -e "s/'/'\\\\''/g" \ -e "s/^\\([a-zA-Z0-9_]*_cv_[a-zA-Z0-9_]*\\)=\\(.*\\)/\\1=\${\\1='\\2'}/p" ;; *) # `set' quotes correctly as required by POSIX, so do not add quotes. sed -n -e 's/^\([a-zA-Z0-9_]*_cv_[a-zA-Z0-9_]*\)=\(.*\)/\1=${\1=\2}/p' ;; esac >> confcache if cmp -s $cache_file confcache; then : else if test -w $cache_file; then echo "updating cache $cache_file" cat confcache > $cache_file else echo "not updating unwritable cache $cache_file" fi fi rm -f confcache trap 'rm -fr conftest* confdefs* core core.* *.core $ac_clean_files; exit 1' 1 2 15 test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' # Any assignment to VPATH causes Sun make to only execute # the first set of double-colon rules, so remove it if not needed. # If there is a colon in the path, we need to keep it. if test "x$srcdir" = x.; then ac_vpsub='/^[ ]*VPATH[ ]*=[^:]*$/d' fi trap 'rm -f $CONFIG_STATUS conftest*; exit 1' 1 2 15 # Transform confdefs.h into DEFS. # Protect against shell expansion while executing Makefile rules. # Protect against Makefile macro expansion. cat > conftest.defs <<\EOF s%#define \([A-Za-z_][A-Za-z0-9_]*\) *\(.*\)%-D\1=\2%g s%[ `~#$^&*(){}\\|;'"<>?]%\\&%g s%\[%\\&%g s%\]%\\&%g s%\$%$$%g EOF DEFS=`sed -f conftest.defs confdefs.h | tr '\012' ' '` rm -f conftest.defs # Without the "./", some shells look in PATH for config.status. : ${CONFIG_STATUS=./config.status} echo creating $CONFIG_STATUS rm -f $CONFIG_STATUS cat > $CONFIG_STATUS </dev/null | sed 1q`: # # $0 $ac_configure_args # # Compiler output produced by configure, useful for debugging # configure, is in ./config.log if it exists. ac_cs_usage="Usage: $CONFIG_STATUS [--recheck] [--version] [--help]" for ac_option do case "\$ac_option" in -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) echo "running \${CONFIG_SHELL-/bin/sh} $0 $ac_configure_args --no-create --no-recursion" exec \${CONFIG_SHELL-/bin/sh} $0 $ac_configure_args --no-create --no-recursion ;; -version | --version | --versio | --versi | --vers | --ver | --ve | --v) echo "$CONFIG_STATUS generated by autoconf version 2.12" exit 0 ;; -help | --help | --hel | --he | --h) echo "\$ac_cs_usage"; exit 0 ;; *) echo "\$ac_cs_usage"; exit 1 ;; esac done ac_given_srcdir=$srcdir ac_given_INSTALL="$INSTALL" trap 'rm -fr `echo "Makefile" | sed "s/:[^ ]*//g"` conftest*; exit 1' 1 2 15 EOF cat >> $CONFIG_STATUS < conftest.subs <<\\CEOF $ac_vpsub $extrasub s%@CFLAGS@%$CFLAGS%g s%@CPPFLAGS@%$CPPFLAGS%g s%@CXXFLAGS@%$CXXFLAGS%g s%@DEFS@%$DEFS%g s%@LDFLAGS@%$LDFLAGS%g s%@LIBS@%$LIBS%g s%@exec_prefix@%$exec_prefix%g s%@prefix@%$prefix%g s%@program_transform_name@%$program_transform_name%g s%@bindir@%$bindir%g s%@sbindir@%$sbindir%g s%@libexecdir@%$libexecdir%g s%@datadir@%$datadir%g s%@sysconfdir@%$sysconfdir%g s%@sharedstatedir@%$sharedstatedir%g s%@localstatedir@%$localstatedir%g s%@libdir@%$libdir%g s%@includedir@%$includedir%g s%@oldincludedir@%$oldincludedir%g s%@infodir@%$infodir%g s%@mandir@%$mandir%g s%@host@%$host%g s%@host_alias@%$host_alias%g s%@host_cpu@%$host_cpu%g s%@host_vendor@%$host_vendor%g s%@host_os@%$host_os%g s%@target@%$target%g s%@target_alias@%$target_alias%g s%@target_cpu@%$target_cpu%g s%@target_vendor@%$target_vendor%g s%@target_os@%$target_os%g s%@build@%$build%g s%@build_alias@%$build_alias%g s%@build_cpu@%$build_cpu%g s%@build_vendor@%$build_vendor%g s%@build_os@%$build_os%g s%@SHLICC2@%$SHLICC2%g s%@CC@%$CC%g s%@CPP@%$CPP%g s%@V_LEX@%$V_LEX%g s%@V_YACC@%$V_YACC%g s%@V_RANLIB@%$V_RANLIB%g s%@V_CCOPT@%$V_CCOPT%g s%@V_INCLS@%$V_INCLS%g s%@V_PCAP@%$V_PCAP%g s%@INSTALL_PROGRAM@%$INSTALL_PROGRAM%g s%@INSTALL_DATA@%$INSTALL_DATA%g CEOF EOF cat >> $CONFIG_STATUS <<\EOF # Split the substitutions into bite-sized pieces for seds with # small command number limits, like on Digital OSF/1 and HP-UX. ac_max_sed_cmds=90 # Maximum number of lines to put in a sed script. ac_file=1 # Number of current file. ac_beg=1 # First line for current file. ac_end=$ac_max_sed_cmds # Line after last line for current file. ac_more_lines=: ac_sed_cmds="" while $ac_more_lines; do if test $ac_beg -gt 1; then sed "1,${ac_beg}d; ${ac_end}q" conftest.subs > conftest.s$ac_file else sed "${ac_end}q" conftest.subs > conftest.s$ac_file fi if test ! -s conftest.s$ac_file; then ac_more_lines=false rm -f conftest.s$ac_file else if test -z "$ac_sed_cmds"; then ac_sed_cmds="sed -f conftest.s$ac_file" else ac_sed_cmds="$ac_sed_cmds | sed -f conftest.s$ac_file" fi ac_file=`expr $ac_file + 1` ac_beg=$ac_end ac_end=`expr $ac_end + $ac_max_sed_cmds` fi done if test -z "$ac_sed_cmds"; then ac_sed_cmds=cat fi EOF cat >> $CONFIG_STATUS <> $CONFIG_STATUS <<\EOF for ac_file in .. $CONFIG_FILES; do if test "x$ac_file" != x..; then # Support "outfile[:infile[:infile...]]", defaulting infile="outfile.in". case "$ac_file" in *:*) ac_file_in=`echo "$ac_file"|sed 's%[^:]*:%%'` ac_file=`echo "$ac_file"|sed 's%:.*%%'` ;; *) ac_file_in="${ac_file}.in" ;; esac # Adjust a relative srcdir, top_srcdir, and INSTALL for subdirectories. # Remove last slash and all that follows it. Not all systems have dirname. ac_dir=`echo $ac_file|sed 's%/[^/][^/]*$%%'` if test "$ac_dir" != "$ac_file" && test "$ac_dir" != .; then # The file is in a subdirectory. test ! -d "$ac_dir" && mkdir "$ac_dir" ac_dir_suffix="/`echo $ac_dir|sed 's%^\./%%'`" # A "../" for each directory in $ac_dir_suffix. ac_dots=`echo $ac_dir_suffix|sed 's%/[^/]*%../%g'` else ac_dir_suffix= ac_dots= fi case "$ac_given_srcdir" in .) srcdir=. if test -z "$ac_dots"; then top_srcdir=. else top_srcdir=`echo $ac_dots|sed 's%/$%%'`; fi ;; /*) srcdir="$ac_given_srcdir$ac_dir_suffix"; top_srcdir="$ac_given_srcdir" ;; *) # Relative path. srcdir="$ac_dots$ac_given_srcdir$ac_dir_suffix" top_srcdir="$ac_dots$ac_given_srcdir" ;; esac case "$ac_given_INSTALL" in [/$]*) INSTALL="$ac_given_INSTALL" ;; *) INSTALL="$ac_dots$ac_given_INSTALL" ;; esac echo creating "$ac_file" rm -f "$ac_file" configure_input="Generated automatically from `echo $ac_file_in|sed 's%.*/%%'` by configure." case "$ac_file" in *Makefile*) ac_comsub="1i\\ # $configure_input" ;; *) ac_comsub= ;; esac ac_file_inputs=`echo $ac_file_in|sed -e "s%^%$ac_given_srcdir/%" -e "s%:% $ac_given_srcdir/%g"` sed -e "$ac_comsub s%@configure_input@%$configure_input%g s%@srcdir@%$srcdir%g s%@top_srcdir@%$top_srcdir%g s%@INSTALL@%$INSTALL%g " $ac_file_inputs | (eval "$ac_sed_cmds") > $ac_file fi; done rm -f conftest.s* EOF cat >> $CONFIG_STATUS <> $CONFIG_STATUS <<\EOF exit 0 EOF chmod +x $CONFIG_STATUS rm -fr confdefs* $ac_clean_files test "$no_create" = yes || ${CONFIG_SHELL-/bin/sh} $CONFIG_STATUS || exit 1 if test -f .devel ; then make depend fi exit 0 nmap-2.08/libpcap-possiblymodified/configure.in100755 764 764 7434 6611214631 20756 0ustar fyodorfyodordnl @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/configure.in,v 1.1 1998/10/15 04:39:58 fyodor Exp $ (LBL) dnl dnl Copyright (c) 1994, 1995, 1996, 1997 dnl The Regents of the University of California. All rights reserved. dnl dnl Process this file with autoconf to produce a configure script. dnl AC_INIT(pcap.c) AC_CANONICAL_SYSTEM umask 002 if test -z "$PWD" ; then PWD=`pwd` fi AC_LBL_C_INIT(V_CCOPT, V_INCLS) AC_CHECK_HEADERS(malloc.h sys/ioccom.h sys/sockio.h) AC_LBL_FIXINCLUDES AC_CHECK_FUNCS(ether_hostton strerror) dnl dnl Not all versions of test support -c (character special) but it's a dnl better way of testing since the device might be protected. So we dnl check in our normal order using -r and then check the for the /dev dnl guys again using -c. dnl AC_ARG_WITH(pcap, [ --with-pcap=TYPE use packet capture TYPE]) AC_MSG_CHECKING(packet capture type) if test ! -z "$with_pcap" ; then V_PCAP="$withval" elif test -r /dev/bpf0 ; then V_PCAP=bpf elif test -r /usr/include/net/pfilt.h ; then V_PCAP=pf elif test -r /dev/enet ; then V_PCAP=enet elif test -r /dev/nit ; then V_PCAP=snit elif test -r /usr/include/sys/net/nit.h ; then V_PCAP=nit elif test -r /usr/include/net/raw.h ; then V_PCAP=snoop elif test -r /usr/include/sys/dlpi.h ; then V_PCAP=dlpi elif test -r /usr/include/linux/socket.h ; then V_PCAP=linux elif test -c /dev/bpf0 ; then # check again in case not readable V_PCAP=bpf elif test -c /dev/enet ; then # check again in case not readable V_PCAP=enet elif test -c /dev/nit ; then # check again in case not readable V_PCAP=snit else V_PCAP=null fi AC_MSG_RESULT($V_PCAP) case "$V_PCAP" in dlpi) AC_CHECK_HEADERS(sys/bufmod.h sys/dlpi_ext.h) AC_MSG_CHECKING(for /dev/dlpi device) if test -c /dev/dlpi ; then AC_MSG_RESULT(yes) AC_DEFINE(HAVE_DEV_DLPI) else AC_MSG_RESULT(no) dir="/dev/dlpi" AC_MSG_CHECKING(for $dir directory) if test -d $dir ; then AC_MSG_RESULT(yes) AC_DEFINE_UNQUOTED(PCAP_DEV_PREFIX, "$dir") else AC_MSG_RESULT(no) fi fi ;; linux) AC_CHECK_HEADERS(net/if_arp.h) AC_MSG_CHECKING(Linux kernel version) AC_CACHE_VAL(ac_cv_linux_vers, ac_cv_linux_vers=`uname -r 2>&1 | \ sed -n -e '$s/.* //' -e '$s/\..*//p'`) AC_MSG_RESULT($ac_cv_linux_vers) if test $ac_cv_linux_vers -lt 2 ; then AC_MSG_ERROR(version 2 or higher required; see the INSTALL doc for more info) fi ;; null) AC_MSG_WARN(cannot determine packet capture interface) AC_MSG_WARN((see the INSTALL doc for more info)) ;; esac AC_LBL_LEX_AND_YACC(V_LEX, V_YACC, pcap_) case "$target_os" in aix*) dnl Workaround to enable certain features AC_DEFINE(_SUN) ;; hpux9*) AC_DEFINE(HAVE_HPUX9) ;; hpux10.0*) ;; hpux10.1*) ;; hpux*) dnl HPUX 10.20 and above is similar to HPUX 9... AC_DEFINE(HAVE_HPUX10_20) ;; sinix*) AC_MSG_CHECKING(if SINIX compiler defines sinix) AC_CACHE_VAL(ac_cv_cc_sinix_defined, AC_TRY_COMPILE( [], [int i = sinix;], ac_cv_cc_sinix_defined=yes, ac_cv_cc_sinix_defined=no)) AC_MSG_RESULT($ac_cv_cc_sinix_defined) if test $ac_cv_cc_sinix_defined = no ; then AC_DEFINE(sinix) fi ;; solaris*) AC_DEFINE(HAVE_SOLARIS) ;; linux*) V_INCLS="$V_INCLS -Ilinux-include" ;; esac AC_CHECK_PROGS(V_RANLIB, ranlib, @true) AC_LBL_DEVEL(V_CCOPT) AC_LBL_SOCKADDR_SA_LEN AC_LBL_UNALIGNED_ACCESS if test "${srcdir}" = "." ; then srcdirprefix="" else srcdirprefix="./" fi if test -r ${srcdirprefix}lbl/gnuc.h ; then rm -f gnuc.h ln -s ${srcdirprefix}lbl/gnuc.h gnuc.h fi rm -f bpf_filter.c ln -s ${srcdirprefix}bpf/net/bpf_filter.c bpf_filter.c rm -f net ln -s ${srcdirprefix}bpf/net net AC_SUBST(V_CCOPT) AC_SUBST(V_INCLS) AC_SUBST(V_LEX) AC_SUBST(V_PCAP) AC_SUBST(V_RANLIB) AC_SUBST(V_YACC) AC_PROG_INSTALL AC_OUTPUT(Makefile) if test -f .devel ; then make depend fi exit 0 nmap-2.08/libpcap-possiblymodified/etherent.c100644 764 764 6414 6611214632 20422 0ustar fyodorfyodor/* * Copyright (c) 1990, 1993, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/etherent.c,v 1.1 1998/10/15 04:39:58 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include #include "pcap-int.h" #include #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif static inline int xdtoi(int); static inline int skip_space(FILE *); static inline int skip_line(FILE *); /* Hex digit to integer. */ static inline int xdtoi(c) register int c; { if (isdigit(c)) return c - '0'; else if (islower(c)) return c - 'a' + 10; else return c - 'A' + 10; } static inline int skip_space(f) FILE *f; { int c; do { c = getc(f); } while (isspace(c) && c != '\n'); return c; } static inline int skip_line(f) FILE *f; { int c; do c = getc(f); while (c != '\n' && c != EOF); return c; } struct pcap_etherent * pcap_next_etherent(FILE *fp) { register int c, d, i; char *bp; static struct pcap_etherent e; memset((char *)&e, 0, sizeof(e)); do { /* Find addr */ c = skip_space(fp); if (c == '\n') continue; /* If this is a comment, or first thing on line cannot be etehrnet address, skip the line. */ if (!isxdigit(c)) { c = skip_line(fp); continue; } /* must be the start of an address */ for (i = 0; i < 6; i += 1) { d = xdtoi(c); c = getc(fp); if (isxdigit(c)) { d <<= 4; d |= xdtoi(c); c = getc(fp); } e.addr[i] = d; if (c != ':') break; c = getc(fp); } if (c == EOF) break; /* Must be whitespace */ if (!isspace(c)) { c = skip_line(fp); continue; } c = skip_space(fp); /* hit end of line... */ if (c == '\n') continue; if (c == '#') { c = skip_line(fp); continue; } /* pick up name */ bp = e.name; /* Use 'd' to prevent buffer overflow. */ d = sizeof(e.name) - 1; do { *bp++ = c; c = getc(fp); } while (!isspace(c) && c != EOF && --d > 0); *bp = '\0'; /* Eat trailing junk */ if (c != '\n') (void)skip_line(fp); return &e; } while (c != EOF); return (NULL); } nmap-2.08/libpcap-possiblymodified/ethertype.h100644 764 764 4534 6611214633 20624 0ustar fyodorfyodor/* * Copyright (c) 1993, 1994, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/ethertype.h,v 1.1 1998/10/15 04:39:58 fyodor Exp $ (LBL) */ /* Types missing from some systems */ #ifndef ETHERTYPE_NS #define ETHERTYPE_NS 0x0600 #endif #ifndef ETHERTYPE_SPRITE #define ETHERTYPE_SPRITE 0x0500 #endif #ifndef ETHERTYPE_TRAIL #define ETHERTYPE_TRAIL 0x1000 #endif #ifndef ETHERTYPE_MOPDL #define ETHERTYPE_MOPDL 0x6001 #endif #ifndef ETHERTYPE_MOPRC #define ETHERTYPE_MOPRC 0x6002 #endif #ifndef ETHERTYPE_DN #define ETHERTYPE_DN 0x6003 #endif #ifndef ETHERTYPE_LAT #define ETHERTYPE_LAT 0x6004 #endif #ifndef ETHERTYPE_SCA #define ETHERTYPE_SCA 0x6007 #endif #ifndef ETHERTYPE_REVARP #define ETHERTYPE_REVARP 0x8035 #endif #ifndef ETHERTYPE_LANBRIDGE #define ETHERTYPE_LANBRIDGE 0x8038 #endif #ifndef ETHERTYPE_DECDNS #define ETHERTYPE_DECDNS 0x803c #endif #ifndef ETHERTYPE_DECDTS #define ETHERTYPE_DECDTS 0x803e #endif #ifndef ETHERTYPE_VEXP #define ETHERTYPE_VEXP 0x805b #endif #ifndef ETHERTYPE_VPROD #define ETHERTYPE_VPROD 0x805c #endif #ifndef ETHERTYPE_ATALK #define ETHERTYPE_ATALK 0x809b #endif #ifndef ETHERTYPE_AARP #define ETHERTYPE_AARP 0x80f3 #endif #ifndef ETHERTYPE_LOOPBACK #define ETHERTYPE_LOOPBACK 0x9000 #endif nmap-2.08/libpcap-possiblymodified/gencode.c100644 764 764 111344 6611214643 20251 0ustar fyodorfyodor/* * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/gencode.c,v 1.1 1998/10/15 04:39:58 fyodor Exp $ (LBL)"; #endif #include #include #include #if __STDC__ struct mbuf; struct rtentry; #endif #include #include #include #include #include #include #if __STDC__ #include #else #include #endif #include "pcap-int.h" #include "ethertype.h" #include "gencode.h" #include "ppp.h" #include #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif #define JMP(c) ((c)|BPF_JMP|BPF_K) /* Locals */ static jmp_buf top_ctx; static pcap_t *bpf_pcap; /* XXX */ #ifdef PCAP_FDDIPAD int pcap_fddipad = PCAP_FDDIPAD; #else int pcap_fddipad; #endif /* VARARGS */ __dead void #if __STDC__ bpf_error(const char *fmt, ...) #else bpf_error(fmt, va_alist) const char *fmt; va_dcl #endif { va_list ap; #if __STDC__ va_start(ap, fmt); #else va_start(ap); #endif if (bpf_pcap != NULL) (void)vsprintf(pcap_geterr(bpf_pcap), fmt, ap); va_end(ap); longjmp(top_ctx, 1); /* NOTREACHED */ } static void init_linktype(int); static int alloc_reg(void); static void free_reg(int); static struct block *root; /* * We divy out chunks of memory rather than call malloc each time so * we don't have to worry about leaking memory. It's probably * not a big deal if all this memory was wasted but it this ever * goes into a library that would probably not be a good idea. */ #define NCHUNKS 16 #define CHUNK0SIZE 1024 struct chunk { u_int n_left; void *m; }; static struct chunk chunks[NCHUNKS]; static int cur_chunk; static void *newchunk(u_int); static void freechunks(void); static inline struct block *new_block(int); static inline struct slist *new_stmt(int); static struct block *gen_retblk(int); static inline void syntax(void); static void backpatch(struct block *, struct block *); static void merge(struct block *, struct block *); static struct block *gen_cmp(u_int, u_int, bpf_int32); static struct block *gen_mcmp(u_int, u_int, bpf_int32, bpf_u_int32); static struct block *gen_bcmp(u_int, u_int, const u_char *); static struct block *gen_uncond(int); static inline struct block *gen_true(void); static inline struct block *gen_false(void); static struct block *gen_linktype(int); static struct block *gen_hostop(bpf_u_int32, bpf_u_int32, int, int, u_int, u_int); static struct block *gen_ehostop(const u_char *, int); static struct block *gen_fhostop(const u_char *, int); static struct block *gen_dnhostop(bpf_u_int32, int, u_int); static struct block *gen_host(bpf_u_int32, bpf_u_int32, int, int); static struct block *gen_gateway(const u_char *, bpf_u_int32 **, int, int); static struct block *gen_ipfrag(void); static struct block *gen_portatom(int, bpf_int32); struct block *gen_portop(int, int, int); static struct block *gen_port(int, int, int); static int lookup_proto(const char *, int); static struct block *gen_proto(int, int, int); static struct slist *xfer_to_x(struct arth *); static struct slist *xfer_to_a(struct arth *); static struct block *gen_len(int, int); static void * newchunk(n) u_int n; { struct chunk *cp; int k, size; /* XXX Round up to nearest long. */ n = (n + sizeof(long) - 1) & ~(sizeof(long) - 1); cp = &chunks[cur_chunk]; if (n > cp->n_left) { ++cp, k = ++cur_chunk; if (k >= NCHUNKS) bpf_error("out of memory"); size = CHUNK0SIZE << k; cp->m = (void *)malloc(size); memset((char *)cp->m, 0, size); cp->n_left = size; if (n > size) bpf_error("out of memory"); } cp->n_left -= n; return (void *)((char *)cp->m + cp->n_left); } static void freechunks() { int i; cur_chunk = 0; for (i = 0; i < NCHUNKS; ++i) if (chunks[i].m != NULL) { free(chunks[i].m); chunks[i].m = NULL; } } /* * A strdup whose allocations are freed after code generation is over. */ char * sdup(s) register const char *s; { int n = strlen(s) + 1; char *cp = newchunk(n); strcpy(cp, s); return (cp); } static inline struct block * new_block(code) int code; { struct block *p; p = (struct block *)newchunk(sizeof(*p)); p->s.code = code; p->head = p; return p; } static inline struct slist * new_stmt(code) int code; { struct slist *p; p = (struct slist *)newchunk(sizeof(*p)); p->s.code = code; return p; } static struct block * gen_retblk(v) int v; { struct block *b = new_block(BPF_RET|BPF_K); b->s.k = v; return b; } static inline void syntax() { bpf_error("syntax error in filter expression"); } static bpf_u_int32 netmask; static int snaplen; int pcap_compile(pcap_t *p, struct bpf_program *program, char *buf, int optimize, bpf_u_int32 mask) { extern int n_errors; int len; n_errors = 0; root = NULL; bpf_pcap = p; if (setjmp(top_ctx)) { freechunks(); return (-1); } netmask = mask; snaplen = pcap_snapshot(p); lex_init(buf ? buf : ""); init_linktype(pcap_datalink(p)); (void)pcap_parse(); if (n_errors) syntax(); if (root == NULL) root = gen_retblk(snaplen); if (optimize) { bpf_optimize(&root); if (root == NULL || (root->s.code == (BPF_RET|BPF_K) && root->s.k == 0)) bpf_error("expression rejects all packets"); } program->bf_insns = icode_to_fcode(root, &len); program->bf_len = len; freechunks(); return (0); } /* * Backpatch the blocks in 'list' to 'target'. The 'sense' field indicates * which of the jt and jf fields has been resolved and which is a pointer * back to another unresolved block (or nil). At least one of the fields * in each block is already resolved. */ static void backpatch(list, target) struct block *list, *target; { struct block *next; while (list) { if (!list->sense) { next = JT(list); JT(list) = target; } else { next = JF(list); JF(list) = target; } list = next; } } /* * Merge the lists in b0 and b1, using the 'sense' field to indicate * which of jt and jf is the link. */ static void merge(b0, b1) struct block *b0, *b1; { register struct block **p = &b0; /* Find end of list. */ while (*p) p = !((*p)->sense) ? &JT(*p) : &JF(*p); /* Concatenate the lists. */ *p = b1; } void finish_parse(p) struct block *p; { backpatch(p, gen_retblk(snaplen)); p->sense = !p->sense; backpatch(p, gen_retblk(0)); root = p->head; } void gen_and(b0, b1) struct block *b0, *b1; { backpatch(b0, b1->head); b0->sense = !b0->sense; b1->sense = !b1->sense; merge(b1, b0); b1->sense = !b1->sense; b1->head = b0->head; } void gen_or(b0, b1) struct block *b0, *b1; { b0->sense = !b0->sense; backpatch(b0, b1->head); b0->sense = !b0->sense; merge(b1, b0); b1->head = b0->head; } void gen_not(b) struct block *b; { b->sense = !b->sense; } static struct block * gen_cmp(offset, size, v) u_int offset, size; bpf_int32 v; { struct slist *s; struct block *b; s = new_stmt(BPF_LD|BPF_ABS|size); s->s.k = offset; b = new_block(JMP(BPF_JEQ)); b->stmts = s; b->s.k = v; return b; } static struct block * gen_mcmp(offset, size, v, mask) u_int offset, size; bpf_int32 v; bpf_u_int32 mask; { struct block *b = gen_cmp(offset, size, v); struct slist *s; if (mask != 0xffffffff) { s = new_stmt(BPF_ALU|BPF_AND|BPF_K); s->s.k = mask; b->stmts->next = s; } return b; } static struct block * gen_bcmp(offset, size, v) register u_int offset, size; register const u_char *v; { register struct block *b, *tmp; b = NULL; while (size >= 4) { register const u_char *p = &v[size - 4]; bpf_int32 w = ((bpf_int32)p[0] << 24) | ((bpf_int32)p[1] << 16) | ((bpf_int32)p[2] << 8) | p[3]; tmp = gen_cmp(offset + size - 4, BPF_W, w); if (b != NULL) gen_and(b, tmp); b = tmp; size -= 4; } while (size >= 2) { register const u_char *p = &v[size - 2]; bpf_int32 w = ((bpf_int32)p[0] << 8) | p[1]; tmp = gen_cmp(offset + size - 2, BPF_H, w); if (b != NULL) gen_and(b, tmp); b = tmp; size -= 2; } if (size > 0) { tmp = gen_cmp(offset, BPF_B, (bpf_int32)v[0]); if (b != NULL) gen_and(b, tmp); b = tmp; } return b; } /* * Various code constructs need to know the layout of the data link * layer. These variables give the necessary offsets. off_linktype * is set to -1 for no encapsulation, in which case, IP is assumed. */ static u_int off_linktype; static u_int off_nl; static int linktype; static void init_linktype(type) int type; { linktype = type; switch (type) { case DLT_EN10MB: off_linktype = 12; off_nl = 14; return; case DLT_SLIP: /* * SLIP doesn't have a link level type. The 16 byte * header is hacked into our SLIP driver. */ off_linktype = -1; off_nl = 16; return; case DLT_SLIP_BSDOS: /* XXX this may be the same as the DLT_PPP_BSDOS case */ off_linktype = -1; /* XXX end */ off_nl = 24; return; case DLT_NULL: off_linktype = 0; off_nl = 4; return; case DLT_PPP: off_linktype = 2; off_nl = 4; return; case DLT_PPP_BSDOS: off_linktype = 5; off_nl = 24; return; case DLT_FDDI: /* * FDDI doesn't really have a link-level type field. * We assume that SSAP = SNAP is being used and pick * out the encapsulated Ethernet type. */ off_linktype = 19; #ifdef PCAP_FDDIPAD off_linktype += pcap_fddipad; #endif off_nl = 21; #ifdef PCAP_FDDIPAD off_nl += pcap_fddipad; #endif return; case DLT_IEEE802: off_linktype = 20; off_nl = 22; return; case DLT_ATM_RFC1483: /* * assume routed, non-ISO PDUs * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00) */ off_linktype = 6; off_nl = 8; return; case DLT_RAW: off_linktype = -1; off_nl = 0; return; } bpf_error("unknown data link type 0x%x", linktype); /* NOTREACHED */ } static struct block * gen_uncond(rsense) int rsense; { struct block *b; struct slist *s; s = new_stmt(BPF_LD|BPF_IMM); s->s.k = !rsense; b = new_block(JMP(BPF_JEQ)); b->stmts = s; return b; } static inline struct block * gen_true() { return gen_uncond(1); } static inline struct block * gen_false() { return gen_uncond(0); } static struct block * gen_linktype(proto) register int proto; { struct block *b0, *b1; /* If we're not using encapsulation and checking for IP, we're done */ if (off_linktype == -1 && proto == ETHERTYPE_IP) return gen_true(); switch (linktype) { case DLT_SLIP: return gen_false(); case DLT_PPP: if (proto == ETHERTYPE_IP) proto = PPP_IP; /* XXX was 0x21 */ break; case DLT_PPP_BSDOS: switch (proto) { case ETHERTYPE_IP: b0 = gen_cmp(off_linktype, BPF_H, PPP_IP); b1 = gen_cmp(off_linktype, BPF_H, PPP_VJC); gen_or(b0, b1); b0 = gen_cmp(off_linktype, BPF_H, PPP_VJNC); gen_or(b1, b0); return b0; case ETHERTYPE_DN: proto = PPP_DECNET; break; case ETHERTYPE_ATALK: proto = PPP_APPLE; break; case ETHERTYPE_NS: proto = PPP_NS; break; } break; case DLT_NULL: /* XXX */ if (proto == ETHERTYPE_IP) return (gen_cmp(0, BPF_W, (bpf_int32)htonl(AF_INET))); else return gen_false(); } return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); } static struct block * gen_hostop(addr, mask, dir, proto, src_off, dst_off) bpf_u_int32 addr; bpf_u_int32 mask; int dir, proto; u_int src_off, dst_off; { struct block *b0, *b1; u_int offset; switch (dir) { case Q_SRC: offset = src_off; break; case Q_DST: offset = dst_off; break; case Q_AND: b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); gen_and(b0, b1); return b1; case Q_OR: case Q_DEFAULT: b0 = gen_hostop(addr, mask, Q_SRC, proto, src_off, dst_off); b1 = gen_hostop(addr, mask, Q_DST, proto, src_off, dst_off); gen_or(b0, b1); return b1; default: abort(); } b0 = gen_linktype(proto); b1 = gen_mcmp(offset, BPF_W, (bpf_int32)addr, mask); gen_and(b0, b1); return b1; } static struct block * gen_ehostop(eaddr, dir) register const u_char *eaddr; register int dir; { register struct block *b0, *b1; switch (dir) { case Q_SRC: return gen_bcmp(6, 6, eaddr); case Q_DST: return gen_bcmp(0, 6, eaddr); case Q_AND: b0 = gen_ehostop(eaddr, Q_SRC); b1 = gen_ehostop(eaddr, Q_DST); gen_and(b0, b1); return b1; case Q_DEFAULT: case Q_OR: b0 = gen_ehostop(eaddr, Q_SRC); b1 = gen_ehostop(eaddr, Q_DST); gen_or(b0, b1); return b1; } abort(); /* NOTREACHED */ } /* * Like gen_ehostop, but for DLT_FDDI */ static struct block * gen_fhostop(eaddr, dir) register const u_char *eaddr; register int dir; { struct block *b0, *b1; switch (dir) { case Q_SRC: #ifdef PCAP_FDDIPAD return gen_bcmp(6 + 1 + pcap_fddipad, 6, eaddr); #else return gen_bcmp(6 + 1, 6, eaddr); #endif case Q_DST: #ifdef PCAP_FDDIPAD return gen_bcmp(0 + 1 + pcap_fddipad, 6, eaddr); #else return gen_bcmp(0 + 1, 6, eaddr); #endif case Q_AND: b0 = gen_fhostop(eaddr, Q_SRC); b1 = gen_fhostop(eaddr, Q_DST); gen_and(b0, b1); return b1; case Q_DEFAULT: case Q_OR: b0 = gen_fhostop(eaddr, Q_SRC); b1 = gen_fhostop(eaddr, Q_DST); gen_or(b0, b1); return b1; } abort(); /* NOTREACHED */ } /* * This is quite tricky because there may be pad bytes in front of the * DECNET header, and then there are two possible data packet formats that * carry both src and dst addresses, plus 5 packet types in a format that * carries only the src node, plus 2 types that use a different format and * also carry just the src node. * * Yuck. * * Instead of doing those all right, we just look for data packets with * 0 or 1 bytes of padding. If you want to look at other packets, that * will require a lot more hacking. * * To add support for filtering on DECNET "areas" (network numbers) * one would want to add a "mask" argument to this routine. That would * make the filter even more inefficient, although one could be clever * and not generate masking instructions if the mask is 0xFFFF. */ static struct block * gen_dnhostop(addr, dir, base_off) bpf_u_int32 addr; int dir; u_int base_off; { struct block *b0, *b1, *b2, *tmp; u_int offset_lh; /* offset if long header is received */ u_int offset_sh; /* offset if short header is received */ switch (dir) { case Q_DST: offset_sh = 1; /* follows flags */ offset_lh = 7; /* flgs,darea,dsubarea,HIORD */ break; case Q_SRC: offset_sh = 3; /* follows flags, dstnode */ offset_lh = 15; /* flgs,darea,dsubarea,did,sarea,ssub,HIORD */ break; case Q_AND: /* Inefficient because we do our Calvinball dance twice */ b0 = gen_dnhostop(addr, Q_SRC, base_off); b1 = gen_dnhostop(addr, Q_DST, base_off); gen_and(b0, b1); return b1; case Q_OR: case Q_DEFAULT: /* Inefficient because we do our Calvinball dance twice */ b0 = gen_dnhostop(addr, Q_SRC, base_off); b1 = gen_dnhostop(addr, Q_DST, base_off); gen_or(b0, b1); return b1; default: abort(); } b0 = gen_linktype(ETHERTYPE_DN); /* Check for pad = 1, long header case */ tmp = gen_mcmp(base_off + 2, BPF_H, (bpf_int32)ntohs(0x0681), (bpf_int32)ntohs(0x07FF)); b1 = gen_cmp(base_off + 2 + 1 + offset_lh, BPF_H, (bpf_int32)ntohs(addr)); gen_and(tmp, b1); /* Check for pad = 0, long header case */ tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x06, (bpf_int32)0x7); b2 = gen_cmp(base_off + 2 + offset_lh, BPF_H, (bpf_int32)ntohs(addr)); gen_and(tmp, b2); gen_or(b2, b1); /* Check for pad = 1, short header case */ tmp = gen_mcmp(base_off + 2, BPF_H, (bpf_int32)ntohs(0x0281), (bpf_int32)ntohs(0x07FF)); b2 = gen_cmp(base_off + 2 + 1 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); gen_and(tmp, b2); gen_or(b2, b1); /* Check for pad = 0, short header case */ tmp = gen_mcmp(base_off + 2, BPF_B, (bpf_int32)0x02, (bpf_int32)0x7); b2 = gen_cmp(base_off + 2 + offset_sh, BPF_H, (bpf_int32)ntohs(addr)); gen_and(tmp, b2); gen_or(b2, b1); /* Combine with test for linktype */ gen_and(b0, b1); return b1; } static struct block * gen_host(addr, mask, proto, dir) bpf_u_int32 addr; bpf_u_int32 mask; int proto; int dir; { struct block *b0, *b1; switch (proto) { case Q_DEFAULT: b0 = gen_host(addr, mask, Q_IP, dir); b1 = gen_host(addr, mask, Q_ARP, dir); gen_or(b0, b1); b0 = gen_host(addr, mask, Q_RARP, dir); gen_or(b1, b0); return b0; case Q_IP: return gen_hostop(addr, mask, dir, ETHERTYPE_IP, off_nl + 12, off_nl + 16); case Q_RARP: return gen_hostop(addr, mask, dir, ETHERTYPE_REVARP, off_nl + 14, off_nl + 24); case Q_ARP: return gen_hostop(addr, mask, dir, ETHERTYPE_ARP, off_nl + 14, off_nl + 24); case Q_TCP: bpf_error("'tcp' modifier applied to host"); case Q_UDP: bpf_error("'udp' modifier applied to host"); case Q_ICMP: bpf_error("'icmp' modifier applied to host"); case Q_IGMP: bpf_error("'igmp' modifier applied to host"); case Q_IGRP: bpf_error("'igrp' modifier applied to host"); case Q_ATALK: bpf_error("ATALK host filtering not implemented"); case Q_DECNET: return gen_dnhostop(addr, dir, off_nl); case Q_SCA: bpf_error("SCA host filtering not implemented"); case Q_LAT: bpf_error("LAT host filtering not implemented"); case Q_MOPDL: bpf_error("MOPDL host filtering not implemented"); case Q_MOPRC: bpf_error("MOPRC host filtering not implemented"); default: abort(); } /* NOTREACHED */ } static struct block * gen_gateway(eaddr, alist, proto, dir) const u_char *eaddr; bpf_u_int32 **alist; int proto; int dir; { struct block *b0, *b1, *tmp; if (dir != 0) bpf_error("direction applied to 'gateway'"); switch (proto) { case Q_DEFAULT: case Q_IP: case Q_ARP: case Q_RARP: if (linktype == DLT_EN10MB) b0 = gen_ehostop(eaddr, Q_OR); else if (linktype == DLT_FDDI) b0 = gen_fhostop(eaddr, Q_OR); else bpf_error( "'gateway' supported only on ethernet or FDDI"); b1 = gen_host(**alist++, 0xffffffff, proto, Q_OR); while (*alist) { tmp = gen_host(**alist++, 0xffffffff, proto, Q_OR); gen_or(b1, tmp); b1 = tmp; } gen_not(b1); gen_and(b0, b1); return b1; } bpf_error("illegal modifier of 'gateway'"); /* NOTREACHED */ } struct block * gen_proto_abbrev(proto) int proto; { struct block *b0, *b1; switch (proto) { case Q_TCP: b0 = gen_linktype(ETHERTYPE_IP); b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)IPPROTO_TCP); gen_and(b0, b1); break; case Q_UDP: b0 = gen_linktype(ETHERTYPE_IP); b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)IPPROTO_UDP); gen_and(b0, b1); break; case Q_ICMP: b0 = gen_linktype(ETHERTYPE_IP); b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)IPPROTO_ICMP); gen_and(b0, b1); break; case Q_IGMP: b0 = gen_linktype(ETHERTYPE_IP); b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)2); gen_and(b0, b1); break; #ifndef IPPROTO_IGRP #define IPPROTO_IGRP 9 #endif case Q_IGRP: b0 = gen_linktype(ETHERTYPE_IP); b1 = gen_cmp(off_nl + 9, BPF_B, (long)IPPROTO_IGRP); gen_and(b0, b1); break; case Q_IP: b1 = gen_linktype(ETHERTYPE_IP); break; case Q_ARP: b1 = gen_linktype(ETHERTYPE_ARP); break; case Q_RARP: b1 = gen_linktype(ETHERTYPE_REVARP); break; case Q_LINK: bpf_error("link layer applied in wrong context"); case Q_ATALK: b1 = gen_linktype(ETHERTYPE_ATALK); break; case Q_DECNET: b1 = gen_linktype(ETHERTYPE_DN); break; case Q_SCA: b1 = gen_linktype(ETHERTYPE_SCA); break; case Q_LAT: b1 = gen_linktype(ETHERTYPE_LAT); break; case Q_MOPDL: b1 = gen_linktype(ETHERTYPE_MOPDL); break; case Q_MOPRC: b1 = gen_linktype(ETHERTYPE_MOPRC); break; default: abort(); } return b1; } static struct block * gen_ipfrag() { struct slist *s; struct block *b; /* not ip frag */ s = new_stmt(BPF_LD|BPF_H|BPF_ABS); s->s.k = off_nl + 6; b = new_block(JMP(BPF_JSET)); b->s.k = 0x1fff; b->stmts = s; gen_not(b); return b; } static struct block * gen_portatom(off, v) int off; bpf_int32 v; { struct slist *s; struct block *b; s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); s->s.k = off_nl; s->next = new_stmt(BPF_LD|BPF_IND|BPF_H); s->next->s.k = off_nl + off; b = new_block(JMP(BPF_JEQ)); b->stmts = s; b->s.k = v; return b; } struct block * gen_portop(port, proto, dir) int port, proto, dir; { struct block *b0, *b1, *tmp; /* ip proto 'proto' */ tmp = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)proto); b0 = gen_ipfrag(); gen_and(tmp, b0); switch (dir) { case Q_SRC: b1 = gen_portatom(0, (bpf_int32)port); break; case Q_DST: b1 = gen_portatom(2, (bpf_int32)port); break; case Q_OR: case Q_DEFAULT: tmp = gen_portatom(0, (bpf_int32)port); b1 = gen_portatom(2, (bpf_int32)port); gen_or(tmp, b1); break; case Q_AND: tmp = gen_portatom(0, (bpf_int32)port); b1 = gen_portatom(2, (bpf_int32)port); gen_and(tmp, b1); break; default: abort(); } gen_and(b0, b1); return b1; } static struct block * gen_port(port, ip_proto, dir) int port; int ip_proto; int dir; { struct block *b0, *b1, *tmp; /* ether proto ip */ b0 = gen_linktype(ETHERTYPE_IP); switch (ip_proto) { case IPPROTO_UDP: case IPPROTO_TCP: b1 = gen_portop(port, ip_proto, dir); break; case PROTO_UNDEF: tmp = gen_portop(port, IPPROTO_TCP, dir); b1 = gen_portop(port, IPPROTO_UDP, dir); gen_or(tmp, b1); break; default: abort(); } gen_and(b0, b1); return b1; } static int lookup_proto(name, proto) register const char *name; register int proto; { register int v; switch (proto) { case Q_DEFAULT: case Q_IP: v = pcap_nametoproto(name); if (v == PROTO_UNDEF) bpf_error("unknown ip proto '%s'", name); break; case Q_LINK: /* XXX should look up h/w protocol type based on linktype */ v = pcap_nametoeproto(name); if (v == PROTO_UNDEF) bpf_error("unknown ether proto '%s'", name); break; default: v = PROTO_UNDEF; break; } return v; } static struct block * gen_proto(v, proto, dir) int v; int proto; int dir; { struct block *b0, *b1; if (dir != Q_DEFAULT) bpf_error("direction applied to 'proto'"); switch (proto) { case Q_DEFAULT: case Q_IP: b0 = gen_linktype(ETHERTYPE_IP); b1 = gen_cmp(off_nl + 9, BPF_B, (bpf_int32)v); gen_and(b0, b1); return b1; case Q_ARP: bpf_error("arp does not encapsulate another protocol"); /* NOTREACHED */ case Q_RARP: bpf_error("rarp does not encapsulate another protocol"); /* NOTREACHED */ case Q_ATALK: bpf_error("atalk encapsulation is not specifiable"); /* NOTREACHED */ case Q_DECNET: bpf_error("decnet encapsulation is not specifiable"); /* NOTREACHED */ case Q_SCA: bpf_error("sca does not encapsulate another protocol"); /* NOTREACHED */ case Q_LAT: bpf_error("lat does not encapsulate another protocol"); /* NOTREACHED */ case Q_MOPRC: bpf_error("moprc does not encapsulate another protocol"); /* NOTREACHED */ case Q_MOPDL: bpf_error("mopdl does not encapsulate another protocol"); /* NOTREACHED */ case Q_LINK: return gen_linktype(v); case Q_UDP: bpf_error("'udp proto' is bogus"); /* NOTREACHED */ case Q_TCP: bpf_error("'tcp proto' is bogus"); /* NOTREACHED */ case Q_ICMP: bpf_error("'icmp proto' is bogus"); /* NOTREACHED */ case Q_IGMP: bpf_error("'igmp proto' is bogus"); /* NOTREACHED */ case Q_IGRP: bpf_error("'igrp proto' is bogus"); /* NOTREACHED */ default: abort(); /* NOTREACHED */ } /* NOTREACHED */ } struct block * gen_scode(name, q) register const char *name; struct qual q; { int proto = q.proto; int dir = q.dir; int tproto; u_char *eaddr; bpf_u_int32 mask, addr, **alist; struct block *b, *tmp; int port, real_proto; switch (q.addr) { case Q_NET: addr = pcap_nametonetaddr(name); if (addr == 0) bpf_error("unknown network '%s'", name); /* Left justify network addr and calculate its network mask */ mask = 0xffffffff; while (addr && (addr & 0xff000000) == 0) { addr <<= 8; mask <<= 8; } return gen_host(addr, mask, proto, dir); case Q_DEFAULT: case Q_HOST: if (proto == Q_LINK) { switch (linktype) { case DLT_EN10MB: eaddr = pcap_ether_hostton(name); if (eaddr == NULL) bpf_error( "unknown ether host '%s'", name); return gen_ehostop(eaddr, dir); case DLT_FDDI: eaddr = pcap_ether_hostton(name); if (eaddr == NULL) bpf_error( "unknown FDDI host '%s'", name); return gen_fhostop(eaddr, dir); default: bpf_error( "only ethernet/FDDI supports link-level host name"); break; } } else if (proto == Q_DECNET) { unsigned short dn_addr = __pcap_nametodnaddr(name); /* * I don't think DECNET hosts can be multihomed, so * there is no need to build up a list of addresses */ return (gen_host(dn_addr, 0, proto, dir)); } else { alist = pcap_nametoaddr(name); if (alist == NULL || *alist == NULL) bpf_error("unknown host '%s'", name); tproto = proto; if (off_linktype == -1 && tproto == Q_DEFAULT) tproto = Q_IP; b = gen_host(**alist++, 0xffffffff, tproto, dir); while (*alist) { tmp = gen_host(**alist++, 0xffffffff, tproto, dir); gen_or(b, tmp); b = tmp; } return b; } case Q_PORT: if (proto != Q_DEFAULT && proto != Q_UDP && proto != Q_TCP) bpf_error("illegal qualifier of 'port'"); if (pcap_nametoport(name, &port, &real_proto) == 0) bpf_error("unknown port '%s'", name); if (proto == Q_UDP) { if (real_proto == IPPROTO_TCP) bpf_error("port '%s' is tcp", name); else /* override PROTO_UNDEF */ real_proto = IPPROTO_UDP; } if (proto == Q_TCP) { if (real_proto == IPPROTO_UDP) bpf_error("port '%s' is udp", name); else /* override PROTO_UNDEF */ real_proto = IPPROTO_TCP; } return gen_port(port, real_proto, dir); case Q_GATEWAY: eaddr = pcap_ether_hostton(name); if (eaddr == NULL) bpf_error("unknown ether host: %s", name); alist = pcap_nametoaddr(name); if (alist == NULL || *alist == NULL) bpf_error("unknown host '%s'", name); return gen_gateway(eaddr, alist, proto, dir); case Q_PROTO: real_proto = lookup_proto(name, proto); if (real_proto >= 0) return gen_proto(real_proto, proto, dir); else bpf_error("unknown protocol: %s", name); case Q_UNDEF: syntax(); /* NOTREACHED */ } abort(); /* NOTREACHED */ } struct block * gen_mcode(s1, s2, masklen, q) register const char *s1, *s2; register int masklen; struct qual q; { register int nlen, mlen; bpf_u_int32 n, m; nlen = __pcap_atoin(s1, &n); /* Promote short ipaddr */ n <<= 32 - nlen; if (s2 != NULL) { mlen = __pcap_atoin(s2, &m); /* Promote short ipaddr */ m <<= 32 - mlen; if ((n & ~m) != 0) bpf_error("non-network bits set in \"%s mask %s\"", s1, s2); } else { /* Convert mask len to mask */ if (masklen > 32) bpf_error("mask length must be <= 32"); m = 0xffffffff << (32 - masklen); if ((n & ~m) != 0) bpf_error("non-network bits set in \"%s/%d\"", s1, masklen); } switch (q.addr) { case Q_NET: return gen_host(n, m, q.proto, q.dir); default: bpf_error("Mask syntax for networks only"); /* NOTREACHED */ } } struct block * gen_ncode(s, v, q) register const char *s; bpf_u_int32 v; struct qual q; { bpf_u_int32 mask; int proto = q.proto; int dir = q.dir; register int vlen; if (s == NULL) vlen = 32; else if (q.proto == Q_DECNET) vlen = __pcap_atodn(s, &v); else vlen = __pcap_atoin(s, &v); switch (q.addr) { case Q_DEFAULT: case Q_HOST: case Q_NET: if (proto == Q_DECNET) return gen_host(v, 0, proto, dir); else if (proto == Q_LINK) { bpf_error("illegal link layer address"); } else { mask = 0xffffffff; if (s == NULL && q.addr == Q_NET) { /* Promote short net number */ while (v && (v & 0xff000000) == 0) { v <<= 8; mask <<= 8; } } else { /* Promote short ipaddr */ v <<= 32 - vlen; mask <<= 32 - vlen; } return gen_host(v, mask, proto, dir); } case Q_PORT: if (proto == Q_UDP) proto = IPPROTO_UDP; else if (proto == Q_TCP) proto = IPPROTO_TCP; else if (proto == Q_DEFAULT) proto = PROTO_UNDEF; else bpf_error("illegal qualifier of 'port'"); return gen_port((int)v, proto, dir); case Q_GATEWAY: bpf_error("'gateway' requires a name"); /* NOTREACHED */ case Q_PROTO: return gen_proto((int)v, proto, dir); case Q_UNDEF: syntax(); /* NOTREACHED */ default: abort(); /* NOTREACHED */ } /* NOTREACHED */ } struct block * gen_ecode(eaddr, q) register const u_char *eaddr; struct qual q; { if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) { if (linktype == DLT_EN10MB) return gen_ehostop(eaddr, (int)q.dir); if (linktype == DLT_FDDI) return gen_fhostop(eaddr, (int)q.dir); } bpf_error("ethernet address used in non-ether expression"); /* NOTREACHED */ } void sappend(s0, s1) struct slist *s0, *s1; { /* * This is definitely not the best way to do this, but the * lists will rarely get long. */ while (s0->next) s0 = s0->next; s0->next = s1; } static struct slist * xfer_to_x(a) struct arth *a; { struct slist *s; s = new_stmt(BPF_LDX|BPF_MEM); s->s.k = a->regno; return s; } static struct slist * xfer_to_a(a) struct arth *a; { struct slist *s; s = new_stmt(BPF_LD|BPF_MEM); s->s.k = a->regno; return s; } struct arth * gen_load(proto, index, size) int proto; struct arth *index; int size; { struct slist *s, *tmp; struct block *b; int regno = alloc_reg(); free_reg(index->regno); switch (size) { default: bpf_error("data size must be 1, 2, or 4"); case 1: size = BPF_B; break; case 2: size = BPF_H; break; case 4: size = BPF_W; break; } switch (proto) { default: bpf_error("unsupported index operation"); case Q_LINK: s = xfer_to_x(index); tmp = new_stmt(BPF_LD|BPF_IND|size); sappend(s, tmp); sappend(index->s, s); break; case Q_IP: case Q_ARP: case Q_RARP: case Q_ATALK: case Q_DECNET: case Q_SCA: case Q_LAT: case Q_MOPRC: case Q_MOPDL: /* XXX Note that we assume a fixed link link header here. */ s = xfer_to_x(index); tmp = new_stmt(BPF_LD|BPF_IND|size); tmp->s.k = off_nl; sappend(s, tmp); sappend(index->s, s); b = gen_proto_abbrev(proto); if (index->b) gen_and(index->b, b); index->b = b; break; case Q_TCP: case Q_UDP: case Q_ICMP: case Q_IGMP: case Q_IGRP: s = new_stmt(BPF_LDX|BPF_MSH|BPF_B); s->s.k = off_nl; sappend(s, xfer_to_a(index)); sappend(s, new_stmt(BPF_ALU|BPF_ADD|BPF_X)); sappend(s, new_stmt(BPF_MISC|BPF_TAX)); sappend(s, tmp = new_stmt(BPF_LD|BPF_IND|size)); tmp->s.k = off_nl; sappend(index->s, s); gen_and(gen_proto_abbrev(proto), b = gen_ipfrag()); if (index->b) gen_and(index->b, b); index->b = b; break; } index->regno = regno; s = new_stmt(BPF_ST); s->s.k = regno; sappend(index->s, s); return index; } struct block * gen_relation(code, a0, a1, reversed) int code; struct arth *a0, *a1; int reversed; { struct slist *s0, *s1, *s2; struct block *b, *tmp; s0 = xfer_to_x(a1); s1 = xfer_to_a(a0); s2 = new_stmt(BPF_ALU|BPF_SUB|BPF_X); b = new_block(JMP(code)); if (code == BPF_JGT || code == BPF_JGE) { reversed = !reversed; b->s.k = 0x80000000; } if (reversed) gen_not(b); sappend(s1, s2); sappend(s0, s1); sappend(a1->s, s0); sappend(a0->s, a1->s); b->stmts = a0->s; free_reg(a0->regno); free_reg(a1->regno); /* 'and' together protocol checks */ if (a0->b) { if (a1->b) { gen_and(a0->b, tmp = a1->b); } else tmp = a0->b; } else tmp = a1->b; if (tmp) gen_and(tmp, b); return b; } struct arth * gen_loadlen() { int regno = alloc_reg(); struct arth *a = (struct arth *)newchunk(sizeof(*a)); struct slist *s; s = new_stmt(BPF_LD|BPF_LEN); s->next = new_stmt(BPF_ST); s->next->s.k = regno; a->s = s; a->regno = regno; return a; } struct arth * gen_loadi(val) int val; { struct arth *a; struct slist *s; int reg; a = (struct arth *)newchunk(sizeof(*a)); reg = alloc_reg(); s = new_stmt(BPF_LD|BPF_IMM); s->s.k = val; s->next = new_stmt(BPF_ST); s->next->s.k = reg; a->s = s; a->regno = reg; return a; } struct arth * gen_neg(a) struct arth *a; { struct slist *s; s = xfer_to_a(a); sappend(a->s, s); s = new_stmt(BPF_ALU|BPF_NEG); s->s.k = 0; sappend(a->s, s); s = new_stmt(BPF_ST); s->s.k = a->regno; sappend(a->s, s); return a; } struct arth * gen_arth(code, a0, a1) int code; struct arth *a0, *a1; { struct slist *s0, *s1, *s2; s0 = xfer_to_x(a1); s1 = xfer_to_a(a0); s2 = new_stmt(BPF_ALU|BPF_X|code); sappend(s1, s2); sappend(s0, s1); sappend(a1->s, s0); sappend(a0->s, a1->s); free_reg(a1->regno); s0 = new_stmt(BPF_ST); a0->regno = s0->s.k = alloc_reg(); sappend(a0->s, s0); return a0; } /* * Here we handle simple allocation of the scratch registers. * If too many registers are alloc'd, the allocator punts. */ static int regused[BPF_MEMWORDS]; static int curreg; /* * Return the next free register. */ static int alloc_reg() { int n = BPF_MEMWORDS; while (--n >= 0) { if (regused[curreg]) curreg = (curreg + 1) % BPF_MEMWORDS; else { regused[curreg] = 1; return curreg; } } bpf_error("too many registers needed to evaluate expression"); /* NOTREACHED */ } /* * Return a register to the table so it can * be used later. */ static void free_reg(n) int n; { regused[n] = 0; } static struct block * gen_len(jmp, n) int jmp, n; { struct slist *s; struct block *b; s = new_stmt(BPF_LD|BPF_LEN); b = new_block(JMP(jmp)); b->stmts = s; b->s.k = n; return b; } struct block * gen_greater(n) int n; { return gen_len(BPF_JGE, n); } struct block * gen_less(n) int n; { struct block *b; b = gen_len(BPF_JGT, n); gen_not(b); return b; } struct block * gen_byteop(op, idx, val) int op, idx, val; { struct block *b; struct slist *s; switch (op) { default: abort(); case '=': return gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); case '<': b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); b->s.code = JMP(BPF_JGE); gen_not(b); return b; case '>': b = gen_cmp((u_int)idx, BPF_B, (bpf_int32)val); b->s.code = JMP(BPF_JGT); return b; case '|': s = new_stmt(BPF_ALU|BPF_OR|BPF_K); break; case '&': s = new_stmt(BPF_ALU|BPF_AND|BPF_K); break; } s->s.k = val; b = new_block(JMP(BPF_JEQ)); b->stmts = s; gen_not(b); return b; } struct block * gen_broadcast(proto) int proto; { bpf_u_int32 hostmask; struct block *b0, *b1, *b2; static u_char ebroadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; switch (proto) { case Q_DEFAULT: case Q_LINK: if (linktype == DLT_EN10MB) return gen_ehostop(ebroadcast, Q_DST); if (linktype == DLT_FDDI) return gen_fhostop(ebroadcast, Q_DST); bpf_error("not a broadcast link"); break; case Q_IP: b0 = gen_linktype(ETHERTYPE_IP); hostmask = ~netmask; b1 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)0, hostmask); b2 = gen_mcmp(off_nl + 16, BPF_W, (bpf_int32)(~0 & hostmask), hostmask); gen_or(b1, b2); gen_and(b0, b2); return b2; } bpf_error("only ether/ip broadcast filters supported"); } struct block * gen_multicast(proto) int proto; { register struct block *b0, *b1; register struct slist *s; switch (proto) { case Q_DEFAULT: case Q_LINK: if (linktype == DLT_EN10MB) { /* ether[0] & 1 != 0 */ s = new_stmt(BPF_LD|BPF_B|BPF_ABS); s->s.k = 0; b0 = new_block(JMP(BPF_JSET)); b0->s.k = 1; b0->stmts = s; return b0; } if (linktype == DLT_FDDI) { /* XXX TEST THIS: MIGHT NOT PORT PROPERLY XXX */ /* fddi[1] & 1 != 0 */ s = new_stmt(BPF_LD|BPF_B|BPF_ABS); s->s.k = 1; b0 = new_block(JMP(BPF_JSET)); b0->s.k = 1; b0->stmts = s; return b0; } /* Link not known to support multicasts */ break; case Q_IP: b0 = gen_linktype(ETHERTYPE_IP); b1 = gen_cmp(off_nl + 16, BPF_B, (bpf_int32)224); b1->s.code = JMP(BPF_JGE); gen_and(b0, b1); return b1; } bpf_error("only IP multicast filters supported on ethernet/FDDI"); } /* * generate command for inbound/outbound. It's here so we can * make it link-type specific. 'dir' = 0 implies "inbound", * = 1 implies "outbound". */ struct block * gen_inbound(dir) int dir; { register struct block *b0; b0 = gen_relation(BPF_JEQ, gen_load(Q_LINK, gen_loadi(0), 1), gen_loadi(0), dir); return (b0); } nmap-2.08/libpcap-possiblymodified/gencode.h100644 764 764 11100 6611214644 20224 0ustar fyodorfyodor/* * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/gencode.h,v 1.1 1998/10/15 04:39:58 fyodor Exp $ (LBL) */ /*XXX*/ #include "gnuc.h" /* Address qualifiers. */ #define Q_HOST 1 #define Q_NET 2 #define Q_PORT 3 #define Q_GATEWAY 4 #define Q_PROTO 5 /* Protocol qualifiers. */ #define Q_LINK 1 #define Q_IP 2 #define Q_ARP 3 #define Q_RARP 4 #define Q_TCP 5 #define Q_UDP 6 #define Q_ICMP 7 #define Q_IGMP 8 #define Q_IGRP 9 #define Q_ATALK 10 #define Q_DECNET 11 #define Q_LAT 12 #define Q_SCA 13 #define Q_MOPRC 14 #define Q_MOPDL 15 /* Directional qualifiers. */ #define Q_SRC 1 #define Q_DST 2 #define Q_OR 3 #define Q_AND 4 #define Q_DEFAULT 0 #define Q_UNDEF 255 struct stmt { int code; bpf_int32 k; }; struct slist { struct stmt s; struct slist *next; }; /* * A bit vector to represent definition sets. We assume TOT_REGISTERS * is smaller than 8*sizeof(atomset). */ typedef bpf_u_int32 atomset; #define ATOMMASK(n) (1 << (n)) #define ATOMELEM(d, n) (d & ATOMMASK(n)) /* * An unbounded set. */ typedef bpf_u_int32 *uset; /* * Total number of atomic entities, including accumulator (A) and index (X). * We treat all these guys similarly during flow analysis. */ #define N_ATOMS (BPF_MEMWORDS+2) struct edge { int id; int code; uset edom; struct block *succ; struct block *pred; struct edge *next; /* link list of incoming edges for a node */ }; struct block { int id; struct slist *stmts; /* side effect stmts */ struct stmt s; /* branch stmt */ int mark; int longjt; /* jt branch requires long jump */ int longjf; /* jf branch requires long jump */ int level; int offset; int sense; struct edge et; struct edge ef; struct block *head; struct block *link; /* link field used by optimizer */ uset dom; uset closure; struct edge *in_edges; atomset def, kill; atomset in_use; atomset out_use; int oval; int val[N_ATOMS]; }; struct arth { struct block *b; /* protocol checks */ struct slist *s; /* stmt list */ int regno; /* virtual register number of result */ }; struct qual { unsigned char addr; unsigned char proto; unsigned char dir; unsigned char pad; }; struct arth *gen_loadi(int); struct arth *gen_load(int, struct arth *, int); struct arth *gen_loadlen(void); struct arth *gen_neg(struct arth *); struct arth *gen_arth(int, struct arth *, struct arth *); void gen_and(struct block *, struct block *); void gen_or(struct block *, struct block *); void gen_not(struct block *); struct block *gen_scode(const char *, struct qual); struct block *gen_ecode(const u_char *, struct qual); struct block *gen_mcode(const char *, const char *, int, struct qual); struct block *gen_ncode(const char *, bpf_u_int32, struct qual); struct block *gen_proto_abbrev(int); struct block *gen_relation(int, struct arth *, struct arth *, int); struct block *gen_less(int); struct block *gen_greater(int); struct block *gen_byteop(int, int, int); struct block *gen_broadcast(int); struct block *gen_multicast(int); struct block *gen_inbound(int); void bpf_optimize(struct block **); #if __STDC__ __dead void bpf_error(const char *, ...) __attribute__((volatile, format (printf, 1, 2))); #endif void finish_parse(struct block *); char *sdup(const char *); struct bpf_insn *icode_to_fcode(struct block *, int *); int pcap_parse(void); void lex_init(char *); void sappend(struct slist *, struct slist *); /* XXX */ #define JT(b) ((b)->et.succ) #define JF(b) ((b)->ef.succ) nmap-2.08/libpcap-possiblymodified/grammar.y100644 764 764 16121 6611214646 20301 0ustar fyodorfyodor%{ /* * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/grammar.y,v 1.1 1998/10/15 04:39:58 fyodor Exp $ (LBL)"; #endif #include #include #include #if __STDC__ struct mbuf; struct rtentry; #endif #include #include #include #include #include "pcap-int.h" #include "gencode.h" #include #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif #define QSET(q, p, d, a) (q).proto = (p),\ (q).dir = (d),\ (q).addr = (a) int n_errors = 0; static struct qual qerr = { Q_UNDEF, Q_UNDEF, Q_UNDEF, Q_UNDEF }; static void yyerror(char *msg) { ++n_errors; bpf_error("%s", msg); /* NOTREACHED */ } #ifndef YYBISON int yyparse(void); int pcap_parse() { return (yyparse()); } #endif %} %union { int i; bpf_u_int32 h; u_char *e; char *s; struct stmt *stmt; struct arth *a; struct { struct qual q; struct block *b; } blk; struct block *rblk; } %type expr id nid pid term rterm qid %type head %type pqual dqual aqual ndaqual %type arth narth %type byteop pname pnum relop irelop %type and or paren not null prog %type other %token DST SRC HOST GATEWAY %token NET MASK PORT LESS GREATER PROTO BYTE %token ARP RARP IP TCP UDP ICMP IGMP IGRP %token ATALK DECNET LAT SCA MOPRC MOPDL %token TK_BROADCAST TK_MULTICAST %token NUM INBOUND OUTBOUND %token LINK %token GEQ LEQ NEQ %token ID EID HID %token LSH RSH %token LEN %type ID %type EID %type HID %type NUM %left OR AND %nonassoc '!' %left '|' %left '&' %left LSH RSH %left '+' '-' %left '*' '/' %nonassoc UMINUS %% prog: null expr { finish_parse($2.b); } | null ; null: /* null */ { $$.q = qerr; } ; expr: term | expr and term { gen_and($1.b, $3.b); $$ = $3; } | expr and id { gen_and($1.b, $3.b); $$ = $3; } | expr or term { gen_or($1.b, $3.b); $$ = $3; } | expr or id { gen_or($1.b, $3.b); $$ = $3; } ; and: AND { $$ = $0; } ; or: OR { $$ = $0; } ; id: nid | pnum { $$.b = gen_ncode(NULL, (bpf_u_int32)$1, $$.q = $0.q); } | paren pid ')' { $$ = $2; } ; nid: ID { $$.b = gen_scode($1, $$.q = $0.q); } | HID '/' NUM { $$.b = gen_mcode($1, NULL, $3, $$.q = $0.q); } | HID MASK HID { $$.b = gen_mcode($1, $3, 0, $$.q = $0.q); } | HID { /* Decide how to parse HID based on proto */ $$.q = $0.q; switch ($$.q.proto) { case Q_DECNET: $$.b = gen_ncode($1, 0, $$.q); break; default: $$.b = gen_ncode($1, 0, $$.q); break; } } | EID { $$.b = gen_ecode($1, $$.q = $0.q); } | not id { gen_not($2.b); $$ = $2; } ; not: '!' { $$ = $0; } ; paren: '(' { $$ = $0; } ; pid: nid | qid and id { gen_and($1.b, $3.b); $$ = $3; } | qid or id { gen_or($1.b, $3.b); $$ = $3; } ; qid: pnum { $$.b = gen_ncode(NULL, (bpf_u_int32)$1, $$.q = $0.q); } | pid ; term: rterm | not term { gen_not($2.b); $$ = $2; } ; head: pqual dqual aqual { QSET($$.q, $1, $2, $3); } | pqual dqual { QSET($$.q, $1, $2, Q_DEFAULT); } | pqual aqual { QSET($$.q, $1, Q_DEFAULT, $2); } | pqual PROTO { QSET($$.q, $1, Q_DEFAULT, Q_PROTO); } | pqual ndaqual { QSET($$.q, $1, Q_DEFAULT, $2); } ; rterm: head id { $$ = $2; } | paren expr ')' { $$.b = $2.b; $$.q = $1.q; } | pname { $$.b = gen_proto_abbrev($1); $$.q = qerr; } | arth relop arth { $$.b = gen_relation($2, $1, $3, 0); $$.q = qerr; } | arth irelop arth { $$.b = gen_relation($2, $1, $3, 1); $$.q = qerr; } | other { $$.b = $1; $$.q = qerr; } ; /* protocol level qualifiers */ pqual: pname | { $$ = Q_DEFAULT; } ; /* 'direction' qualifiers */ dqual: SRC { $$ = Q_SRC; } | DST { $$ = Q_DST; } | SRC OR DST { $$ = Q_OR; } | DST OR SRC { $$ = Q_OR; } | SRC AND DST { $$ = Q_AND; } | DST AND SRC { $$ = Q_AND; } ; /* address type qualifiers */ aqual: HOST { $$ = Q_HOST; } | NET { $$ = Q_NET; } | PORT { $$ = Q_PORT; } ; /* non-directional address type qualifiers */ ndaqual: GATEWAY { $$ = Q_GATEWAY; } ; pname: LINK { $$ = Q_LINK; } | IP { $$ = Q_IP; } | ARP { $$ = Q_ARP; } | RARP { $$ = Q_RARP; } | TCP { $$ = Q_TCP; } | UDP { $$ = Q_UDP; } | ICMP { $$ = Q_ICMP; } | IGMP { $$ = Q_IGMP; } | IGRP { $$ = Q_IGRP; } | ATALK { $$ = Q_ATALK; } | DECNET { $$ = Q_DECNET; } | LAT { $$ = Q_LAT; } | SCA { $$ = Q_SCA; } | MOPDL { $$ = Q_MOPDL; } | MOPRC { $$ = Q_MOPRC; } ; other: pqual TK_BROADCAST { $$ = gen_broadcast($1); } | pqual TK_MULTICAST { $$ = gen_multicast($1); } | LESS NUM { $$ = gen_less($2); } | GREATER NUM { $$ = gen_greater($2); } | BYTE NUM byteop NUM { $$ = gen_byteop($3, $2, $4); } | INBOUND { $$ = gen_inbound(0); } | OUTBOUND { $$ = gen_inbound(1); } ; relop: '>' { $$ = BPF_JGT; } | GEQ { $$ = BPF_JGE; } | '=' { $$ = BPF_JEQ; } ; irelop: LEQ { $$ = BPF_JGT; } | '<' { $$ = BPF_JGE; } | NEQ { $$ = BPF_JEQ; } ; arth: pnum { $$ = gen_loadi($1); } | narth ; narth: pname '[' arth ']' { $$ = gen_load($1, $3, 1); } | pname '[' arth ':' NUM ']' { $$ = gen_load($1, $3, $5); } | arth '+' arth { $$ = gen_arth(BPF_ADD, $1, $3); } | arth '-' arth { $$ = gen_arth(BPF_SUB, $1, $3); } | arth '*' arth { $$ = gen_arth(BPF_MUL, $1, $3); } | arth '/' arth { $$ = gen_arth(BPF_DIV, $1, $3); } | arth '&' arth { $$ = gen_arth(BPF_AND, $1, $3); } | arth '|' arth { $$ = gen_arth(BPF_OR, $1, $3); } | arth LSH arth { $$ = gen_arth(BPF_LSH, $1, $3); } | arth RSH arth { $$ = gen_arth(BPF_RSH, $1, $3); } | '-' arth %prec UMINUS { $$ = gen_neg($2); } | paren narth ')' { $$ = $2; } | LEN { $$ = gen_loadlen(); } ; byteop: '&' { $$ = '&'; } | '|' { $$ = '|'; } | '<' { $$ = '<'; } | '>' { $$ = '>'; } | '=' { $$ = '='; } ; pnum: NUM | paren pnum ')' { $$ = $2; } ; %% nmap-2.08/libpcap-possiblymodified/inet.c100644 764 764 14432 6611214647 17570 0ustar fyodorfyodor/* * Copyright (c) 1994, 1995, 1996, 1997, 1998 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the Computer Systems * Engineering Group at Lawrence Berkeley Laboratory. * 4. Neither the name of the University nor of the Laboratory may be used * to endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/inet.c,v 1.1 1998/10/15 04:39:58 fyodor Exp $ (LBL)"; #endif #include #include #include #include #ifdef HAVE_SYS_SOCKIO_H #include #endif #include /* concession to AIX */ #if __STDC__ struct mbuf; struct rtentry; #endif #include #include #include #include #include #include #include #include #include #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif /* Not all systems have IFF_LOOPBACK */ #ifdef IFF_LOOPBACK #define ISLOOPBACK(p) ((p)->ifr_flags & IFF_LOOPBACK) #else #define ISLOOPBACK(p) ((p)->ifr_name[0] == 'l' && (p)->ifr_name[1] == 'o' && \ (isdigit((p)->ifr_name[2]) || (p)->ifr_name[2] == '\0')) #endif /* * Return the name of a network interface attached to the system, or NULL * if none can be found. The interface must be configured up; the * lowest unit number is preferred; loopback is ignored. */ char * pcap_lookupdev(errbuf) register char *errbuf; { register int fd, minunit, n; register char *cp; register struct ifreq *ifrp, *ifend, *ifnext, *mp; struct ifconf ifc; struct ifreq ibuf[16], ifr; static char device[sizeof(ifrp->ifr_name) + 1]; fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { (void)sprintf(errbuf, "socket: %s", pcap_strerror(errno)); return (NULL); } ifc.ifc_len = sizeof ibuf; ifc.ifc_buf = (caddr_t)ibuf; memset((char *)ibuf, 0, sizeof(ibuf)); if (ioctl(fd, SIOCGIFCONF, (char *)&ifc) < 0 || ifc.ifc_len < sizeof(struct ifreq)) { (void)sprintf(errbuf, "SIOCGIFCONF: %s", pcap_strerror(errno)); (void)close(fd); return (NULL); } ifrp = ibuf; ifend = (struct ifreq *)((char *)ibuf + ifc.ifc_len); mp = NULL; minunit = 666; for (; ifrp < ifend; ifrp = ifnext) { #ifdef HAVE_SOCKADDR_SA_LEN n = ifrp->ifr_addr.sa_len + sizeof(ifrp->ifr_name); if (n < sizeof(*ifrp)) ifnext = ifrp + 1; else ifnext = (struct ifreq *)((char *)ifrp + n); if (ifrp->ifr_addr.sa_family != AF_INET) continue; #else ifnext = ifrp + 1; #endif /* * Need a template to preserve address info that is * used below to locate the next entry. (Otherwise, * SIOCGIFFLAGS stomps over it because the requests * are returned in a union.) */ strncpy(ifr.ifr_name, ifrp->ifr_name, sizeof(ifr.ifr_name)); if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) { if (errno == ENXIO) continue; (void)sprintf(errbuf, "SIOCGIFFLAGS: %.*s: %s", (int)sizeof(ifr.ifr_name), ifr.ifr_name, pcap_strerror(errno)); (void)close(fd); return (NULL); } /* Must be up and not the loopback */ if ((ifr.ifr_flags & IFF_UP) == 0 || ISLOOPBACK(&ifr)) continue; for (cp = ifrp->ifr_name; !isdigit(*cp); ++cp) continue; n = atoi(cp); if (n < minunit) { minunit = n; mp = ifrp; } } (void)close(fd); if (mp == NULL) { (void)strcpy(errbuf, "no suitable device found"); return (NULL); } (void)strncpy(device, mp->ifr_name, sizeof(device) - 1); device[sizeof(device) - 1] = '\0'; return (device); } int pcap_lookupnet(device, netp, maskp, errbuf) register char *device; register bpf_u_int32 *netp, *maskp; register char *errbuf; { register int fd; register struct sockaddr_in *sin; struct ifreq ifr; fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { (void)sprintf(errbuf, "socket: %s", pcap_strerror(errno)); return (-1); } memset(&ifr, 0, sizeof(ifr)); #ifdef linux /* XXX Work around Linux kernel bug */ ifr.ifr_addr.sa_family = AF_INET; #endif (void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); if (ioctl(fd, SIOCGIFADDR, (char *)&ifr) < 0) { (void)sprintf(errbuf, "SIOCGIFADDR: %s: %s", device, pcap_strerror(errno)); (void)close(fd); return (-1); } sin = (struct sockaddr_in *)&ifr.ifr_addr; *netp = sin->sin_addr.s_addr; if (ioctl(fd, SIOCGIFNETMASK, (char *)&ifr) < 0) { (void)sprintf(errbuf, "SIOCGIFNETMASK: %s: %s", device, pcap_strerror(errno)); (void)close(fd); return (-1); } (void)close(fd); *maskp = sin->sin_addr.s_addr; if (*maskp == 0) { if (IN_CLASSA(*netp)) *maskp = IN_CLASSA_NET; else if (IN_CLASSB(*netp)) *maskp = IN_CLASSB_NET; else if (IN_CLASSC(*netp)) *maskp = IN_CLASSC_NET; else { (void)sprintf(errbuf, "inet class for 0x%x unknown", *netp); return (-1); } } *netp &= *maskp; return (0); } nmap-2.08/libpcap-possiblymodified/install-sh100555 764 764 12721 6247663000 20462 0ustar fyodorfyodor#! /bin/sh # # install - install a program, script, or datafile # This comes from X11R5 (mit/util/scripts/install.sh). # # Copyright 1991 by the Massachusetts Institute of Technology # # Permission to use, copy, modify, distribute, and sell this software and its # documentation for any purpose is hereby granted without fee, provided that # the above copyright notice appear in all copies and that both that # copyright notice and this permission notice appear in supporting # documentation, and that the name of M.I.T. not be used in advertising or # publicity pertaining to distribution of the software without specific, # written prior permission. M.I.T. makes no representations about the # suitability of this software for any purpose. It is provided "as is" # without express or implied warranty. # # Calling this script install-sh is preferred over install.sh, to prevent # `make' implicit rules from creating a file called install from it # when there is no Makefile. # # This script is compatible with the BSD install script, but was written # from scratch. It can only install one file at a time, a restriction # shared with many OS's install programs. # set DOITPROG to echo to test this script # Don't use :- since 4.3BSD and earlier shells don't like it. doit="${DOITPROG-}" # put in absolute paths if you don't have them in your path; or use env. vars. mvprog="${MVPROG-mv}" cpprog="${CPPROG-cp}" chmodprog="${CHMODPROG-chmod}" chownprog="${CHOWNPROG-chown}" chgrpprog="${CHGRPPROG-chgrp}" stripprog="${STRIPPROG-strip}" rmprog="${RMPROG-rm}" mkdirprog="${MKDIRPROG-mkdir}" transformbasename="" transform_arg="" instcmd="$mvprog" chmodcmd="$chmodprog 0755" chowncmd="" chgrpcmd="" stripcmd="" rmcmd="$rmprog -f" mvcmd="$mvprog" src="" dst="" dir_arg="" while [ x"$1" != x ]; do case $1 in -c) instcmd="$cpprog" shift continue;; -d) dir_arg=true shift continue;; -m) chmodcmd="$chmodprog $2" shift shift continue;; -o) chowncmd="$chownprog $2" shift shift continue;; -g) chgrpcmd="$chgrpprog $2" shift shift continue;; -s) stripcmd="$stripprog" shift continue;; -t=*) transformarg=`echo $1 | sed 's/-t=//'` shift continue;; -b=*) transformbasename=`echo $1 | sed 's/-b=//'` shift continue;; *) if [ x"$src" = x ] then src=$1 else # this colon is to work around a 386BSD /bin/sh bug : dst=$1 fi shift continue;; esac done if [ x"$src" = x ] then echo "install: no input file specified" exit 1 else true fi if [ x"$dir_arg" != x ]; then dst=$src src="" if [ -d $dst ]; then instcmd=: else instcmd=mkdir fi else # Waiting for this to be detected by the "$instcmd $src $dsttmp" command # might cause directories to be created, which would be especially bad # if $src (and thus $dsttmp) contains '*'. if [ -f $src -o -d $src ] then true else echo "install: $src does not exist" exit 1 fi if [ x"$dst" = x ] then echo "install: no destination specified" exit 1 else true fi # If destination is a directory, append the input filename; if your system # does not like double slashes in filenames, you may need to add some logic if [ -d $dst ] then dst="$dst"/`basename $src` else true fi fi ## this sed command emulates the dirname command dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'` # Make sure that the destination directory exists. # this part is taken from Noah Friedman's mkinstalldirs script # Skip lots of stat calls in the usual case. if [ ! -d "$dstdir" ]; then defaultIFS=' ' IFS="${IFS-${defaultIFS}}" oIFS="${IFS}" # Some sh's can't handle IFS=/ for some reason. IFS='%' set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'` IFS="${oIFS}" pathcomp='' while [ $# -ne 0 ] ; do pathcomp="${pathcomp}${1}" shift if [ ! -d "${pathcomp}" ] ; then $mkdirprog "${pathcomp}" else true fi pathcomp="${pathcomp}/" done fi if [ x"$dir_arg" != x ] then $doit $instcmd $dst && if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else true ; fi && if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else true ; fi && if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else true ; fi && if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else true ; fi else # If we're going to rename the final executable, determine the name now. if [ x"$transformarg" = x ] then dstfile=`basename $dst` else dstfile=`basename $dst $transformbasename | sed $transformarg`$transformbasename fi # don't allow the sed command to completely eliminate the filename if [ x"$dstfile" = x ] then dstfile=`basename $dst` else true fi # Make a temp file name in the proper directory. dsttmp=$dstdir/#inst.$$# # Move or copy the file name to the temp name $doit $instcmd $src $dsttmp && trap "rm -f ${dsttmp}" 0 && # and set any options; do chmod last to preserve setuid bits # If any of these fail, we abort the whole thing. If we want to # ignore errors from any of these, just make sure not to ignore # errors from the above "$doit $instcmd $src $dsttmp" command. if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else true;fi && if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else true;fi && if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else true;fi && if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else true;fi && # Now rename the file to the real destination. $doit $rmcmd -f $dstdir/$dstfile && $doit $mvcmd $dsttmp $dstdir/$dstfile fi && exit 0 nmap-2.08/libpcap-possiblymodified/lbl/ 40755 764 764 0 6662341762 17122 5ustar fyodorfyodornmap-2.08/libpcap-possiblymodified/lbl/gnuc.h100644 764 764 1375 6611213336 20317 0ustar fyodorfyodor/* @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/lbl/gnuc.h,v 1.1 1998/10/15 04:28:36 fyodor Exp $ (LBL) */ /* Define __P() macro, if necessary */ #ifndef __P #if __STDC__ #define __P(protos) protos #else #define __P(protos) () #endif #endif /* inline foo */ #ifdef __GNUC__ #define inline __inline #else #define inline #endif /* * Handle new and old "dead" routine prototypes * * For example: * * __dead void foo(void) __attribute__((volatile)); * */ #ifdef __GNUC__ #ifndef __dead #define __dead volatile #endif #if __GNUC__ < 2 || (__GNUC__ == 2 && __GNUC_MINOR__ < 5) #ifndef __attribute__ #define __attribute__(args) #endif #endif #else #ifndef __dead #define __dead #endif #ifndef __attribute__ #define __attribute__(args) #endif #endif nmap-2.08/libpcap-possiblymodified/lbl/os-solaris2.h100644 764 764 4255 6611213336 21540 0ustar fyodorfyodor/* * Copyright (c) 1993, 1994, 1995, 1996, 1997 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/lbl/os-solaris2.h,v 1.1 1998/10/15 04:28:36 fyodor Exp $ (LBL) */ /* Prototypes missing in SunOS 5 */ int daemon(int, int); int dn_expand(const u_char *, const u_char *, const u_char *, char *, int); int dn_skipname(const u_char *, const u_char *); int flock(int, int); int getdtablesize(void); int gethostname(char *, int); int getpagesize(void); char *getusershell(void); char *getwd(char *); int iruserok(u_int, int, char *, char *); #ifdef __STDC__ struct utmp; void login(struct utmp *); #endif int logout(const char *); int res_query(const char *, int, int, u_char *, int); int setenv(const char *, const char *, int); #if defined(_STDIO_H) && defined(HAVE_SETLINEBUF) int setlinebuf(FILE *); #endif int sigblock(int); int sigsetmask(int); char *strerror(int); int snprintf(char *, size_t, const char *, ...); int strcasecmp(const char *, const char *); void unsetenv(const char *); #ifdef __STDC__ struct timeval; #endif int utimes(const char *, struct timeval *); nmap-2.08/libpcap-possiblymodified/lbl/os-sunos4.h100644 764 764 14216 6611213337 21254 0ustar fyodorfyodor/* * Copyright (c) 1989, 1990, 1993, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/lbl/os-sunos4.h,v 1.1 1998/10/15 04:28:36 fyodor Exp $ (LBL) */ /* Prototypes missing in SunOS 4 */ #ifdef FILE int _filbuf(FILE *); int _flsbuf(u_char, FILE *); int fclose(FILE *); int fflush(FILE *); int fgetc(FILE *); int fprintf(FILE *, const char *, ...); int fputc(int, FILE *); int fputs(const char *, FILE *); u_int fread(void *, u_int, u_int, FILE *); int fseek(FILE *, long, int); u_int fwrite(const void *, u_int, u_int, FILE *); int pclose(FILE *); void rewind(FILE *); void setbuf(FILE *, char *); int setlinebuf(FILE *); int ungetc(int, FILE *); int vfprintf(FILE *, const char *, ...); int vprintf(const char *, ...); #endif #if __GNUC__ <= 1 int read(int, char *, u_int); int write(int, char *, u_int); #endif long a64l(const char *); #ifdef __STDC__ struct sockaddr; #endif int accept(int, struct sockaddr *, int *); int bind(int, struct sockaddr *, int); int bcmp(const void *, const void *, u_int); void bcopy(const void *, void *, u_int); void bzero(void *, int); int chroot(const char *); int close(int); void closelog(void); int connect(int, struct sockaddr *, int); char *crypt(const char *, const char *); int daemon(int, int); int fchmod(int, int); int fchown(int, int, int); void endgrent(void); void endpwent(void); void endservent(void); #ifdef __STDC__ struct ether_addr; #endif struct ether_addr *ether_aton(const char *); int flock(int, int); #ifdef __STDC__ struct stat; #endif int fstat(int, struct stat *); #ifdef __STDC__ struct statfs; #endif int fstatfs(int, struct statfs *); int fsync(int); #ifdef __STDC__ struct timeb; #endif int ftime(struct timeb *); int ftruncate(int, off_t); int getdtablesize(void); long gethostid(void); int gethostname(char *, int); int getopt(int, char * const *, const char *); int getpagesize(void); char *getpass(char *); int getpeername(int, struct sockaddr *, int *); int getpriority(int, int); #ifdef __STDC__ struct rlimit; #endif int getrlimit(int, struct rlimit *); int getsockname(int, struct sockaddr *, int *); int getsockopt(int, int, int, char *, int *); #ifdef __STDC__ struct timeval; struct timezone; #endif int gettimeofday(struct timeval *, struct timezone *); char *getusershell(void); char *getwd(char *); int initgroups(const char *, int); int ioctl(int, int, caddr_t); int iruserok(u_long, int, char *, char *); int isatty(int); int killpg(int, int); int listen(int, int); #ifdef __STDC__ struct utmp; #endif void login(struct utmp *); int logout(const char *); off_t lseek(int, off_t, int); int lstat(const char *, struct stat *); int mkstemp(char *); char *mktemp(char *); int munmap(caddr_t, int); void openlog(const char *, int, int); void perror(const char *); int printf(const char *, ...); int puts(const char *); long random(void); int readlink(const char *, char *, int); #ifdef __STDC__ struct iovec; #endif int readv(int, struct iovec *, int); int recv(int, char *, u_int, int); int recvfrom(int, char *, u_int, int, struct sockaddr *, int *); int rename(const char *, const char *); int rcmd(char **, u_short, char *, char *, char *, int *); int rresvport(int *); int send(int, char *, u_int, int); int sendto(int, char *, u_int, int, struct sockaddr *, int); int setenv(const char *, const char *, int); int seteuid(int); int setpriority(int, int, int); int select(int, fd_set *, fd_set *, fd_set *, struct timeval *); int setpgrp(int, int); void setpwent(void); int setrlimit(int, struct rlimit *); void setservent(int); int setsockopt(int, int, int, char *, int); int shutdown(int, int); int sigblock(int); void (*signal (int, void (*) (int))) (int); int sigpause(int); int sigsetmask(int); #ifdef __STDC__ struct sigvec; #endif int sigvec(int, struct sigvec *, struct sigvec*); int snprintf(char *, size_t, const char *, ...); int socket(int, int, int); int socketpair(int, int, int, int *); int symlink(const char *, const char *); void srandom(int); int sscanf(char *, const char *, ...); int stat(const char *, struct stat *); int statfs(char *, struct statfs *); char *strerror(int); int strcasecmp(const char *, const char *); #ifdef __STDC__ struct tm; #endif int strftime(char *, int, char *, struct tm *); int strncasecmp(const char *, const char *, int); long strtol(const char *, char **, int); void sync(void); void syslog(int, const char *, ...); int system(const char *); long tell(int); time_t time(time_t *); char *timezone(int, int); int tolower(int); int toupper(int); int truncate(char *, off_t); void unsetenv(const char *); int vfork(void); int vsprintf(char *, const char *, ...); int writev(int, struct iovec *, int); #ifdef __STDC__ struct rusage; #endif int utimes(const char *, struct timeval *); #if __GNUC__ <= 1 int wait(int *); pid_t wait3(int *, int, struct rusage *); #endif /* Ugly signal hacking */ #ifdef SIG_ERR #undef SIG_ERR #define SIG_ERR (void (*)(int))-1 #undef SIG_DFL #define SIG_DFL (void (*)(int))0 #undef SIG_IGN #define SIG_IGN (void (*)(int))1 #ifdef KERNEL #undef SIG_CATCH #define SIG_CATCH (void (*)(int))2 #endif #undef SIG_HOLD #define SIG_HOLD (void (*)(int))3 #endif nmap-2.08/libpcap-possiblymodified/lbl/os-ultrix4.h100644 764 764 3400 6611213340 21377 0ustar fyodorfyodor/* * Copyright (c) 1990, 1993, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/lbl/os-ultrix4.h,v 1.1 1998/10/15 04:28:36 fyodor Exp $ (LBL) */ /* Prototypes missing in Ultrix 4 */ int bcmp(const char *, const char *, u_int); void bcopy(const void *, void *, u_int); void bzero(void *, u_int); void endservent(void); int getopt(int, char * const *, const char *); #ifdef __STDC__ struct timeval; struct timezone; #endif int gettimeofday(struct timeval *, struct timezone *); int ioctl(int, int, caddr_t); int pfopen(char *, int); int setlinebuf(FILE *); int socket(int, int, int); int strcasecmp(const char *, const char *); nmap-2.08/libpcap-possiblymodified/linux-include/ 40755 764 764 0 6662341762 21131 5ustar fyodorfyodornmap-2.08/libpcap-possiblymodified/linux-include/netinet/ 40755 764 764 0 6662341762 22577 5ustar fyodorfyodornmap-2.08/libpcap-possiblymodified/linux-include/netinet/if_ether.h100444 764 764 6403 6247535752 24636 0ustar fyodorfyodor/* * Copyright (c) 1982, 1986, 1993 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the University of * California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)if_ether.h 8.3 (Berkeley) 5/2/95 */ #include /* * Ethernet address - 6 octets */ struct ether_addr { u_char ether_addr_octet[6]; }; /* * Structure of a 10Mb/s Ethernet header. */ struct ether_header { u_char ether_dhost[6]; u_char ether_shost[6]; u_short ether_type; }; #define ETHERTYPE_PUP 0x0200 /* PUP protocol */ #define ETHERTYPE_IP 0x0800 /* IP protocol */ #define ETHERTYPE_ARP 0x0806 /* Addr. resolution protocol */ #define ETHERTYPE_REVARP 0x8035 /* reverse Addr. resolution protocol */ /* * The ETHERTYPE_NTRAILER packet types starting at ETHERTYPE_TRAIL have * (type-ETHERTYPE_TRAIL)*512 bytes of data followed * by an ETHER type (as given above) and then the (variable-length) header. */ #define ETHERTYPE_TRAIL 0x1000 /* Trailer packet */ #define ETHERTYPE_NTRAILER 16 #define ETHERMTU 1500 #define ETHERMIN (60-14) /* * Ethernet Address Resolution Protocol. * * See RFC 826 for protocol description. Structure below is adapted * to resolving internet addresses. Field names used correspond to * RFC 826. */ struct ether_arp { struct arphdr ea_hdr; /* fixed-size header */ u_char arp_sha[6]; /* sender hardware address */ u_char arp_spa[4]; /* sender protocol address */ u_char arp_tha[6]; /* target hardware address */ u_char arp_tpa[4]; /* target protocol address */ }; #define arp_hrd ea_hdr.ar_hrd #define arp_pro ea_hdr.ar_pro #define arp_hln ea_hdr.ar_hln #define arp_pln ea_hdr.ar_pln #define arp_op ea_hdr.ar_op nmap-2.08/libpcap-possiblymodified/linux-include/netinet/ip_var.h100444 764 764 15653 6464504205 24346 0ustar fyodorfyodor/* * Copyright (c) 1982, 1986, 1993 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the University of * California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)ip_var.h 8.2 (Berkeley) 1/9/95 */ #include /* * Overlay for ip header used by other protocols (tcp, udp). */ struct ipovly { caddr_t ih_next, ih_prev; /* for protocol sequence q's */ u_char ih_x1; /* (unused) */ u_char ih_pr; /* protocol */ short ih_len; /* protocol length */ struct in_addr ih_src; /* source internet address */ struct in_addr ih_dst; /* destination internet address */ }; /* * Ip reassembly queue structure. Each fragment * being reassembled is attached to one of these structures. * They are timed out after ipq_ttl drops to 0, and may also * be reclaimed if memory becomes tight. */ struct ipq { struct ipq *next,*prev; /* to other reass headers */ u_char ipq_ttl; /* time for reass q to live */ u_char ipq_p; /* protocol of this fragment */ u_short ipq_id; /* sequence id for reassembly */ struct ipasfrag *ipq_next,*ipq_prev; /* to ip headers of fragments */ struct in_addr ipq_src,ipq_dst; }; /* * Ip header, when holding a fragment. * * Note: ipf_next must be at same offset as ipq_next above */ struct ipasfrag { #if BYTE_ORDER == LITTLE_ENDIAN u_char ip_hl:4, ip_v:4; #endif #if BYTE_ORDER == BIG_ENDIAN u_char ip_v:4, ip_hl:4; #endif u_char ipf_mff; /* XXX overlays ip_tos: use low bit * to avoid destroying tos; * copied from (ip_off&IP_MF) */ short ip_len; u_short ip_id; short ip_off; u_char ip_ttl; u_char ip_p; u_short ip_sum; struct ipasfrag *ipf_next; /* next fragment */ struct ipasfrag *ipf_prev; /* previous fragment */ }; /* * Structure stored in mbuf in inpcb.ip_options * and passed to ip_output when ip options are in use. * The actual length of the options (including ipopt_dst) * is in m_len. */ #define MAX_IPOPTLEN 40 struct ipoption { struct in_addr ipopt_dst; /* first-hop dst if source routed */ char ipopt_list[MAX_IPOPTLEN]; /* options proper */ }; struct ipstat { n_long ips_total; /* total packets received */ n_long ips_badsum; /* checksum bad */ n_long ips_tooshort; /* packet too short */ n_long ips_toosmall; /* not enough data */ n_long ips_badhlen; /* ip header length < data size */ n_long ips_badlen; /* ip length < ip header length */ n_long ips_fragments; /* fragments received */ n_long ips_fragdropped; /* frags dropped (dups, out of space) */ n_long ips_fragtimeout; /* fragments timed out */ n_long ips_forward; /* packets forwarded */ n_long ips_cantforward; /* packets rcvd for unreachable dest */ n_long ips_redirectsent; /* packets forwarded on same net */ n_long ips_noproto; /* unknown or unsupported protocol */ n_long ips_delivered; /* datagrams delivered to upper level*/ n_long ips_localout; /* total ip packets generated here */ n_long ips_odropped; /* lost packets due to nobufs, etc. */ n_long ips_reassembled; /* total packets reassembled ok */ n_long ips_fragmented; /* datagrams sucessfully fragmented */ n_long ips_ofragments; /* output fragments created */ n_long ips_cantfrag; /* don't fragment flag was set, etc. */ n_long ips_badoptions; /* error in option processing */ n_long ips_noroute; /* packets discarded due to no route */ n_long ips_badvers; /* ip version != 4 */ n_long ips_rawout; /* total raw ip packets generated */ }; #ifdef KERNEL /* flags passed to ip_output as last parameter */ #define IP_FORWARDING 0x1 /* most of ip header exists */ #define IP_RAWOUTPUT 0x2 /* raw ip header exists */ #define IP_ROUTETOIF SO_DONTROUTE /* bypass routing tables */ #define IP_ALLOWBROADCAST SO_BROADCAST /* can send broadcast packets */ struct ipstat ipstat; struct ipq ipq; /* ip reass. queue */ u_short ip_id; /* ip packet ctr, for ids */ int ip_defttl; /* default IP ttl */ int in_control __P((struct socket *, n_long, caddr_t, struct ifnet *)); int ip_ctloutput __P((int, struct socket *, int, int, struct mbuf **)); void ip_deq __P((struct ipasfrag *)); int ip_dooptions __P((struct mbuf *)); void ip_drain __P((void)); void ip_enq __P((struct ipasfrag *, struct ipasfrag *)); void ip_forward __P((struct mbuf *, int)); void ip_freef __P((struct ipq *)); void ip_freemoptions __P((struct ip_moptions *)); int ip_getmoptions __P((int, struct ip_moptions *, struct mbuf **)); void ip_init __P((void)); int ip_mforward __P((struct mbuf *, struct ifnet *)); int ip_optcopy __P((struct ip *, struct ip *)); int ip_output __P((struct mbuf *, struct mbuf *, struct route *, int, struct ip_moptions *)); int ip_pcbopts __P((struct mbuf **, struct mbuf *)); struct ip * ip_reass __P((struct ipasfrag *, struct ipq *)); struct in_ifaddr * ip_rtaddr __P((struct in_addr)); int ip_setmoptions __P((int, struct ip_moptions **, struct mbuf *)); void ip_slowtimo __P((void)); struct mbuf * ip_srcroute __P((void)); void ip_stripoptions __P((struct mbuf *, struct mbuf *)); int ip_sysctl __P((int *, n_long, void *, size_t *, void *, size_t)); void ipintr __P((void)); int rip_ctloutput __P((int, struct socket *, int, int, struct mbuf **)); void rip_init __P((void)); void rip_input __P((struct mbuf *)); int rip_output __P((struct mbuf *, struct socket *, n_long)); int rip_usrreq __P((struct socket *, int, struct mbuf *, struct mbuf *, struct mbuf *)); #endif nmap-2.08/libpcap-possiblymodified/mkdep100555 764 764 4456 6163206604 17472 0ustar fyodorfyodor#!/bin/sh - # # Copyright (c) 1994, 1996 # The Regents of the University of California. All rights reserved. # # Redistribution and use in source and binary forms are permitted # provided that this notice is preserved and that due credit is given # to the University of California at Berkeley. The name of the University # may not be used to endorse or promote products derived from this # software without specific prior written permission. This software # is provided ``as is'' without express or implied warranty. # # @(#)mkdep.sh 5.11 (Berkeley) 5/5/88 # PATH=/bin:/usr/bin:/usr/ucb:/usr/local:/usr/local/bin export PATH MAKE=Makefile # default makefile name is "Makefile" CC=cc # default C compiler is "cc" while : do case "$1" in # -c allows you to specify the C compiler -c) CC=$2 shift; shift ;; # -f allows you to select a makefile name -f) MAKE=$2 shift; shift ;; # the -p flag produces "program: program.c" style dependencies # so .o's don't get produced -p) SED='s;\.o;;' shift ;; *) break ;; esac done if [ $# = 0 ] ; then echo 'usage: mkdep [-p] [-c cc] [-f makefile] [flags] file ...' exit 1 fi if [ ! -w $MAKE ]; then echo "mkdep: no writeable file \"$MAKE\"" exit 1 fi TMP=/tmp/mkdep$$ trap 'rm -f $TMP ; exit 1' 1 2 3 13 15 cp $MAKE ${MAKE}.bak sed -e '/DO NOT DELETE THIS LINE/,$d' < $MAKE > $TMP cat << _EOF_ >> $TMP # DO NOT DELETE THIS LINE -- mkdep uses it. # DO NOT PUT ANYTHING AFTER THIS LINE, IT WILL GO AWAY. _EOF_ # If your compiler doesn't have -M, add it. If you can't, the next two # lines will try and replace the "cc -M". The real problem is that this # hack can't deal with anything that requires a search path, and doesn't # even try for anything using bracket (<>) syntax. # # egrep '^#include[ ]*".*"' /dev/null $* | # sed -e 's/:[^"]*"\([^"]*\)".*/: \1/' -e 's/\.c/.o/' | # XXX this doesn't work with things like "-DDECLWAITSTATUS=union\ wait" $CC -M $* | sed " s; \./; ;g $SED" | awk '{ if ($1 != prev) { if (rec != "") print rec; rec = $0; prev = $1; } else { if (length(rec $2) > 78) { print rec; rec = $0; } else rec = rec " " $2 } } END { print rec }' >> $TMP cat << _EOF_ >> $TMP # IF YOU PUT ANYTHING HERE IT WILL GO AWAY _EOF_ # copy to preserve permissions cp $TMP $MAKE rm -f ${MAKE}.bak $TMP exit 0 nmap-2.08/libpcap-possiblymodified/nametoaddr.c100644 764 764 17216 6611214652 20746 0ustar fyodorfyodor/* * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * Name to id translation routines used by the scanner. * These functions are not time critical. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/nametoaddr.c,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL)"; #endif #include #include /* concession to AIX */ #include #include #if __STDC__ struct mbuf; struct rtentry; #endif #include #include #include #include #include #include #include #include #include #include #include "pcap-int.h" #include "gencode.h" #include #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif #ifndef NTOHL #define NTOHL(x) (x) = ntohl(x) #define NTOHS(x) (x) = ntohs(x) #endif static inline int xdtoi(int); /* * Convert host name to internet address. * Return 0 upon failure. */ bpf_u_int32 ** pcap_nametoaddr(const char *name) { #ifndef h_addr static bpf_u_int32 *hlist[2]; #endif bpf_u_int32 **p; struct hostent *hp; if ((hp = gethostbyname(name)) != NULL) { #ifndef h_addr hlist[0] = (bpf_u_int32 *)hp->h_addr; NTOHL(hp->h_addr); return hlist; #else for (p = (bpf_u_int32 **)hp->h_addr_list; *p; ++p) NTOHL(**p); return (bpf_u_int32 **)hp->h_addr_list; #endif } else return 0; } /* * Convert net name to internet address. * Return 0 upon failure. */ bpf_u_int32 pcap_nametonetaddr(const char *name) { struct netent *np; if ((np = getnetbyname(name)) != NULL) return np->n_net; else return 0; } /* * Convert a port name to its port and protocol numbers. * We assume only TCP or UDP. * Return 0 upon failure. */ int pcap_nametoport(const char *name, int *port, int *proto) { struct servent *sp; char *other; sp = getservbyname(name, (char *)0); if (sp != NULL) { NTOHS(sp->s_port); *port = sp->s_port; *proto = pcap_nametoproto(sp->s_proto); /* * We need to check /etc/services for ambiguous entries. * If we find the ambiguous entry, and it has the * same port number, change the proto to PROTO_UNDEF * so both TCP and UDP will be checked. */ if (*proto == IPPROTO_TCP) other = "udp"; else other = "tcp"; sp = getservbyname(name, other); if (sp != 0) { NTOHS(sp->s_port); #ifdef notdef if (*port != sp->s_port) /* Can't handle ambiguous names that refer to different port numbers. */ warning("ambiguous port %s in /etc/services", name); #endif *proto = PROTO_UNDEF; } return 1; } #if defined(ultrix) || defined(__osf__) /* Special hack in case NFS isn't in /etc/services */ if (strcmp(name, "nfs") == 0) { *port = 2049; *proto = PROTO_UNDEF; return 1; } #endif return 0; } int pcap_nametoproto(const char *str) { struct protoent *p; p = getprotobyname(str); if (p != 0) return p->p_proto; else return PROTO_UNDEF; } #include "ethertype.h" struct eproto { char *s; u_short p; }; /* Static data base of ether protocol types. */ struct eproto eproto_db[] = { { "pup", ETHERTYPE_PUP }, { "xns", ETHERTYPE_NS }, { "ip", ETHERTYPE_IP }, { "arp", ETHERTYPE_ARP }, { "rarp", ETHERTYPE_REVARP }, { "sprite", ETHERTYPE_SPRITE }, { "mopdl", ETHERTYPE_MOPDL }, { "moprc", ETHERTYPE_MOPRC }, { "decnet", ETHERTYPE_DN }, { "lat", ETHERTYPE_LAT }, { "sca", ETHERTYPE_SCA }, { "lanbridge", ETHERTYPE_LANBRIDGE }, { "vexp", ETHERTYPE_VEXP }, { "vprod", ETHERTYPE_VPROD }, { "atalk", ETHERTYPE_ATALK }, { "atalkarp", ETHERTYPE_AARP }, { "loopback", ETHERTYPE_LOOPBACK }, { "decdts", ETHERTYPE_DECDTS }, { "decdns", ETHERTYPE_DECDNS }, { (char *)0, 0 } }; int pcap_nametoeproto(const char *s) { struct eproto *p = eproto_db; while (p->s != 0) { if (strcmp(p->s, s) == 0) return p->p; p += 1; } return PROTO_UNDEF; } /* Hex digit to integer. */ static inline int xdtoi(c) register int c; { if (isdigit(c)) return c - '0'; else if (islower(c)) return c - 'a' + 10; else return c - 'A' + 10; } int __pcap_atoin(const char *s, bpf_u_int32 *addr) { u_int n; int len; *addr = 0; len = 0; while (1) { n = 0; while (*s && *s != '.') n = n * 10 + *s++ - '0'; *addr <<= 8; *addr |= n & 0xff; len += 8; if (*s == '\0') return len; ++s; } /* NOTREACHED */ } int __pcap_atodn(const char *s, bpf_u_int32 *addr) { #define AREASHIFT 10 #define AREAMASK 0176000 #define NODEMASK 01777 u_int node, area; if (sscanf((char *)s, "%d.%d", &area, &node) != 2) bpf_error("malformed decnet address '%s'", s); *addr = (area << AREASHIFT) & AREAMASK; *addr |= (node & NODEMASK); return(32); } /* * Convert 's' which has the form "xx:xx:xx:xx:xx:xx" into a new * ethernet address. Assumes 's' is well formed. */ u_char * pcap_ether_aton(const char *s) { register u_char *ep, *e; register u_int d; e = ep = (u_char *)malloc(6); while (*s) { if (*s == ':') s += 1; d = xdtoi(*s++); if (isxdigit(*s)) { d <<= 4; d |= xdtoi(*s++); } *ep++ = d; } return (e); } #ifndef HAVE_ETHER_HOSTTON /* Roll our own */ u_char * pcap_ether_hostton(const char *name) { register struct pcap_etherent *ep; register u_char *ap; static FILE *fp = NULL; static init = 0; if (!init) { fp = fopen(PCAP_ETHERS_FILE, "r"); ++init; if (fp == NULL) return (NULL); } else if (fp == NULL) return (NULL); else rewind(fp); while ((ep = pcap_next_etherent(fp)) != NULL) { if (strcmp(ep->name, name) == 0) { ap = (u_char *)malloc(6); if (ap != NULL) { memcpy(ap, ep->addr, 6); return (ap); } break; } } return (NULL); } #else /* --CHANGE BY FYODOR@DHP.COM . IT IS APPARENTLY NECESSARY TO COMMENT THIS OUT FOR COMPILING ON NETBSD */ /* #ifndef sgi extern int ether_hostton(char *, struct ether_addr *); #endif */ /* Use the os supplied routines */ u_char * pcap_ether_hostton(const char *name) { register u_char *ap; u_char a[6]; ap = NULL; if (ether_hostton((char *)name, (struct ether_addr *)a) == 0) { ap = (u_char *)malloc(6); if (ap != NULL) memcpy((char *)ap, (char *)a, 6); } return (ap); } #endif u_short __pcap_nametodnaddr(const char *name) { #ifdef DECNETLIB struct nodeent *getnodebyname(); struct nodeent *nep; unsigned short res; nep = getnodebyname(name); if (nep == ((struct nodeent *)0)) bpf_error("unknown decnet host name '%s'\n", name); memcpy((char *)&res, (char *)nep->n_addr, sizeof(unsigned short)); return(res); #else bpf_error("decnet name support not included, '%s' cannot be translated\n", name); #endif } nmap-2.08/libpcap-possiblymodified/optimize.c100644 764 764 117662 6611214673 20521 0ustar fyodorfyodor/* * Copyright (c) 1988, 1989, 1990, 1991, 1993, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * Optimization module for tcpdump intermediate representation. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/optimize.c,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include #include "pcap-int.h" #include "gencode.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif #ifdef BDEBUG extern int dflag; #endif #define A_ATOM BPF_MEMWORDS #define X_ATOM (BPF_MEMWORDS+1) #define NOP -1 /* * This define is used to represent *both* the accumulator and * x register in use-def computations. * Currently, the use-def code assumes only one definition per instruction. */ #define AX_ATOM N_ATOMS /* * A flag to indicate that further optimization is needed. * Iterative passes are continued until a given pass yields no * branch movement. */ static int done; /* * A block is marked if only if its mark equals the current mark. * Rather than traverse the code array, marking each item, 'cur_mark' is * incremented. This automatically makes each element unmarked. */ static int cur_mark; #define isMarked(p) ((p)->mark == cur_mark) #define unMarkAll() cur_mark += 1 #define Mark(p) ((p)->mark = cur_mark) static void opt_init(struct block *); static void opt_cleanup(void); static void make_marks(struct block *); static void mark_code(struct block *); static void intern_blocks(struct block *); static int eq_slist(struct slist *, struct slist *); static void find_levels_r(struct block *); static void find_levels(struct block *); static void find_dom(struct block *); static void propedom(struct edge *); static void find_edom(struct block *); static void find_closure(struct block *); static int atomuse(struct stmt *); static int atomdef(struct stmt *); static void compute_local_ud(struct block *); static void find_ud(struct block *); static void init_val(void); static int F(int, int, int); static inline void vstore(struct stmt *, int *, int, int); static void opt_blk(struct block *, int); static int use_conflict(struct block *, struct block *); static void opt_j(struct edge *); static void or_pullup(struct block *); static void and_pullup(struct block *); static void opt_blks(struct block *, int); static inline void link_inedge(struct edge *, struct block *); static void find_inedges(struct block *); static void opt_root(struct block **); static void opt_loop(struct block *, int); static void fold_op(struct stmt *, int, int); static inline struct slist *this_op(struct slist *); static void opt_not(struct block *); static void opt_peep(struct block *); static void opt_stmt(struct stmt *, int[], int); static void deadstmt(struct stmt *, struct stmt *[]); static void opt_deadstores(struct block *); static void opt_blk(struct block *, int); static int use_conflict(struct block *, struct block *); static void opt_j(struct edge *); static struct block *fold_edge(struct block *, struct edge *); static inline int eq_blk(struct block *, struct block *); static int slength(struct slist *); static int count_blocks(struct block *); static void number_blks_r(struct block *); static int count_stmts(struct block *); static int convert_code_r(struct block *); #ifdef BDEBUG static void opt_dump(struct block *); #endif static int n_blocks; struct block **blocks; static int n_edges; struct edge **edges; /* * A bit vector set representation of the dominators. * We round up the set size to the next power of two. */ static int nodewords; static int edgewords; struct block **levels; bpf_u_int32 *space; #define BITS_PER_WORD (8*sizeof(bpf_u_int32)) /* * True if a is in uset {p} */ #define SET_MEMBER(p, a) \ ((p)[(unsigned)(a) / BITS_PER_WORD] & (1 << ((unsigned)(a) % BITS_PER_WORD))) /* * Add 'a' to uset p. */ #define SET_INSERT(p, a) \ (p)[(unsigned)(a) / BITS_PER_WORD] |= (1 << ((unsigned)(a) % BITS_PER_WORD)) /* * Delete 'a' from uset p. */ #define SET_DELETE(p, a) \ (p)[(unsigned)(a) / BITS_PER_WORD] &= ~(1 << ((unsigned)(a) % BITS_PER_WORD)) /* * a := a intersect b */ #define SET_INTERSECT(a, b, n)\ {\ register bpf_u_int32 *_x = a, *_y = b;\ register int _n = n;\ while (--_n >= 0) *_x++ &= *_y++;\ } /* * a := a - b */ #define SET_SUBTRACT(a, b, n)\ {\ register bpf_u_int32 *_x = a, *_y = b;\ register int _n = n;\ while (--_n >= 0) *_x++ &=~ *_y++;\ } /* * a := a union b */ #define SET_UNION(a, b, n)\ {\ register bpf_u_int32 *_x = a, *_y = b;\ register int _n = n;\ while (--_n >= 0) *_x++ |= *_y++;\ } static uset all_dom_sets; static uset all_closure_sets; static uset all_edge_sets; #ifndef MAX #define MAX(a,b) ((a)>(b)?(a):(b)) #endif static void find_levels_r(b) struct block *b; { int level; if (isMarked(b)) return; Mark(b); b->link = 0; if (JT(b)) { find_levels_r(JT(b)); find_levels_r(JF(b)); level = MAX(JT(b)->level, JF(b)->level) + 1; } else level = 0; b->level = level; b->link = levels[level]; levels[level] = b; } /* * Level graph. The levels go from 0 at the leaves to * N_LEVELS at the root. The levels[] array points to the * first node of the level list, whose elements are linked * with the 'link' field of the struct block. */ static void find_levels(root) struct block *root; { memset((char *)levels, 0, n_blocks * sizeof(*levels)); unMarkAll(); find_levels_r(root); } /* * Find dominator relationships. * Assumes graph has been leveled. */ static void find_dom(root) struct block *root; { int i; struct block *b; bpf_u_int32 *x; /* * Initialize sets to contain all nodes. */ x = all_dom_sets; i = n_blocks * nodewords; while (--i >= 0) *x++ = ~0; /* Root starts off empty. */ for (i = nodewords; --i >= 0;) root->dom[i] = 0; /* root->level is the highest level no found. */ for (i = root->level; i >= 0; --i) { for (b = levels[i]; b; b = b->link) { SET_INSERT(b->dom, b->id); if (JT(b) == 0) continue; SET_INTERSECT(JT(b)->dom, b->dom, nodewords); SET_INTERSECT(JF(b)->dom, b->dom, nodewords); } } } static void propedom(ep) struct edge *ep; { SET_INSERT(ep->edom, ep->id); if (ep->succ) { SET_INTERSECT(ep->succ->et.edom, ep->edom, edgewords); SET_INTERSECT(ep->succ->ef.edom, ep->edom, edgewords); } } /* * Compute edge dominators. * Assumes graph has been leveled and predecessors established. */ static void find_edom(root) struct block *root; { int i; uset x; struct block *b; x = all_edge_sets; for (i = n_edges * edgewords; --i >= 0; ) x[i] = ~0; /* root->level is the highest level no found. */ memset(root->et.edom, 0, edgewords * sizeof(*(uset)0)); memset(root->ef.edom, 0, edgewords * sizeof(*(uset)0)); for (i = root->level; i >= 0; --i) { for (b = levels[i]; b != 0; b = b->link) { propedom(&b->et); propedom(&b->ef); } } } /* * Find the backwards transitive closure of the flow graph. These sets * are backwards in the sense that we find the set of nodes that reach * a given node, not the set of nodes that can be reached by a node. * * Assumes graph has been leveled. */ static void find_closure(root) struct block *root; { int i; struct block *b; /* * Initialize sets to contain no nodes. */ memset((char *)all_closure_sets, 0, n_blocks * nodewords * sizeof(*all_closure_sets)); /* root->level is the highest level no found. */ for (i = root->level; i >= 0; --i) { for (b = levels[i]; b; b = b->link) { SET_INSERT(b->closure, b->id); if (JT(b) == 0) continue; SET_UNION(JT(b)->closure, b->closure, nodewords); SET_UNION(JF(b)->closure, b->closure, nodewords); } } } /* * Return the register number that is used by s. If A and X are both * used, return AX_ATOM. If no register is used, return -1. * * The implementation should probably change to an array access. */ static int atomuse(s) struct stmt *s; { register int c = s->code; if (c == NOP) return -1; switch (BPF_CLASS(c)) { case BPF_RET: return (BPF_RVAL(c) == BPF_A) ? A_ATOM : (BPF_RVAL(c) == BPF_X) ? X_ATOM : -1; case BPF_LD: case BPF_LDX: return (BPF_MODE(c) == BPF_IND) ? X_ATOM : (BPF_MODE(c) == BPF_MEM) ? s->k : -1; case BPF_ST: return A_ATOM; case BPF_STX: return X_ATOM; case BPF_JMP: case BPF_ALU: if (BPF_SRC(c) == BPF_X) return AX_ATOM; return A_ATOM; case BPF_MISC: return BPF_MISCOP(c) == BPF_TXA ? X_ATOM : A_ATOM; } abort(); /* NOTREACHED */ } /* * Return the register number that is defined by 's'. We assume that * a single stmt cannot define more than one register. If no register * is defined, return -1. * * The implementation should probably change to an array access. */ static int atomdef(s) struct stmt *s; { if (s->code == NOP) return -1; switch (BPF_CLASS(s->code)) { case BPF_LD: case BPF_ALU: return A_ATOM; case BPF_LDX: return X_ATOM; case BPF_ST: case BPF_STX: return s->k; case BPF_MISC: return BPF_MISCOP(s->code) == BPF_TAX ? X_ATOM : A_ATOM; } return -1; } static void compute_local_ud(b) struct block *b; { struct slist *s; atomset def = 0, use = 0, kill = 0; int atom; for (s = b->stmts; s; s = s->next) { if (s->s.code == NOP) continue; atom = atomuse(&s->s); if (atom >= 0) { if (atom == AX_ATOM) { if (!ATOMELEM(def, X_ATOM)) use |= ATOMMASK(X_ATOM); if (!ATOMELEM(def, A_ATOM)) use |= ATOMMASK(A_ATOM); } else if (atom < N_ATOMS) { if (!ATOMELEM(def, atom)) use |= ATOMMASK(atom); } else abort(); } atom = atomdef(&s->s); if (atom >= 0) { if (!ATOMELEM(use, atom)) kill |= ATOMMASK(atom); def |= ATOMMASK(atom); } } if (!ATOMELEM(def, A_ATOM) && BPF_CLASS(b->s.code) == BPF_JMP) use |= ATOMMASK(A_ATOM); b->def = def; b->kill = kill; b->in_use = use; } /* * Assume graph is already leveled. */ static void find_ud(root) struct block *root; { int i, maxlevel; struct block *p; /* * root->level is the highest level no found; * count down from there. */ maxlevel = root->level; for (i = maxlevel; i >= 0; --i) for (p = levels[i]; p; p = p->link) { compute_local_ud(p); p->out_use = 0; } for (i = 1; i <= maxlevel; ++i) { for (p = levels[i]; p; p = p->link) { p->out_use |= JT(p)->in_use | JF(p)->in_use; p->in_use |= p->out_use &~ p->kill; } } } /* * These data structures are used in a Cocke and Shwarz style * value numbering scheme. Since the flowgraph is acyclic, * exit values can be propagated from a node's predecessors * provided it is uniquely defined. */ struct valnode { int code; int v0, v1; int val; struct valnode *next; }; #define MODULUS 213 static struct valnode *hashtbl[MODULUS]; static int curval; static int maxval; /* Integer constants mapped with the load immediate opcode. */ #define K(i) F(BPF_LD|BPF_IMM|BPF_W, i, 0L) struct vmapinfo { int is_const; bpf_int32 const_val; }; struct vmapinfo *vmap; struct valnode *vnode_base; struct valnode *next_vnode; static void init_val() { curval = 0; next_vnode = vnode_base; memset((char *)vmap, 0, maxval * sizeof(*vmap)); memset((char *)hashtbl, 0, sizeof hashtbl); } /* Because we really don't have an IR, this stuff is a little messy. */ static int F(code, v0, v1) int code; int v0, v1; { u_int hash; int val; struct valnode *p; hash = (u_int)code ^ (v0 << 4) ^ (v1 << 8); hash %= MODULUS; for (p = hashtbl[hash]; p; p = p->next) if (p->code == code && p->v0 == v0 && p->v1 == v1) return p->val; val = ++curval; if (BPF_MODE(code) == BPF_IMM && (BPF_CLASS(code) == BPF_LD || BPF_CLASS(code) == BPF_LDX)) { vmap[val].const_val = v0; vmap[val].is_const = 1; } p = next_vnode++; p->val = val; p->code = code; p->v0 = v0; p->v1 = v1; p->next = hashtbl[hash]; hashtbl[hash] = p; return val; } static inline void vstore(s, valp, newval, alter) struct stmt *s; int *valp; int newval; int alter; { if (alter && *valp == newval) s->code = NOP; else *valp = newval; } static void fold_op(s, v0, v1) struct stmt *s; int v0, v1; { bpf_int32 a, b; a = vmap[v0].const_val; b = vmap[v1].const_val; switch (BPF_OP(s->code)) { case BPF_ADD: a += b; break; case BPF_SUB: a -= b; break; case BPF_MUL: a *= b; break; case BPF_DIV: if (b == 0) bpf_error("division by zero"); a /= b; break; case BPF_AND: a &= b; break; case BPF_OR: a |= b; break; case BPF_LSH: a <<= b; break; case BPF_RSH: a >>= b; break; case BPF_NEG: a = -a; break; default: abort(); } s->k = a; s->code = BPF_LD|BPF_IMM; done = 0; } static inline struct slist * this_op(s) struct slist *s; { while (s != 0 && s->s.code == NOP) s = s->next; return s; } static void opt_not(b) struct block *b; { struct block *tmp = JT(b); JT(b) = JF(b); JF(b) = tmp; } static void opt_peep(b) struct block *b; { struct slist *s; struct slist *next, *last; int val; s = b->stmts; if (s == 0) return; last = s; while (1) { s = this_op(s); if (s == 0) break; next = this_op(s->next); if (next == 0) break; last = next; /* * st M[k] --> st M[k] * ldx M[k] tax */ if (s->s.code == BPF_ST && next->s.code == (BPF_LDX|BPF_MEM) && s->s.k == next->s.k) { done = 0; next->s.code = BPF_MISC|BPF_TAX; } /* * ld #k --> ldx #k * tax txa */ if (s->s.code == (BPF_LD|BPF_IMM) && next->s.code == (BPF_MISC|BPF_TAX)) { s->s.code = BPF_LDX|BPF_IMM; next->s.code = BPF_MISC|BPF_TXA; done = 0; } /* * This is an ugly special case, but it happens * when you say tcp[k] or udp[k] where k is a constant. */ if (s->s.code == (BPF_LD|BPF_IMM)) { struct slist *add, *tax, *ild; /* * Check that X isn't used on exit from this * block (which the optimizer might cause). * We know the code generator won't generate * any local dependencies. */ if (ATOMELEM(b->out_use, X_ATOM)) break; if (next->s.code != (BPF_LDX|BPF_MSH|BPF_B)) add = next; else add = this_op(next->next); if (add == 0 || add->s.code != (BPF_ALU|BPF_ADD|BPF_X)) break; tax = this_op(add->next); if (tax == 0 || tax->s.code != (BPF_MISC|BPF_TAX)) break; ild = this_op(tax->next); if (ild == 0 || BPF_CLASS(ild->s.code) != BPF_LD || BPF_MODE(ild->s.code) != BPF_IND) break; /* * XXX We need to check that X is not * subsequently used. We know we can eliminate the * accumulator modifications since it is defined * by the last stmt of this sequence. * * We want to turn this sequence: * * (004) ldi #0x2 {s} * (005) ldxms [14] {next} -- optional * (006) addx {add} * (007) tax {tax} * (008) ild [x+0] {ild} * * into this sequence: * * (004) nop * (005) ldxms [14] * (006) nop * (007) nop * (008) ild [x+2] * */ ild->s.k += s->s.k; s->s.code = NOP; add->s.code = NOP; tax->s.code = NOP; done = 0; } s = next; } /* * If we have a subtract to do a comparison, and the X register * is a known constant, we can merge this value into the * comparison. */ if (last->s.code == (BPF_ALU|BPF_SUB|BPF_X) && !ATOMELEM(b->out_use, A_ATOM)) { val = b->val[X_ATOM]; if (vmap[val].is_const) { int op; b->s.k += vmap[val].const_val; op = BPF_OP(b->s.code); if (op == BPF_JGT || op == BPF_JGE) { struct block *t = JT(b); JT(b) = JF(b); JF(b) = t; b->s.k += 0x80000000; } last->s.code = NOP; done = 0; } else if (b->s.k == 0) { /* * sub x -> nop * j #0 j x */ last->s.code = NOP; b->s.code = BPF_CLASS(b->s.code) | BPF_OP(b->s.code) | BPF_X; done = 0; } } /* * Likewise, a constant subtract can be simplified. */ else if (last->s.code == (BPF_ALU|BPF_SUB|BPF_K) && !ATOMELEM(b->out_use, A_ATOM)) { int op; b->s.k += last->s.k; last->s.code = NOP; op = BPF_OP(b->s.code); if (op == BPF_JGT || op == BPF_JGE) { struct block *t = JT(b); JT(b) = JF(b); JF(b) = t; b->s.k += 0x80000000; } done = 0; } /* * and #k nop * jeq #0 -> jset #k */ if (last->s.code == (BPF_ALU|BPF_AND|BPF_K) && !ATOMELEM(b->out_use, A_ATOM) && b->s.k == 0) { b->s.k = last->s.k; b->s.code = BPF_JMP|BPF_K|BPF_JSET; last->s.code = NOP; done = 0; opt_not(b); } /* * If the accumulator is a known constant, we can compute the * comparison result. */ val = b->val[A_ATOM]; if (vmap[val].is_const && BPF_SRC(b->s.code) == BPF_K) { bpf_int32 v = vmap[val].const_val; switch (BPF_OP(b->s.code)) { case BPF_JEQ: v = v == b->s.k; break; case BPF_JGT: v = (unsigned)v > b->s.k; break; case BPF_JGE: v = (unsigned)v >= b->s.k; break; case BPF_JSET: v &= b->s.k; break; default: abort(); } if (JF(b) != JT(b)) done = 0; if (v) JF(b) = JT(b); else JT(b) = JF(b); } } /* * Compute the symbolic value of expression of 's', and update * anything it defines in the value table 'val'. If 'alter' is true, * do various optimizations. This code would be cleaner if symbolic * evaluation and code transformations weren't folded together. */ static void opt_stmt(s, val, alter) struct stmt *s; int val[]; int alter; { int op; int v; switch (s->code) { case BPF_LD|BPF_ABS|BPF_W: case BPF_LD|BPF_ABS|BPF_H: case BPF_LD|BPF_ABS|BPF_B: v = F(s->code, s->k, 0L); vstore(s, &val[A_ATOM], v, alter); break; case BPF_LD|BPF_IND|BPF_W: case BPF_LD|BPF_IND|BPF_H: case BPF_LD|BPF_IND|BPF_B: v = val[X_ATOM]; if (alter && vmap[v].is_const) { s->code = BPF_LD|BPF_ABS|BPF_SIZE(s->code); s->k += vmap[v].const_val; v = F(s->code, s->k, 0L); done = 0; } else v = F(s->code, s->k, v); vstore(s, &val[A_ATOM], v, alter); break; case BPF_LD|BPF_LEN: v = F(s->code, 0L, 0L); vstore(s, &val[A_ATOM], v, alter); break; case BPF_LD|BPF_IMM: v = K(s->k); vstore(s, &val[A_ATOM], v, alter); break; case BPF_LDX|BPF_IMM: v = K(s->k); vstore(s, &val[X_ATOM], v, alter); break; case BPF_LDX|BPF_MSH|BPF_B: v = F(s->code, s->k, 0L); vstore(s, &val[X_ATOM], v, alter); break; case BPF_ALU|BPF_NEG: if (alter && vmap[val[A_ATOM]].is_const) { s->code = BPF_LD|BPF_IMM; s->k = -vmap[val[A_ATOM]].const_val; val[A_ATOM] = K(s->k); } else val[A_ATOM] = F(s->code, val[A_ATOM], 0L); break; case BPF_ALU|BPF_ADD|BPF_K: case BPF_ALU|BPF_SUB|BPF_K: case BPF_ALU|BPF_MUL|BPF_K: case BPF_ALU|BPF_DIV|BPF_K: case BPF_ALU|BPF_AND|BPF_K: case BPF_ALU|BPF_OR|BPF_K: case BPF_ALU|BPF_LSH|BPF_K: case BPF_ALU|BPF_RSH|BPF_K: op = BPF_OP(s->code); if (alter) { if (s->k == 0) { if (op == BPF_ADD || op == BPF_SUB || op == BPF_LSH || op == BPF_RSH || op == BPF_OR) { s->code = NOP; break; } if (op == BPF_MUL || op == BPF_AND) { s->code = BPF_LD|BPF_IMM; val[A_ATOM] = K(s->k); break; } } if (vmap[val[A_ATOM]].is_const) { fold_op(s, val[A_ATOM], K(s->k)); val[A_ATOM] = K(s->k); break; } } val[A_ATOM] = F(s->code, val[A_ATOM], K(s->k)); break; case BPF_ALU|BPF_ADD|BPF_X: case BPF_ALU|BPF_SUB|BPF_X: case BPF_ALU|BPF_MUL|BPF_X: case BPF_ALU|BPF_DIV|BPF_X: case BPF_ALU|BPF_AND|BPF_X: case BPF_ALU|BPF_OR|BPF_X: case BPF_ALU|BPF_LSH|BPF_X: case BPF_ALU|BPF_RSH|BPF_X: op = BPF_OP(s->code); if (alter && vmap[val[X_ATOM]].is_const) { if (vmap[val[A_ATOM]].is_const) { fold_op(s, val[A_ATOM], val[X_ATOM]); val[A_ATOM] = K(s->k); } else { s->code = BPF_ALU|BPF_K|op; s->k = vmap[val[X_ATOM]].const_val; done = 0; val[A_ATOM] = F(s->code, val[A_ATOM], K(s->k)); } break; } /* * Check if we're doing something to an accumulator * that is 0, and simplify. This may not seem like * much of a simplification but it could open up further * optimizations. * XXX We could also check for mul by 1, and -1, etc. */ if (alter && vmap[val[A_ATOM]].is_const && vmap[val[A_ATOM]].const_val == 0) { if (op == BPF_ADD || op == BPF_OR || op == BPF_LSH || op == BPF_RSH || op == BPF_SUB) { s->code = BPF_MISC|BPF_TXA; vstore(s, &val[A_ATOM], val[X_ATOM], alter); break; } else if (op == BPF_MUL || op == BPF_DIV || op == BPF_AND) { s->code = BPF_LD|BPF_IMM; s->k = 0; vstore(s, &val[A_ATOM], K(s->k), alter); break; } else if (op == BPF_NEG) { s->code = NOP; break; } } val[A_ATOM] = F(s->code, val[A_ATOM], val[X_ATOM]); break; case BPF_MISC|BPF_TXA: vstore(s, &val[A_ATOM], val[X_ATOM], alter); break; case BPF_LD|BPF_MEM: v = val[s->k]; if (alter && vmap[v].is_const) { s->code = BPF_LD|BPF_IMM; s->k = vmap[v].const_val; done = 0; } vstore(s, &val[A_ATOM], v, alter); break; case BPF_MISC|BPF_TAX: vstore(s, &val[X_ATOM], val[A_ATOM], alter); break; case BPF_LDX|BPF_MEM: v = val[s->k]; if (alter && vmap[v].is_const) { s->code = BPF_LDX|BPF_IMM; s->k = vmap[v].const_val; done = 0; } vstore(s, &val[X_ATOM], v, alter); break; case BPF_ST: vstore(s, &val[s->k], val[A_ATOM], alter); break; case BPF_STX: vstore(s, &val[s->k], val[X_ATOM], alter); break; } } static void deadstmt(s, last) register struct stmt *s; register struct stmt *last[]; { register int atom; atom = atomuse(s); if (atom >= 0) { if (atom == AX_ATOM) { last[X_ATOM] = 0; last[A_ATOM] = 0; } else last[atom] = 0; } atom = atomdef(s); if (atom >= 0) { if (last[atom]) { done = 0; last[atom]->code = NOP; } last[atom] = s; } } static void opt_deadstores(b) register struct block *b; { register struct slist *s; register int atom; struct stmt *last[N_ATOMS]; memset((char *)last, 0, sizeof last); for (s = b->stmts; s != 0; s = s->next) deadstmt(&s->s, last); deadstmt(&b->s, last); for (atom = 0; atom < N_ATOMS; ++atom) if (last[atom] && !ATOMELEM(b->out_use, atom)) { last[atom]->code = NOP; done = 0; } } static void opt_blk(b, do_stmts) struct block *b; int do_stmts; { struct slist *s; struct edge *p; int i; bpf_int32 aval; /* * Initialize the atom values. * If we have no predecessors, everything is undefined. * Otherwise, we inherent our values from our predecessors. * If any register has an ambiguous value (i.e. control paths are * merging) give it the undefined value of 0. */ p = b->in_edges; if (p == 0) memset((char *)b->val, 0, sizeof(b->val)); else { memcpy((char *)b->val, (char *)p->pred->val, sizeof(b->val)); while ((p = p->next) != NULL) { for (i = 0; i < N_ATOMS; ++i) if (b->val[i] != p->pred->val[i]) b->val[i] = 0; } } aval = b->val[A_ATOM]; for (s = b->stmts; s; s = s->next) opt_stmt(&s->s, b->val, do_stmts); /* * This is a special case: if we don't use anything from this * block, and we load the accumulator with value that is * already there, or if this block is a return, * eliminate all the statements. */ if (do_stmts && ((b->out_use == 0 && aval != 0 &&b->val[A_ATOM] == aval) || BPF_CLASS(b->s.code) == BPF_RET)) { if (b->stmts != 0) { b->stmts = 0; done = 0; } } else { opt_peep(b); opt_deadstores(b); } /* * Set up values for branch optimizer. */ if (BPF_SRC(b->s.code) == BPF_K) b->oval = K(b->s.k); else b->oval = b->val[X_ATOM]; b->et.code = b->s.code; b->ef.code = -b->s.code; } /* * Return true if any register that is used on exit from 'succ', has * an exit value that is different from the corresponding exit value * from 'b'. */ static int use_conflict(b, succ) struct block *b, *succ; { int atom; atomset use = succ->out_use; if (use == 0) return 0; for (atom = 0; atom < N_ATOMS; ++atom) if (ATOMELEM(use, atom)) if (b->val[atom] != succ->val[atom]) return 1; return 0; } static struct block * fold_edge(child, ep) struct block *child; struct edge *ep; { int sense; int aval0, aval1, oval0, oval1; int code = ep->code; if (code < 0) { code = -code; sense = 0; } else sense = 1; if (child->s.code != code) return 0; aval0 = child->val[A_ATOM]; oval0 = child->oval; aval1 = ep->pred->val[A_ATOM]; oval1 = ep->pred->oval; if (aval0 != aval1) return 0; if (oval0 == oval1) /* * The operands are identical, so the * result is true if a true branch was * taken to get here, otherwise false. */ return sense ? JT(child) : JF(child); if (sense && code == (BPF_JMP|BPF_JEQ|BPF_K)) /* * At this point, we only know the comparison if we * came down the true branch, and it was an equality * comparison with a constant. We rely on the fact that * distinct constants have distinct value numbers. */ return JF(child); return 0; } static void opt_j(ep) struct edge *ep; { register int i, k; register struct block *target; if (JT(ep->succ) == 0) return; if (JT(ep->succ) == JF(ep->succ)) { /* * Common branch targets can be eliminated, provided * there is no data dependency. */ if (!use_conflict(ep->pred, ep->succ->et.succ)) { done = 0; ep->succ = JT(ep->succ); } } /* * For each edge dominator that matches the successor of this * edge, promote the edge successor to the its grandchild. * * XXX We violate the set abstraction here in favor a reasonably * efficient loop. */ top: for (i = 0; i < edgewords; ++i) { register bpf_u_int32 x = ep->edom[i]; while (x != 0) { k = ffs(x) - 1; x &=~ (1 << k); k += i * BITS_PER_WORD; target = fold_edge(ep->succ, edges[k]); /* * Check that there is no data dependency between * nodes that will be violated if we move the edge. */ if (target != 0 && !use_conflict(ep->pred, target)) { done = 0; ep->succ = target; if (JT(target) != 0) /* * Start over unless we hit a leaf. */ goto top; return; } } } } static void or_pullup(b) struct block *b; { int val, at_top; struct block *pull; struct block **diffp, **samep; struct edge *ep; ep = b->in_edges; if (ep == 0) return; /* * Make sure each predecessor loads the same value. * XXX why? */ val = ep->pred->val[A_ATOM]; for (ep = ep->next; ep != 0; ep = ep->next) if (val != ep->pred->val[A_ATOM]) return; if (JT(b->in_edges->pred) == b) diffp = &JT(b->in_edges->pred); else diffp = &JF(b->in_edges->pred); at_top = 1; while (1) { if (*diffp == 0) return; if (JT(*diffp) != JT(b)) return; if (!SET_MEMBER((*diffp)->dom, b->id)) return; if ((*diffp)->val[A_ATOM] != val) break; diffp = &JF(*diffp); at_top = 0; } samep = &JF(*diffp); while (1) { if (*samep == 0) return; if (JT(*samep) != JT(b)) return; if (!SET_MEMBER((*samep)->dom, b->id)) return; if ((*samep)->val[A_ATOM] == val) break; /* XXX Need to check that there are no data dependencies between dp0 and dp1. Currently, the code generator will not produce such dependencies. */ samep = &JF(*samep); } #ifdef notdef /* XXX This doesn't cover everything. */ for (i = 0; i < N_ATOMS; ++i) if ((*samep)->val[i] != pred->val[i]) return; #endif /* Pull up the node. */ pull = *samep; *samep = JF(pull); JF(pull) = *diffp; /* * At the top of the chain, each predecessor needs to point at the * pulled up node. Inside the chain, there is only one predecessor * to worry about. */ if (at_top) { for (ep = b->in_edges; ep != 0; ep = ep->next) { if (JT(ep->pred) == b) JT(ep->pred) = pull; else JF(ep->pred) = pull; } } else *diffp = pull; done = 0; } static void and_pullup(b) struct block *b; { int val, at_top; struct block *pull; struct block **diffp, **samep; struct edge *ep; ep = b->in_edges; if (ep == 0) return; /* * Make sure each predecessor loads the same value. */ val = ep->pred->val[A_ATOM]; for (ep = ep->next; ep != 0; ep = ep->next) if (val != ep->pred->val[A_ATOM]) return; if (JT(b->in_edges->pred) == b) diffp = &JT(b->in_edges->pred); else diffp = &JF(b->in_edges->pred); at_top = 1; while (1) { if (*diffp == 0) return; if (JF(*diffp) != JF(b)) return; if (!SET_MEMBER((*diffp)->dom, b->id)) return; if ((*diffp)->val[A_ATOM] != val) break; diffp = &JT(*diffp); at_top = 0; } samep = &JT(*diffp); while (1) { if (*samep == 0) return; if (JF(*samep) != JF(b)) return; if (!SET_MEMBER((*samep)->dom, b->id)) return; if ((*samep)->val[A_ATOM] == val) break; /* XXX Need to check that there are no data dependencies between diffp and samep. Currently, the code generator will not produce such dependencies. */ samep = &JT(*samep); } #ifdef notdef /* XXX This doesn't cover everything. */ for (i = 0; i < N_ATOMS; ++i) if ((*samep)->val[i] != pred->val[i]) return; #endif /* Pull up the node. */ pull = *samep; *samep = JT(pull); JT(pull) = *diffp; /* * At the top of the chain, each predecessor needs to point at the * pulled up node. Inside the chain, there is only one predecessor * to worry about. */ if (at_top) { for (ep = b->in_edges; ep != 0; ep = ep->next) { if (JT(ep->pred) == b) JT(ep->pred) = pull; else JF(ep->pred) = pull; } } else *diffp = pull; done = 0; } static void opt_blks(root, do_stmts) struct block *root; int do_stmts; { int i, maxlevel; struct block *p; init_val(); maxlevel = root->level; for (i = maxlevel; i >= 0; --i) for (p = levels[i]; p; p = p->link) opt_blk(p, do_stmts); if (do_stmts) /* * No point trying to move branches; it can't possibly * make a difference at this point. */ return; for (i = 1; i <= maxlevel; ++i) { for (p = levels[i]; p; p = p->link) { opt_j(&p->et); opt_j(&p->ef); } } for (i = 1; i <= maxlevel; ++i) { for (p = levels[i]; p; p = p->link) { or_pullup(p); and_pullup(p); } } } static inline void link_inedge(parent, child) struct edge *parent; struct block *child; { parent->next = child->in_edges; child->in_edges = parent; } static void find_inedges(root) struct block *root; { int i; struct block *b; for (i = 0; i < n_blocks; ++i) blocks[i]->in_edges = 0; /* * Traverse the graph, adding each edge to the predecessor * list of its successors. Skip the leaves (i.e. level 0). */ for (i = root->level; i > 0; --i) { for (b = levels[i]; b != 0; b = b->link) { link_inedge(&b->et, JT(b)); link_inedge(&b->ef, JF(b)); } } } static void opt_root(b) struct block **b; { struct slist *tmp, *s; s = (*b)->stmts; (*b)->stmts = 0; while (BPF_CLASS((*b)->s.code) == BPF_JMP && JT(*b) == JF(*b)) *b = JT(*b); tmp = (*b)->stmts; if (tmp != 0) sappend(s, tmp); (*b)->stmts = s; /* * If the root node is a return, then there is no * point executing any statements (since the bpf machine * has no side effects). */ if (BPF_CLASS((*b)->s.code) == BPF_RET) (*b)->stmts = 0; } static void opt_loop(root, do_stmts) struct block *root; int do_stmts; { #ifdef BDEBUG if (dflag > 1) opt_dump(root); #endif do { done = 1; find_levels(root); find_dom(root); find_closure(root); find_inedges(root); find_ud(root); find_edom(root); opt_blks(root, do_stmts); #ifdef BDEBUG if (dflag > 1) opt_dump(root); #endif } while (!done); } /* * Optimize the filter code in its dag representation. */ void bpf_optimize(rootp) struct block **rootp; { struct block *root; root = *rootp; opt_init(root); opt_loop(root, 0); opt_loop(root, 1); intern_blocks(root); opt_root(rootp); opt_cleanup(); } static void make_marks(p) struct block *p; { if (!isMarked(p)) { Mark(p); if (BPF_CLASS(p->s.code) != BPF_RET) { make_marks(JT(p)); make_marks(JF(p)); } } } /* * Mark code array such that isMarked(i) is true * only for nodes that are alive. */ static void mark_code(p) struct block *p; { cur_mark += 1; make_marks(p); } /* * True iff the two stmt lists load the same value from the packet into * the accumulator. */ static int eq_slist(x, y) struct slist *x, *y; { while (1) { while (x && x->s.code == NOP) x = x->next; while (y && y->s.code == NOP) y = y->next; if (x == 0) return y == 0; if (y == 0) return x == 0; if (x->s.code != y->s.code || x->s.k != y->s.k) return 0; x = x->next; y = y->next; } } static inline int eq_blk(b0, b1) struct block *b0, *b1; { if (b0->s.code == b1->s.code && b0->s.k == b1->s.k && b0->et.succ == b1->et.succ && b0->ef.succ == b1->ef.succ) return eq_slist(b0->stmts, b1->stmts); return 0; } static void intern_blocks(root) struct block *root; { struct block *p; int i, j; int done; top: done = 1; for (i = 0; i < n_blocks; ++i) blocks[i]->link = 0; mark_code(root); for (i = n_blocks - 1; --i >= 0; ) { if (!isMarked(blocks[i])) continue; for (j = i + 1; j < n_blocks; ++j) { if (!isMarked(blocks[j])) continue; if (eq_blk(blocks[i], blocks[j])) { blocks[i]->link = blocks[j]->link ? blocks[j]->link : blocks[j]; break; } } } for (i = 0; i < n_blocks; ++i) { p = blocks[i]; if (JT(p) == 0) continue; if (JT(p)->link) { done = 0; JT(p) = JT(p)->link; } if (JF(p)->link) { done = 0; JF(p) = JF(p)->link; } } if (!done) goto top; } static void opt_cleanup() { free((void *)vnode_base); free((void *)vmap); free((void *)edges); free((void *)space); free((void *)levels); free((void *)blocks); } /* * Return the number of stmts in 's'. */ static int slength(s) struct slist *s; { int n = 0; for (; s; s = s->next) if (s->s.code != NOP) ++n; return n; } /* * Return the number of nodes reachable by 'p'. * All nodes should be initially unmarked. */ static int count_blocks(p) struct block *p; { if (p == 0 || isMarked(p)) return 0; Mark(p); return count_blocks(JT(p)) + count_blocks(JF(p)) + 1; } /* * Do a depth first search on the flow graph, numbering the * the basic blocks, and entering them into the 'blocks' array.` */ static void number_blks_r(p) struct block *p; { int n; if (p == 0 || isMarked(p)) return; Mark(p); n = n_blocks++; p->id = n; blocks[n] = p; number_blks_r(JT(p)); number_blks_r(JF(p)); } /* * Return the number of stmts in the flowgraph reachable by 'p'. * The nodes should be unmarked before calling. */ static int count_stmts(p) struct block *p; { int n; if (p == 0 || isMarked(p)) return 0; Mark(p); n = count_stmts(JT(p)) + count_stmts(JF(p)); return slength(p->stmts) + n + 1; } /* * Allocate memory. All allocation is done before optimization * is begun. A linear bound on the size of all data structures is computed * from the total number of blocks and/or statements. */ static void opt_init(root) struct block *root; { bpf_u_int32 *p; int i, n, max_stmts; /* * First, count the blocks, so we can malloc an array to map * block number to block. Then, put the blocks into the array. */ unMarkAll(); n = count_blocks(root); blocks = (struct block **)malloc(n * sizeof(*blocks)); unMarkAll(); n_blocks = 0; number_blks_r(root); n_edges = 2 * n_blocks; edges = (struct edge **)malloc(n_edges * sizeof(*edges)); /* * The number of levels is bounded by the number of nodes. */ levels = (struct block **)malloc(n_blocks * sizeof(*levels)); edgewords = n_edges / (8 * sizeof(bpf_u_int32)) + 1; nodewords = n_blocks / (8 * sizeof(bpf_u_int32)) + 1; /* XXX */ space = (bpf_u_int32 *)malloc(2 * n_blocks * nodewords * sizeof(*space) + n_edges * edgewords * sizeof(*space)); p = space; all_dom_sets = p; for (i = 0; i < n; ++i) { blocks[i]->dom = p; p += nodewords; } all_closure_sets = p; for (i = 0; i < n; ++i) { blocks[i]->closure = p; p += nodewords; } all_edge_sets = p; for (i = 0; i < n; ++i) { register struct block *b = blocks[i]; b->et.edom = p; p += edgewords; b->ef.edom = p; p += edgewords; b->et.id = i; edges[i] = &b->et; b->ef.id = n_blocks + i; edges[n_blocks + i] = &b->ef; b->et.pred = b; b->ef.pred = b; } max_stmts = 0; for (i = 0; i < n; ++i) max_stmts += slength(blocks[i]->stmts) + 1; /* * We allocate at most 3 value numbers per statement, * so this is an upper bound on the number of valnodes * we'll need. */ maxval = 3 * max_stmts; vmap = (struct vmapinfo *)malloc(maxval * sizeof(*vmap)); vnode_base = (struct valnode *)malloc(maxval * sizeof(*vmap)); } /* * Some pointers used to convert the basic block form of the code, * into the array form that BPF requires. 'fstart' will point to * the malloc'd array while 'ftail' is used during the recursive traversal. */ static struct bpf_insn *fstart; static struct bpf_insn *ftail; #ifdef BDEBUG int bids[1000]; #endif /* * Returns true if successful. Returns false if a branch has * an offset that is too large. If so, we have marked that * branch so that on a subsequent iteration, it will be treated * properly. */ static int convert_code_r(p) struct block *p; { struct bpf_insn *dst; struct slist *src; int slen; u_int off; int extrajmps; /* number of extra jumps inserted */ if (p == 0 || isMarked(p)) return (1); Mark(p); if (convert_code_r(JF(p)) == 0) return (0); if (convert_code_r(JT(p)) == 0) return (0); slen = slength(p->stmts); dst = ftail -= (slen + 1 + p->longjt + p->longjf); /* inflate length by any extra jumps */ p->offset = dst - fstart; for (src = p->stmts; src; src = src->next) { if (src->s.code == NOP) continue; dst->code = (u_short)src->s.code; dst->k = src->s.k; ++dst; } #ifdef BDEBUG bids[dst - fstart] = p->id + 1; #endif dst->code = (u_short)p->s.code; dst->k = p->s.k; if (JT(p)) { extrajmps = 0; off = JT(p)->offset - (p->offset + slen) - 1; if (off >= 256) { /* offset too large for branch, must add a jump */ if (p->longjt == 0) { /* mark this instruction and retry */ p->longjt++; return(0); } /* branch if T to following jump */ dst->jt = extrajmps; extrajmps++; dst[extrajmps].code = BPF_JMP|BPF_JA; dst[extrajmps].k = off - extrajmps; } else dst->jt = off; off = JF(p)->offset - (p->offset + slen) - 1; if (off >= 256) { /* offset too large for branch, must add a jump */ if (p->longjf == 0) { /* mark this instruction and retry */ p->longjf++; return(0); } /* branch if F to following jump */ /* if two jumps are inserted, F goes to second one */ dst->jf = extrajmps; extrajmps++; dst[extrajmps].code = BPF_JMP|BPF_JA; dst[extrajmps].k = off - extrajmps; } else dst->jf = off; } return (1); } /* * Convert flowgraph intermediate representation to the * BPF array representation. Set *lenp to the number of instructions. */ struct bpf_insn * icode_to_fcode(root, lenp) struct block *root; int *lenp; { int n; struct bpf_insn *fp; /* * Loop doing convert_codr_r() until no branches remain * with too-large offsets. */ while (1) { unMarkAll(); n = *lenp = count_stmts(root); fp = (struct bpf_insn *)malloc(sizeof(*fp) * n); memset((char *)fp, 0, sizeof(*fp) * n); fstart = fp; ftail = fp + n; unMarkAll(); if (convert_code_r(root)) break; free(fp); } return fp; } #ifdef BDEBUG static void opt_dump(root) struct block *root; { struct bpf_program f; memset(bids, 0, sizeof bids); f.bf_insns = icode_to_fcode(root, &f.bf_len); bpf_dump(&f, 1); putchar('\n'); free((char *)f.bf_insns); } #endif nmap-2.08/libpcap-possiblymodified/pcap-bpf.c100644 764 764 14266 6611214675 20327 0ustar fyodorfyodor/* * Copyright (c) 1993, 1994, 1995, 1996, 1998 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-bpf.c,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL)"; #endif #include /* optionally get BSD define */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif int pcap_stats(pcap_t *p, struct pcap_stat *ps) { struct bpf_stat s; if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) { sprintf(p->errbuf, "BIOCGSTATS: %s", pcap_strerror(errno)); return (-1); } ps->ps_recv = s.bs_recv; ps->ps_drop = s.bs_drop; return (0); } int pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { int cc; int n = 0; register u_char *bp, *ep; again: cc = p->cc; if (p->cc == 0) { cc = read(p->fd, (char *)p->buffer, p->bufsize); if (cc < 0) { /* Don't choke when we get ptraced */ switch (errno) { case EINTR: goto again; case EWOULDBLOCK: return (0); #if defined(sun) && !defined(BSD) /* * Due to a SunOS bug, after 2^31 bytes, the kernel * file offset overflows and read fails with EINVAL. * The lseek() to 0 will fix things. */ case EINVAL: if (lseek(p->fd, 0L, SEEK_CUR) + p->bufsize < 0) { (void)lseek(p->fd, 0L, SEEK_SET); goto again; } /* fall through */ #endif } sprintf(p->errbuf, "read: %s", pcap_strerror(errno)); return (-1); } bp = p->buffer; } else bp = p->bp; /* * Loop through each packet. */ #define bhp ((struct bpf_hdr *)bp) ep = bp + cc; while (bp < ep) { register int caplen, hdrlen; caplen = bhp->bh_caplen; hdrlen = bhp->bh_hdrlen; /* * XXX A bpf_hdr matches a pcap_pkthdr. */ (*callback)(user, (struct pcap_pkthdr*)bp, bp + hdrlen); bp += BPF_WORDALIGN(caplen + hdrlen); if (++n >= cnt && cnt > 0) { p->bp = bp; p->cc = ep - bp; return (n); } } #undef bhp p->cc = 0; return (n); } static inline int bpf_open(pcap_t *p, char *errbuf) { int fd; int n = 0; char device[sizeof "/dev/bpf000"]; /* * Go through all the minors and find one that isn't in use. */ do { (void)sprintf(device, "/dev/bpf%d", n++); fd = open(device, O_RDONLY); } while (fd < 0 && errno == EBUSY); /* * XXX better message for all minors used */ if (fd < 0) sprintf(errbuf, "%s: %s", device, pcap_strerror(errno)); return (fd); } pcap_t * pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf) { int fd; struct ifreq ifr; struct bpf_version bv; u_int v; pcap_t *p; p = (pcap_t *)malloc(sizeof(*p)); if (p == NULL) { sprintf(ebuf, "malloc: %s", pcap_strerror(errno)); return (NULL); } bzero(p, sizeof(*p)); fd = bpf_open(p, ebuf); if (fd < 0) goto bad; p->fd = fd; p->snapshot = snaplen; if (ioctl(fd, BIOCVERSION, (caddr_t)&bv) < 0) { sprintf(ebuf, "BIOCVERSION: %s", pcap_strerror(errno)); goto bad; } if (bv.bv_major != BPF_MAJOR_VERSION || bv.bv_minor < BPF_MINOR_VERSION) { sprintf(ebuf, "kernel bpf filter out of date"); goto bad; } v = 32768; /* XXX this should be a user-accessible hook */ /* Ignore the return value - this is because the call fails on * BPF systems that don't have kernel malloc. And if the call * fails, it's no big deal, we just continue to use the standard * buffer size. */ (void) ioctl(fd, BIOCSBLEN, (caddr_t)&v); (void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) { sprintf(ebuf, "%s: %s", device, pcap_strerror(errno)); goto bad; } /* Get the data link layer type. */ if (ioctl(fd, BIOCGDLT, (caddr_t)&v) < 0) { sprintf(ebuf, "BIOCGDLT: %s", pcap_strerror(errno)); goto bad; } #if _BSDI_VERSION - 0 >= 199510 /* The SLIP and PPP link layer header changed in BSD/OS 2.1 */ switch (v) { case DLT_SLIP: v = DLT_SLIP_BSDOS; break; case DLT_PPP: v = DLT_PPP_BSDOS; break; } #endif p->linktype = v; /* set timeout */ if (to_ms != 0) { struct timeval to; to.tv_sec = to_ms / 1000; to.tv_usec = (to_ms * 1000) % 1000000; if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&to) < 0) { sprintf(ebuf, "BIOCSRTIMEOUT: %s", pcap_strerror(errno)); goto bad; } } if (promisc) /* set promiscuous mode, okay if it fails */ (void)ioctl(p->fd, BIOCPROMISC, NULL); if (ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) { sprintf(ebuf, "BIOCGBLEN: %s", pcap_strerror(errno)); goto bad; } p->bufsize = v; p->buffer = (u_char *)malloc(p->bufsize); if (p->buffer == NULL) { sprintf(ebuf, "malloc: %s", pcap_strerror(errno)); goto bad; } return (p); bad: (void)close(fd); free(p); return (NULL); } int pcap_setfilter(pcap_t *p, struct bpf_program *fp) { if (p->sf.rfile != NULL) p->fcode = *fp; else if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) < 0) { sprintf(p->errbuf, "BIOCSETF: %s", pcap_strerror(errno)); return (-1); } return (0); } nmap-2.08/libpcap-possiblymodified/pcap-dlpi.c100644 764 764 46023 6611214700 20471 0ustar fyodorfyodor/* * Copyright (c) 1993, 1994, 1995, 1996, 1997 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * This code contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), * University College London. */ /* * Packet capture routine for dlpi under SunOS 5 * * Notes: * * - Apparently the DLIOCRAW ioctl() is specific to SunOS. * * - There is a bug in bufmod(7) such that setting the snapshot * length results in data being left of the front of the packet. * * - It might be desirable to use pfmod(7) to filter packets in the * kernel. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-dlpi.c,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL)"; #endif #include #include #ifdef HAVE_SYS_BUFMOD_H #include #endif #include #ifdef HAVE_SYS_DLPI_EXT_H #include #endif #ifdef HAVE_HPUX9 #include #endif #ifdef DL_HP_PPA_ACK_OBS #include #endif #include #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H) #include #endif #ifdef HAVE_HPUX9 #include #endif #include #ifdef HAVE_HPUX9 #include #endif #include #include #include #include #include #include #include #include #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif #ifndef PCAP_DEV_PREFIX #define PCAP_DEV_PREFIX "/dev" #endif #define MAXDLBUF 8192 /* Forwards */ static int dlattachreq(int, bpf_u_int32, char *); static int dlbindack(int, char *, char *); static int dlbindreq(int, bpf_u_int32, char *); static int dlinfoack(int, char *, char *); static int dlinforeq(int, char *); static int dlokack(int, const char *, char *, char *); static int recv_ack(int, int, const char *, char *, char *); static int dlpromisconreq(int, bpf_u_int32, char *); #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H) static char *get_release(bpf_u_int32 *, bpf_u_int32 *, bpf_u_int32 *); #endif static int send_request(int, char *, int, char *, char *); #ifdef HAVE_SYS_BUFMOD_H static int strioctl(int, int, int, char *); #endif #ifdef HAVE_HPUX9 static int dlpi_kread(int, off_t, void *, u_int, char *); #endif #ifdef HAVE_DEV_DLPI static int get_dlpi_ppa(int, const char *, int, char *); #endif int pcap_stats(pcap_t *p, struct pcap_stat *ps) { *ps = p->md.stat; return (0); } /* XXX Needed by HP-UX (at least) */ static bpf_u_int32 ctlbuf[MAXDLBUF]; static struct strbuf ctl = { MAXDLBUF, 0, (char *)ctlbuf }; int pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { register int cc, n, caplen, origlen; register u_char *bp, *ep, *pk; register struct bpf_insn *fcode; #ifdef HAVE_SYS_BUFMOD_H register struct sb_hdr *sbp; #ifdef LBL_ALIGN struct sb_hdr sbhdr; #endif #endif int flags; struct strbuf data; struct pcap_pkthdr pkthdr; flags = 0; cc = p->cc; if (cc == 0) { data.buf = (char *)p->buffer + p->offset; data.maxlen = MAXDLBUF; data.len = 0; do { if (getmsg(p->fd, &ctl, &data, &flags) < 0) { /* Don't choke when we get ptraced */ if (errno == EINTR) { cc = 0; continue; } strcpy(p->errbuf, pcap_strerror(errno)); return (-1); } cc = data.len; } while (cc == 0); bp = p->buffer + p->offset; } else bp = p->bp; /* Loop through packets */ fcode = p->fcode.bf_insns; ep = bp + cc; n = 0; #ifdef HAVE_SYS_BUFMOD_H while (bp < ep) { #ifdef LBL_ALIGN if ((long)bp & 3) { sbp = &sbhdr; memcpy(sbp, bp, sizeof(*sbp)); } else #endif sbp = (struct sb_hdr *)bp; p->md.stat.ps_drop += sbp->sbh_drops; pk = bp + sizeof(*sbp); bp += sbp->sbh_totlen; origlen = sbp->sbh_origlen; caplen = sbp->sbh_msglen; #else origlen = cc; caplen = min(p->snapshot, cc); pk = bp; bp += caplen; #endif ++p->md.stat.ps_recv; if (bpf_filter(fcode, pk, origlen, caplen)) { #ifdef HAVE_SYS_BUFMOD_H pkthdr.ts = sbp->sbh_timestamp; #else (void)gettimeofday(&pkthdr.ts, NULL); #endif pkthdr.len = origlen; pkthdr.caplen = caplen; /* Insure caplen does not exceed snapshot */ if (pkthdr.caplen > p->snapshot) pkthdr.caplen = p->snapshot; (*callback)(user, &pkthdr, pk); if (++n >= cnt && cnt >= 0) { p->cc = ep - bp; p->bp = bp; return (n); } } #ifdef HAVE_SYS_BUFMOD_H } #endif p->cc = 0; return (n); } pcap_t * pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf) { register char *cp; char *eos; register pcap_t *p; register int ppa; register dl_info_ack_t *infop; #ifdef HAVE_SYS_BUFMOD_H bpf_u_int32 ss, flag; #ifdef HAVE_SOLARIS register char *release; bpf_u_int32 osmajor, osminor, osmicro; #endif #endif bpf_u_int32 buf[MAXDLBUF]; char dname[100]; #ifndef HAVE_DEV_DLPI char dname2[100]; #endif p = (pcap_t *)malloc(sizeof(*p)); if (p == NULL) { strcpy(ebuf, pcap_strerror(errno)); return (NULL); } memset(p, 0, sizeof(*p)); /* ** Determine device and ppa */ cp = strpbrk(device, "0123456789"); if (cp == NULL) { sprintf(ebuf, "%s missing unit number", device); goto bad; } ppa = strtol(cp, &eos, 10); if (*eos != '\0') { sprintf(ebuf, "%s bad unit number", device); goto bad; } if (*device == '/') strcpy(dname, device); else sprintf(dname, "%s/%s", PCAP_DEV_PREFIX, device); #ifdef HAVE_DEV_DLPI /* Map network device to /dev/dlpi unit */ cp = "/dev/dlpi"; if ((p->fd = open(cp, O_RDWR)) < 0) { sprintf(ebuf, "%s: %s", cp, pcap_strerror(errno)); goto bad; } /* Map network interface to /dev/dlpi unit */ ppa = get_dlpi_ppa(p->fd, dname, ppa, ebuf); if (ppa < 0) goto bad; #else /* Try device without unit number */ strcpy(dname2, dname); cp = strchr(dname, *cp); *cp = '\0'; if ((p->fd = open(dname, O_RDWR)) < 0) { if (errno != ENOENT) { sprintf(ebuf, "%s: %s", dname, pcap_strerror(errno)); goto bad; } /* Try again with unit number */ if ((p->fd = open(dname2, O_RDWR)) < 0) { sprintf(ebuf, "%s: %s", dname2, pcap_strerror(errno)); goto bad; } /* XXX Assume unit zero */ ppa = 0; } #endif p->snapshot = snaplen; /* ** Attach if "style 2" provider */ if (dlinforeq(p->fd, ebuf) < 0 || dlinfoack(p->fd, (char *)buf, ebuf) < 0) goto bad; infop = &((union DL_primitives *)buf)->info_ack; if (infop->dl_provider_style == DL_STYLE2 && (dlattachreq(p->fd, ppa, ebuf) < 0 || dlokack(p->fd, "attach", (char *)buf, ebuf) < 0)) goto bad; /* ** Bind (defer if using HP-UX 9 or HP-UX 10.20, totally skip if ** using SINIX) */ #if !defined(HAVE_HPUX9) && !defined(HAVE_HPUX10_20) && !defined(sinix) if (dlbindreq(p->fd, 0, ebuf) < 0 || dlbindack(p->fd, (char *)buf, ebuf) < 0) goto bad; #endif if (promisc) { /* ** Enable promiscuous */ if (dlpromisconreq(p->fd, DL_PROMISC_PHYS, ebuf) < 0 || dlokack(p->fd, "promisc_phys", (char *)buf, ebuf) < 0) goto bad; /* ** Try to enable multicast (you would have thought ** promiscuous would be sufficient). (Skip if using ** HP-UX or SINIX) */ #if !defined(__hpux) && !defined(sinix) if (dlpromisconreq(p->fd, DL_PROMISC_MULTI, ebuf) < 0 || dlokack(p->fd, "promisc_multi", (char *)buf, ebuf) < 0) fprintf(stderr, "WARNING: DL_PROMISC_MULTI failed (%s)\n", ebuf); #endif } /* ** Try to enable sap (when not in promiscuous mode when using ** using HP-UX and never under SINIX) */ #ifndef sinix if ( #ifdef __hpux !promisc && #endif (dlpromisconreq(p->fd, DL_PROMISC_SAP, ebuf) < 0 || dlokack(p->fd, "promisc_sap", (char *)buf, ebuf) < 0)) { /* Not fatal if promisc since the DL_PROMISC_PHYS worked */ if (promisc) fprintf(stderr, "WARNING: DL_PROMISC_SAP failed (%s)\n", ebuf); else goto bad; } #endif /* ** HP-UX 9 and HP-UX 10.20 must bind after setting promiscuous ** options) */ #if defined(HAVE_HPUX9) || defined(HAVE_HPUX10_20) if (dlbindreq(p->fd, 0, ebuf) < 0 || dlbindack(p->fd, (char *)buf, ebuf) < 0) goto bad; #endif /* ** Determine link type */ if (dlinforeq(p->fd, ebuf) < 0 || dlinfoack(p->fd, (char *)buf, ebuf) < 0) goto bad; infop = &((union DL_primitives *)buf)->info_ack; switch (infop->dl_mac_type) { case DL_CSMACD: case DL_ETHER: p->linktype = DLT_EN10MB; p->offset = 2; break; case DL_FDDI: p->linktype = DLT_FDDI; p->offset = 3; break; default: sprintf(ebuf, "unknown mac type 0x%lu", infop->dl_mac_type); goto bad; } #ifdef DLIOCRAW /* ** This is a non standard SunOS hack to get the ethernet header. */ if (strioctl(p->fd, DLIOCRAW, 0, NULL) < 0) { sprintf(ebuf, "DLIOCRAW: %s", pcap_strerror(errno)); goto bad; } #endif #ifdef HAVE_SYS_BUFMOD_H /* ** Another non standard call to get the data nicely buffered */ if (ioctl(p->fd, I_PUSH, "bufmod") != 0) { sprintf(ebuf, "I_PUSH bufmod: %s", pcap_strerror(errno)); goto bad; } /* ** Now that the bufmod is pushed lets configure it. ** ** There is a bug in bufmod(7). When dealing with messages of ** less than snaplen size it strips data from the beginning not ** the end. ** ** This bug is supposed to be fixed in 5.3.2. Also, there is a ** patch available. Ask for bugid 1149065. */ ss = snaplen; #ifdef HAVE_SOLARIS release = get_release(&osmajor, &osminor, &osmicro); if (osmajor == 5 && (osminor <= 2 || (osminor == 3 && osmicro < 2)) && getenv("BUFMOD_FIXED") == NULL) { fprintf(stderr, "WARNING: bufmod is broken in SunOS %s; ignoring snaplen.\n", release); ss = 0; } #endif if (ss > 0 && strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) { sprintf(ebuf, "SBIOCSSNAP: %s", pcap_strerror(errno)); goto bad; } /* ** Set up the bufmod flags */ if (strioctl(p->fd, SBIOCGFLAGS, sizeof(flag), (char *)&flag) < 0) { sprintf(ebuf, "SBIOCGFLAGS: %s", pcap_strerror(errno)); goto bad; } flag |= SB_NO_DROPS; if (strioctl(p->fd, SBIOCSFLAGS, sizeof(flag), (char *)&flag) != 0) { sprintf(ebuf, "SBIOCSFLAGS: %s", pcap_strerror(errno)); goto bad; } /* ** Set up the bufmod timeout */ if (to_ms != 0) { struct timeval to; to.tv_sec = to_ms / 1000; to.tv_usec = (to_ms * 1000) % 1000000; if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { sprintf(ebuf, "SBIOCSTIME: %s", pcap_strerror(errno)); goto bad; } } #endif /* ** As the last operation flush the read side. */ if (ioctl(p->fd, I_FLUSH, FLUSHR) != 0) { sprintf(ebuf, "FLUSHR: %s", pcap_strerror(errno)); goto bad; } /* Allocate data buffer */ p->bufsize = MAXDLBUF * sizeof(bpf_u_int32); p->buffer = (u_char *)malloc(p->bufsize + p->offset); return (p); bad: free(p); return (NULL); } int pcap_setfilter(pcap_t *p, struct bpf_program *fp) { p->fcode = *fp; return (0); } static int send_request(int fd, char *ptr, int len, char *what, char *ebuf) { struct strbuf ctl; int flags; ctl.maxlen = 0; ctl.len = len; ctl.buf = ptr; flags = 0; if (putmsg(fd, &ctl, (struct strbuf *) NULL, flags) < 0) { sprintf(ebuf, "send_request: putmsg \"%s\": %s", what, pcap_strerror(errno)); return (-1); } return (0); } static int recv_ack(int fd, int size, const char *what, char *bufp, char *ebuf) { union DL_primitives *dlp; struct strbuf ctl; int flags; ctl.maxlen = MAXDLBUF; ctl.len = 0; ctl.buf = bufp; flags = 0; if (getmsg(fd, &ctl, (struct strbuf*)NULL, &flags) < 0) { sprintf(ebuf, "recv_ack: %s getmsg: %s", what, pcap_strerror(errno)); return (-1); } dlp = (union DL_primitives *) ctl.buf; switch (dlp->dl_primitive) { case DL_INFO_ACK: case DL_BIND_ACK: case DL_OK_ACK: #ifdef DL_HP_PPA_ACK case DL_HP_PPA_ACK: #endif /* These are OK */ break; case DL_ERROR_ACK: switch (dlp->error_ack.dl_errno) { case DL_BADPPA: sprintf(ebuf, "recv_ack: %s bad ppa (device unit)", what); break; case DL_SYSERR: sprintf(ebuf, "recv_ack: %s: %s", what, pcap_strerror(dlp->error_ack.dl_unix_errno)); break; case DL_UNSUPPORTED: sprintf(ebuf, "recv_ack: %s: Service not supplied by provider", what); break; default: sprintf(ebuf, "recv_ack: %s error 0x%x", what, (bpf_u_int32)dlp->error_ack.dl_errno); break; } return (-1); default: sprintf(ebuf, "recv_ack: %s unexpected primitive ack 0x%x ", what, (bpf_u_int32)dlp->dl_primitive); return (-1); } if (ctl.len < size) { sprintf(ebuf, "recv_ack: %s ack too small (%d < %d)", what, ctl.len, size); return (-1); } return (ctl.len); } static int dlattachreq(int fd, bpf_u_int32 ppa, char *ebuf) { dl_attach_req_t req; req.dl_primitive = DL_ATTACH_REQ; req.dl_ppa = ppa; return (send_request(fd, (char *)&req, sizeof(req), "attach", ebuf)); } static int dlbindreq(int fd, bpf_u_int32 sap, char *ebuf) { dl_bind_req_t req; memset((char *)&req, 0, sizeof(req)); req.dl_primitive = DL_BIND_REQ; #ifdef DL_HP_RAWDLS req.dl_max_conind = 1; /* XXX magic number */ /* 22 is INSAP as per the HP-UX DLPI Programmer's Guide */ req.dl_sap = 22; req.dl_service_mode = DL_HP_RAWDLS; #else req.dl_sap = sap; #ifdef DL_CLDLS req.dl_service_mode = DL_CLDLS; #endif #endif return (send_request(fd, (char *)&req, sizeof(req), "bind", ebuf)); } static int dlbindack(int fd, char *bufp, char *ebuf) { return (recv_ack(fd, DL_BIND_ACK_SIZE, "bind", bufp, ebuf)); } static int dlpromisconreq(int fd, bpf_u_int32 level, char *ebuf) { dl_promiscon_req_t req; req.dl_primitive = DL_PROMISCON_REQ; req.dl_level = level; return (send_request(fd, (char *)&req, sizeof(req), "promiscon", ebuf)); } static int dlokack(int fd, const char *what, char *bufp, char *ebuf) { return (recv_ack(fd, DL_OK_ACK_SIZE, what, bufp, ebuf)); } static int dlinforeq(int fd, char *ebuf) { dl_info_req_t req; req.dl_primitive = DL_INFO_REQ; return (send_request(fd, (char *)&req, sizeof(req), "info", ebuf)); } static int dlinfoack(int fd, char *bufp, char *ebuf) { return (recv_ack(fd, DL_INFO_ACK_SIZE, "info", bufp, ebuf)); } #ifdef HAVE_SYS_BUFMOD_H static int strioctl(int fd, int cmd, int len, char *dp) { struct strioctl str; int rc; str.ic_cmd = cmd; str.ic_timout = -1; str.ic_len = len; str.ic_dp = dp; rc = ioctl(fd, I_STR, &str); if (rc < 0) return (rc); else return (str.ic_len); } #endif #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H) static char * get_release(bpf_u_int32 *majorp, bpf_u_int32 *minorp, bpf_u_int32 *microp) { char *cp; static char buf[32]; *majorp = 0; *minorp = 0; *microp = 0; if (sysinfo(SI_RELEASE, buf, sizeof(buf)) < 0) return ("?"); cp = buf; if (!isdigit(*cp)) return (buf); *majorp = strtol(cp, &cp, 10); if (*cp++ != '.') return (buf); *minorp = strtol(cp, &cp, 10); if (*cp++ != '.') return (buf); *microp = strtol(cp, &cp, 10); return (buf); } #endif #ifdef DL_HP_PPA_ACK_OBS /* * Under HP-UX 10, we can ask for the ppa */ /* Determine ppa number that specifies ifname */ static int get_dlpi_ppa(register int fd, register const char *device, register int unit, register char *ebuf) { register dl_hp_ppa_ack_t *ap; register dl_hp_ppa_info_t *ip; register int i; register u_long majdev; dl_hp_ppa_req_t req; struct stat statbuf; bpf_u_int32 buf[MAXDLBUF]; if (stat(device, &statbuf) < 0) { sprintf(ebuf, "stat: %s: %s", device, pcap_strerror(errno)); return (-1); } majdev = major(statbuf.st_rdev); memset((char *)&req, 0, sizeof(req)); req.dl_primitive = DL_HP_PPA_REQ; memset((char *)buf, 0, sizeof(buf)); if (send_request(fd, (char *)&req, sizeof(req), "hpppa", ebuf) < 0 || recv_ack(fd, DL_HP_PPA_ACK_SIZE, "hpppa", (char *)buf, ebuf) < 0) return (-1); ap = (dl_hp_ppa_ack_t *)buf; ip = (dl_hp_ppa_info_t *)((u_char *)ap + ap->dl_offset); for(i = 0; i < ap->dl_count; i++) { if (ip->dl_mjr_num == majdev && ip->dl_instance_num == unit) break; ip = (dl_hp_ppa_info_t *)((u_char *)ip + ip->dl_next_offset); } if (i == ap->dl_count) { sprintf(ebuf, "can't find PPA for %s", device); return (-1); } if (ip->dl_hdw_state == HDW_DEAD) { sprintf(ebuf, "%s: hardware state: DOWN\n", device); return (-1); } return ((int)ip->dl_ppa); } #endif #ifdef HAVE_HPUX9 /* * Under HP-UX 9, there is no good way to determine the ppa. * So punt and read it from /dev/kmem. */ static struct nlist nl[] = { #define NL_IFNET 0 { "ifnet" }, { "" } }; static char path_vmunix[] = "/hp-ux"; /* Determine ppa number that specifies ifname */ static int get_dlpi_ppa(register int fd, register const char *ifname, register int unit, register char *ebuf) { register const char *cp; register int kd; void *addr; struct ifnet ifnet; char if_name[sizeof(ifnet.if_name)], tifname[32]; cp = strrchr(ifname, '/'); if (cp != NULL) ifname = cp + 1; if (nlist(path_vmunix, &nl) < 0) { sprintf(ebuf, "nlist %s failed", path_vmunix); return (-1); } if (nl[NL_IFNET].n_value == 0) { sprintf(ebuf, "could't find %s kernel symbol", nl[NL_IFNET].n_name); return (-1); } kd = open("/dev/kmem", O_RDONLY); if (kd < 0) { sprintf(ebuf, "kmem open: %s", pcap_strerror(errno)); return (-1); } if (dlpi_kread(kd, nl[NL_IFNET].n_value, &addr, sizeof(addr), ebuf) < 0) { close(kd); return (-1); } for (; addr != NULL; addr = ifnet.if_next) { if (dlpi_kread(kd, (off_t)addr, &ifnet, sizeof(ifnet), ebuf) < 0 || dlpi_kread(kd, (off_t)ifnet.if_name, if_name, sizeof(if_name), ebuf) < 0) { (void)close(kd); return (-1); } sprintf(tifname, "%.*s%d", (int)sizeof(if_name), if_name, ifnet.if_unit); if (strcmp(tifname, ifname) == 0) return (ifnet.if_index); } sprintf(ebuf, "Can't find %s", ifname); return (-1); } static int dlpi_kread(register int fd, register off_t addr, register void *buf, register u_int len, register char *ebuf) { register int cc; if (lseek(fd, addr, SEEK_SET) < 0) { sprintf(ebuf, "lseek: %s", pcap_strerror(errno)); return (-1); } cc = read(fd, buf, len); if (cc < 0) { sprintf(ebuf, "read: %s", pcap_strerror(errno)); return (-1); } else if (cc != len) { sprintf(ebuf, "short read (%d != %d)", cc, len); return (-1); } return (cc); } #endif nmap-2.08/libpcap-possiblymodified/pcap-enet.c100444 764 764 11307 6253457263 20506 0ustar fyodorfyodor/* * Stanford Enetfilter subroutines for tcpdump * * Based on the MERIT NNstat etherifrt.c and the Ultrix pcap-pf.c * subroutines. * * Rayan Zachariassen, CA*Net */ #include #include #include #include #include #include #include #include #include #include #include #include #include "interface.h" struct packet_header { #ifdef IBMRTPC struct LengthWords length; struct tap_header tap; #endif /* IBMRTPC */ u_char packet[8] }; extern int errno; #define BUFSPACE (4*1024) /* Forwards */ static void efReadError(int, char *); void readloop(int cnt, int if_fd, struct bpf_program *fp, printfunc printit) { #ifdef IBMRTPC register struct packet_header *ph; register u_char *bp; register int inc; #else /* !IBMRTPC */ static struct timeval tv = { 0 }; #endif /* IBMRTPC */ register int cc, caplen; register struct bpf_insn *fcode = fp->bf_insns; union { struct packet_header hdr; u_char p[BUFSPACE]; u_short s; } buf; while (1) { if ((cc = read(if_fd, (char *)buf.p, sizeof(buf))) < 0) efReadError(if_fd, "reader"); #ifdef IBMRTPC /* * Loop through each packet. */ bp = buf.p; while (cc > 0) { ph = (struct packet_header *)bp; caplen = ph->tap.th_wirelen > snaplen ? snaplen : ph->tap .th_wirelen ; if (bpf_filter(fcode, (char *)ph->packet, ph->tap.th_wirelen, caplen)) { if (cnt >= 0 && --cnt < 0) goto out; (*printit)((char *)ph->packet, (struct timeval *)ph->tap.th_timestamp, ph->tap.th_wirelen, caplen); } inc = ph->length.PacketOffset; cc -= inc; bp += inc; } #else /* !IBMRTPC */ caplen = cc > snaplen ? snaplen : cc ; if (bpf_filter(fcode, buf.hdr.packet, cc, caplen)) { if (cnt >= 0 && --cnt < 0) goto out; (*printit)(buf.hdr.packet, &tv, cc, caplen); } #endif /* IBMRTPC */ } out: wrapup(if_fd); } /* Call ONLY if read() has returned an error on packet filter */ static void efReadError(int fid, char *msg) { if (errno == EINVAL) { /* read MAXINT bytes already! */ if (lseek(fid, 0, 0) < 0) { perror("tcpdump: efReadError/lseek"); exit(-1); } else return; } else { (void) fprintf(stderr, "tcpdump: "); perror(msg); exit(-1); } } void wrapup(int fd) { #ifdef IBMRTPC struct enstats es; if (ioctl(fd, EIOSTATS, &es) == -1) { perror("tcpdump: enet ioctl EIOSTATS error"); exit(-1); } fprintf(stderr, "%d packets queued", es.enStat_Rcnt); if (es.enStat_Rdrops > 0) fprintf(stderr, ", %d dropped", es.enStat_Rdrops); if (es.enStat_Reads > 0) fprintf(stderr, ", %d tcpdump %s", es.enStat_Reads, es.enStat_Reads > 1 ? "reads" : "read"); if (es.enStat_MaxRead > 1) fprintf(stderr, ", %d packets in largest read", es.enStat_MaxRead); putc('\n', stderr); #endif /* IBMRTPC */ close(fd); } int initdevice(char *device, int pflag, int *linktype) { struct eniocb ctl; struct enfilter filter; u_int maxwaiting; int if_fd; #ifdef IBMRTPC GETENETDEVICE(0, O_RDONLY, &if_fd); #else /* !IBMRTPC */ if_fd = open("/dev/enet", O_RDONLY, 0); #endif /* IBMRTPC */ if (if_fd == -1) { perror("tcpdump: enet open error"); error( "your system may not be properly configured; see \"man enet(4)\""); exit(-1); } /* Get operating parameters. */ if (ioctl(if_fd, EIOCGETP, (char *)&ctl) == -1) { perror("tcpdump: enet ioctl EIOCGETP error"); exit(-1); } /* Set operating parameters. */ #ifdef IBMRTPC ctl.en_rtout = 1 * ctl.en_hz; ctl.en_tr_etherhead = 1; ctl.en_tap_network = 1; ctl.en_multi_packet = 1; ctl.en_maxlen = BUFSPACE; #else /* !IBMRTPC */ ctl.en_rtout = 64; /* randomly picked value for HZ */ #endif /* IBMRTPC */ if (ioctl(if_fd, EIOCSETP, &ctl) == -1) { perror("tcpdump: enet ioctl EIOCSETP error"); exit(-1); } /* Flush the receive queue, since we've changed the operating parameters and we otherwise might receive data without headers. */ if (ioctl(if_fd, EIOCFLUSH) == -1) { perror("tcpdump: enet ioctl EIOCFLUSH error"); exit(-1); } /* Set the receive queue depth to its maximum. */ maxwaiting = ctl.en_maxwaiting; if (ioctl(if_fd, EIOCSETW, &maxwaiting) == -1) { perror("tcpdump: enet ioctl EIOCSETW error"); exit(-1); } #ifdef IBMRTPC /* Clear statistics. */ if (ioctl(if_fd, EIOCLRSTAT, 0) == -1) { perror("tcpdump: enet ioctl EIOCLRSTAT error"); exit(-1); } #endif /* IBMRTPC */ /* Set the filter (accept all packets). */ filter.enf_Priority = 3; filter.enf_FilterLen = 0; if (ioctl(if_fd, EIOCSETF, &filter) == -1) { perror("tcpdump: enet ioctl EIOCSETF error"); exit(-1); } /* * "enetfilter" supports only ethernets. */ *linktype = DLT_EN10MB; return(if_fd); } nmap-2.08/libpcap-possiblymodified/pcap-int.h100644 764 764 6476 6611214701 20331 0ustar fyodorfyodor/* * Copyright (c) 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the Computer Systems * Engineering Group at Lawrence Berkeley Laboratory. * 4. Neither the name of the University nor of the Laboratory may be used * to endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-int.h,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL) */ #ifndef pcap_int_h #define pcap_int_h #include /* * Savefile */ struct pcap_sf { FILE *rfile; int swapped; int version_major; int version_minor; u_char *base; }; struct pcap_md { struct pcap_stat stat; /*XXX*/ int use_bpf; u_long TotPkts; /* can't oflow for 79 hrs on ether */ u_long TotAccepted; /* count accepted by filter */ u_long TotDrops; /* count of dropped packets */ long TotMissed; /* missed by i/f during this run */ long OrigMissed; /* missed by i/f before this run */ #ifdef linux int pad; int skip; char *device; #endif }; struct pcap { int fd; int snapshot; int linktype; int tzoff; /* timezone offset */ int offset; /* offset for proper alignment */ struct pcap_sf sf; struct pcap_md md; /* * Read buffer. */ int bufsize; u_char *buffer; u_char *bp; int cc; /* * Place holder for pcap_next(). */ u_char *pkt; /* * Placeholder for filter code if bpf not in kernel. */ struct bpf_program fcode; char errbuf[PCAP_ERRBUF_SIZE]; }; int yylex(void); #ifndef min #define min(a, b) ((a) > (b) ? (b) : (a)) #endif /* XXX should these be in pcap.h? */ int pcap_offline_read(pcap_t *, int, pcap_handler, u_char *); int pcap_read(pcap_t *, int cnt, pcap_handler, u_char *); /* Ultrix pads to make everything line up on a nice boundary */ #if defined(ultrix) || defined(__alpha) #define PCAP_FDDIPAD 3 #endif /* XXX */ extern int pcap_fddipad; #endif nmap-2.08/libpcap-possiblymodified/pcap-linux.c100755 764 764 20317 6632230673 20713 0ustar fyodorfyodor/* * Copyright (c) 1996, 1997 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-linux.c,v 1.2 1998/12/05 20:17:28 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include #ifdef HAVE_NET_IF_ARP_H #include #else #include #endif #include #include #include #include #include #include #include #include static struct ifreq saved_ifr; #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif #define TIMEVAL_SUBTRACT(a,b) ((a.tv_sec - b.tv_sec) * 1000000 + a.tv_usec - b.tv_usec) static int timeout; void linux_restore_ifr(void); int pcap_stats(pcap_t *p, struct pcap_stat *ps) { *ps = p->md.stat; return (0); } int pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { register int cc; register int bufsize; register int caplen; register u_char *bp; struct sockaddr from; int fromlen; fd_set fd_r; struct timeval select_time, start, now, tmp; int res; fromlen = sizeof(from); select_time.tv_sec = timeout / 1000; select_time.tv_usec = (timeout % 1000) * 1000; gettimeofday(&start, NULL); do { FD_ZERO(&fd_r); FD_SET(p->fd, &fd_r ); bp = p->buffer + p->offset; bufsize = p->bufsize - p->offset; if (p->md.pad > 0) { memset(bp, 0, p->md.pad); bp += p->md.pad; bufsize -= p->md.pad; } tmp = select_time; /* Because linux mucks with the timeout in select() */ res = select(p->fd+1, &fd_r, NULL, NULL, &tmp); if (res < 0) { sprintf(p->errbuf, "select: %s", pcap_strerror(errno)); return (-1); } else if (res > 0) { fromlen = sizeof(from); while ((cc = recvfrom(p->fd, bp, bufsize, 0, &from, &fromlen)) < 0) { /* Don't choke when we get ptraced */ if (errno != EINTR && errno != EAGAIN) { sprintf(p->errbuf, "read: %s", pcap_strerror(errno)); return (-1); } } if (!strcmp(p->md.device, from.sa_data)) { /* If we need have leading zero bytes, adjust count */ cc += p->md.pad; bp = p->buffer + p->offset; /* If we need to step over leading junk, adjust count and pointer */ cc -= p->md.skip; bp += p->md.skip; /* Captured length can't exceed our read buffer size */ caplen = cc; if (caplen > bufsize) caplen = bufsize; /* Captured length can't exceed the snapshot length */ if (caplen > p->snapshot) caplen = p->snapshot; if (p->fcode.bf_insns == NULL || bpf_filter(p->fcode.bf_insns, bp, cc, caplen)) { struct pcap_pkthdr h; ++p->md.stat.ps_recv; /* Get timestamp */ if (ioctl(p->fd, SIOCGSTAMP, &h.ts) < 0) { sprintf(p->errbuf, "SIOCGSTAMP: %s", pcap_strerror(errno)); return (-1); } h.len = cc; h.caplen = caplen; (*callback)(user, &h, bp); return (1); } } } gettimeofday(&now, NULL); } while((timeout == 0 && res) || (TIMEVAL_SUBTRACT(now,start) < timeout * 1000)); return 0; } pcap_t * pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf) { register int fd, broadcast; register pcap_t *p; struct ifreq ifr; struct sockaddr sa; timeout = to_ms; p = (pcap_t *)malloc(sizeof(*p)); if (p == NULL) { sprintf(ebuf, "malloc: %s", pcap_strerror(errno)); return (NULL); } memset(p, 0, sizeof(*p)); fd = -1; fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL)); if (fd < 0) { sprintf(ebuf, "socket: %s", pcap_strerror(errno)); goto bad; } p->fd = fd; /* Bind to the interface name */ memset(&sa, 0, sizeof(sa)); sa.sa_family = AF_INET; (void)strncpy(sa.sa_data, device, sizeof(sa.sa_data)); if (bind(p->fd, &sa, sizeof(sa))) { sprintf(ebuf, "bind: %s: %s", device, pcap_strerror(errno)); goto bad; } memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); if (ioctl(p->fd, SIOCGIFHWADDR, &ifr) < 0 ) { sprintf(ebuf, "SIOCGIFHWADDR: %s", pcap_strerror(errno)); goto bad; } broadcast = 0; switch (ifr.ifr_hwaddr.sa_family) { case ARPHRD_ETHER: case ARPHRD_METRICOM: p->linktype = DLT_EN10MB; p->offset = 2; ++broadcast; break; case ARPHRD_EETHER: p->linktype = DLT_EN3MB; ++broadcast; break; case ARPHRD_AX25: p->linktype = DLT_AX25; ++broadcast; break; case ARPHRD_PRONET: p->linktype = DLT_PRONET; break; case ARPHRD_CHAOS: p->linktype = DLT_CHAOS; break; case ARPHRD_IEEE802: p->linktype = DLT_IEEE802; ++broadcast; break; case ARPHRD_ARCNET: p->linktype = DLT_ARCNET; ++broadcast; break; case ARPHRD_SLIP: case ARPHRD_CSLIP: case ARPHRD_SLIP6: case ARPHRD_CSLIP6: case ARPHRD_PPP: p->linktype = DLT_RAW; break; case ARPHRD_LOOPBACK: p->linktype = DLT_NULL; p->md.pad = 2; p->md.skip = 12; break; #ifdef ARPHRD_FDDI /* Not all versions of the kernel has this define */ case ARPHRD_FDDI: p->linktype = DLT_FDDI; ++broadcast; break; #endif #ifdef notdef case ARPHRD_LOCALTLK: case ARPHRD_NETROM: case ARPHRD_APPLETLK: case ARPHRD_DLCI: case ARPHRD_RSRVD: case ARPHRD_ADAPT: case ARPHRD_TUNNEL: case ARPHRD_TUNNEL6: case ARPHRD_FRAD: case ARPHRD_SKIP: /* XXX currently do not know what to do with these... */ abort(); #endif default: sprintf(ebuf, "unknown physical layer type 0x%x", ifr.ifr_hwaddr.sa_family); goto bad; } /* Base the buffer size on the interface MTU */ memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); if (ioctl(p->fd, SIOCGIFMTU, &ifr) < 0 ) { sprintf(ebuf, "SIOCGIFMTU: %s", pcap_strerror(errno)); goto bad; } /* Leave room for link header (which is never large under linux...) */ p->bufsize = ifr.ifr_mtu + 64; p->buffer = (u_char *)malloc(p->bufsize + p->offset); if (p->buffer == NULL) { sprintf(ebuf, "malloc: %s", pcap_strerror(errno)); goto bad; } /* XXX */ if (promisc && broadcast) { memset(&ifr, 0, sizeof(ifr)); strcpy(ifr.ifr_name, device); if (ioctl(p->fd, SIOCGIFFLAGS, &ifr) < 0 ) { sprintf(ebuf, "SIOCGIFFLAGS: %s", pcap_strerror(errno)); goto bad; } saved_ifr = ifr; ifr.ifr_flags |= IFF_PROMISC; if (ioctl(p->fd, SIOCSIFFLAGS, &ifr) < 0 ) { sprintf(ebuf, "SIOCSIFFLAGS: %s", pcap_strerror(errno)); goto bad; } ifr.ifr_flags &= ~IFF_PROMISC; atexit(linux_restore_ifr); } p->md.device = strdup(device); if (p->md.device == NULL) { sprintf(ebuf, "malloc: %s", pcap_strerror(errno)); goto bad; } p->snapshot = snaplen; return (p); bad: if (fd >= 0) (void)close(fd); if (p->buffer != NULL) free(p->buffer); if (p->md.device != NULL) free(p->md.device); free(p); return (NULL); } int pcap_setfilter(pcap_t *p, struct bpf_program *fp) { p->fcode = *fp; return (0); } void linux_restore_ifr(void) { register int fd; fd = socket(PF_INET, SOCK_PACKET, htons(0x0003)); if (fd < 0) fprintf(stderr, "linux socket: %s", pcap_strerror(errno)); else if (ioctl(fd, SIOCSIFFLAGS, &saved_ifr) < 0) fprintf(stderr, "linux SIOCSIFFLAGS: %s", pcap_strerror(errno)); } nmap-2.08/libpcap-possiblymodified/pcap-namedb.h100644 764 764 6207 6611214703 20757 0ustar fyodorfyodor/* * Copyright (c) 1994, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the Computer Systems * Engineering Group at Lawrence Berkeley Laboratory. * 4. Neither the name of the University nor of the Laboratory may be used * to endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-namedb.h,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL) */ #ifndef lib_pcap_ethers_h #define lib_pcap_ethers_h /* * As returned by the pcap_next_etherent() * XXX this stuff doesn't belong in this interface, but this * library already must do name to address translation, so * on systems that don't have support for /etc/ethers, we * export these hooks since they'll */ struct pcap_etherent { u_char addr[6]; char name[122]; }; #ifndef PCAP_ETHERS_FILE #define PCAP_ETHERS_FILE "/etc/ethers" #endif struct pcap_etherent *pcap_next_etherent(FILE *); u_char *pcap_ether_hostton(const char*); u_char *pcap_ether_aton(const char *); bpf_u_int32 **pcap_nametoaddr(const char *); bpf_u_int32 pcap_nametonetaddr(const char *); int pcap_nametoport(const char *, int *, int *); int pcap_nametoproto(const char *); int pcap_nametoeproto(const char *); /* * If a protocol is unknown, PROTO_UNDEF is returned. * Also, pcap_nametoport() returns the protocol along with the port number. * If there are ambiguous entried in /etc/services (i.e. domain * can be either tcp or udp) PROTO_UNDEF is returned. */ #define PROTO_UNDEF -1 /* XXX move these to pcap-int.h? */ int __pcap_atodn(const char *, bpf_u_int32 *); int __pcap_atoin(const char *, bpf_u_int32 *); u_short __pcap_nametodnaddr(const char *); #endif nmap-2.08/libpcap-possiblymodified/pcap-nit.c100644 764 764 13076 6611214706 20343 0ustar fyodorfyodor/* * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-nit.c,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif /* * The chunk size for NIT. This is the amount of buffering * done for read calls. */ #define CHUNKSIZE (2*1024) /* * The total buffer space used by NIT. */ #define BUFSPACE (4*CHUNKSIZE) /* Forwards */ static int nit_setflags(int, int, int, char *); int pcap_stats(pcap_t *p, struct pcap_stat *ps) { *ps = p->md.stat; return (0); } int pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { register int cc, n; register struct bpf_insn *fcode = p->fcode.bf_insns; register u_char *bp, *cp, *ep; register struct nit_hdr *nh; register int caplen; cc = p->cc; if (cc == 0) { cc = read(p->fd, (char *)p->buffer, p->bufsize); if (cc < 0) { if (errno == EWOULDBLOCK) return (0); sprintf(p->errbuf, "pcap_read: %s", pcap_strerror(errno)); return (-1); } bp = p->buffer; } else bp = p->bp; /* * Loop through each packet. The increment expression * rounds up to the next int boundary past the end of * the previous packet. */ n = 0; ep = bp + cc; while (bp < ep) { nh = (struct nit_hdr *)bp; cp = bp + sizeof(*nh); switch (nh->nh_state) { case NIT_CATCH: break; case NIT_NOMBUF: case NIT_NOCLUSTER: case NIT_NOSPACE: p->md.stat.ps_drop = nh->nh_dropped; continue; case NIT_SEQNO: continue; default: sprintf(p->errbuf, "bad nit state %d", nh->nh_state); return (-1); } ++p->md.stat.ps_recv; bp += ((sizeof(struct nit_hdr) + nh->nh_datalen + sizeof(int) - 1) & ~(sizeof(int) - 1)); caplen = nh->nh_wirelen; if (caplen > p->snapshot) caplen = p->snapshot; if (bpf_filter(fcode, cp, nh->nh_wirelen, caplen)) { struct pcap_pkthdr h; h.ts = nh->nh_timestamp; h.len = nh->nh_wirelen; h.caplen = caplen; (*callback)(user, &h, cp); if (++n >= cnt && cnt >= 0) { p->cc = ep - bp; p->bp = bp; return (n); } } } p->cc = 0; return (n); } static int nit_setflags(int fd, int promisc, int to_ms, char *ebuf) { struct nit_ioc nioc; bzero((char *)&nioc, sizeof(nioc)); nioc.nioc_bufspace = BUFSPACE; nioc.nioc_chunksize = CHUNKSIZE; nioc.nioc_typetomatch = NT_ALLTYPES; nioc.nioc_snaplen = p->snapshot; nioc.nioc_bufalign = sizeof(int); nioc.nioc_bufoffset = 0; if (to_ms != 0) { nioc.nioc_flags |= NF_TIMEOUT; nioc.nioc_timeout.tv_sec = to_ms / 1000; nioc.nioc_timeout.tv_usec = (to_ms * 1000) % 1000000; } if (promisc) nioc.nioc_flags |= NF_PROMISC; if (ioctl(fd, SIOCSNIT, &nioc) < 0) { sprintf(ebuf, "SIOCSNIT: %s", pcap_strerror(errno)); return (-1); } return (0); } pcap_t * pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf) { int fd; struct sockaddr_nit snit; register pcap_t *p; p = (pcap_t *)malloc(sizeof(*p)); if (p == NULL) { strcpy(ebuf, pcap_strerror(errno)); return (NULL); } if (snaplen < 96) /* * NIT requires a snapshot length of at least 96. */ snaplen = 96; bzero(p, sizeof(*p)); p->fd = fd = socket(AF_NIT, SOCK_RAW, NITPROTO_RAW); if (fd < 0) { sprintf(ebuf, "socket: %s", pcap_strerror(errno)); goto bad; } snit.snit_family = AF_NIT; (void)strncpy(snit.snit_ifname, device, NITIFSIZ); if (bind(fd, (struct sockaddr *)&snit, sizeof(snit))) { sprintf(ebuf, "bind: %s: %s", snit.snit_ifname, pcap_strerror(errno)); goto bad; } p->snapshot = snaplen; nit_setflags(p->fd, promisc, to_ms, ebuf); /* * NIT supports only ethernets. */ p->linktype = DLT_EN10MB; p->bufsize = BUFSPACE; p->buffer = (u_char *)malloc(p->bufsize); if (p->buffer == NULL) { strcpy(ebuf, pcap_strerror(errno)); goto bad; } return (p); bad: if (fd >= 0) close(fd); free(p); return (NULL); } int pcap_setfilter(pcap_t *p, struct bpf_program *fp) { p->fcode = *fp; return (0); } nmap-2.08/libpcap-possiblymodified/pcap-nit.h100644 764 764 1734 6611214707 20327 0ustar fyodorfyodor/* * Copyright (c) 1990, 1994 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms are permitted * provided that the above copyright notice and this paragraph are * duplicated in all such forms and that any documentation, * advertising materials, and other materials related to such * distribution and use acknowledge that the software was developed * by the University of California, Lawrence Berkeley Laboratory, * Berkeley, CA. The name of the University may not be used to * endorse or promote products derived from this software without * specific prior written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-nit.h,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL) */ nmap-2.08/libpcap-possiblymodified/pcap-null.c100644 764 764 4206 6611214707 20477 0ustar fyodorfyodor/* * Copyright (c) 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-null.c,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL)"; #endif #include /* optionally get BSD define */ #include #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif #include "pcap-int.h" static char nosup[] = "live packet capture not supported on this system"; int pcap_stats(pcap_t *p, struct pcap_stat *ps) { (void)sprintf(p->errbuf, "pcap_stats: %s", nosup); return (-1); } int pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { (void)sprintf(p->errbuf, "pcap_read: %s", nosup); return (-1); } pcap_t * pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf) { (void)strcpy(ebuf, nosup); return (NULL); } int pcap_setfilter(pcap_t *p, struct bpf_program *fp) { if (p->sf.rfile == NULL) { (void)sprintf(p->errbuf, "pcap_setfilter: %s", nosup); return (-1); } p->fcode = *fp; return (0); } nmap-2.08/libpcap-possiblymodified/pcap-pf.c100644 764 764 21473 6611214711 20152 0ustar fyodorfyodor/* * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * packet filter subroutines for tcpdump * Extraction/creation by Jeffrey Mogul, DECWRL */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-pf.c,v 1.1 1998/10/15 04:39:59 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include #include #include #if __STDC__ struct mbuf; struct rtentry; #endif #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif /* * BUFSPACE is the size in bytes of the packet read buffer. Most tcpdump * applications aren't going to need more than 200 bytes of packet header * and the read shouldn't return more packets than packetfilter's internal * queue limit (bounded at 256). */ #define BUFSPACE (200 * 256) int pcap_read(pcap_t *pc, int cnt, pcap_handler callback, u_char *user) { register u_char *p, *bp; struct bpf_insn *fcode; register int cc, n, buflen, inc; register struct enstamp *sp; #ifdef LBL_ALIGN struct enstamp stamp; #endif #ifdef PCAP_FDDIPAD register int pad; #endif fcode = pc->md.use_bpf ? NULL : pc->fcode.bf_insns; again: cc = pc->cc; if (cc == 0) { cc = read(pc->fd, (char *)pc->buffer + pc->offset, pc->bufsize); if (cc < 0) { if (errno == EWOULDBLOCK) return (0); if (errno == EINVAL && lseek(pc->fd, 0L, SEEK_CUR) + pc->bufsize < 0) { /* * Due to a kernel bug, after 2^31 bytes, * the kernel file offset overflows and * read fails with EINVAL. The lseek() * to 0 will fix things. */ (void)lseek(pc->fd, 0L, SEEK_SET); goto again; } sprintf(pc->errbuf, "pf read: %s", pcap_strerror(errno)); return (-1); } bp = pc->buffer + pc->offset; } else bp = pc->bp; /* * Loop through each packet. */ n = 0; #ifdef PCAP_FDDIPAD if (pc->linktype == DLT_FDDI) pad = pcap_fddipad; else pad = 0; #endif while (cc > 0) { if (cc < sizeof(*sp)) { sprintf(pc->errbuf, "pf short read (%d)", cc); return (-1); } #ifdef LBL_ALIGN if ((long)bp & 3) { sp = &stamp; memcpy((char *)sp, (char *)bp, sizeof(*sp)); } else #endif sp = (struct enstamp *)bp; if (sp->ens_stamplen != sizeof(*sp)) { sprintf(pc->errbuf, "pf short stamplen (%d)", sp->ens_stamplen); return (-1); } p = bp + sp->ens_stamplen; buflen = sp->ens_count; if (buflen > pc->snapshot) buflen = pc->snapshot; /* Calculate inc before possible pad update */ inc = ENALIGN(buflen + sp->ens_stamplen); cc -= inc; bp += inc; #ifdef PCAP_FDDIPAD p += pad; buflen -= pad; #endif pc->md.TotPkts++; pc->md.TotDrops += sp->ens_dropped; pc->md.TotMissed = sp->ens_ifoverflows; if (pc->md.OrigMissed < 0) pc->md.OrigMissed = pc->md.TotMissed; /* * Short-circuit evaluation: if using BPF filter * in kernel, no need to do it now. */ if (fcode == NULL || bpf_filter(fcode, p, sp->ens_count, buflen)) { struct pcap_pkthdr h; pc->md.TotAccepted++; h.ts = sp->ens_tstamp; #ifdef PCAP_FDDIPAD h.len = sp->ens_count - pad; #else h.len = sp->ens_count; #endif h.caplen = buflen; (*callback)(user, &h, p); if (++n >= cnt && cnt > 0) { pc->cc = cc; pc->bp = bp; return (n); } } } pc->cc = 0; return (n); } int pcap_stats(pcap_t *p, struct pcap_stat *ps) { ps->ps_recv = p->md.TotAccepted; ps->ps_drop = p->md.TotDrops; ps->ps_ifdrop = p->md.TotMissed - p->md.OrigMissed; return (0); } pcap_t * pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf) { pcap_t *p; short enmode; int backlog = -1; /* request the most */ struct enfilter Filter; struct endevp devparams; p = (pcap_t *)malloc(sizeof(*p)); if (p == NULL) { sprintf(ebuf, "pcap_open_live: %s", pcap_strerror(errno)); return (0); } bzero((char *)p, sizeof(*p)); p->fd = pfopen(device, O_RDONLY); if (p->fd < 0) { sprintf(ebuf, "pf open: %s: %s\n\ your system may not be properly configured; see \"man packetfilter(4)\"\n", device, pcap_strerror(errno)); goto bad; } p->md.OrigMissed = -1; enmode = ENTSTAMP|ENBATCH|ENNONEXCL; if (promisc) enmode |= ENPROMISC; if (ioctl(p->fd, EIOCMBIS, (caddr_t)&enmode) < 0) { sprintf(ebuf, "EIOCMBIS: %s", pcap_strerror(errno)); goto bad; } #ifdef ENCOPYALL /* Try to set COPYALL mode so that we see packets to ourself */ enmode = ENCOPYALL; (void)ioctl(p->fd, EIOCMBIS, (caddr_t)&enmode);/* OK if this fails */ #endif /* set the backlog */ if (ioctl(p->fd, EIOCSETW, (caddr_t)&backlog) < 0) { sprintf(ebuf, "EIOCSETW: %s", pcap_strerror(errno)); goto bad; } /* discover interface type */ if (ioctl(p->fd, EIOCDEVP, (caddr_t)&devparams) < 0) { sprintf(ebuf, "EIOCDEVP: %s", pcap_strerror(errno)); goto bad; } /* HACK: to compile prior to Ultrix 4.2 */ #ifndef ENDT_FDDI #define ENDT_FDDI 4 #endif switch (devparams.end_dev_type) { case ENDT_10MB: p->linktype = DLT_EN10MB; p->offset = 2; break; case ENDT_FDDI: p->linktype = DLT_FDDI; break; default: /* * XXX * Currently, the Ultrix packet filter supports only * Ethernet and FDDI. Eventually, support for SLIP and PPP * (and possibly others: T1?) should be added. */ #ifdef notdef warning( "Packet filter data-link type %d unknown, assuming Ethernet", devparams.end_dev_type); #endif p->linktype = DLT_EN10MB; p->offset = 2; break; } /* set truncation */ #ifdef PCAP_FDDIPAD if (p->linktype == DLT_FDDI) /* packetfilter includes the padding in the snapshot */ snaplen += pcap_fddipad; #endif if (ioctl(p->fd, EIOCTRUNCATE, (caddr_t)&snaplen) < 0) { sprintf(ebuf, "EIOCTRUNCATE: %s", pcap_strerror(errno)); goto bad; } p->snapshot = snaplen; /* accept all packets */ bzero((char *)&Filter, sizeof(Filter)); Filter.enf_Priority = 37; /* anything > 2 */ Filter.enf_FilterLen = 0; /* means "always true" */ if (ioctl(p->fd, EIOCSETF, (caddr_t)&Filter) < 0) { sprintf(ebuf, "EIOCSETF: %s", pcap_strerror(errno)); goto bad; } if (to_ms != 0) { struct timeval timeout; timeout.tv_sec = to_ms / 1000; timeout.tv_usec = (to_ms * 1000) % 1000000; if (ioctl(p->fd, EIOCSRTIMEOUT, (caddr_t)&timeout) < 0) { sprintf(ebuf, "EIOCSRTIMEOUT: %s", pcap_strerror(errno)); goto bad; } } p->bufsize = BUFSPACE; p->buffer = (u_char*)malloc(p->bufsize + p->offset); return (p); bad: free(p); return (NULL); } int pcap_setfilter(pcap_t *p, struct bpf_program *fp) { /* * See if BIOCSETF works. If it does, the kernel supports * BPF-style filters, and we do not need to do post-filtering. */ p->md.use_bpf = (ioctl(p->fd, BIOCSETF, (caddr_t)fp) >= 0); if (p->md.use_bpf) { struct bpf_version bv; if (ioctl(p->fd, BIOCVERSION, (caddr_t)&bv) < 0) { sprintf(p->errbuf, "BIOCVERSION: %s", pcap_strerror(errno)); return (-1); } else if (bv.bv_major != BPF_MAJOR_VERSION || bv.bv_minor < BPF_MINOR_VERSION) { fprintf(stderr, "requires bpf language %d.%d or higher; kernel is %d.%d", BPF_MAJOR_VERSION, BPF_MINOR_VERSION, bv.bv_major, bv.bv_minor); /* don't give up, just be inefficient */ p->md.use_bpf = 0; } } else p->fcode = *fp; /*XXX this goes in tcpdump*/ if (p->md.use_bpf) fprintf(stderr, "tcpdump: Using kernel BPF filter\n"); else fprintf(stderr, "tcpdump: Filtering in user process\n"); return (0); } nmap-2.08/libpcap-possiblymodified/pcap-pf.h100644 764 764 1733 6611214712 20135 0ustar fyodorfyodor/* * Copyright (c) 1990, 1994 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms are permitted * provided that the above copyright notice and this paragraph are * duplicated in all such forms and that any documentation, * advertising materials, and other materials related to such * distribution and use acknowledge that the software was developed * by the University of California, Lawrence Berkeley Laboratory, * Berkeley, CA. The name of the University may not be used to * endorse or promote products derived from this software without * specific prior written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-pf.h,v 1.1 1998/10/15 04:40:00 fyodor Exp $ (LBL) */ nmap-2.08/libpcap-possiblymodified/pcap-snit.c100644 764 764 16172 6611214713 20524 0ustar fyodorfyodor/* * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * Modifications made to accommodate the new SunOS4.0 NIT facility by * Micky Liu, micky@cunixc.cc.columbia.edu, Columbia University in May, 1989. * This module now handles the STREAMS based NIT. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-snit.c,v 1.1 1998/10/15 04:40:00 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef HAVE_MALLOC_H #include #endif #include #include #include #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif /* * The chunk size for NIT. This is the amount of buffering * done for read calls. */ #define CHUNKSIZE (2*1024) /* * The total buffer space used by NIT. */ #define BUFSPACE (4*CHUNKSIZE) /* Forwards */ static int nit_setflags(int, int, int, char *); int pcap_stats(pcap_t *p, struct pcap_stat *ps) { *ps = p->md.stat; return (0); } int pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { register int cc, n; register struct bpf_insn *fcode = p->fcode.bf_insns; register u_char *bp, *cp, *ep; register struct nit_bufhdr *hdrp; register struct nit_iftime *ntp; register struct nit_iflen *nlp; register struct nit_ifdrops *ndp; register int caplen; cc = p->cc; if (cc == 0) { cc = read(p->fd, (char *)p->buffer, p->bufsize); if (cc < 0) { if (errno == EWOULDBLOCK) return (0); sprintf(p->errbuf, "pcap_read: %s", pcap_strerror(errno)); return (-1); } bp = p->buffer; } else bp = p->bp; /* * loop through each snapshot in the chunk */ n = 0; ep = bp + cc; while (bp < ep) { ++p->md.stat.ps_recv; cp = bp; /* get past NIT buffer */ hdrp = (struct nit_bufhdr *)cp; cp += sizeof(*hdrp); /* get past NIT timer */ ntp = (struct nit_iftime *)cp; cp += sizeof(*ntp); ndp = (struct nit_ifdrops *)cp; p->md.stat.ps_drop = ndp->nh_drops; cp += sizeof *ndp; /* get past packet len */ nlp = (struct nit_iflen *)cp; cp += sizeof(*nlp); /* next snapshot */ bp += hdrp->nhb_totlen; caplen = nlp->nh_pktlen; if (caplen > p->snapshot) caplen = p->snapshot; if (bpf_filter(fcode, cp, nlp->nh_pktlen, caplen)) { struct pcap_pkthdr h; h.ts = ntp->nh_timestamp; h.len = nlp->nh_pktlen; h.caplen = caplen; (*callback)(user, &h, cp); if (++n >= cnt && cnt >= 0) { p->cc = ep - bp; p->bp = bp; return (n); } } } p->cc = 0; return (n); } static int nit_setflags(int fd, int promisc, int to_ms, char *ebuf) { bpf_u_int32 flags; struct strioctl si; struct timeval timeout; si.ic_timout = INFTIM; if (to_ms != 0) { timeout.tv_sec = to_ms / 1000; timeout.tv_usec = (to_ms * 1000) % 1000000; si.ic_cmd = NIOCSTIME; si.ic_len = sizeof(timeout); si.ic_dp = (char *)&timeout; if (ioctl(fd, I_STR, (char *)&si) < 0) { sprintf(ebuf, "NIOCSTIME: %s", pcap_strerror(errno)); return (-1); } } flags = NI_TIMESTAMP | NI_LEN | NI_DROPS; if (promisc) flags |= NI_PROMISC; si.ic_cmd = NIOCSFLAGS; si.ic_len = sizeof(flags); si.ic_dp = (char *)&flags; if (ioctl(fd, I_STR, (char *)&si) < 0) { sprintf(ebuf, "NIOCSFLAGS: %s", pcap_strerror(errno)); return (-1); } return (0); } pcap_t * pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf) { struct strioctl si; /* struct for ioctl() */ struct ifreq ifr; /* interface request struct */ int chunksize = CHUNKSIZE; int fd; static char dev[] = "/dev/nit"; register pcap_t *p; p = (pcap_t *)malloc(sizeof(*p)); if (p == NULL) { strcpy(ebuf, pcap_strerror(errno)); return (NULL); } if (snaplen < 96) /* * NIT requires a snapshot length of at least 96. */ snaplen = 96; bzero(p, sizeof(*p)); p->fd = fd = open(dev, O_RDONLY); if (fd < 0) { sprintf(ebuf, "%s: %s", dev, pcap_strerror(errno)); goto bad; } /* arrange to get discrete messages from the STREAM and use NIT_BUF */ if (ioctl(fd, I_SRDOPT, (char *)RMSGD) < 0) { sprintf(ebuf, "I_SRDOPT: %s", pcap_strerror(errno)); goto bad; } if (ioctl(fd, I_PUSH, "nbuf") < 0) { sprintf(ebuf, "push nbuf: %s", pcap_strerror(errno)); goto bad; } /* set the chunksize */ si.ic_cmd = NIOCSCHUNK; si.ic_timout = INFTIM; si.ic_len = sizeof(chunksize); si.ic_dp = (char *)&chunksize; if (ioctl(fd, I_STR, (char *)&si) < 0) { sprintf(ebuf, "NIOCSCHUNK: %s", pcap_strerror(errno)); goto bad; } /* request the interface */ strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = ' '; si.ic_cmd = NIOCBIND; si.ic_len = sizeof(ifr); si.ic_dp = (char *)𝔦 if (ioctl(fd, I_STR, (char *)&si) < 0) { sprintf(ebuf, "NIOCBIND: %s: %s", ifr.ifr_name, pcap_strerror(errno)); goto bad; } /* set the snapshot length */ si.ic_cmd = NIOCSSNAP; si.ic_len = sizeof(snaplen); si.ic_dp = (char *)&snaplen; if (ioctl(fd, I_STR, (char *)&si) < 0) { sprintf(ebuf, "NIOCSSNAP: %s", pcap_strerror(errno)); goto bad; } p->snapshot = snaplen; if (nit_setflags(p->fd, promisc, to_ms, ebuf) < 0) goto bad; (void)ioctl(fd, I_FLUSH, (char *)FLUSHR); /* * NIT supports only ethernets. */ p->linktype = DLT_EN10MB; p->bufsize = BUFSPACE; p->buffer = (u_char *)malloc(p->bufsize); if (p->buffer == NULL) { strcpy(ebuf, pcap_strerror(errno)); goto bad; } return (p); bad: if (fd >= 0) close(fd); free(p); return (NULL); } int pcap_setfilter(pcap_t *p, struct bpf_program *fp) { p->fcode = *fp; return (0); } nmap-2.08/libpcap-possiblymodified/pcap-snoop.c100644 764 764 13630 6611214714 20702 0ustar fyodorfyodor/* * Copyright (c) 1993, 1994, 1995, 1996, 1997 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap-snoop.c,v 1.1 1998/10/15 04:40:00 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif int pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { int cc; register struct snoopheader *sh; register int datalen; register int caplen; register u_char *cp; again: cc = read(p->fd, (char *)p->buffer, p->bufsize); if (cc < 0) { /* Don't choke when we get ptraced */ switch (errno) { case EINTR: goto again; case EWOULDBLOCK: return (0); /* XXX */ } sprintf(p->errbuf, "read: %s", pcap_strerror(errno)); return (-1); } sh = (struct snoopheader *)p->buffer; datalen = sh->snoop_packetlen; caplen = (datalen < p->snapshot) ? datalen : p->snapshot; cp = (u_char *)(sh + 1) + p->offset; /* XXX */ if (p->fcode.bf_insns == NULL || bpf_filter(p->fcode.bf_insns, cp, datalen, caplen)) { struct pcap_pkthdr h; ++p->md.stat.ps_recv; h.ts = sh->snoop_timestamp; h.len = datalen; h.caplen = caplen; (*callback)(user, &h, cp); return (1); } return (0); } int pcap_stats(pcap_t *p, struct pcap_stat *ps) { register struct rawstats *rs; struct rawstats rawstats; rs = &rawstats; bzero((char *)rs, sizeof(*rs)); if (ioctl(p->fd, SIOCRAWSTATS, (char *)rs) < 0) { sprintf(p->errbuf, "SIOCRAWSTATS: %s", pcap_strerror(errno)); return (-1); } p->md.stat.ps_drop = rs->rs_snoop.ss_ifdrops + rs->rs_snoop.ss_sbdrops + rs->rs_drain.ds_ifdrops + rs->rs_drain.ds_sbdrops; *ps = p->md.stat; return (0); } /* XXX can't disable promiscuous */ pcap_t * pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf) { int fd; struct sockaddr_raw sr; struct snoopfilter sf; u_int v; pcap_t *p; p = (pcap_t *)malloc(sizeof(*p)); if (p == NULL) { sprintf(ebuf, "malloc: %s", pcap_strerror(errno)); return (NULL); } bzero((char *)p, sizeof(*p)); fd = socket(PF_RAW, SOCK_RAW, RAWPROTO_SNOOP); if (fd < 0) { sprintf(ebuf, "snoop socket: %s", pcap_strerror(errno)); goto bad; } p->fd = fd; bzero((char *)&sr, sizeof(sr)); sr.sr_family = AF_RAW; (void)strncpy(sr.sr_ifname, device, sizeof(sr.sr_ifname)); if (bind(fd, (struct sockaddr *)&sr, sizeof(sr))) { sprintf(ebuf, "snoop bind: %s", pcap_strerror(errno)); goto bad; } bzero((char *)&sf, sizeof(sf)); if (ioctl(fd, SIOCADDSNOOP, &sf) < 0) { sprintf(ebuf, "SIOCADDSNOOP: %s", pcap_strerror(errno)); goto bad; } v = 64 * 1024; (void)setsockopt(fd, SOL_SOCKET, SO_RCVBUF, (char *)&v, sizeof(v)); if (ioctl(fd, SIOCSNOOPLEN, &snaplen) < 0) { sprintf(ebuf, "SIOCSNOOPLEN: %s", pcap_strerror(errno)); goto bad; } p->snapshot = snaplen; v = 1; if (ioctl(fd, SIOCSNOOPING, &v) < 0) { sprintf(ebuf, "SIOCSNOOPING: %s", pcap_strerror(errno)); goto bad; } /* * XXX hack - map device name to link layer type */ if (strncmp("et", device, 2) == 0 || /* Challenge 10 Mbit */ strncmp("ec", device, 2) == 0 || /* Indigo/Indy 10 Mbit, O2 10/100 */ strncmp("ef", device, 2) == 0 || /* O200/2000 10/100 Mbit */ strncmp("gfe", device, 3) == 0 || /* GIO 100 Mbit */ strncmp("fxp", device, 3) == 0 || /* Challenge VME Enet */ strncmp("ep", device, 2) == 0 || /* Challenge 8x10 Mbit EPLEX */ strncmp("vfe", device, 3) == 0 || /* Challenge VME 100Mbit */ strncmp("fa", device, 2) == 0 || strncmp("qaa", device, 3) == 0) { p->linktype = DLT_EN10MB; p->offset = RAW_HDRPAD(sizeof(struct ether_header)); } else if (strncmp("ipg", device, 3) == 0 || strncmp("rns", device, 3) == 0 || /* O2/200/2000 FDDI */ strncmp("xpi", device, 3) == 0) { p->linktype = DLT_FDDI; p->offset = 3; /* XXX yeah? */ } else if (strncmp("ppp", device, 3) == 0) { p->linktype = DLT_RAW; } else if (strncmp("lo", device, 2) == 0) { p->linktype = DLT_NULL; } else { sprintf(ebuf, "snoop: unknown physical layer type"); goto bad; } p->bufsize = 4096; /* XXX */ p->buffer = (u_char *)malloc(p->bufsize); if (p->buffer == NULL) { sprintf(ebuf, "malloc: %s", pcap_strerror(errno)); goto bad; } return (p); bad: (void)close(fd); free(p); return (NULL); } int pcap_setfilter(pcap_t *p, struct bpf_program *fp) { p->fcode = *fp; return (0); } nmap-2.08/libpcap-possiblymodified/pcap.3100444 764 764 20513 6544336050 17465 0ustar fyodorfyodor.\" Copyright (c) 1994, 1996, 1997 .\" The Regents of the University of California. All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that: (1) source code distributions .\" retain the above copyright notice and this paragraph in its entirety, (2) .\" distributions including binary code include the above copyright notice and .\" this paragraph in its entirety in the documentation or other materials .\" provided with the distribution, and (3) all advertising materials mentioning .\" features or use of this software display the following acknowledgement: .\" ``This product includes software developed by the University of California, .\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of .\" the University nor the names of its contributors may be used to endorse .\" or promote products derived from this software without specific prior .\" written permission. .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. .\" .TH PCAP 3 "24 June 1998" .SH NAME pcap \- Packet Capture library .SH SYNOPSIS .nf .ft B #include .ft .LP .ft B pcap_t *pcap_open_live(char *device, int snaplen, .ti +8 int promisc, int to_ms, char *ebuf) pcap_t *pcap_open_offline(char *fname, char *ebuf) pcap_dumper_t *pcap_dump_open(pcap_t *p, char *fname) .ft .LP .ft B char errbuf[PCAP_ERRBUF_SIZE]; char *pcap_lookupdev(char *errbuf) int pcap_lookupnet(char *device, bpf_u_int32 *netp, .ti +8 bpf_u_int32 *maskp, char *errbuf) .ft .LP .ft B int pcap_dispatch(pcap_t *p, int cnt, .ti +8 pcap_handler callback, u_char *user) int pcap_loop(pcap_t *p, int cnt, .ti +8 pcap_handler callback, u_char *user) void pcap_dump(u_char *user, struct pcap_pkthdr *h, .ti +8 u_char *sp) .ft .LP .ft B int pcap_compile(pcap_t *p, struct bpf_program *fp, .ti +8 char *str, int optimize, bpf_u_int32 netmask) int pcap_setfilter(pcap_t *p, struct bpf_program *fp) .ft .LP .ft B u_char *pcap_next(pcap_t *p, struct pcap_pkthdr *h) .ft .LP .ft B int pcap_datalink(pcap_t *p) int pcap_snapshot(pcap_t *p) int pcap_is_swapped(pcap_t *p) int pcap_major_version(pcap_t *p) int pcap_minor_version(pcap_t *p) int pcap_stats(pcap_t *p, struct pcap_stat *ps) FILE *pcap_file(pcap_t *p) int pcap_fileno(pcap_t *p) void pcap_perror(pcap_t *p, char *prefix) char *pcap_geterr(pcap_t *p) char *pcap_strerror(int error) .ft .LP .ft B void pcap_close(pcap_t *p) void pcap_dump_close(pcap_dumper_t *p) .ft .fi .SH DESCRIPTION The Packet Capture library provides a high level interface to packet capture systems. All packets on the network, even those destined for other hosts, are accessible through this mechanism. .PP .SH ROUTINES .B pcap_open_live() is used to obtain a packet capture descriptor to look at packets on the network. .I device is a string that specifies the network device to open. .I snaplen specifies the maximum number of bytes to capture. .I promisc specifies if the interface is to be put into promiscuous mode. (Note that even if this parameter is false, the interface could well be in promiscuous mode for some other reason.) .I to_ms specifies the read timeout in milliseconds. .I ebuf is used to return error text and is only set when .B pcap_open_live() fails and returns .BR NULL . .PP .B pcap_open_offline() is called to open a ``savefile'' for reading. .I fname specifies the name of the file to open. The file has the same format as those used by .B tcpdump(1) and .BR tcpslice(1) . The name "-" in a synonym for .BR stdin . .I ebuf is used to return error text and is only set when .B pcap_open_offline() fails and returns .BR NULL . .PP .B pcap_dump_open() is called to open a ``savefile'' for writing. The name "-" in a synonym for .BR stdout . .B NULL is returned on failure. .I p is a .I pcap struct as returned by .B pcap_open_offline() or .BR pcap_open_live() . .I fname specifies the name of the file to open. If .B NULL is returned, .B pcap_geterr() can be used to get the error text. .PP .B pcap_lookupdev() returns a pointer to a network device suitable for use with .B pcap_open_live() and .BR pcap_lookupnet() . If there is an error, .B NULL is returned and .I errbuf is filled in with with an appropriate error message. .PP .B pcap_lookupnet() is used to determine the network number and mask associated with the network device .BR device . Both .I netp and .I maskp are .I bpf_u_int32 pointers. A return of -1 indicates an error in which case .I errbuf is filled in with with an appropriate error message. .PP .B pcap_dispatch() is used to collect and process packets. .I cnt specifies the maximum number of packets to process before returning. A .I cnt of -1 processes all the packets received in one buffer. A .I cnt of 0 processes all packets until an error occurs, .B EOF is reached, or the read times out (when doing live reads and a non-zero read timeout is specified). .I callback specifies a routine to be called with three arguments: a .I u_char pointer which is passed in from .BR pcap_dispatch() , a pointer to the .I pcap_pkthdr struct (which precede the actual network headers and data), and a .I u_char pointer to the packet data. The number of packets read is returned. Zero is returned when .B EOF is reached in a ``savefile.'' A return of -1 indicates an error in which case .B pcap_perror() or .BR pcap_geterr() may be used to display the error text. .PP .B pcap_dump() outputs a packet to the ``savefile'' opened with .BR pcap_dump_open() . Note that its calling arguments are suitable for use with .BR pcap_dispatch() . .PP .B pcap_compile() is used to compile the string .I str into a filter program. .I program is a pointer to a .I bpf_program struct and is filled in by .BR pcap_compile() . .I optimize controls whether optimization on the resulting code is performed. .I netmask specifies the netmask of the local net. .PP .B pcap_setfilter() is used to specify a filter program. .I fp is a pointer to an array of .I bpf_program struct, usually the result of a call to .BR pcap_compile() . .B \-1 is returned on failure; .B 0 is returned on success. .PP .B pcap_loop() is similar to .B pcap_dispatch() except it keeps reading packets until .I cnt packets are processed or an error occurs. It does .B not return when live read timeouts occur. Rather, specifying a non-zero read timeout to .B pcap_open_live() and then calling .B pcap_dispatch() allows the reception and processing of any packets that arrive when the timeout occurs. A negative .I cnt causes .B pcap_loop() to loop forever (or at least until an error occurs). .PP .B pcap_next() returns a .I u_char pointer to the next packet. .PP .B pcap_datalink() returns the link layer type, e.g. .BR DLT_EN10MB . .PP .B pcap_snapshot() returns the snapshot length specified when .B pcap_open_live was called. .PP .B pcap_is_swapped() returns true if the current ``savefile'' uses a different byte order than the current system. .PP .B pcap_major_version() returns the major number of the version of the pcap used to write the savefile. .PP .B pcap_minor_version() returns the minor number of the version of the pcap used to write the savefile. .PP .B pcap_file() returns the name of the ``savefile.'' .PP .B int pcap_stats() returns 0 and fills in a .B pcap_stat struct. The values represent packet statistics from the start of the run to the time of the call. If there is an error or the under lying packet capture doesn't support packet statistics, -1 is returned and the error text can be obtained with .B pcap_perror() or .BR pcap_geterr() . .PP .B pcap_fileno() returns the file descriptor number of the ``savefile.'' .PP .B pcap_perror() prints the text of the last pcap library error on .BR stderr , prefixed by .IR prefix . .PP .B pcap_geterr() returns the error text pertaining to the last pcap library error. .PP .B pcap_strerror() is provided in case .BR strerror (1) isn't available. .PP .B pcap_close() closes the files associated with .I p and deallocates resources. .PP .B pcap_dump_close() closes the ``savefile.'' .PP .SH SEE ALSO tcpdump(1), tcpslice(1) .SH AUTHORS Van Jacobson, Craig Leres and Steven McCanne, all of the Lawrence Berkeley National Laboratory, University of California, Berkeley, CA. .LP The current version is available via anonymous ftp: .LP .RS .I ftp://ftp.ee.lbl.gov/libpcap.tar.Z .RE .SH BUGS Please send bug reports to libpcap@ee.lbl.gov. nmap-2.08/libpcap-possiblymodified/pcap.c100644 764 764 10732 6611214715 17547 0ustar fyodorfyodor/* * Copyright (c) 1993, 1994, 1995, 1996, 1997, 1998 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the Computer Systems * Engineering Group at Lawrence Berkeley Laboratory. * 4. Neither the name of the University nor of the Laboratory may be used * to endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap.c,v 1.1 1998/10/15 04:40:00 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif #include "pcap-int.h" int pcap_dispatch(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { if (p->sf.rfile != NULL) return (pcap_offline_read(p, cnt, callback, user)); return (pcap_read(p, cnt, callback, user)); } int pcap_loop(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { register int n; for (;;) { if (p->sf.rfile != NULL) n = pcap_offline_read(p, cnt, callback, user); else { /* * XXX keep reading until we get something * (or an error occurs) */ do { n = pcap_read(p, cnt, callback, user); } while (n == 0); } if (n <= 0) return (n); if (cnt > 0) { cnt -= n; if (cnt <= 0) return (0); } } } struct singleton { struct pcap_pkthdr *hdr; const u_char *pkt; }; static void pcap_oneshot(u_char *userData, const struct pcap_pkthdr *h, const u_char *pkt) { struct singleton *sp = (struct singleton *)userData; *sp->hdr = *h; sp->pkt = pkt; } const u_char * pcap_next(pcap_t *p, struct pcap_pkthdr *h) { struct singleton s; s.hdr = h; if (pcap_dispatch(p, 1, pcap_oneshot, (u_char*)&s) <= 0) return (0); return (s.pkt); } int pcap_datalink(pcap_t *p) { return (p->linktype); } int pcap_snapshot(pcap_t *p) { return (p->snapshot); } int pcap_is_swapped(pcap_t *p) { return (p->sf.swapped); } int pcap_major_version(pcap_t *p) { return (p->sf.version_major); } int pcap_minor_version(pcap_t *p) { return (p->sf.version_minor); } FILE * pcap_file(pcap_t *p) { return (p->sf.rfile); } int pcap_fileno(pcap_t *p) { return (p->fd); } void pcap_perror(pcap_t *p, char *prefix) { fprintf(stderr, "%s: %s\n", prefix, p->errbuf); } char * pcap_geterr(pcap_t *p) { return (p->errbuf); } /* * Not all systems have strerror(). */ char * pcap_strerror(int errnum) { #ifdef HAVE_STRERROR return (strerror(errnum)); #else extern int sys_nerr; extern const char *const sys_errlist[]; static char ebuf[20]; if ((unsigned int)errnum < sys_nerr) return ((char *)sys_errlist[errnum]); (void)sprintf(ebuf, "Unknown error: %d", errnum); return(ebuf); #endif } void pcap_close(pcap_t *p) { /*XXX*/ if (p->fd >= 0) close(p->fd); if (p->sf.rfile != NULL) { (void)fclose(p->sf.rfile); if (p->sf.base != NULL) free(p->sf.base); } else if (p->buffer != NULL) free(p->buffer); #ifdef linux if (p->md.device != NULL) free(p->md.device); #endif free(p); } nmap-2.08/libpcap-possiblymodified/pcap.h100644 764 764 11535 6611214716 17557 0ustar fyodorfyodor/* * Copyright (c) 1993, 1994, 1995, 1996, 1997 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the Computer Systems * Engineering Group at Lawrence Berkeley Laboratory. * 4. Neither the name of the University nor of the Laboratory may be used * to endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/pcap.h,v 1.1 1998/10/15 04:40:00 fyodor Exp $ (LBL) */ #ifndef lib_pcap_h #define lib_pcap_h #include #include #include #include #define PCAP_VERSION_MAJOR 2 #define PCAP_VERSION_MINOR 4 #define PCAP_ERRBUF_SIZE 256 /* * Compatibility for systems that have a bpf.h that * predates the bpf typedefs for 64-bit support. */ #if BPF_RELEASE - 0 < 199406 typedef int bpf_int32; typedef u_int bpf_u_int32; #endif typedef struct pcap pcap_t; typedef struct pcap_dumper pcap_dumper_t; /* * The first record in the file contains saved values for some * of the flags used in the printout phases of tcpdump. * Many fields here are 32 bit ints so compilers won't insert unwanted * padding; these files need to be interchangeable across architectures. */ struct pcap_file_header { bpf_u_int32 magic; u_short version_major; u_short version_minor; bpf_int32 thiszone; /* gmt to local correction */ bpf_u_int32 sigfigs; /* accuracy of timestamps */ bpf_u_int32 snaplen; /* max length saved portion of each pkt */ bpf_u_int32 linktype; /* data link type (DLT_*) */ }; /* * Each packet in the dump file is prepended with this generic header. * This gets around the problem of different headers for different * packet interfaces. */ struct pcap_pkthdr { struct timeval ts; /* time stamp */ bpf_u_int32 caplen; /* length of portion present */ bpf_u_int32 len; /* length this packet (off wire) */ }; /* * As returned by the pcap_stats() */ struct pcap_stat { u_int ps_recv; /* number of packets received */ u_int ps_drop; /* number of packets dropped */ u_int ps_ifdrop; /* drops by interface XXX not yet supported */ }; typedef void (*pcap_handler)(u_char *, const struct pcap_pkthdr *, const u_char *); char *pcap_lookupdev(char *); int pcap_lookupnet(char *, bpf_u_int32 *, bpf_u_int32 *, char *); pcap_t *pcap_open_live(char *, int, int, int, char *); pcap_t *pcap_open_offline(const char *, char *); void pcap_close(pcap_t *); int pcap_loop(pcap_t *, int, pcap_handler, u_char *); int pcap_dispatch(pcap_t *, int, pcap_handler, u_char *); const u_char* pcap_next(pcap_t *, struct pcap_pkthdr *); int pcap_stats(pcap_t *, struct pcap_stat *); int pcap_setfilter(pcap_t *, struct bpf_program *); void pcap_perror(pcap_t *, char *); char *pcap_strerror(int); char *pcap_geterr(pcap_t *); int pcap_compile(pcap_t *, struct bpf_program *, char *, int, bpf_u_int32); /* XXX */ int pcap_freecode(pcap_t *, struct bpf_program *); int pcap_datalink(pcap_t *); int pcap_snapshot(pcap_t *); int pcap_is_swapped(pcap_t *); int pcap_major_version(pcap_t *); int pcap_minor_version(pcap_t *); /* XXX */ FILE *pcap_file(pcap_t *); int pcap_fileno(pcap_t *); pcap_dumper_t *pcap_dump_open(pcap_t *, const char *); void pcap_dump_close(pcap_dumper_t *); void pcap_dump(u_char *, const struct pcap_pkthdr *, const u_char *); /* XXX this guy lives in the bpf tree */ u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int); char *bpf_image(struct bpf_insn *, int); #endif nmap-2.08/libpcap-possiblymodified/ppp.h100644 764 764 4561 6611214717 17415 0ustar fyodorfyodor/* @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/ppp.h,v 1.1 1998/10/15 04:40:00 fyodor Exp $ (LBL) */ /* * Point to Point Protocol (PPP) RFC1331 * * Copyright 1989 by Carnegie Mellon. * * Permission to use, copy, modify, and distribute this program for any * purpose and without fee is hereby granted, provided that this copyright * and permission notice appear on all copies and supporting documentation, * the name of Carnegie Mellon not be used in advertising or publicity * pertaining to distribution of the program without specific prior * permission, and notice be given in supporting documentation that copying * and distribution is by permission of Carnegie Mellon and Stanford * University. Carnegie Mellon makes no representations about the * suitability of this software for any purpose. It is provided "as is" * without express or implied warranty. */ #define PPP_ADDRESS 0xff /* The address byte value */ #define PPP_CONTROL 0x03 /* The control byte value */ /* Protocol numbers */ #define PPP_IP 0x0021 /* Raw IP */ #define PPP_OSI 0x0023 /* OSI Network Layer */ #define PPP_NS 0x0025 /* Xerox NS IDP */ #define PPP_DECNET 0x0027 /* DECnet Phase IV */ #define PPP_APPLE 0x0029 /* Appletalk */ #define PPP_IPX 0x002b /* Novell IPX */ #define PPP_VJC 0x002d /* Van Jacobson Compressed TCP/IP */ #define PPP_VJNC 0x002f /* Van Jacobson Uncompressed TCP/IP */ #define PPP_BRPDU 0x0031 /* Bridging PDU */ #define PPP_STII 0x0033 /* Stream Protocol (ST-II) */ #define PPP_VINES 0x0035 /* Banyan Vines */ #define PPP_HELLO 0x0201 /* 802.1d Hello Packets */ #define PPP_LUXCOM 0x0231 /* Luxcom */ #define PPP_SNS 0x0233 /* Sigma Network Systems */ #define PPP_IPCP 0x8021 /* IP Control Protocol */ #define PPP_OSICP 0x8023 /* OSI Network Layer Control Protocol */ #define PPP_NSCP 0x8025 /* Xerox NS IDP Control Protocol */ #define PPP_DECNETCP 0x8027 /* DECnet Control Protocol */ #define PPP_APPLECP 0x8029 /* Appletalk Control Protocol */ #define PPP_IPXCP 0x802b /* Novell IPX Control Protocol */ #define PPP_STIICP 0x8033 /* Strean Protocol Control Protocol */ #define PPP_VINESCP 0x8035 /* Banyan Vines Control Protocol */ #define PPP_LCP 0xc021 /* Link Control Protocol */ #define PPP_PAP 0xc023 /* Password Authentication Protocol */ #define PPP_LQM 0xc025 /* Link Quality Monitoring */ #define PPP_CHAP 0xc223 /* Challenge Handshake Authentication Protocol */ nmap-2.08/libpcap-possiblymodified/savefile.c100644 764 764 22212 6611214720 20412 0ustar fyodorfyodor/* * Copyright (c) 1993, 1994, 1995, 1996, 1997 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. * * savefile.c - supports offline use of tcpdump * Extraction/creation by Jeffrey Mogul, DECWRL * Modified by Steve McCanne, LBL. * * Used to save the received packet headers, after filtering, to * a file, and then read them later. * The first record in the file contains saved values for the machine * dependent values so we can print the dump file on any architecture. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/savefile.c,v 1.1 1998/10/15 04:40:00 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include #include #include #include "pcap-int.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif #define TCPDUMP_MAGIC 0xa1b2c3d4 /* * We use the "receiver-makes-right" approach to byte order, * because time is at a premium when we are writing the file. * In other words, the pcap_file_header and pcap_pkthdr, * records are written in host byte order. * Note that the packets are always written in network byte order. * * ntoh[ls] aren't sufficient because we might need to swap on a big-endian * machine (if the file was written in little-end order). */ #define SWAPLONG(y) \ ((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff)) #define SWAPSHORT(y) \ ( (((y)&0xff)<<8) | ((u_short)((y)&0xff00)>>8) ) #define SFERR_TRUNC 1 #define SFERR_BADVERSION 2 #define SFERR_BADF 3 #define SFERR_EOF 4 /* not really an error, just a status */ static int sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen) { struct pcap_file_header hdr; hdr.magic = TCPDUMP_MAGIC; hdr.version_major = PCAP_VERSION_MAJOR; hdr.version_minor = PCAP_VERSION_MINOR; hdr.thiszone = thiszone; hdr.snaplen = snaplen; hdr.sigfigs = 0; hdr.linktype = linktype; if (fwrite((char *)&hdr, sizeof(hdr), 1, fp) != 1) return (-1); return (0); } static void swap_hdr(struct pcap_file_header *hp) { hp->version_major = SWAPSHORT(hp->version_major); hp->version_minor = SWAPSHORT(hp->version_minor); hp->thiszone = SWAPLONG(hp->thiszone); hp->sigfigs = SWAPLONG(hp->sigfigs); hp->snaplen = SWAPLONG(hp->snaplen); hp->linktype = SWAPLONG(hp->linktype); } pcap_t * pcap_open_offline(const char *fname, char *errbuf) { register pcap_t *p; register FILE *fp; struct pcap_file_header hdr; int linklen; p = (pcap_t *)malloc(sizeof(*p)); if (p == NULL) { strcpy(errbuf, "out of swap"); return (NULL); } memset((char *)p, 0, sizeof(*p)); /* * Set this field so we don't close stdin in pcap_close! */ p->fd = -1; if (fname[0] == '-' && fname[1] == '\0') fp = stdin; else { fp = fopen(fname, "r"); if (fp == NULL) { sprintf(errbuf, "%s: %s", fname, pcap_strerror(errno)); goto bad; } } if (fread((char *)&hdr, sizeof(hdr), 1, fp) != 1) { sprintf(errbuf, "fread: %s", pcap_strerror(errno)); goto bad; } if (hdr.magic != TCPDUMP_MAGIC) { if (SWAPLONG(hdr.magic) != TCPDUMP_MAGIC) { sprintf(errbuf, "bad dump file format"); goto bad; } p->sf.swapped = 1; swap_hdr(&hdr); } if (hdr.version_major < PCAP_VERSION_MAJOR) { sprintf(errbuf, "archaic file format"); goto bad; } p->tzoff = hdr.thiszone; p->snapshot = hdr.snaplen; p->linktype = hdr.linktype; p->sf.rfile = fp; p->bufsize = hdr.snaplen; /* Align link header as required for proper data alignment */ /* XXX should handle all types */ switch (p->linktype) { case DLT_EN10MB: linklen = 14; break; case DLT_FDDI: linklen = 13 + 8; /* fddi_header + llc */ break; case DLT_NULL: default: linklen = 0; break; } p->sf.base = (u_char *)malloc(p->bufsize + BPF_ALIGNMENT); p->buffer = p->sf.base + BPF_ALIGNMENT - (linklen % BPF_ALIGNMENT); p->sf.version_major = hdr.version_major; p->sf.version_minor = hdr.version_minor; #ifdef PCAP_FDDIPAD /* XXX padding only needed for kernel fcode */ pcap_fddipad = 0; #endif return (p); bad: free(p); return (NULL); } /* * Read sf_readfile and return the next packet. Return the header in hdr * and the contents in buf. Return 0 on success, SFERR_EOF if there were * no more packets, and SFERR_TRUNC if a partial packet was encountered. */ static int sf_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char *buf, int buflen) { FILE *fp = p->sf.rfile; /* read the stamp */ if (fread((char *)hdr, sizeof(struct pcap_pkthdr), 1, fp) != 1) { /* probably an EOF, though could be a truncated packet */ return (1); } if (p->sf.swapped) { /* these were written in opposite byte order */ hdr->caplen = SWAPLONG(hdr->caplen); hdr->len = SWAPLONG(hdr->len); hdr->ts.tv_sec = SWAPLONG(hdr->ts.tv_sec); hdr->ts.tv_usec = SWAPLONG(hdr->ts.tv_usec); } /* * We interchanged the caplen and len fields at version 2.3, * in order to match the bpf header layout. But unfortunately * some files were written with version 2.3 in their headers * but without the interchanged fields. */ if (p->sf.version_minor < 3 || (p->sf.version_minor == 3 && hdr->caplen > hdr->len)) { int t = hdr->caplen; hdr->caplen = hdr->len; hdr->len = t; } if (hdr->caplen > buflen) { /* * This can happen due to Solaris 2.3 systems tripping * over the BUFMOD problem and not setting the snapshot * correctly in the savefile header. If the caplen isn't * grossly wrong, try to salvage. */ static u_char *tp = NULL; static int tsize = 0; if (hdr->caplen > 65535) { sprintf(p->errbuf, "bogus savefile header"); return (-1); } if (tsize < hdr->caplen) { tsize = ((hdr->caplen + 1023) / 1024) * 1024; if (tp != NULL) free((u_char *)tp); tp = (u_char *)malloc(tsize); if (tp == NULL) { tsize = 0; sprintf(p->errbuf, "BUFMOD hack malloc"); return (-1); } } if (fread((char *)tp, hdr->caplen, 1, fp) != 1) { sprintf(p->errbuf, "truncated dump file"); return (-1); } /* * We can only keep up to buflen bytes. Since caplen > buflen * is exactly how we got here, we know we can only keep the * first buflen bytes and must drop the remainder. Adjust * caplen accordingly, so we don't get confused later as * to how many bytes we have to play with. */ hdr->caplen = buflen; memcpy((char *)buf, (char *)tp, buflen); } else { /* read the packet itself */ if (fread((char *)buf, hdr->caplen, 1, fp) != 1) { sprintf(p->errbuf, "truncated dump file"); return (-1); } } return (0); } /* * Print out packets stored in the file initialized by sf_read_init(). * If cnt > 0, return after 'cnt' packets, otherwise continue until eof. */ int pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user) { struct bpf_insn *fcode = p->fcode.bf_insns; int status = 0; int n = 0; while (status == 0) { struct pcap_pkthdr h; status = sf_next_packet(p, &h, p->buffer, p->bufsize); if (status) { if (status == 1) return (0); return (status); } if (fcode == NULL || bpf_filter(fcode, p->buffer, h.len, h.caplen)) { (*callback)(user, &h, p->buffer); if (++n >= cnt && cnt > 0) break; } } /*XXX this breaks semantics tcpslice expects */ return (n); } /* * Output a packet to the initialized dump file. */ void pcap_dump(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) { register FILE *f; f = (FILE *)user; /* XXX we should check the return status */ (void)fwrite((char *)h, sizeof(*h), 1, f); (void)fwrite((char *)sp, h->caplen, 1, f); } /* * Initialize so that sf_write() will output to the file named 'fname'. */ pcap_dumper_t * pcap_dump_open(pcap_t *p, const char *fname) { FILE *f; if (fname[0] == '-' && fname[1] == '\0') f = stdout; else { f = fopen(fname, "w"); if (f == NULL) { sprintf(p->errbuf, "%s: %s", fname, pcap_strerror(errno)); return (NULL); } } (void)sf_write_header(f, p->linktype, p->tzoff, p->snapshot); return ((pcap_dumper_t *)f); } void pcap_dump_close(pcap_dumper_t *p) { #ifdef notyet if (ferror((FILE *)p)) return-an-error; /* XXX should check return from fclose() too */ #endif (void)fclose((FILE *)p); } nmap-2.08/libpcap-possiblymodified/scanner.l100644 764 764 10601 6611214721 20256 0ustar fyodorfyodor%{ /* * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that: (1) source code distributions * retain the above copyright notice and this paragraph in its entirety, (2) * distributions including binary code include the above copyright notice and * this paragraph in its entirety in the documentation or other materials * provided with the distribution, and (3) all advertising materials mentioning * features or use of this software display the following acknowledgement: * ``This product includes software developed by the University of California, * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of * the University nor the names of its contributors may be used to endorse * or promote products derived from this software without specific prior * written permission. * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef lint static const char rcsid[] = "@(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/scanner.l,v 1.1 1998/10/15 04:40:00 fyodor Exp $ (LBL)"; #endif #include #include #include #include #include "pcap-int.h" #include "gencode.h" #include #include "tokdefs.h" #include "gnuc.h" #ifdef HAVE_OS_PROTO_H #include "os-proto.h" #endif static int stoi(char *); static inline int xdtoi(int); #ifdef FLEX_SCANNER #define YY_NO_UNPUT #undef YY_INPUT #define YY_INPUT(buf, result, max)\ {\ char *src = in_buffer;\ int i;\ \ if (*src == 0)\ result = YY_NULL;\ else {\ for (i = 0; *src && i < max; ++i)\ buf[i] = *src++;\ in_buffer += i;\ result = i;\ }\ } #else #undef getc #define getc(fp) (*in_buffer == 0 ? EOF : *in_buffer++) #endif #define yylval pcap_lval extern YYSTYPE yylval; static char *in_buffer; %} N ([0-9]+|(0X|0x)[0-9A-Fa-f]+) B ([0-9A-Fa-f][0-9A-Fa-f]?) %a 3000 %% dst return DST; src return SRC; link|ether|ppp|slip return LINK; fddi return LINK; arp return ARP; rarp return RARP; ip return IP; tcp return TCP; udp return UDP; icmp return ICMP; igmp return IGMP; igrp return IGRP; atalk return ATALK; decnet return DECNET; lat return LAT; sca return SCA; moprc return MOPRC; mopdl return MOPDL; host return HOST; net return NET; mask return MASK; port return PORT; proto return PROTO; gateway return GATEWAY; less return LESS; greater return GREATER; byte return BYTE; broadcast return TK_BROADCAST; multicast return TK_MULTICAST; and|"&&" return AND; or|"||" return OR; not return '!'; len|length return LEN; inbound return INBOUND; outbound return OUTBOUND; [ \n\t] ; [+\-*/:\[\]!<>()&|=] return yytext[0]; ">=" return GEQ; "<=" return LEQ; "!=" return NEQ; "==" return '='; "<<" return LSH; ">>" return RSH; {N} { yylval.i = stoi((char *)yytext); return NUM; } ({N}\.{N})|({N}\.{N}\.{N})|({N}\.{N}\.{N}\.{N}) { yylval.s = sdup((char *)yytext); return HID; } {B}:{B}:{B}:{B}:{B}:{B} { yylval.e = pcap_ether_aton((char *)yytext); return EID; } {B}:+({B}:+)+ { bpf_error("bogus ethernet address %s", yytext); } [A-Za-z0-9][-_.A-Za-z0-9]*[.A-Za-z0-9] { yylval.s = sdup((char *)yytext); return ID; } "\\"[^ !()\n\t]+ { yylval.s = sdup((char *)yytext + 1); return ID; } [^ \[\]\t\n\-_.A-Za-z0-9!<>()&|=]+i { bpf_error("illegal token: %s\n", yytext); } . { bpf_error("illegal char '%c'", *yytext); } %% void lex_init(buf) char *buf; { in_buffer = buf; } /* * Also define a yywrap. Note that if we're using flex, it will * define a macro to map this identifier to pcap_wrap. */ int yywrap() { return 1; } /* Hex digit to integer. */ static inline int xdtoi(c) register int c; { if (isdigit(c)) return c - '0'; else if (islower(c)) return c - 'a' + 10; else return c - 'A' + 10; } /* * Convert string to integer. Just like atoi(), but checks for * preceding 0x or 0 and uses hex or octal instead of decimal. */ static int stoi(s) char *s; { int base = 10; int n = 0; if (*s == '0') { if (s[1] == 'x' || s[1] == 'X') { s += 2; base = 16; } else { base = 8; s += 1; } } while (*s) n = n * base + xdtoi(*s++); return n; } nmap-2.08/libpcap-possiblymodified/config.log100600 764 764 2532 6662341642 20405 0ustar fyodorfyodorThis file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. configure:578: checking host system type configure:599: checking target system type configure:617: checking build system type configure:711: checking for gcc configure:788: checking whether the C compiler (gcc ) works configure:802: gcc -o conftest conftest.c 1>&5 configure:822: checking whether the C compiler (gcc ) is a cross-compiler configure:827: checking whether we are using GNU C configure:851: checking whether gcc accepts -g configure:884: checking gcc version configure:1028: checking how to run the C preprocessor configure:1092: checking for malloc.h configure:1092: checking for sys/ioccom.h configure:1092: checking for sys/sockio.h configure:1131: checking for ANSI ioctl definitions configure:1178: checking for ether_hostton configure:1178: checking for strerror configure:1238: checking packet capture type configure:1341: checking for net/if_arp.h configure:1378: checking Linux kernel version configure:1419: checking for flex configure:1452: checking for flex 2.4 or higher configure:1478: checking for bison configure:1602: checking for ranlib configure:1672: checking if sockaddr struct has sa_len member configure:1707: checking if unaligned accesses fail configure:1803: checking for a BSD compatible install nmap-2.08/libpcap-possiblymodified/SUNOS4/ 40755 764 764 0 6662341762 17344 5ustar fyodorfyodornmap-2.08/libpcap-possiblymodified/SUNOS4/nit_if.o.sun4c.4.0.3c100644 764 764 12355 6611213235 22741 0ustar fyodorfyodor L`㿠.`>``@ " ` & @2`2"  ?S(4Ѐ"N?`@" `& `4 ?<(4@2` @ 2  ?-(4В  '   '`@'@&@'`& & 8'`'`'`'`@'` ` - ` . 07@c7`  7` `&` @@@ 㿠 $@    " " @`" @"2@2@ '& @ 㿠` ` H`!``B` " `  @` @ /@` @`0@.@-)` ``!  @@2 @6    0@@@ 㿠 `  ` 0a 2 ` 2 ` *`  9&@` `4@&"`` ,  ,  & ` @ 2'` ` -  &` * & `  "`"`  `2` @ "`` , & " `` @ "`` -` y& '`` '``+ n& `  ` `#`, c& ` '`` " ``:` '`` + &  @ "K`"%``d4a 4   ,`   06@/`6 /`@6  &@(`  ` %`*` & ` x `  ` ]0` 0` 0a "=` ` + @ 㿠 " @2  " @ 2   ' 2  @2 ' ?#" "` @2@ `" @@`2 ` '`@2` " `2 `@2 `  '`@i2`` '` "P   "    "  `"  @2@ :'  ,`  `" %% 3 %&  "   %& `"  %&@ ` @@ @ k 㿠 " &@(   @ 7 / @2 -` %&& @   & @&㿠@ 㿘'   "  @ 2 ' @@  2 @(#) $Header: /archive/CVS/nmap/libpcap-possiblymodified/SUNOS4/nit_if.o.sun4c.4.0.3c,v 1.1 1998/10/15 04:27:30 fyodor Exp $ sun4c (LBL)@(#)nit_if.c 1.24++ 88/02/09 Copyr 1987 Sun Micro껀.snitsnit_close nonexistent instance  | L&8    D H%L \&L7\t6d7p+4h:x:7l<7T X  hh #L X p6   < <  0 P  L  L p H 6@  ll l |  " .: lF R |^hqz@l #.6=AI `\ck r L@  P  8&+_phz_hostnamelen_snit_close_snit_cpmsg_snit_ioctl_snit_minfo_snit_winit_snit_rinit_boottime_mclfree_m_freem_mclgetx_nisoftc_pidhash_freeproc_hostname_bcopy_proc_whichqs_freeb_m_cpytoc_ifnet_time_tick_rawintrq_allocb_linkb_lbolt_snit_put_domainnamelen_mfree_ifpromisc_canput_nproc_hz_dupmsg_cp_mblks_to_mbufs_panic_flushq_rcsid_free_mbuffed_mblk_domainname_zombproc_ifunit_procNPROC_allproc_avenrun_snit_open_snit_info_snit_intr_qs_m_want_mbstat_tz_freemsg_qreply_etherbroadcastaddr_sccsid.mulnmap-2.08/libpcap-possiblymodified/SUNOS4/nit_if.o.sparc100444 764 764 12134 4542422443 22206 0ustar fyodorfyodor X`㿠.`>``@ " ` & @2`20  ?^(4Ѐ"Y?`@"! `6 ` @ 2  ?D(4Ѐ4 ?=(4@" `6` @ "    '   '`@'@&@'`& & 8'`'`'`'`@'` ` - ` . 07@c7`  7` `&` @@@ 㿠 $@    " " @`" @"2@2@ '& @ 㿠` ` H`!``B` " `  @` @ /@` @`0@.@-)` ``!  @@2 @6    0@@@ 㿠 `  ` 0a 2 ` 2  ` *`  9&@!` F `  ` +0` o0` 0a " ` ` + @ ` `4@&"`` ,  ,  & ` @ 2'` ` -  &` * & `  "`"`  `2` @ "`` , & " `` @ "`` -` & '`` '``+ & `  ` `#`, & ` '`` " ``:` '`` + &  @ "}`"%``d4a 4   ,`   06@/`6 /`@6  &@Z`  ` %`*` O& 㿠 " @2  " @ 2   ' 2  @"  " " ' @2@ `" @@`2 ` '`@2` " `2 `@2 ` '`@c2```'`  "J   `"   "  "  @2@  4'  *   "  %%&  "   %&  " @%`&@ ` @@ @ q 㿠 " &@(   @ 7 / @2 -` %&& @   & @&㿠@ 㿘'   "  @ 2 ' @@  2 @(#)nit_if.c 1.24 88/02/09 Copyr 1987 Sun Micro껀.snitsnit_close nonexistent instance  | Lx&   $, 0 p t%x x& 6xH58466L *XP9(9D6   <| #8 l 5|   8 @  , L  H  H t L 5D4 HLT \p x 0| L " .: F LR 0^hqz@ #.6=AI \\ck H~@  h| $_phz_hostnamelen_snit_close_snit_cpmsg_snit_ioctl_snit_minfo_snit_winit_snit_rinit_boottime_mclfree_m_freem_mclgetx_nisoftc_pidhash_freeproc_hostname_bcopy_proc_whichqs_freeb_m_cpytoc_ifnet_time_tick_rawintrq_allocb_linkb_lbolt_snit_put_domainnamelen_mfree_ifpromisc_canput_nproc_hz_dupmsg_cp_mblks_to_mbufs_panic_flushq_free_mbuffed_mblk_domainname_zombproc_ifunit_procNPROC_allproc_avenrun_snit_open_snit_info_snit_intr_qs_m_want_mbstat_tz_freemsg_qreply_etherbroadcastaddr_sccsid.mulnmap-2.08/libpcap-possiblymodified/SUNOS4/nit_if.o.sun3100444 764 764 10253 4542422452 21766 0ustar fyodorfyodor H@NVH< f.~(|` m R(M*TJf fFxp`Jgp`~.(|`mn xp`(M*TJfHxHx NPO&@Jf  xp`r ӫ*k +K*(+n n!M n!M8BB+GBB HxHxNPO&@Jg: k| $k 405| 5|. rӫHS n/( h P PNPO LF@RYajr{  _cp_mblks_to_mbufs_sccsid_lbolt_qs_snit_winit_nproc_whichqs_avenrun_domainnamelen_hostnamelen_snit_cpmsg_rawintrq_hostname_tz_canput_nisoftc_boottime_mclgetx_snit_close_etherbroadcastaddr_snit_info_snit_minfo_m_want_ifunit_tick_procNPROC_phz_free_mbuffed_mblk_snit_open_pidhash_bcopy_qreply_domainname_mfree_dupmsg_freemsg_allocb_m_freem_hz_snit_ioctl_snit_rinit_mclfree_freeproc_proc_flushq_time_panic_snit_put_ifnet_allproc_zombproc_mbstat_snit_intr_linkb_m_cpytoc_freeb_ifpromiscnmap-2.08/libpcap-possiblymodified/gnuc.h120777 764 764 0 6662341762 21350 2lbl/gnuc.hustar fyodorfyodornmap-2.08/libpcap-possiblymodified/bpf_filter.c120777 764 764 0 6662341762 24462 2bpf/net/bpf_filter.custar fyodorfyodornmap-2.08/libpcap-possiblymodified/net120777 764 764 0 6662341762 20356 2bpf/netustar fyodorfyodornmap-2.08/libpcap-possiblymodified/config.status100775 764 764 12561 6662341643 21210 0ustar fyodorfyodor#! /bin/sh # Generated automatically by configure. # Run this file to recreate the current configuration. # This directory was configured as follows, # on host playground.yuma.net: # # ./configure # # Compiler output produced by configure, useful for debugging # configure, is in ./config.log if it exists. ac_cs_usage="Usage: ./config.status [--recheck] [--version] [--help]" for ac_option do case "$ac_option" in -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) echo "running ${CONFIG_SHELL-/bin/sh} ./configure --no-create --no-recursion" exec ${CONFIG_SHELL-/bin/sh} ./configure --no-create --no-recursion ;; -version | --version | --versio | --versi | --vers | --ver | --ve | --v) echo "./config.status generated by autoconf version 2.12" exit 0 ;; -help | --help | --hel | --he | --h) echo "$ac_cs_usage"; exit 0 ;; *) echo "$ac_cs_usage"; exit 1 ;; esac done ac_given_srcdir=. ac_given_INSTALL="/usr/bin/install -c" trap 'rm -fr Makefile conftest*; exit 1' 1 2 15 # Protect against being on the right side of a sed subst in config.status. sed 's/%@/@@/; s/@%/@@/; s/%g$/@g/; /@g$/s/[\\&%]/\\&/g; s/@@/%@/; s/@@/@%/; s/@g$/%g/' > conftest.subs <<\CEOF /^[ ]*VPATH[ ]*=[^:]*$/d s%@CFLAGS@%-g -O2%g s%@CPPFLAGS@%%g s%@CXXFLAGS@%%g s%@DEFS@% -DHAVE_MALLOC_H=1 -DHAVE_ETHER_HOSTTON=1 -DHAVE_STRERROR=1 -DHAVE_NET_IF_ARP_H=1 %g s%@LDFLAGS@%%g s%@LIBS@%%g s%@exec_prefix@%${prefix}%g s%@prefix@%/usr/local%g s%@program_transform_name@%s,x,x,%g s%@bindir@%${exec_prefix}/bin%g s%@sbindir@%${exec_prefix}/sbin%g s%@libexecdir@%${exec_prefix}/libexec%g s%@datadir@%${prefix}/share%g s%@sysconfdir@%${prefix}/etc%g s%@sharedstatedir@%${prefix}/com%g s%@localstatedir@%${prefix}/var%g s%@libdir@%${exec_prefix}/lib%g s%@includedir@%${prefix}/include%g s%@oldincludedir@%/usr/include%g s%@infodir@%${prefix}/info%g s%@mandir@%${prefix}/man%g s%@host@%i586-pc-linux-gnu%g s%@host_alias@%i586-pc-linux-gnu%g s%@host_cpu@%i586%g s%@host_vendor@%pc%g s%@host_os@%linux-gnu%g s%@target@%i586-pc-linux-gnu%g s%@target_alias@%i586-pc-linux-gnu%g s%@target_cpu@%i586%g s%@target_vendor@%pc%g s%@target_os@%linux-gnu%g s%@build@%i586-pc-linux-gnu%g s%@build_alias@%i586-pc-linux-gnu%g s%@build_cpu@%i586%g s%@build_vendor@%pc%g s%@build_os@%linux-gnu%g s%@SHLICC2@%%g s%@CC@%gcc%g s%@CPP@%gcc -E%g s%@V_LEX@%flex -Ppcap_%g s%@V_YACC@%bison -y -p pcap_%g s%@V_RANLIB@%ranlib%g s%@V_CCOPT@%-O2%g s%@V_INCLS@% -Ilinux-include%g s%@V_PCAP@%linux%g s%@INSTALL_PROGRAM@%${INSTALL}%g s%@INSTALL_DATA@%${INSTALL} -m 644%g CEOF # Split the substitutions into bite-sized pieces for seds with # small command number limits, like on Digital OSF/1 and HP-UX. ac_max_sed_cmds=90 # Maximum number of lines to put in a sed script. ac_file=1 # Number of current file. ac_beg=1 # First line for current file. ac_end=$ac_max_sed_cmds # Line after last line for current file. ac_more_lines=: ac_sed_cmds="" while $ac_more_lines; do if test $ac_beg -gt 1; then sed "1,${ac_beg}d; ${ac_end}q" conftest.subs > conftest.s$ac_file else sed "${ac_end}q" conftest.subs > conftest.s$ac_file fi if test ! -s conftest.s$ac_file; then ac_more_lines=false rm -f conftest.s$ac_file else if test -z "$ac_sed_cmds"; then ac_sed_cmds="sed -f conftest.s$ac_file" else ac_sed_cmds="$ac_sed_cmds | sed -f conftest.s$ac_file" fi ac_file=`expr $ac_file + 1` ac_beg=$ac_end ac_end=`expr $ac_end + $ac_max_sed_cmds` fi done if test -z "$ac_sed_cmds"; then ac_sed_cmds=cat fi CONFIG_FILES=${CONFIG_FILES-"Makefile"} for ac_file in .. $CONFIG_FILES; do if test "x$ac_file" != x..; then # Support "outfile[:infile[:infile...]]", defaulting infile="outfile.in". case "$ac_file" in *:*) ac_file_in=`echo "$ac_file"|sed 's%[^:]*:%%'` ac_file=`echo "$ac_file"|sed 's%:.*%%'` ;; *) ac_file_in="${ac_file}.in" ;; esac # Adjust a relative srcdir, top_srcdir, and INSTALL for subdirectories. # Remove last slash and all that follows it. Not all systems have dirname. ac_dir=`echo $ac_file|sed 's%/[^/][^/]*$%%'` if test "$ac_dir" != "$ac_file" && test "$ac_dir" != .; then # The file is in a subdirectory. test ! -d "$ac_dir" && mkdir "$ac_dir" ac_dir_suffix="/`echo $ac_dir|sed 's%^\./%%'`" # A "../" for each directory in $ac_dir_suffix. ac_dots=`echo $ac_dir_suffix|sed 's%/[^/]*%../%g'` else ac_dir_suffix= ac_dots= fi case "$ac_given_srcdir" in .) srcdir=. if test -z "$ac_dots"; then top_srcdir=. else top_srcdir=`echo $ac_dots|sed 's%/$%%'`; fi ;; /*) srcdir="$ac_given_srcdir$ac_dir_suffix"; top_srcdir="$ac_given_srcdir" ;; *) # Relative path. srcdir="$ac_dots$ac_given_srcdir$ac_dir_suffix" top_srcdir="$ac_dots$ac_given_srcdir" ;; esac case "$ac_given_INSTALL" in [/$]*) INSTALL="$ac_given_INSTALL" ;; *) INSTALL="$ac_dots$ac_given_INSTALL" ;; esac echo creating "$ac_file" rm -f "$ac_file" configure_input="Generated automatically from `echo $ac_file_in|sed 's%.*/%%'` by configure." case "$ac_file" in *Makefile*) ac_comsub="1i\\ # $configure_input" ;; *) ac_comsub= ;; esac ac_file_inputs=`echo $ac_file_in|sed -e "s%^%$ac_given_srcdir/%" -e "s%:% $ac_given_srcdir/%g"` sed -e "$ac_comsub s%@configure_input@%$configure_input%g s%@srcdir@%$srcdir%g s%@top_srcdir@%$top_srcdir%g s%@INSTALL@%$INSTALL%g " $ac_file_inputs | (eval "$ac_sed_cmds") > $ac_file fi; done rm -f conftest.s* exit 0