Recent Changes - Search:

PerformanceNotes

0:02:08
10–34355
means that a scan took 0:02:08, had 10 hosts up, 34 open ports, and 355 closed ports.

#token-2009-10-10

Test with probe IDs (tokens)

These are tests with setting a unique ID in each probe instead of matching tryno and pingseq values. Matching a tryno and pingseq can fail during a ping scan when a reply to a SYN probe is matched up to an ACK probe. The harm from this is that the ACK probe becomes the new timing/traceroute probe, when it may be completely inappropriate.

2009-10-10

These results seem to show a big decrease in accuracy with tokens on gusto. However, the experiment was flawed: The nmap-token was compiled in a way such that it couldn't access its nmap-services, so it used /etc/services instead. Thus the port list was smaller and different.

On goomba

 scanmedown-pingup-pingrandom-Fup-F
nmap-10:06:53
1–24
0:02:28
0–00
0:00:02
200–00
0:12:17
204–94231203
0:11:33
200–92230125
nmap-20:06:18
1–24
0:01:16
0–00
0:00:02
200–00
0:10:40
204–94231255
0:09:27
200–91630039
nmap-30:06:27
1–24
0:01:00
0–00
0:00:02
200–00
0:12:36
204–93331091
0:13:43
200–92130024
nmap-40:06:25
1–24
0:01:26
0–00
0:00:02
200–00
0:10:55
204–93531275
0:09:54
200–91730052
nmap-token-10:05:40
1–24
0:01:51
0–00
0:00:02
200–00
0:10:34
204–93931165
0:10:16
200–90430020
nmap-token-20:06:35
1–24
0:01:40
0–00
0:00:02
200–00
0:10:43
204–94031157
0:09:45
200–91430018
nmap-token-30:07:40
1–24
0:01:46
0–00
0:00:02
200–00
0:11:11
204–93231175
0:10:04
200–91530026
nmap-token-40:06:17
1–23
0:02:01
0–00
0:00:02
200–00
0:11:47
204–93331157
0:10:25
200–91730011

On gusto

 scanmedown-pingup-pingrandom-Fup-F
nmap-10:10:07
1–24
0:00:44
0–00
0:00:03
199–00
0:07:44
200–96410452
0:07:14
199–95310051
nmap-20:10:22
1–24
0:00:35
0–00
0:00:02
199–00
0:08:05
203–96710446
0:07:28
199–95210058
nmap-30:10:16
1–24
0:01:33
0–00
0:00:03
199–00
0:07:45
203–97010399
0:07:33
199–95710077
nmap-40:10:05
1–24
0:00:39
0–00
0:00:02
199–00
0:08:14
202–96810391
0:07:39
199–95410060
nmap-token-10:07:51
1–24
0:00:42
0–00
0:00:09
199–00
0:07:05
202–4908337
0:06:21
192–4758043
nmap-token-20:08:37
1–24
0:01:37
0–00
0:00:02
199–00
0:06:58
199–4898349
0:06:13
195–4818037
nmap-token-30:08:27
1–24
0:00:51
0–00
0:00:02
199–00
0:07:17
203–4978345
0:06:47
198–4788045
nmap-token-40:08:37
1–24
0:00:18
0–00
0:00:04
199–00
0:06:56
201–4918345
0:06:19
197–4758043

#token-2009-10-13

2009-10-13

This is after fixing the problem with nmap-services.

On goomba

The means are

> tapply(x$up, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap               0   204.00      1 200.00  199.75
nmap-token         0   203.75      1 199.75  200.00
> tapply(x$open, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap               0 982.3333      2 960.00       0
nmap-token         0 977.0000      2 960.75       0
> tapply(x$closed, list(x$variant, x$scan), mean)
           down-ping random-F scanme     up-F up-ping
nmap               0 10582.33      4 10211.75       0
nmap-token         0 10571.50      4 10176.75       0

The hole at nmap-3/random-F was because of a corrupted XML file, maybe due to a filesystem error.

 scanmedown-pingup-pingrandom-Fup-F
nmap-10:06:36
1–24
0:02:03
0–00
0:00:02
199–00
0:04:28
204–98310620
0:03:45
200–95810183
nmap-20:06:02
1–24
0:01:19
0–00
0:00:02
200–00
0:04:58
204–98310578
0:03:52
200–95910208
nmap-30:06:47
1–24
0:01:34
0–00
0:00:02
200–00
 0:05:35
200–96110245
nmap-40:06:45
1–24
0:01:51
0–00
0:00:02
200–00
0:06:59
204–98110549
0:04:14
200–96210211
nmap-token-10:06:49
1–24
0:02:00
0–00
0:00:02
200–00
0:04:58
204–98010583
0:03:45
200–96110191
nmap-token-20:05:57
1–24
0:01:49
0–00
0:00:02
200–00
0:03:52
203–97910579
0:04:02
200–96210208
nmap-token-30:06:43
1–24
0:00:44
0–00
0:00:01
200–00
0:04:17
204–98010549
0:03:40
199–96010101
nmap-token-40:06:33
1–24
0:01:14
0–00
0:00:02
200–00
0:04:42
204–96910575
0:03:50
200–96010207

On gusto

The means are

> tapply(x$up, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap               0   202.75      1 198.75     199
nmap-token         0   202.75      1 198.75     199
> tapply(x$open, list(x$variant, x$scan), mean)
           down-ping random-F scanme  up-F up-ping
nmap               0   969.50   2.00 953.5       0
nmap-token         0   962.75   1.75 945.0       0
> tapply(x$closed, list(x$variant, x$scan), mean)
           down-ping random-F scanme    up-F up-ping
nmap               0 10415.75    4.0 10064.5       0
nmap-token         0 10397.75    3.5 10020.5
 scanmedown-pingup-pingrandom-Fup-F
nmap-10:10:03
1–24
0:01:43
0–00
0:00:02
199–00
0:08:39
202–96910440
0:07:14
199–95310080
nmap-20:09:59
1–24
0:01:44
0–00
0:00:02
199–00
0:08:33
203–96510363
0:07:34
199–95310052
nmap-30:09:45
1–24
0:00:29
0–00
0:00:03
199–00
0:08:03
203–97310416
0:07:03
198–95310055
nmap-40:10:21
1–24
0:00:17
0–00
0:00:02
199–00
0:07:30
203–97110444
0:07:20
199–95510071
nmap-token-10:08:08
1–12
0:01:00
0–00
0:00:02
199–00
0:07:13
202–96110389
0:06:48
199–94810029
nmap-token-20:07:38
1–24
0:01:55
0–00
0:00:03
199–00
0:07:14
203–96410409
0:06:39
198–94010016
nmap-token-30:09:05
1–24
0:01:11
0–00
0:00:02
199–00
0:07:48
203–96310396
0:07:04
199–94710029
nmap-token-40:08:33
1–24
0:02:14
0–00
0:00:02
199–00
0:07:23
203–96310397
0:06:46
199–94510008

#token-2009-10-14

2009-10-14

On goomba

> tapply(x$up, list(x$variant, x$scan), mean)
           down-ping random-F scanme up-F up-ping
nmap               0      204      1  200     200
nmap-token         0      204      1  200     200
> tapply(x$open, list(x$variant, x$scan), mean)
           down-ping random-F scanme  up-F up-ping
nmap               0   978.50      2 961.0       0
nmap-token         0   971.75      2 957.5       0
> tapply(x$closed, list(x$variant, x$scan), mean)
           down-ping random-F scanme    up-F up-ping
nmap               0 10581.25      4 10211.0       0
nmap-token         0 10579.25      4 10199.5       0
 scanmedown-pingup-pingrandom-Fup-F
nmap-10:06:14
1–24
0:02:09
0–00
0:00:02
200–00
0:04:44
204–97610599
0:04:01
200–96010222
nmap-20:06:45
1–24
0:02:13
0–00
0:00:02
200–00
0:05:04
204–98010569
0:08:24
200–96210228
nmap-30:05:13
1–24
0:02:06
0–00
0:00:02
200–00
0:05:34
204–98210576
0:03:05
200–96010182
nmap-40:06:52
1–24
0:01:56
0–00
0:00:02
200–00
0:06:40
204–97610581
0:03:18
200–96210212
nmap-token-10:06:38
1–24
0:02:05
0–00
0:00:02
200–00
0:05:26
204–98010577
0:04:11
200–95910201
nmap-token-20:06:26
1–24
0:01:21
0–00
0:00:02
200–00
0:04:18
204–97810585
0:03:29
200–96110196
nmap-token-30:06:17
1–24
0:01:13
0–00
0:00:02
200–00
0:04:30
204–97210581
0:03:24
200–95910205
nmap-token-40:05:19
1–24
0:02:17
0–00
0:00:01
200–00
0:04:14
204–95710574
0:03:38
200–95110196

#token-2009-10-22

2009-10-22

On gusto

 scanmedown-pingup-pingrandom-Fup-F
nmap-1 0:00:41
0–00
0:00:02
199–00
0:08:46
203–102910357
0:07:21
199–10039992
nmap-2 0:00:38
0–00
0:00:02
199–00
0:08:31
203–102910395
0:07:25
199–100810008
nmap-token-1 0:02:44
0–00
0:00:02
199–00
0:07:41
203–102710315
0:06:52
199–9999951
nmap-token-2 0:01:52
0–00
0:00:02
199–00
0:07:48
202–102410310
0:06:41
198–9939869
nmap-tryno-1 0:00:51
0–00
0:00:02
199–00
0:08:03
203–103510401
0:07:40
199–10109969
nmap-tryno-2 0:01:14
0–00
0:00:02
199–00
0:08:31
200–102910371
0:07:39
199–100810002

#token-2009-10-27a

2009-10-27a

On gusto

 scanmedown-pingup-pingrandom-Fup-F
nmap-1 0:00:39
1–00
0:00:02
199–00
0:09:58
204–80210032
0:09:25
199–7739695
nmap-2 0:00:31
1–00
0:00:02
197–00
0:09:55
202–80310034
0:08:27
197–7759665
nmap-3 0:02:04
1–00
0:00:02
198–00
0:09:29
203–80410102
0:08:44
198–7739717
nmap-4 0:00:17
1–00
0:00:03
198–00
0:08:29
203–80110038
0:07:49
195–7699688
nmap-token-1 0:00:35
1–00
0:00:03
199–00
0:08:17
204–79810013
0:08:31
199–7699623
nmap-token-2 0:00:15
1–00
0:00:03
199–00
0:09:22
204–8009994
0:07:27
196–7679630
nmap-token-3 0:01:38
1–00
0:00:03
198–00
0:08:43
201–80210040
0:07:13
198–7689644
nmap-token-4 0:00:11
1–00
0:00:09
197–00
0:08:16
200–7959992
0:08:27
198–7428978

#token-2009-10-28

2009-10-28

On goomba

> tapply(x$up, list(x$variant, x$scan), mean)
           down-ping random-F scanme up-F up-ping
nmap               1   202.25      1  198     198
nmap-token         1   203.00      1  198     198
> tapply(x$open, list(x$variant, x$scan), mean)
           down-ping random-F scanme    up-F up-ping
nmap               0  1041.50      2 1014.75       0
nmap-token         0  1045.25      2 1010.50       0
> tapply(x$closed, list(x$variant, x$scan), mean)
           down-ping random-F scanme     up-F up-ping
nmap               0  10554.0   3.75 10164.75       0
nmap-token         0  10532.5   4.00 10086.75       0
> tapply(x$time, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap           60.00   390.75 376.75 251.00       2
nmap-token     75.25   350.25 482.75 224.75       2
 scanmedown-pingup-pingrandom-Fup-F
nmap-10:06:54
1–24
0:00:48
1–00
0:00:02
198–00
0:08:12
203–104210350
0:03:46
198–10119960
nmap-20:06:09
1–23
0:00:50
1–00
0:00:02
198–00
0:04:16
200–103910369
0:03:46
198–10139970
nmap-30:06:02
1–24
0:01:19
1–00
0:00:02
198–00
0:04:29
203–104310742
0:03:35
198–101310347
nmap-40:06:02
1–24
0:01:03
1–00
0:00:02
198–00
0:09:06
203–104210755
0:05:37
198–102210382
nmap-token-10:06:18
1–24
0:01:10
1–00
0:00:02
198–00
0:04:57
203–104410330
0:03:12
198–10149927
nmap-token-20:06:33
1–24
0:01:16
1–00
0:00:02
198–00
0:03:45
203–104210330
0:04:02
198–10169949
nmap-token-30:06:40
1–24
0:01:24
1–00
0:00:02
198–00
0:06:18
203–104710736
0:03:26
198–102110354
nmap-token-40:12:40
1–24
0:01:11
1–00
0:00:02
198–00
0:08:21
203–104810734
0:04:19
198–99110117

On gusto

For this test I used -g 53, because that forces a different method of encoding the token.

> tapply(x$up, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap               1   199.75      1 194.25  195.75
nmap-token         1   199.00      1 194.25  194.75
> tapply(x$open, list(x$variant, x$scan), mean)
           down-ping random-F scanme  up-F up-ping
nmap               0   992.50   2.00 943.5       0
nmap-token         0   963.75   1.75 941.0       0
> tapply(x$closed, list(x$variant, x$scan), mean)
           down-ping random-F scanme up-F up-ping
nmap               0  10372.5      4 9992       0
nmap-token         0  10362.5      4 9966       0
> tapply(x$time, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap           29.75   618.50  419.0 550.00    3.00
nmap-token     39.50   598.75  422.5 559.75    2.25
nmap-10:06:41
1–24
0:00:22
1–00
0:00:03
196–00
0:11:01
201–99110569
0:08:59
196–96510189
nmap-20:07:01
1–24
0:00:45
1–00
0:00:03
196–00
0:09:31
199–100310569
0:09:11
193–93210189
nmap-30:07:28
1–24
0:00:25
1–00
0:00:04
195–00
0:10:34
198–98710175
0:09:59
195–9559792
nmap-40:06:46
1–24
0:00:27
1–00
0:00:02
196–00
0:10:08
201–98910177
0:08:31
193–9229798
nmap-token-10:06:51
1–24
0:00:34
1–00
0:00:02
196–00
0:09:09
199–95810562
0:08:29
190–92310183
nmap-token-20:07:05
1–24
0:00:38
1–00
0:00:02
194–00
0:09:26
196–94510560
0:10:14
195–95810093
nmap-token-30:06:54
1–24
0:00:37
1–00
0:00:02
193–00
0:10:57
201–97610172
0:09:18
196–9509797
nmap-token-40:07:20
1–14
0:00:49
1–00
0:00:03
196–00
0:10:23
200–97610156
0:09:18
196–9339791

#token-2009-10-29

2009-10-29

On gusto

In this test I added a third version of Nmap that uses the old tryno-pingseq source port as the token, but it still does a token comparison, not a tryno-pingseq comparison. The results are good this time. This led me to consider restricting the range of source ports.

> tapply(x$up, list(x$variant, x$scan), mean)
                 down-ping random-F scanme     up-F up-ping
nmap                     1 199.6667      1 195.6667     196
nmap-token               1 199.0000      1 195.6667     196
nmap-token-tryno         1 201.0000      1 196.0000     196
> tapply(x$open, list(x$variant, x$scan), mean)
                 down-ping random-F scanme     up-F up-ping
nmap                     0 956.3333      2 916.3333       0
nmap-token               0 946.0000      2 848.0000       0
nmap-token-tryno         0 954.3333      2 848.6667       0
> tapply(x$closed, list(x$variant, x$scan), mean)
                 down-ping random-F   scanme     up-F up-ping
nmap                     0 10072.33 3.666667 9631.667       0
nmap-token               0 10037.67 3.666667 9558.667       0
nmap-token-tryno         0 10082.67 4.000000 9607.000       0
> tapply(x$time, list(x$variant, x$scan), mean)
                 down-ping random-F   scanme     up-F  up-ping
nmap              51.33333 519.0000 610.3333 460.3333 3.000000
nmap-token        73.66667 462.6667 473.6667 429.0000 5.666667
nmap-token-tryno  55.33333 513.3333 611.3333 475.3333 2.000000
 scanmedown-pingup-pingrandom-Fup-F
nmap-10:10:23
1–24
0:01:10
1–00
0:00:04
196–00
0:08:24
199–103410185
0:07:33
196–10029810
nmap-20:10:11
1–23
0:00:47
1–00
0:00:03
196–00
0:08:11
200–103310151
0:07:30
195–9769564
nmap-30:09:57
1–24
0:00:37
1–00
0:00:02
196–00
0:09:22
200–8029881
0:07:58
196–7719521
nmap-token-10:08:20
1–23
0:00:30
1–00
0:00:05
196–00
0:07:29
200–102210148
0:06:37
195–9999765
nmap-token-20:07:23
1–24
0:01:57
1–00
0:00:09
196–00
0:07:50
201–102710140
0:07:13
196–7739455
nmap-token-30:07:58
1–24
0:01:14
1–00
0:00:03
196–00
0:07:49
196–7899825
0:07:37
196–7729456
nmap-token-tryno-10:10:11
1–24
0:00:43
1–00
0:00:02
196–00
0:08:26
201–103010167
0:07:12
196–10059834
nmap-token-tryno-20:09:59
1–24
0:00:48
1–00
0:00:02
196–00
0:08:25
201–103410200
0:08:26
196–7729492
nmap-token-tryno-30:10:24
1–24
0:01:15
1–00
0:00:02
196–00
0:08:49
201–7999881
0:08:08
196–7699495

On syn

 scanmedown-pingup-pingrandom-Fup-F
nmap-token-10:00:01
0–00
0:01:00
1–00
0:00:03
197–00
0:02:31
203–105310739
0:01:55
198–102310331
nmap-token-20:00:00
0–00
0:01:43
1–00
0:00:02
198–00
0:02:34
203–104810727
0:02:04
198–102010346
nmap-token-30:00:00
0–00
0:01:03
1–00
0:00:03
198–00
0:02:51
203–104710742
0:01:57
198–102010341
nmap-token-40:00:00
0–00
0:01:30
1–00
0:00:03
198–00
0:02:54
203–105210736
0:02:12
198–101810341

#token-2009-10-29a

2009-10-29a

On gusto

In this test, tokens are constrained to the range 0x8000–0xBFFF, instead of 0x8000–0xFFFF as before. The results are a lot better now.

> tapply(x$up, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap               1    199.5      1 195.75     196
nmap-token         1    200.5      1 195.50     196
> tapply(x$open, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap               0    853.5      2 830.25       0
nmap-token         0    852.5      2 815.50       0
> tapply(x$closed, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap               0   9941.0      4 9581.5       0
nmap-token         0   9910.5      4 9564.0       0
> tapply(x$time, list(x$variant, x$scan), mean)
           down-ping random-F scanme   up-F up-ping
nmap           50.75   505.00 624.75 484.75    4.25
nmap-token     40.25   477.75 497.50 411.25    3.25
 scanmedown-pingup-pingrandom-Fup-F
nmap-10:12:38
1–24
0:00:34
1–00
0:00:02
196–00
0:08:11
199–7929862
0:08:15
196–7769474
nmap-20:10:09
1–24
0:00:09
1–00
0:00:10
196–00
0:07:42
198–102210161
0:07:29
196–10029824
nmap-30:09:25
1–24
0:01:20
1–00
0:00:02
196–00
0:08:49
201–8039878
0:08:04
196–7729497
nmap-40:09:27
1–24
0:01:20
1–00
0:00:03
196–00
0:08:58
200–7979863
0:08:31
195–7719531
nmap-token-10:08:19
1–24
0:01:34
1–00
0:00:03
196–00
0:08:07
201–7929822
0:06:51
196–7639423
nmap-token-20:08:19
1–24
0:00:09
1–00
0:00:03
196–00
0:07:26
200–102710164
0:06:19
195–9679512
nmap-token-30:08:30
1–24
0:00:42
1–00
0:00:03
196–00
0:08:28
200–7969832
0:06:48
196–7629462
nmap-token-40:08:02
1–24
0:00:16
1–00
0:00:04
196–00
0:07:50
201–7959824
0:07:27
195–7709859

#token-2009-10-30

2009-10-30

On gusto

Now constraining token values to 0x8000–0x9FFF.

> tapply(x$up, list(x$scan, x$variant), mean)
                nmap nmap-token
down-ping     1.0000     1.0000
down-ping-g   1.0000     1.0000
random-F    199.6667   199.0000
random-F-g  198.3333   197.6667
up-F        196.0000   195.3333
up-F-g      195.3333   192.3333
up-ping     196.0000   196.0000
up-ping-g   195.6667   195.3333
> tapply(x$open, list(x$scan, x$variant), mean)
                nmap nmap-token
down-ping     0.0000     0.0000
down-ping-g   0.0000     0.0000
random-F    798.3333   791.6667
random-F-g  748.6667   734.0000
up-F        772.6667   767.6667
up-F-g      720.0000   701.3333
up-ping       0.0000     0.0000
up-ping-g     0.0000     0.0000
> tapply(x$closed, list(x$scan, x$variant), mean)
                nmap nmap-token
down-ping      0.000      0.000
down-ping-g    0.000      0.000
random-F    9854.000   9774.667
random-F-g  9818.667   9827.000
up-F        9511.333   9449.333
up-F-g      9444.667   9416.000
up-ping        0.000      0.000
up-ping-g      0.000      0.000
> tapply(x$time, list(x$scan, x$variant), mean)
                  nmap nmap-token
down-ping    43.000000  63.666667
down-ping-g  40.333333  39.333333
random-F    555.333333 527.333333
random-F-g  530.000000 580.000000
up-F        505.000000 424.333333
up-F-g      553.000000 489.666667
up-ping       2.000000   4.333333
up-ping-g     2.666667   2.666667
 down-pingup-pingrandom-Fup-Fdown-ping-grandom-F-gup-F-gup-ping-g
nmap-10:00:53
1–00
0:00:02
196–00
0:09:45
201–7989853
0:09:38
196–7759490
0:01:04
1–00
0:08:22
200–7569789
0:09:57
196–7349449
0:00:02
195–00
nmap-20:00:54
1–00
0:00:02
196–00
0:08:47
198–8019866
0:07:56
196–7719505
0:00:28
1–00
0:09:37
197–7539838
0:08:34
195–7029426
0:00:03
196–00
nmap-30:00:22
1–00
0:00:02
196–00
0:09:14
200–7969843
0:07:41
196–7729539
0:00:29
1–00
0:08:31
198–7379829
0:09:08
195–7249459
0:00:03
196–00
nmap-token-10:01:03
1–00
0:00:08
196–00
0:08:56
198–7929823
0:07:07
195–7669444
0:00:48
1–00
0:09:39
197–7199803
0:07:57
195–7099449
0:00:03
196–00
nmap-token-20:00:43
1–00
0:00:02
196–00
0:09:42
201–7929669
0:07:16
196–7699457
0:00:22
1–00
0:10:31
198–7379839
0:08:24
190–6959337
0:00:02
195–00
nmap-token-30:01:25
1–00
0:00:03
196–00
0:07:44
198–7919832
0:06:50
195–7689447
0:00:48
1–00
0:08:50
198–7469839
0:08:08
192–7009462
0:00:03
195–00

#token-2009-10-30a

2009-10-30a

On gusto

> tapply(x$up, list(x$scan, x$variant), mean)
                nmap nmap-token
down-ping     1.0000     1.0000
down-ping-g   1.0000     1.0000
random-F    199.6667   199.3333
random-F-g  196.0000   198.3333
up-F        195.0000   194.3333
up-F-g      194.6667   193.6667
up-ping     195.3333   195.6667
up-ping-g   194.0000   194.3333
> tapply(x$open, list(x$scan, x$variant), mean)
                nmap nmap-token
down-ping     0.0000     0.0000
down-ping-g   0.0000     0.0000
random-F    797.6667   793.3333
random-F-g  734.6667   753.0000
up-F        768.6667   766.6667
up-F-g      714.0000   733.6667
up-ping       0.0000     0.0000
up-ping-g     0.0000     0.0000
> tapply(x$closed, list(x$scan, x$variant), mean)
                nmap nmap-token
down-ping      0.000      0.000
down-ping-g    0.000      0.000
random-F    9852.000   9857.333
random-F-g  9840.667   9841.333
up-F        9487.667   9483.667
up-F-g      9464.333   9433.667
up-ping        0.000      0.000
up-ping-g      0.000      0.000
> tapply(x$time, list(x$scan, x$variant), mean)
                  nmap nmap-token
down-ping    65.333333  56.333333
down-ping-g  51.000000  40.000000
random-F    541.666667 513.000000
random-F-g  506.000000 542.666667
up-F        486.333333 434.000000
up-F-g      485.666667 540.666667
up-ping       2.666667   3.333333
up-ping-g     3.000000   2.000000
 scanmedown-pingup-pingrandom-Fup-Fdown-ping-grandom-F-gup-F-gup-ping-g
nmap-1 0:00:50
1–00
0:00:03
196–00
0:09:31
201–8019838
0:08:16
194–7669479
0:01:02
1–00
0:08:44
198–7329841
0:08:31
196–7119465
0:00:02
196–00
nmap-2 0:01:28
1–00
0:00:02
195–00
0:08:59
198–7959839
0:08:01
195–7699483
0:01:00
1–00
0:07:44
196–7419846
0:07:45
193–7009460
0:00:04
190–00
nmap-3 0:00:58
1–00
0:00:03
195–00
0:08:35
200–7979879
0:08:02
196–7719501
0:00:31
1–00
0:08:50
194–7319835
0:08:01
195–7319468
0:00:03
196–00
nmap-token-1 0:00:39
1–00
0:00:02
196–00
0:08:39
201–8009852
0:07:06
193–7669480
0:00:54
1–00
0:09:13
200–7559840
0:09:39
195–7429462
0:00:02
196–00
nmap-token-2 0:01:01
1–00
0:00:06
196–00
0:08:40
197–7869866
0:07:26
196–7739486
0:00:28
1–00
0:08:50
198–7579842
0:08:11
191–7279374
0:00:02
191–00
nmap-token-3 0:01:09
1–00
0:00:02
195–00
0:08:20
200–7949854
0:07:10
194–7619485
0:00:38
1–00
0:09:05
197–7479842
0:09:12
195–7329465
0:00:02
196–00

#token-2009-11-02

2009-11-02

These tests are with nmap-token r15976, which doesn't really use tokens anymore. This test is just to see that the additional TCP matching tests don't affect accuracy, which they don't. The -g tests are with a source port set. the scanme-A test is an ACK scan of scanme. The tables don't show the filtered and unfiltered ports, because those are built into the analysis programs, but they were all accurate, finding 6 unfiltered and 65529 filtered ports.

On goomba

> tapply(x$up, list(x$scan, x$variant), mean)
              nmap nmap-token
down-ping     1.00       1.00
down-ping-g   1.00       1.00
random-F    202.00     201.75
random-F-g  201.75     202.00
scanme        1.00       1.00
scanme-A      1.00       1.00
up-F        197.00     197.00
up-F-g      196.75     196.75
up-ping     196.75     197.00
up-ping-g   196.75     197.00
> tapply(x$open, list(x$scan, x$variant), mean)
               nmap nmap-token
down-ping      0.00       0.00
down-ping-g    0.00       0.00
random-F    1041.00    1041.75
random-F-g  1037.00    1037.75
scanme         2.00       2.00
scanme-A       0.00       0.00
up-F        1002.75    1013.25
up-F-g      1007.25    1008.00
up-ping        0.00       0.00
up-ping-g      0.00       0.00
> tapply(x$closed, list(x$scan, x$variant), mean)
                nmap nmap-token
down-ping       0.00       0.00
down-ping-g     0.00       0.00
random-F    10239.00   10234.25
random-F-g  10184.50   10184.00
scanme          4.00       3.75
scanme-A        0.00       0.00
up-F         9854.25    9858.25
up-F-g       9801.25    9801.00
up-ping         0.00       0.00
up-ping-g       0.00       0.00
> tapply(x$time, list(x$scan, x$variant), mean)
              nmap nmap-token
down-ping    63.75      79.75
down-ping-g  94.00      78.75
random-F    254.75     466.00
random-F-g  286.75     324.50
scanme      362.75     389.25
scanme-A    378.25     397.00
up-F        363.25     427.00
up-F-g      211.00     236.00
up-ping       5.25       2.00
up-ping-g     2.00       2.25
 scanmedown-pingup-pingrandom-Fup-Fdown-ping-grandom-F-gscanme-Aup-F-gup-ping-g
nmap-10:05:01
1–24
0:01:12
1–00
0:00:02
197–00
0:03:55
202–103910243
0:03:29
197–10149860
0:00:36
1–00
0:06:07
201–103610184
0:06:42
1–00
0:03:45
197–10089801
0:00:02
197–00
nmap-20:07:06
1–24
0:01:41
1–00
0:00:03
196–00
0:04:28
202–104410268
0:03:34
197–10159856
0:00:40
1–00
0:04:48
202–103710185
0:06:11
1–00
0:03:06
197–10079802
0:00:02
197–00
nmap-30:05:52
1–24
0:01:00
1–00
0:00:02
197–00
0:03:44
202–104210221
0:06:34
197–9699854
0:03:15
1–00
0:04:01
202–103810184
0:06:29
1–00
0:02:33
197–10099801
0:00:02
197–00
nmap-40:06:12
1–24
0:00:22
1–00
0:00:14
197–00
0:04:52
202–103910224
0:10:36
197–10139847
0:01:45
1–00
0:04:11
202–103710185
0:05:51
1–00
0:04:40
196–10059801
0:00:02
196–00
nmap-token-10:05:42
1–24
0:00:59
1–00
0:00:02
197–00
0:04:34
202–104410229
0:03:37
197–10119845
0:00:54
1–00
0:03:39
202–103910184
0:06:59
1–00
0:02:45
197–10109801
0:00:02
197–00
nmap-token-20:06:40
1–24
0:01:14
1–00
0:00:02
197–00
0:04:38
202–104410271
0:03:50
197–10129884
0:01:11
1–00
0:06:31
202–103810184
0:05:35
1–00
0:02:59
197–10099801
0:00:02
197–00
nmap-token-30:06:26
1–24
0:01:10
1–00
0:00:02
197–00
0:09:03
201–104010231
0:15:46
197–10159867
0:01:27
1–00
0:07:00
202–103610184
0:06:16
1–00
0:04:31
196–10069801
0:00:03
197–00
nmap-token-40:07:09
1–23
0:01:56
1–00
0:00:02
197–00
0:12:49
202–103910206
0:05:15
197–10159837
0:01:43
1–00
0:04:28
202–103810184
0:07:38
1–00
0:05:29
197–10079801
0:00:02
197–00

On gusto

> tapply(x$up, list(x$scan, x$variant), mean)
              nmap nmap-token
down-ping     1.00       1.00
down-ping-g   1.00       1.00
random-F    199.25     199.75
random-F-g  196.75     196.00
up-F        194.25     193.75
up-F-g      191.25     194.50
up-ping     195.00     195.00
up-ping-g   193.75     191.50
> tapply(x$open, list(x$scan, x$variant), mean)
               nmap nmap-token
down-ping      0.00       0.00
down-ping-g    0.00       0.00
random-F    1033.75    1030.50
random-F-g   969.50     970.25
up-F        1001.75    1001.25
up-F-g       933.25     954.00
up-ping        0.00       0.00
up-ping-g      0.00       0.00
> tapply(x$closed, list(x$scan, x$variant), mean)
                nmap nmap-token
down-ping       0.00       0.00
down-ping-g     0.00       0.00
random-F    10088.75   10084.50
random-F-g  10006.25   10019.75
up-F         9696.25    9725.25
up-F-g       9698.25    9698.75
up-ping         0.00       0.00
up-ping-g       0.00       0.00
> tapply(x$time, list(x$scan, x$variant), mean)
              nmap nmap-token
down-ping    48.00      52.75
down-ping-g  54.25      34.50
random-F    499.75     511.00
random-F-g  612.50     586.75
up-F        442.25     452.25
up-F-g      556.00     591.00
up-ping       4.75       2.25
up-ping-g     2.50       3.00
 scanmedown-pingup-pingrandom-Fup-Fdown-ping-grandom-F-gup-F-gup-ping-g
nmap-1 0:00:49
1–00
0:00:03
195–00
0:08:23
200–103610126
0:07:24
195–10119735
0:00:39
1–00
0:10:31
198–97610083
0:10:06
194–9709702
0:00:02
195–00
nmap-2 0:00:35
1–00
0:00:11
195–00
0:08:34
200–103810109
0:07:33
194–9979619
0:00:35
1–00
0:09:29
198–9699986
0:09:11
190–9079702
0:00:02
194–00
nmap-3 0:00:43
1–00
0:00:02
195–00
0:08:02
198–102710019
0:07:20
193–9969754
0:00:41
1–00
0:10:23
198–9889985
0:08:21
190–9199699
0:00:03
195–00
nmap-4 0:01:05
1–00
0:00:03
195–00
0:08:20
199–103410101
0:07:12
195–10039677
0:01:42
1–00
0:10:27
193–9459971
0:09:26
191–9379690
0:00:03
191–00
nmap-token-1 0:01:16
1–00
0:00:02
195–00
0:08:13
200–103410100
0:08:13
195–9989743
0:00:48
1–00
0:10:00
195–96410044
0:09:39
194–9489697
0:00:03
192–00
nmap-token-2 0:00:07
1–00
0:00:02
195–00
0:08:59
200–103110077
0:06:53
191–9989708
0:01:00
1–00
0:09:26
197–97010078
0:10:14
194–9569697
0:00:03
195–00
nmap-token-3 0:00:49
1–00
0:00:03
195–00
0:08:34
200–102510060
0:07:18
194–10039729
0:00:18
1–00
0:10:22
196–9659974
0:10:07
195–9399698
0:00:03
190–00
nmap-token-4 0:01:19
1–00
0:00:02
195–00
0:08:18
199–103210101
0:07:45
195–10069721
0:00:12
1–00
0:09:19
196–9829983
0:09:24
195–9739703
0:00:03
189–00
Edit - History - Print - Recent Changes - Search
Page last modified on November 03, 2009, at 01:04 PM