Steganos Hacker Tools/SHT151.iso/programme/scanner/nmapNTsp1/Win_nt.exe/nmapNT-src/CHANGELOG

Text File | 2000-05-08 | 28.0 KB | 673 lines

# Nmap Changelog

** Version 2.53

-- Fixed a commenting issue that could cause trouble for non-GNU compilers
   (first found by Jan-Frode Myklebust (janfrode at parallab.uib.no))

-- A few new services to nmap-services

** Version 2.52

-- Added very simple man pages for xnmap/nmapfe (lack of man pages for
   these was noticed by LaMont Jones (lamont (at) hp.com), the Debian
   Nmap package maintainer, based on bug report by Adrian Bunk (bunk
   (at) fs.tum.de ).

-- Fixed a "Status: Down" machine name output problem in machine
   parseable logs found by Alek O. Komarnitsky ( alek (at) ast.lmco.com )

-- Took some wierd files out of the doc directory (cd, grep , vi, and
   .swp)

-- Fixed some typos found by Thomas Klausner ( wiz (at)
   danbala.ifoer.tuwien.ac.at )

-- Updated nmap-rpc with new entries found in the latest version of Eilon
   Gishri's rpc list.

** Version 2.51

-- Fixed target parsing bug found by Steve Horsburgh (shorsburgh (at)
   horsburgh.com).

-- Changed makefile/rpm to store fingerprint, rpc, and services file
   in $prefix/share/nmap rather than $prefix/lib/nmap , since these
   files are architecture independent.  You should now use
   ./configure --datadir instead of ./configure --libdir to change
   the default location.  Suggested by Thomas Klausner ( wiz (at)
   danbala.ifoer.tuwien.ac.at ).

-- I am now including Eilon Gishri's (eilon (at) aristo.tau.ac.il) rpc
   number list (which he recently merged with the Nmap 2.50 rpc list).

-- Included Spanish and French HTML versions of the Nmap man page (may
   not always be up to date).

** Version 2.50

-- Fixed an IP calculation error which could occur in some cases where
   you scan machines on different devices (like lo and eth0).  This
   problem was discoved by Jonathan Fine ([e-mail]).

-- Fixed a problem that could, in rare cases, cause a SYN scan scan to
   crash (the error message was "attempt to add port number X with
   illegal state 0").  This problem was reported by Erik Benner
   ([e-mail])

-- Changed the .spec file so that RPM versions create a xnmap link to
   nmapfe ( the normal make install has done this for a long time ).

** Version 2.3BETA21

-- A number of people reported problems with nmapfe in various
   environments (specifically gdk errors, hangs, and crashes).  I
   think that is now fixed.  Let me know if you still have the problem
   (make sure the title bar says BETA21).

-- Added a bunch of OS fingerprints based on all the contributions in
   the last month or so.

-- Fixed a bug that completely broke RPC scanning in BETA19.

-- Added list of ports scanned near the top of each machine log WHEN
   -v was specified.  Here is an example of the format:
   # Ports scanned: TCP(13;1-10,22,25) UDP(0;)
   The "13" above is the number of TCP ports being scanned.

-- Got rid of a snprintf() from nmapfe sine some systems don't have it
   :( and I'm to lazy to integrate in the snprintf that comes with
   nmap right now.

-- Fixed important target IP range parsing bug found by Jean-Yves
   Simon ( [e-mail] ).

-- Applied patch by albert chin (china at thewrittenword.com) which
   adds --with-libpcap[=DIR] option to configure and and adds an
   elegant approach for -lnsl and -lsocket checking to configure .

-- Fixed a bug which could cause Nmap to mark a port filtered based on ICMP
   dest. unreachable packets relating to a different host than the one
   being scanned.

-- Fixed output problem relating to ident scan noted by Peter
   Marschall ( peter.marschall at mayn.de )

-- Applied patch to services.c by Andrew Brown ([e-mail])
   which prevents some useless debugging (-d) output when reading some
   kindss of /etc/services files.

-- Added "Host: [machinename] (ip) Status: Down" to machine logs when
   the verbose option is given (just like down hosts are reported to
   stdout when verbose is given).  Suggested by Alek Komarnitsky.

-- Applied NetBSD compatability patch provided by Mipam (reinoud at
   ibbnet.org) which changes an autoconf macro to check for
   getopt_long_only instead of getopt_long.

-- Nmap used to print an inaccuracy warning when no open TCP ports
   were found on the target machine.  Due to a bug, this was not
   always being printed.  Problem found by Matt (matt at use.net) and
   Ajay Gupta2 (Ajay.Gupta2 at ey.com).

-- Added the number of ports in the ignored state right after the
state name in machine parseable logs.  It used to looke like:
 "Ignored State: closed" whereas now it looks like:
 "Ignored State: closed (1508)" Meaning that 1508 ports were closed
 and thus are not specifically enumerated.

-- Changed all nmapfe calls to gdk_font_load into gdk_fontset_load .
   Bennett Feitell (bfeitell at panix.com) suggested that this fixed
   some nmapfe font problems.

** Version 2.3BETA20

-- Applied patch sent in by [e-mail] which fixes a
   memory alignment bug in osscan.c which could cause core dumps on
   machines which require aligned access (like SPARC).

-- Fixed a compilation problem on machines that do not have MAP_FAILED
   defined (as a return value to mmap).  Problem noted by Phil
   Stracchino <[e-mail]>.

** Version 2.3BETA19

-- Tweaked the output so that it now tells how many ports are not
   shown and what state the ignored ports are in.  This info could be
   inferred before by people who had studied the manpage, but now the
   info is explicitly available.  I cleaned up a bunch of stuff
   internally to make this happen.  I hope I didn't break anything!

-- Changed NmapFE so that it always kills any running Nmap process
   when you press exit. Problem noted by Marc Renner
   (mrenner (at) ci.marysville.wa.us)

-- Apparently some Linux (glibc) systems now come with a "strcasestr"
   function.  So I have made autoconf look for this and use the native
   version if supported. (problem noted by Sami Farin
   (sfarin (at) ratol.fi)).

-- Added a new attribute "Ignored State: xxx" to the machine parseable
   logs, where xxx is the state (closed, filtered, or UNfiltered) that
   is being ignored.  Ports in that state are not listed (they weren't
   listed in earlier versions either).  Perhaps I should list ALL
   ports for machine parseable output.  Opinions?

-- Merged in a patch sent in by Mipam (reinoud (at) ibbnet.org) which is
   apparently part of the OpenBSD Nmap "port".  Although Nmap seems to
   work fine for me on my OpenBSD 2.4 box, a couple OpenBSD users have
   complained of problems.  Hopefully this will help. (it adds
   DLT_LOOP and DLT_ENC offset cases when reading from libpcap).

-- A few really minor bugfixes.

** Version 2.3BETA18

-- Fixed a very important bug that occurred when SYN scanning
   localhost.  Many thanks to Dries Schellekens (
   gwyllion (at) ace.ulyssis.student.kuleuven.ac.be ) for first reporting
   the problem.

-- Uros Prestor from TurboLinux informed us that the latest
   versions of Nmap work with Linux on the upcoming Intel
   Merced/Itanium IA-64 processors.  He also said that the TurboLinux
   distribution includes Nmap.  Kudos to them!  As well as the other
   distros that support Nmap (Debian, Red Hat, Suse, Trinux) and of
   course FreeBSD, NetBSD, & OpenBSD.  Does anyone know if Nmap ships
   with the latest from Mandrake or Corel?  The latest Solaris
   includes some Free software.  If anyone can get them to ship Nmap,
   I will buy you a case of beer :).

-- Added a #define to change vsnprintf to vsprintf on machines which
   do not support the former (mostly Solaris 2.5.1 and earlier).  This
   function is less safe.  For people who care about security, we
   recommend an upgrade to Solaris 8 (or Linux/*BSD).

-- Changed the NmapFE version to 0.<nmap_version> rather than always
   leaving it at 0.9.5 (which was confusing).  Thanks to J.D.K. Chipps
   (jdkc (at) woptura.com) for noticing this.

-- Added support for "-vv" (means the same as "-v -v").  Older
   versions of Nmap supported it (noted by George Kurtz).

** Version 2.3BETA17


-- Added ACK scanning.  This scan technique (which van Houser and
   others have been bugging me to add for years :), is great for
   testing firewall rulesets.  It can NOT find open ports, but it can
   distinguish between filtered/unfilterd by sending an ACK packet to
   each port and waiting for a RST to come back.  Filtered ports will
   not send back a RST (or will send ICMP unreachables).  This scan
   type is activated with -sA .

-- Documented the Window scan (-sW) which Lamont Granquist added in
   September 99.

-- Added a whole bunch of OS fingerprints that people have submitted.

-- "Protocol" field in output eliminated.  It is now printed right
   next to the number (/etc/services style).  Like "22/tcp".  I wonder
   what I should put in the extra white space this leaves on the
   report :).

-- Added --resume option to continue a large network scan where you
   left off.  This is useful for recovering from errors (modem drops
   carrier, network outage, etc).  It also allows you to start and
   stop for policy reasons (like if a client only wants you to scan on
   weekends or at night) or if you want to run the scan on a different
   host.  Usage is 'nmap --resume logfile' where logfile can be either
   normal (-oN) or machine parseable (-oM) logfile from the scan that
   was aborted.  No other options can be given (the options in the
   logfile from the original scan will be used).  Nmap will start off
   with the host after the last one successfully scanned in the log
   file.

-- Added --append_output option which causes -oN/-oM/-oS to APPEND to
   the output file you specify rather than overwriting it.

-- Various internal code cleanup, makefile fixes, etc.

-- Changed version number from 2.3BETA* to 2.30BETA* to appease
   various packaging systems that thought 2.3BETA was < 2.12 .

-- Nmap output to files now correctly flushes output after scanning
   for each host is finished.

-- Fixed compiler -L flags error found by Ralf Hildebrandt
   <R.Hildebrandt (at) tu-bs.de>

-- Fixed configure scripts so that options you give to the Nmap
   configure (like --prefix ) are also passed to the nmapfe configure
   script.  This problem was noted by Ralf Hildebrandt
   <R.Hildebrandt (at) tu-bs.de>.  While I was at it, I added some other
   cleanups to the system.

-- Added --noninteractive option for when nmap is called from scripts
   (where stuff like prompting users for info is unacceptable).  It
   does not currently do anything (Nmap never prompts) and script
   writers should probably wait until at least May '2000 so their
   scripts still work with earlier versions of Nmap.

-- Updated to the latest config.guess and config.sub from Autoconf 2.13

-- Applied patch by Sven <s.carstens (at) gmx.de> which fixes a segmentation
   fault problem in Nmapfe colored mode as well as some output niceties.

-- Changed some C++ comments to C-style for portability (noticed by
   "Sergei V. Rousakov" <sergei (at) cas.Vanderbilt.Edu> )

** Version 2.3BETA14

-- Peter Kosinar <goober (at) gjh.sk> performed some cleanup of the output
   routines and as a bonus he added skript kiddie output mode!!!  Try
   it out by adding "-oS - " to your nmap command line.  Note that
   using '-' to represent stdout instead of a filename is something
   you can do with any of the output modes.

-- Ensured that Nmap always gives up on ident scan after the first
   port attempt finds it to be closed (problem noticed by Matt
   <matt (at) use.net>)

-- Changed strsep's in nmapfe to more portable strtok's (should
   especially help Nmapfe compiles on Solaris)

-- Changed permutation algorithm to make port order and host order
   shuffling more random.

-- Various minor changes and internal code cleanup.

-- Fixed integer overflow that was limiting the max --host_timeout value
   to about 2,000,000 milliseconds (~1/2 hour).  The limit is now
   about 4,000,000,000 milliseconds (~1 month).  I really hope you don't
   need more than that :).

** Version 2.3BETA13
-- I made Nmap smarter about detecting filtering during UDP, Xmas,
   NULL, and FIN scans.

-- Updated Nmapfe to 0.9.5 (+ a patch from NmapFE author Zach Smith)

-- Fixed a problem where NmapFE would fail to honor $PATH (Noticed
   by K. Scott Rowe <kscott (at) nmt.edu>)

-- Added a couple ICMP unreachable messages Nmap was missing (found by
   Bifrost <bifrost (at) minions.com>).

-- Internal cleanup that improves the way some port lists are stored.

-- Added some more RPC numbers from <mmmorris (at) netscape.net>

-- Relaxed the dependency requirements of nmapfe rpm (now will accept
   any version of Nmap).

** Version 2.3BETA12
-- Added interactive mode which adds convenience for managing nmap
   sessions and also enhances privacy.  Get to it with --interactive
   and then type 'h' for help.

-- Added/modified many fingerprints including the latest 2.3.X Linux
   releases, the latest Win2000 builds, the Apple Airport Wireless
   device, and several dozen more.

-- Migrated to RPM .spec file sent in by Tim Powers
   <timp (at) redhat.com>.  That is the file they will be using to package
   Nmap with the power tools CD in the next Redhat release.  The most
   important changes are that Nmap (only the RPM version) now installs
   in /usr/* instead of /usr/local/* and the frontend is now
   dynamically linked with GTK and comes in a separate rpm.

-- The -i (input from list) option has been deprecated.  From now on
   you should use -iL <filename> to read from a list or -iR to have
   Nmap generate random IPs to scan.  This -iR option is new.

-- The -o and -m options have been deprecated.  From now on, you
   should use -oN for normal (human readable) output and -oM for
   machine parseable output.  At some point I might add -oH (HTML
   output) or -oSK (sKr|pt |<iDdi3 0uTPut).

-- Added --randomize_hosts option, which causes hosts be be scanned in
   non-sequential order.  This makes scans less conspicuous.  For
   efficiency reasons, the hosts are chopped into groups of 2048 and
   then each group is internally shuffled (the groups still go in
   order).

-- Rearranged the help ('nmap -h' or 'nmap' or 'nmap --help') screen
   to be shorter (37 -> 23 lines!) and include some of the new
   features of this release.  The man page was updated as well.

-- Fixed longstanding bug where nmap -sS mylocalnetwork/24 would not
   successfully scan the host running nmap.

-- Internal improvements to make scanning faster with -i (input list)
   or when you specify multiple machines on the command line.

-- Uses faster GCD algorithm and fixed several typos (sent in by Peter
   Kosinar).

-- Provide more information in machine/human readable output files
   (start time, end time, RPC program name, Nmap version number)

-- Killed the -A option (if you don't know what that is then you won't
   miss it.  In fact, even if you do know what it is you won't miss
   it.)

** Version 2.3BETA10

-- Added about 70 new OS fingerprints so that Nmap can detect more
   systems.  The most important new fingerprints are probably:
   * The new SP5+ NT boxes -- After all these years MS FINALLY made
     sequence prediction harder (on NT anyway).
   * Solaris 8 Pre-Release
   * Sega Dreamcast (Hack that!)
   * Latest Windows 2000 builds
   * OpenBSD 2.6

** Version 2.3BETA9

-- Applied patch by Mark Abene (Phiber Optik) to fix several type
   length issues so that it works on Linux/Alpha.

-- Applied patch by Matthieu Verbert <mve (at) zurich.ibm.com> to speed up OSScan

** Version 2.3Beta8
-- Added "firewall mode" timing optimizations which can decrease the
   ammount of time neccessary to SYN or connect scan some heavily
   filtered hosts.

-- Added min_rtt_timeout timing option (see man page for details)

-- Changed "TCP Ping" to use a random ACK value rather than 0 (an IDS
   called Snort was using this to detect Nmap TCP Pings).

-- Some changes for better Alpha/Linux support based on investigation
   by Bill Beers <wbeers (at) carolina.rr.com>

-- Applied changes for FDDI support by Tobias J. Nijweide <tobias (at) mesa.nl

-- Applied a socket binding patch from LaMont Jones <lamont (at) security.hp.com>
   which can be useful when using -S to specify one of multiple interfaces
   on a machine.

-- Made OS detection smart enough to first check scan results for a known
   closed port instead of immediately resorting to a random one.  This
   improves OS detection against some machines behind packet
   filters. (suggested by van Hauser)

-- Applied a shortcut suggestion by Thomas Reinke which can lead to
   a tremendous speedup against some firewalled hosts.

-- Added some ports commonly used for RPC to nmap-services

-- Fixed a problem with the timing of an RPC scan (could come before
   the UDP scans they rely on)

-- Added a number of new ports to nmap-services

** Version 2.3Beta6 **

-- Added sophisticated timing controls to give the user much more
   control over Nmap's speed.  This allows you to make Nmap much more
   aggressive to scan hosts faster, or you can make Nmap more "polite"
   -- slower but less likely to wreak havoc on your Network.  You can
   even enforce large delays between sending packets to sneak under
   IDS thresholds and prevent detection.  See the new "Timing Options"
   section of the Nmap man page for more information on using this.

-- Applied Lamont Granquist's <lamontg (at) u.washington.edu> Window
   scan patch (I changed the name from ACK scan to Window scan since I
   may add another scan that uses ACK packets and I don't want them to
   be confused).  -sW activates this scan type.  It is mostly
   effective against BSD, AIX, Digital UNIX, and various older HP/UX,
   SunOS, and VAX. (See nmap-hackers mailing list archives for an
   extensive list).

-- Added various long options people expect to see like --version ,
   --help , --usage , etc.  Some of the new timing options are also
   long.  I had to add getopt_long C files since most non-Linux boxes
   don't support getopt_long in libc.

-- Human readable (-o) output changed to include the time/date of the
   scan.  Suggested by van Hauser.

** Version 2.3-Beta5 ***

-- Changed RPC output based on suggestions by David O'Brien
   <obrien (at) NUXI.com> and Lance Spitzner <lance (at) spitzner.net>.  I got
   rid of the "(Non-RPC)" unnecessary clutter which appeared after
   each non RPC port and the "(untested)" that appeard after each
   "filtered" port.

-- Added a ton of new OS fingerprints people submitted.  I had about
   400 in my inbox.  Of course, almost 100 of them were submissions for
   www.windows2000test.com :).

-- Changed the machine parseable output of RPC information to include
   the version information.  If we figured out the RPC info, it is now
   provided as "program-num*lowversion-highversion".  If we didn't get
   the number, but we think the port is RPC, the field simply contains
   "R".  If we believe the port is NOT RPC, then the field contains
   "N".  If the field is empty, we did not RPC scan the port.  Thanks
   to H D Moore <nlog (at) ings.com> for making me aware how much the
   earlier machine parseable RPC logging sucked :).

*** Version 2.3-Beta4 ***

-- Added direct (non-portmapper) RPC scanning to determine what RPC
   program is listening on a particular port.  This works for UDP and
   TCP ports and is currently implemented using sockets (which means
   you can't use decoys, but on the other hand you don't have to be
   root).  Thanks go to ga <ga (at) capyork.com> for writing sample code to
   demonstrate the technique.  The RPC services list included with
   nmap was compiled by Vik Bajaj <vbajaj (at) sas.upenn.edu> with help
   from various members of the nmap-hackers list.

-- Fixed a problem that could cause freezes when you
   scan machines on at least two different types of interfaces as part
   of the same command.

-- Identified and found workaround for Linux kernel bug which allows
   connect() to sometimes succeed inapropriately when scanning closed
   ports on localhost.

-- Fixed problems relating to people who specify the same port more
   than once on the command line.  While the right answer is "well,
   don't do that!", I decided to fix nmap to handle this gracefully.

-- Tweaked UDP scanning to be more effective against Solaris ICMP
   error limiting.

-- Fixed strtol() integer overflow problem found by Renaud
   Deraison <deraison (at) cvs.nessus.org>

-- The HTML translation of the Man page at
   http://www.insecure.org/nmap/nmap_manpage.html should now be
   complete (man2html was dropping lines before).

-- Added a note in the man page that Nmap 2.0+ is believed to be
   COMPLETELY Y2K COMPLIANT!  I've been getting a lot of letters from
   laywers about that recently.  You should still be able to port scan on
   Jan 1st (well ... as long as you have electricity and gangs of looting
   thugs haven't stolen your computers :)

*** Version 2.2-Beta4 ***
-- Integrated nmapfe code from Zach Smith to allow
   the nmapfe output window to resize when you resize the nmapfe window.

-- Integrated patch sent in by Stefan Erben <stefan (at) erben.com> which
   allows nmap to recognize and ignore null interfaces.  If you were
   getting a bogus error like "eth0 not found in /proc/net/route" then
   this should solve your problem.

-- Applied patch from Alexander Savelyev <fano (at) ham.kiev.ua> which
   gives nmap the parameters necessary to support SLIP and PPP on BSDI
   systems.

-- Upgraded to a new version of shtool (1.2.3)

*** Version 2.2-Beta3 ***

-- Adopted Ralf S. Engelschall's excellent shtool script
   for simplifying the nmap makefile and making it more portable
-- Various other minor changes to nmapfe.

*** Version 2.2-Beta2 ***

-- Cleaned up build environment more, fixed up RPM and Makefile.in,
   eliminated the automake stuff.
-- Added nmapfe feature to show nmap command as you change options
-- Changed nmapfe to use a global MyWidgets struct rather than
   tons of global vars all over the place.
-- Made nmapfe much smarter about rejecting stupid option attempts.
   It now tries to correct things when you specify illegal options.
-- GTK+ 1.0 compatibility fixes
-- Integrated nmapfe changes from Zach

*** Version 2.2-BETA1 Changes ***

-- Integrated in nmapfe -- a cool front end wrottem by Zach Smith <matrxweb (at) hotmail.com>


*** Version 2.12 Changes ***

-- Changed the way tcp connect() scan determines the results of a
   connect() call.  Hopefully this will make nmap a little more
   portable.

-- Got rid of the security warning message for people who are missing
   /dev/random and /dev/urandom due to complaints about the warning.
   This only silences the warnings -- it still uses relatively weak
   random number generation under Solaris and other systems that lack
   this functionality.

-- Eliminated pow() calls on Linux boxes.  I think some sort of glibc
   bug was causing nmap to sigsegv in some cases inside of pow().
   Most people weren't affected, but those who were would almost
   always SIGSEGV with -O.

-- Fixed an rpm problem noted by Mark Smith <marks (at) senet.com.au>

*** Version 2.11 Changes ***

-- Many new fingerprints added.  I received more than 300 submissions
   between this release and the last one.

-- Fixed IRIX problems which prevented OS scanning from working on
   that platform.  The problem was researched and solution found by
   Lamont Granquist <lamontg (at) u.washington.edu>.  You can also thank
   him for porting nmap to almost every UNIX around.

-- Added support for '-m -' to redirect machine readable logs to
   stdout for shell pipelining, etc.  I also changed machine readable
   output to show service names now that we use a nmap specific
   services file rather than /etc/services.  These features were
   suggested by Dan Farmer.  You can also thank him for SATAN (the
   auditing tool).

-- Fixed a link-list bug that could cause hangs in UDP,FIN,NULL, and
   XMAS scans.  Also fixed a ptr problem that could cause SIGSEGV.
   These problem were discovered and tracked down by Ben Laurie
   <ben (at) algroup.co.uk>.  You can also thank him for Apache, OpenSSL,
   and Apache-SSL.

-- Fixed installation problem for people without a /usr/local/man/man1
   directory.  Found by Jeffrey Robertson <a-jeffro (at) microsoft.com>.
   I guess you can thank him for Win98 ;).

-- Several other little fixes to the installation script and minor
   scanner tweaks.

*** Version 2.10 Changes ***

-- Private test release

*** Version 2.09 Changes ***

-- Private test release

*** Version 2.08 Changes ***

-- Bugfix for problem that can cause nmap to appear to "freeze up" for long
   periods of time when run on some busy networks. (found by Lamont Granquist)

*** Version 2.07 Changes ***

-- Fixed a lockup on Solaris (and perhaps other proprietary UNIX
   systems) caused by a lack of /dev/random & /dev/urandom and a
   rand() that only returns values up to 65535.  Users of Free
   operating systems like Linux, FreeBSD, or OpenBSD probably
   shouldn't bother upgrading.

***Version 2.06 Changes***

-- Fixed compile problems on machines which lack snprintf() (found by Ken
   Williams <jkwilli2 (at) unity.ncsu.edu>)
-- Added the squid proxy to nmap-services (suggested by Holger Heimann)
-- Fixed a problem where the new memory allocation system was handing out
   misaligned pointers.
-- Fixed another memory allocation bug which probably doesn't cause any
   real-life problems.
-- Made nmap look in more places for nmap-os-fingerprints

***Version 2.05 Changes***

-- Tons of new fingerprints.  The number has grown by more than 25%.
  In particular, Charles M. Hannum <root (at) ihack.net> fixed several
  problems with NetBSD that made it easy to fingerprint and he sent me
  a huge new batch of fingerprints for various NetBSD releases down to
  1.2.  Other people sent NetBSD fingerprints down to 1.0.  I finally
  got some early Linux fingerprints in (down to 1.09).

-- Nmap now comes with its own nmap-services which I created by
   merging the /etc/services from a bunch of OS' and then adding
   Netbus, Back Orifice, etc.

-- Random number generation now takes advantage of the /dev/urandom or
   /dev/random that most Free operating systems offer.

-- Increased the maximum number of OS guesses nmap will make, told
   nmap never to give you two matches where the OS names are
   byte-to-byte equivalent.  Fixed nmap to differentiate between "no
   OS matches found" and "too many OS matches to list".

-- Fixed an information leak in the packet TTL values (found by
   HD Moore <hdmoore (at) usa.net>)

-- Fixed the problem noted by Savva Uspensky about offsets used for
   various operating systems' PPP/SLIP headers.  Due to lack of
   responses regarding other operating systems, I have made
   assumptions about what works for BSDI, NetBSD, and SOLARIS.  If
   this version no longer works on your modem, please let me know (and
   tell me whether you are using SLIP/PPP and what OS you are
   running).

-- Machine parseable logs are now more machine parseable (I now use a
   tab to seperate test result fields rather than the more ambiguous
   spaces.  This may break a few things which rely on the old format.
   Sorry.  They should be easy to fix.

-- Added my nmap-fingerprintinting-article.txt to the distribution in
   the docs directory.

-- Added a CHANGELOG file to the distribution.

-- Fixed problem where nmap -sS <my_ethernet_or_ppp_ip_address> would
   not correctly scan localhost (due to the kernel rerouting the
   traffic through localhost).  Nmap should now detect and work around
   this behavior.

-- Applied patch sent to my by Bill Fenner <fenner (at) parc.xerox.com>
   which fixes various SunOS compatibility problems.

-- Changed the makefile 'all' target to use install-sh rather than
   mkdir -p (doesn't work on some systems)

-- Documentation updated and clarified slightly.