Aloha, I'd like to announce version 1.86 of n0t - network 0S tracer In short n0t is an easy to use sniffer with remote OS and NAT detection, simple IDS (NMap, XMAS, NULL scans), output configuration scripts (very useful for really big traffic) and BPF filter (tcpdump-style). I believe discussion will help in process of debugging and developing next versions of this tool. Please send any comments, suggestions and (what's probably the most important) new OS fingerprints to n0t database. Also, please send any information about successful or unsuccessful attempts of compiling/launching n0t on different platforms. n0t in action: (root!osiris ~/n0t)# ./n0t -c n0t-sample.out -i ppp0 -S n0t - network 0S tracer, version 1.86 (c) Marcin Ulikowski <r3b00t@xxxxxxxx> n0t: parsed 156 signatures in 'n0t.fp' n0t: listening on 'ppp0' 22:30:46 83.28.253.45:1145 -> 217.153.145.198:80 [.S....] LEN:48 TTL:64 WSS:5840 DF (0 hops) OS: Linux 2.4 22:30:57 83.28.253.45:2563 -> 216.136.204.117:80 [.S....] (NAT) LEN:60 TTL:63 WSS:57344 DF (1 hops) OS: FreeBSD 4.6 - 4.9 caught SIGINT(2) signal, exiting... (2 packets, 108 bytes read) Newest version is always available at http://r3b00t.itsec.pl/n0t/n0t-latest.tgz -- ---------------------------------------------- Marcin Ulikowski && http://r3b00t.itsec.pl/ Accidents are accidents only to ignorance -------------------- `kill${IFS}-9${IFS}-1` --
