Nmap 7 发布
Nmap
![](/data/attachment/album/201511/21/101847jkev3vl9mwydysly.jpg)


[Nmap](https://nmap.org/) 是一款历史悠久的网络扫描工具，已经有18年的历史了。它由 Gordon Lyon 所设计，可以用来快速探测网络上的计算机主机及其服务。Nmap 会发送特定的数据包给目标主机/网络，然后根据返回的数据结果进行分析，从而探知目标主机是否存活、操作系统类型、网络协议细节、网络服务特性和安全缺陷等。


![](/data/attachment/album/201511/21/102608euf2yjyfi11r1fh1.png)


Nmap 6是在2012年5月发布的，[最新版本](https://nmap.org/7/)历时3年半时间的开发，包含将近3200个代码递交。主要更新如下：


### **1. Nmap Scripting Engine (NSE) 增加了很多功能**


Nmap 核心已经稳定，NSE 子系统中增加了越来越多的新功能。相比 Nmap 6 增加了171个新脚本和20个库，比如 [firewall-bypass](https://nmap.org/nsedoc/scripts/firewall-bypass.html)、 [supermicro-ipmi-conf](https://nmap.org/nsedoc/scripts/supermicro-ipmi-conf.html)、 [oracle-brute-stealth](https://nmap.org/nsedoc/scripts/oracle-brute-stealth.html) 和 [ssl-heartbleed](https://nmap.org/nsedoc/scripts/ssl-heartbleed.html) 等。NSE 现在功能更加强大了，脚本可以通过它使用更强力的核心功能，比如主机发现（[dns-ip6-arpa-scan](https://nmap.org/nsedoc/scripts/dns-ip6-arpa-scan.html)）、版本扫描（[ike-version](https://nmap.org/nsedoc/scripts/ike-version.html)、 [snmp-info](https://nmap.org/nsedoc/scripts/snmp-info.html) 等）和 RPC grinding （[rpc-grind](https://nmap.org/nsedoc/scripts/rpc-grind.html)）。


### **2. 成熟的 IPv6 支持**


Nmap 6 中的重大提升之一是 IPv6 扫描的改进 ，而在 Nmap 7 中对此支持就更加完善了，包括支持 CIDR 风格的地址范围、空余扫描、并发的反向 DNS 解析、更多的 NSE 脚本支持 IPv6。


### **3. 基础架构升级**


虽然已经是有18年历史的项目，但是我们并不固步自封地守着残破的基础架构不放。Nmap 项目持续地跟进最新的技术，加强开发过程以服务日益增多的用户。比如说，我们将 nmap.org 网站全部转换到 SSL 上来避免二进制程序被木马感染和减少窥探风险。我们在大部分工作流中使用了 [Git 版本控制系统](https://git-scm.com/)，并在 [Github 上建立了官方的 Nmap subversion 版本库镜像](https://github.com/nmap/nmap) ，我们鼓励大家提交代码补丁到 Github 上去。我们也创建了一个 [官方的 bug 跟踪系统](https://github.com/nmap/nmap/issues/)，也放在 Github 上。通过这样的跟踪 bug 和接受功能请求的方式降低了缺陷的数量。


### **4. 扫描更快**


18年来，Nmap 不断刷新了网络同步扫描的速度上限，这个版本也不例外。新的 Nsock 引擎极大提升了在 Windows 和 BSD 系统上的性能，<ruby> 目标重排 <rp>  （ </rp> <rt>  target reordering </rt> <rp>  ） </rp></ruby>防止了多宿主系统上的隐蔽死角，NSE 优化带来了更快的 -sV 扫描。


### **5. SSL/TLS 扫描解决方案的选择**


TLS 及其前身 SSL 是网站安全的基础，所以当类似心脏流血、 POODLE 和 FREAK 这样的大漏洞出现时，Nmap 的应对就是 NSE 漏洞检测脚本。整个重写了的 [ssl-enum-ciphers](https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html) 脚本可以更快地进行 TLS 部署问题的分析，也优化了版本探测功能，可以更快的检测最新的 TLS 握手的版本。


### **6. 增强 Ncat**


我们非常兴奋而自豪地宣布：Ncat 在 RedHat/Fedora 系列的发行版中成为了默认提供“netcat” 和“nc”命令的软件包！这是我们大量修正了错误和增强了对 netcat 选项兼容性的结果。另一个让人兴奋的地方是增加了一个嵌入式的 Lua 接口，可以创建简单的跨平台的守护进程和流量的过滤器。


### **7. 无与伦比的可移植性**


Nmap 在跨平台方面做的非常棒，它可以运行在各种高深的、古老的系统上。而我们的二进制程序则对最新的流行操作系统保持紧密更新。Nmap 可以完全运行在从 Windows 10 到 Windows Vista 的操作系统上，根据大家的需求，我们甚至在 Windows XP 上也可以运行——虽然我们建议他们升级系统。 Mac OS X 则支持从 10.8 Mountain Lion 到 10.11 El Capitan。此外，我们更新了 Solaris 和 AIX 的支持。当然，Linux 用户，那就更没的说了。


 


OK
Nmap 7 Released

**November 19, 2015**—The Nmap Project is pleased to announce the
immediate, free availability of the Nmap Security Scanner version 7.00 from
[https://nmap.org/](https://nmap.org/). It is the product of three
and a half years of work, nearly 3200 code commits, and more than a dozen point
releases since the big [Nmap 6 release](https://nmap.org/6/) in May
2012. Nmap turned 18 years old in September this year and celebrates its
birthday with 171 new NSE scripts, expanded IPv6 support, world-class SSL/TLS
analysis, and more user-requested features than ever.
We recommend that all current users [upgrade](#download).

**Contents:**

[About Nmap](#about)[Top 7 Improvements in Nmap 7](#7changes)[Press](#press)[Screen Shots](#screenshots)[Detailed Improvements](#changes)[Moving Forward (Future Plans)](#future)[Acknowledgments](#acknowledgments)[Download and updates](#download)

## About Nmap

Nmap (“Network Mapper”) is a free and open source
([license](https://nmap.org/data/COPYING)) utility for network
discovery and security auditing. Many systems and network administrators also
find it useful for network inventory, managing service upgrade schedules,
monitoring host or service uptime, and many other tasks. Nmap uses raw IP
packets in novel ways to determine what hosts are available on the network, what
services (application name and version) those hosts are offering, what operating
systems (and OS versions) they are running, what type of packet
filters/firewalls are in use, and dozens of other characteristics. It was
designed to rapidly scan large networks, but works fine against single hosts.
Nmap runs on all major computer operating systems, and official binary packages
are available for Linux, Windows, and Mac OS X. In addition to the classic
command-line Nmap executable, the Nmap suite includes an advanced GUI and
results viewer ([Zenmap](https://nmap.org/zenmap/)), a flexible data
transfer, redirection, and debugging tool
([Ncat](https://nmap.org/ncat/)), a utility for comparing scan
results ([Ndiff](https://nmap.org/ndiff/)), and a packet generation
and response analysis tool ([Nping](https://nmap.org/nping/)).

Nmap was named “Security Product of the Year” by Linux Journal,
Info World, LinuxQuestions.Org, and Codetalker Digest. It was even featured in
[nineteen movies and TV series](https://nmap.org/movies/), including
[The Matrix Reloaded](https://nmap.org/movies/#matrix),
[The Bourne Ultimatum](https://nmap.org/movies/#bourne).
[Girl with the Dragon Tattoo](https://nmap.org/movies/#gwtdt),
[Dredd](https://nmap.org/movies/#dredd),
[Elysium](https://nmap.org/movies/#elysium),
and [Die Hard 4](https://nmap.org/movies/#diehard4). Nmap was
released to the public in 1997 and has earned the trust of millions of
users.

As free software, we don't have any sort of advertising budget. So please spread the word that Nmap 7 is now available!

## Top 7 Improvements in Nmap 7

Before we get into the [detailed changes](#changes), here
are the top 7 improvements in Nmap 7:

**1. Major Nmap Scripting Engine (NSE) Expansion**As the Nmap core has matured, more and more new functionality is developed as part of our NSE subsystem instead. In fact, we've added 171 new scripts and 20 libraries since Nmap 6. Examples include

[firewall-bypass](https://nmap.org/nsedoc/scripts/firewall-bypass.html),[supermicro-ipmi-conf](https://nmap.org/nsedoc/scripts/supermicro-ipmi-conf.html),[oracle-brute-stealth](https://nmap.org/nsedoc/scripts/oracle-brute-stealth.html), and[ssl-heartbleed](https://nmap.org/nsedoc/scripts/ssl-heartbleed.html). And NSE is now powerful enough that scripts can take on core functions such as host discovery ([dns-ip6-arpa-scan](https://nmap.org/nsedoc/scripts/dns-ip6-arpa-scan.html)), version scanning ([ike-version](https://nmap.org/nsedoc/scripts/ike-version.html),[snmp-info](https://nmap.org/nsedoc/scripts/snmp-info.html), etc.), and RPC grinding ([rpc-grind](https://nmap.org/nsedoc/scripts/rpc-grind.html)). There's even a proposal to[implement port scanning in NSE](https://secwiki.org/w/GSoC_community_ideas#Exploring_port_scanning_from_within_NSE). [[More Details](#changes-nse)]**2. Mature IPv6 support**IPv6 scanning improvements were a big item in the Nmap 6 release, but Nmap 7 outdoes them all with full IPv6 support for CIDR-style address ranges, Idle Scan, parallel reverse-DNS, and more NSE script coverage. [

[More Details](#changes-ipv6)]**3. Infrastructure Upgrades**We may be an 18-year-old project, but that doesn't mean we'll stick with old, crumbling infrastructure! The Nmap Project continues to adopt the latest technologies to enhance the development process and serve a growing user base. For example, we converted all of Nmap.Org to SSL to reduce the risk of trojan binaries and reduce snooping in general. We've also been using the

[Git version control system](https://git-scm.com/)as a larger part of our workflow and have an official[Github mirror of the Nmap Subversion source repository](https://github.com/nmap/nmap)and we encourage code submissions to be made as Github pull requests. We also created an[official bug tracker](https://github.com/nmap/nmap/issues/)which is also hosted on Github. Tracking bugs and enhancement requests this way has already reduced the number which fall through the cracks. [[More Details](#changes-infrastructure)]**4. Faster Scans**Nmap has continually pushed the speed boundaries of synchronous network scanning for 18 years, and this release is no exception. New Nsock engines give a performance boost to Windows and BSD systems, target reordering prevents a nasty edge case on multihomed systems, and NSE tweaks lead to much faster -sV scans. [

[More Details](#changes-performance)]**5. SSL/TLS scanning solution of choice**Transport Layer Security (TLS) and its predecessor, SSL, are the security underpinning of the web, so when big vulnerabilities like Heartbleed, POODLE, and FREAK come calling, Nmap answers with vulnerability detection NSE scripts. The

[ssl-enum-ciphers](https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html)script has been entirely revamped to perform fast analysis of TLS deployment problems, and version scanning probes have been tweaked to quickly detect the newest TLS handshake versions. [[More Details](#changes-ssl)]**6. Ncat Enhanced**We are excited and proud to announce that Ncat has been adopted by the Red Hat/Fedora family of distributions as the default package to provide the "netcat" and "nc" commands! This cooperation has resulted in a lot of squashed bugs and enhanced compatibility with Netcat's options. Also very exciting is the addition of an embedded Lua interpreter for creating simple, cross-platform daemons and traffic filters.

**7. Extreme Portability**Nmap is proudly cross-platform and runs on all sorts of esoteric and archaic systems. But our binary distributions have to be kept up-to-date with the latest popular operating systems. Nmap 7 runs cleanly on Windows 10 all the way back to Windows Vista. By popular request, we even built it to run on Windows XP, though we suggest those users upgrade their systems. Mac OS X is supported from 10.8 Mountain Lion through 10.11 El Capitan. Plus, we updated support for Solaris and AIX. And Linux users—you have it easy.


## Press

Please [mail Fyodor](mailto:fyodor@nmap.org) if you see (or write)
reviews/articles on the Nmap 7 release. Here are the ones seen so far:

Reasonably detailed (or with many comments) English articles:

- Reddit:
[Nmap 7 Released!](https://www.reddit.com/r/netsec/comments/3the8j/nmap_7_released/) - Hacker News:
[Nmap 7 Release Notes](https://news.ycombinator.com/item?id=10597563) - The Register:
[New Wireshark, Nmap releases bring pre-Xmas cheer to infosec types](http://www.theregister.co.uk/2015/11/23/wireshark_20_nmap/) - Softpedia:
[After Wireshark 2.0, Nmap 7 Free Network Scanner Is Finally Here](http://linux.softpedia.com/blog/after-wireshark-2-0-nmap-7-free-network-scanner-is-finally-here-496455.shtml) - n0where.net:
[Network Exploration with Nmap: Nmap v7 Released.](https://n0where.net/network-exploration-with-nmap/) - SecurityWeek:
[Nmap 7 Brings Faster Scans, Other Improvements](http://www.securityweek.com/nmap-7-brings-faster-scans-other-improvements) - SD Times:
[Nmap 7 is released](http://sdtimes.com/nmap-7-is-released/) - InfoWorld:
[Nmap 7 brings faster scanning and improved IPv6 support](http://www.infoworld.com/article/3007301/network-security/nmap-7-brings-faster-scanning-and-improved-ipv6-support.html) - Help Net Security:
[The top 7 improvements in Nmap 7](http://www.net-security.org/secworld.php?id=19142) - eSecurity Planet:
[5 Key New Features in Nmap Network Security Tool](http://www.esecurityplanet.com/network-security/5-key-new-features-in-nmap-network-security-tool.html)

Brief English mentions: [Linux Weekly News (LWN)](https://lwn.net/Articles/665170/), [SANS Internet Storm Center (ISC)](https://isc.sans.edu/forums/diary/Nmap+700+is+out/20403/).

Permission is granted for journalists (or anyone writing about this Nmap
release) to use any of the text or screen shots on this page. For quotes, you
can email [Fyodor](http://insecure.org/fyodor/) at
[fyodor@nmap.org](mailto:fyodor@nmap.org). Leave your phone number
if you want a callback.


## Screen Shots

Nmap 7 provides a wealth of information about remote
systems, as shown in this sample scan against a machine we maintain for
scan testing purposes ([scanme.nmap.org](http://scanme.nmap.org)).

![Screenshot of OS X terminal window running 'nmap -6 -A scanme.nmap.org'](screenshots/nmap7-scanme-terminal-717x575.png)

Here is an example using Zenmap on Windows 8.1 against a
couple of production web servers ([Nmap.org](https://nmap.org)
and [Reddit](http://reddit.com)).

![Screenshot of Zenmap 7 on Windows 8.1 showing Nmap text output](screenshots/zenmap7-example-785x746.png)

Perhaps the most visually appealing aspect of Zenmap
is its [network topology
mapper](https://nmap.org/book/zenmap-topology.html). Here it is being used to interactively explore the routes
between a source machine and a handful of interesting web sites, using the
Chinese translation.

![Screenshot of Zenmap 7 in XFCE4 showing the Topology tab in the Chinese language](screenshots/zenmap7-topology-example-796x727.png)

## Detailed Improvements

The [Nmap Changelog](https://nmap.org/changelog.html)
describes more than 330 significant improvements since our last major
release
([6.00](https://nmap.org/6) in May 2012).
Here are the highlights:

### NSE Improvements

The [Nmap Scripting Engine (NSE)](https://nmap.org/book/nse.html)
is one of Nmap's most powerful and flexible features. It
allows users to write (and share) simple [Lua](http://www.lua.org/)
scripts to automate a wide variety of networking tasks. Those scripts are then
executed in parallel with the speed and efficiency you expect from Nmap. The
low learning curve and powerful networking libraries of NSE make it ideal for
rapid development of security scanning and service probing scripts.

Script count has jumped from 348 to 515 scripts! That is 171 new scripts, minus four deletions. Of these, 109 will run by default when you use -sC, and another 35 will run with -sV for version detection. The list of new scripts is so long that we can't even include the summaries here, but each script is linked to it's own page on the

[NSE Documentation Portal](https://nmap.org/nsedoc/)for full details:[ajp-auth](https://nmap.org/nsedoc/scripts/ajp-auth.html),[ajp-brute](https://nmap.org/nsedoc/scripts/ajp-brute.html),[ajp-headers](https://nmap.org/nsedoc/scripts/ajp-headers.html),[ajp-methods](https://nmap.org/nsedoc/scripts/ajp-methods.html),[ajp-request](https://nmap.org/nsedoc/scripts/ajp-request.html),[allseeingeye-info](https://nmap.org/nsedoc/scripts/allseeingeye-info.html),[bacnet-info](https://nmap.org/nsedoc/scripts/bacnet-info.html),[bjnp-discover](https://nmap.org/nsedoc/scripts/bjnp-discover.html),[broadcast-ataoe-discover](https://nmap.org/nsedoc/scripts/broadcast-ataoe-discover.html),[broadcast-bjnp-discover](https://nmap.org/nsedoc/scripts/broadcast-bjnp-discover.html),[broadcast-eigrp-discovery](https://nmap.org/nsedoc/scripts/broadcast-eigrp-discovery.html),[broadcast-igmp-discovery](https://nmap.org/nsedoc/scripts/broadcast-igmp-discovery.html),[broadcast-pim-discovery](https://nmap.org/nsedoc/scripts/broadcast-pim-discovery.html),[broadcast-sonicwall-discover](https://nmap.org/nsedoc/scripts/broadcast-sonicwall-discover.html),[broadcast-tellstick-discover](https://nmap.org/nsedoc/scripts/broadcast-tellstick-discover.html),[cassandra-brute](https://nmap.org/nsedoc/scripts/cassandra-brute.html),[cassandra-info](https://nmap.org/nsedoc/scripts/cassandra-info.html),[cups-info](https://nmap.org/nsedoc/scripts/cups-info.html),[cups-queue-info](https://nmap.org/nsedoc/scripts/cups-queue-info.html),[dict-info](https://nmap.org/nsedoc/scripts/dict-info.html),[distcc-cve2004-2687](https://nmap.org/nsedoc/scripts/distcc-cve2004-2687.html),[dns-check-zone](https://nmap.org/nsedoc/scripts/dns-check-zone.html),[dns-ip6-arpa-scan](https://nmap.org/nsedoc/scripts/dns-ip6-arpa-scan.html),[dns-nsec3-enum](https://nmap.org/nsedoc/scripts/dns-nsec3-enum.html),[docker-version](https://nmap.org/nsedoc/scripts/docker-version.html),[enip-info](https://nmap.org/nsedoc/scripts/enip-info.html),[eppc-enum-processes](https://nmap.org/nsedoc/scripts/eppc-enum-processes.html),[fcrdns](https://nmap.org/nsedoc/scripts/fcrdns.html),[firewall-bypass](https://nmap.org/nsedoc/scripts/firewall-bypass.html),[flume-master-info](https://nmap.org/nsedoc/scripts/flume-master-info.html),[freelancer-info](https://nmap.org/nsedoc/scripts/freelancer-info.html),[gkrellm-info](https://nmap.org/nsedoc/scripts/gkrellm-info.html),[gpsd-info](https://nmap.org/nsedoc/scripts/gpsd-info.html),[hnap-info](https://nmap.org/nsedoc/scripts/hnap-info.html),[hostmap-ip2hosts](https://nmap.org/nsedoc/scripts/hostmap-ip2hosts.html),[hostmap-robtex](https://nmap.org/nsedoc/scripts/hostmap-robtex.html),[http-adobe-coldfusion-apsa1301](https://nmap.org/nsedoc/scripts/http-adobe-coldfusion-apsa1301.html),[http-avaya-ipoffice-users](https://nmap.org/nsedoc/scripts/http-avaya-ipoffice-users.html),[http-cisco-anyconnect](https://nmap.org/nsedoc/scripts/http-cisco-anyconnect.html),[http-coldfusion-subzero](https://nmap.org/nsedoc/scripts/http-coldfusion-subzero.html),[http-comments-displayer](https://nmap.org/nsedoc/scripts/http-comments-displayer.html),[http-cross-domain-policy](https://nmap.org/nsedoc/scripts/http-cross-domain-policy.html),[http-csrf](https://nmap.org/nsedoc/scripts/http-csrf.html),[http-devframework](https://nmap.org/nsedoc/scripts/http-devframework.html),[http-dlink-backdoor](https://nmap.org/nsedoc/scripts/http-dlink-backdoor.html),[http-dombased-xss](https://nmap.org/nsedoc/scripts/http-dombased-xss.html),[http-drupal-enum](https://nmap.org/nsedoc/scripts/http-drupal-enum.html),[http-drupal-enum-users](https://nmap.org/nsedoc/scripts/http-drupal-enum-users.html),[http-errors](https://nmap.org/nsedoc/scripts/http-errors.html),[http-exif-spider](https://nmap.org/nsedoc/scripts/http-exif-spider.html),[http-feed](https://nmap.org/nsedoc/scripts/http-feed.html),[http-fetch](https://nmap.org/nsedoc/scripts/http-fetch.html),[http-fileupload-exploiter](https://nmap.org/nsedoc/scripts/http-fileupload-exploiter.html),[http-form-fuzzer](https://nmap.org/nsedoc/scripts/http-form-fuzzer.html),[http-frontpage-login](https://nmap.org/nsedoc/scripts/http-frontpage-login.html),[http-git](https://nmap.org/nsedoc/scripts/http-git.html),[http-gitweb-projects-enum](https://nmap.org/nsedoc/scripts/http-gitweb-projects-enum.html),[http-huawei-hg5xx-vuln](https://nmap.org/nsedoc/scripts/http-huawei-hg5xx-vuln.html),[http-icloud-findmyiphone](https://nmap.org/nsedoc/scripts/http-icloud-findmyiphone.html),[http-icloud-sendmsg](https://nmap.org/nsedoc/scripts/http-icloud-sendmsg.html),[http-iis-short-name-brute](https://nmap.org/nsedoc/scripts/http-iis-short-name-brute.html),[http-ls](https://nmap.org/nsedoc/scripts/http-ls.html),[http-mobileversion-checker](https://nmap.org/nsedoc/scripts/http-mobileversion-checker.html),[http-ntlm-info](https://nmap.org/nsedoc/scripts/http-ntlm-info.html),[http-phpmyadmin-dir-traversal](https://nmap.org/nsedoc/scripts/http-phpmyadmin-dir-traversal.html),[http-phpself-xss](https://nmap.org/nsedoc/scripts/http-phpself-xss.html),[http-referer-checker](https://nmap.org/nsedoc/scripts/http-referer-checker.html),[http-rfi-spider](https://nmap.org/nsedoc/scripts/http-rfi-spider.html),[http-robtex-shared-ns](https://nmap.org/nsedoc/scripts/http-robtex-shared-ns.html),[http-server-header](https://nmap.org/nsedoc/scripts/http-server-header.html),[http-shellshock](https://nmap.org/nsedoc/scripts/http-shellshock.html),[http-sitemap-generator](https://nmap.org/nsedoc/scripts/http-sitemap-generator.html),[http-slowloris-check](https://nmap.org/nsedoc/scripts/http-slowloris-check.html),[http-slowloris](https://nmap.org/nsedoc/scripts/http-slowloris.html),[http-stored-xss](https://nmap.org/nsedoc/scripts/http-stored-xss.html),[http-svn-enum](https://nmap.org/nsedoc/scripts/http-svn-enum.html),[http-svn-info](https://nmap.org/nsedoc/scripts/http-svn-info.html),[http-tplink-dir-traversal](https://nmap.org/nsedoc/scripts/http-tplink-dir-traversal.html),[http-traceroute](https://nmap.org/nsedoc/scripts/http-traceroute.html),[http-useragent-tester](https://nmap.org/nsedoc/scripts/http-useragent-tester.html),[http-virustotal](https://nmap.org/nsedoc/scripts/http-virustotal.html),[http-vlcstreamer-ls](https://nmap.org/nsedoc/scripts/http-vlcstreamer-ls.html),[http-vuln-cve2006-3392](https://nmap.org/nsedoc/scripts/http-vuln-cve2006-3392.html),[http-vuln-cve2010-0738](https://nmap.org/nsedoc/scripts/http-vuln-cve2010-0738.html),[http-vuln-cve2013-0156](https://nmap.org/nsedoc/scripts/http-vuln-cve2013-0156.html),[http-vuln-cve2013-7091](https://nmap.org/nsedoc/scripts/http-vuln-cve2013-7091.html),[http-vuln-cve2014-2126](https://nmap.org/nsedoc/scripts/http-vuln-cve2014-2126.html),[http-vuln-cve2014-2127](https://nmap.org/nsedoc/scripts/http-vuln-cve2014-2127.html),[http-vuln-cve2014-2128](https://nmap.org/nsedoc/scripts/http-vuln-cve2014-2128.html),[http-vuln-cve2014-2129](https://nmap.org/nsedoc/scripts/http-vuln-cve2014-2129.html),[http-vuln-cve2014-8877](https://nmap.org/nsedoc/scripts/http-vuln-cve2014-8877.html),[http-vuln-cve2015-1427](https://nmap.org/nsedoc/scripts/http-vuln-cve2015-1427.html),[http-vuln-cve2015-1635](https://nmap.org/nsedoc/scripts/http-vuln-cve2015-1635.html),[http-vuln-misfortune-cookie](https://nmap.org/nsedoc/scripts/http-vuln-misfortune-cookie.html),[http-vuln-wnr1000-creds](https://nmap.org/nsedoc/scripts/http-vuln-wnr1000-creds.html),[http-waf-fingerprint](https://nmap.org/nsedoc/scripts/http-waf-fingerprint.html),[http-webdav-scan](https://nmap.org/nsedoc/scripts/http-webdav-scan.html),[http-wordpress-users](https://nmap.org/nsedoc/scripts/http-wordpress-users.html),[http-xssed](https://nmap.org/nsedoc/scripts/http-xssed.html),[icap-info](https://nmap.org/nsedoc/scripts/icap-info.html),[ike-version](https://nmap.org/nsedoc/scripts/ike-version.html),[ip-forwarding](https://nmap.org/nsedoc/scripts/ip-forwarding.html),[ip-https-discover](https://nmap.org/nsedoc/scripts/ip-https-discover.html),[ipv6-ra-flood](https://nmap.org/nsedoc/scripts/ipv6-ra-flood.html),[irc-sasl-brute](https://nmap.org/nsedoc/scripts/irc-sasl-brute.html),[isns-info](https://nmap.org/nsedoc/scripts/isns-info.html),[jdwp-exec](https://nmap.org/nsedoc/scripts/jdwp-exec.html),[jdwp-info](https://nmap.org/nsedoc/scripts/jdwp-info.html),[jdwp-inject](https://nmap.org/nsedoc/scripts/jdwp-inject.html),[knx-gateway-discover](https://nmap.org/nsedoc/scripts/knx-gateway-discover.html),[knx-gateway-info](https://nmap.org/nsedoc/scripts/knx-gateway-info.html),[llmnr-resolve](https://nmap.org/nsedoc/scripts/llmnr-resolve.html),[mcafee-epo-agent](https://nmap.org/nsedoc/scripts/mcafee-epo-agent.html),[metasploit-info](https://nmap.org/nsedoc/scripts/metasploit-info.html),[metasploit-msgrpc-brute](https://nmap.org/nsedoc/scripts/metasploit-msgrpc-brute.html),[mikrotik-routeros-brute](https://nmap.org/nsedoc/scripts/mikrotik-routeros-brute.html),[mmouse-brute](https://nmap.org/nsedoc/scripts/mmouse-brute.html),[mmouse-exec](https://nmap.org/nsedoc/scripts/mmouse-exec.html),[mrinfo](https://nmap.org/nsedoc/scripts/mrinfo.html),[msrpc-enum](https://nmap.org/nsedoc/scripts/msrpc-enum.html),[ms-sql-dac](https://nmap.org/nsedoc/scripts/ms-sql-dac.html),[mtrace](https://nmap.org/nsedoc/scripts/mtrace.html),[murmur-version](https://nmap.org/nsedoc/scripts/murmur-version.html),[mysql-dump-hashes](https://nmap.org/nsedoc/scripts/mysql-dump-hashes.html),[mysql-enum](https://nmap.org/nsedoc/scripts/mysql-enum.html),[mysql-query](https://nmap.org/nsedoc/scripts/mysql-query.html),[mysql-vuln-cve2012-2122](https://nmap.org/nsedoc/scripts/mysql-vuln-cve2012-2122.html),[nje-node-brute](https://nmap.org/nsedoc/scripts/nje-node-brute.html),[omron-info](https://nmap.org/nsedoc/scripts/omron-info.html),[oracle-brute-stealth](https://nmap.org/nsedoc/scripts/oracle-brute-stealth.html),[pcanywhere-brute](https://nmap.org/nsedoc/scripts/pcanywhere-brute.html),[qconn-exec](https://nmap.org/nsedoc/scripts/qconn-exec.html),[quake1-info](https://nmap.org/nsedoc/scripts/quake1-info.html),[rdp-enum-encryption](https://nmap.org/nsedoc/scripts/rdp-enum-encryption.html),[rfc868-time](https://nmap.org/nsedoc/scripts/rfc868-time.html),[rmi-vuln-classloader](https://nmap.org/nsedoc/scripts/rmi-vuln-classloader.html),[rpc-grind](https://nmap.org/nsedoc/scripts/rpc-grind.html),[s7-info](https://nmap.org/nsedoc/scripts/s7-info.html),[sip-call-spoof](https://nmap.org/nsedoc/scripts/sip-call-spoof.html),[sip-methods](https://nmap.org/nsedoc/scripts/sip-methods.html),[smb-ls](https://nmap.org/nsedoc/scripts/smb-ls.html),[smb-print-text](https://nmap.org/nsedoc/scripts/smb-print-text.html),[smb-vuln-conficker](https://nmap.org/nsedoc/scripts/smb-vuln-conficker.html),[smb-vuln-cve2009-3103](https://nmap.org/nsedoc/scripts/smb-vuln-cve2009-3103.html),[smb-vuln-ms06-025](https://nmap.org/nsedoc/scripts/smb-vuln-ms06-025.html),[smb-vuln-ms07-029](https://nmap.org/nsedoc/scripts/smb-vuln-ms07-029.html),[smb-vuln-ms08-067](https://nmap.org/nsedoc/scripts/smb-vuln-ms08-067.html),[smb-vuln-ms10-054](https://nmap.org/nsedoc/scripts/smb-vuln-ms10-054.html),[smb-vuln-ms10-061](https://nmap.org/nsedoc/scripts/smb-vuln-ms10-061.html),[smb-vuln-regsvc-dos](https://nmap.org/nsedoc/scripts/smb-vuln-regsvc-dos.html),[snmp-hh3c-logins](https://nmap.org/nsedoc/scripts/snmp-hh3c-logins.html),[snmp-info](https://nmap.org/nsedoc/scripts/snmp-info.html),[ssl-ccs-injection](https://nmap.org/nsedoc/scripts/ssl-ccs-injection.html),[ssl-date](https://nmap.org/nsedoc/scripts/ssl-date.html),[ssl-dh-params](https://nmap.org/nsedoc/scripts/ssl-dh-params.html),[ssl-heartbleed](https://nmap.org/nsedoc/scripts/ssl-heartbleed.html),[ssl-poodle](https://nmap.org/nsedoc/scripts/ssl-poodle.html),[sstp-discover](https://nmap.org/nsedoc/scripts/sstp-discover.html),[supermicro-ipmi-conf](https://nmap.org/nsedoc/scripts/supermicro-ipmi-conf.html),[targets-ipv6-map4to6](https://nmap.org/nsedoc/scripts/targets-ipv6-map4to6.html),[targets-ipv6-wordlist](https://nmap.org/nsedoc/scripts/targets-ipv6-wordlist.html),[targets-xml](https://nmap.org/nsedoc/scripts/targets-xml.html),[teamspeak2-version](https://nmap.org/nsedoc/scripts/teamspeak2-version.html),[tls-nextprotoneg](https://nmap.org/nsedoc/scripts/tls-nextprotoneg.html),[tor-consensus-checker](https://nmap.org/nsedoc/scripts/tor-consensus-checker.html),[traceroute-geolocation](https://nmap.org/nsedoc/scripts/traceroute-geolocation.html),[unittest](https://nmap.org/nsedoc/scripts/unittest.html),[ventrilo-info](https://nmap.org/nsedoc/scripts/ventrilo-info.html),[weblogic-t3-info](https://nmap.org/nsedoc/scripts/weblogic-t3-info.html),[whois-domain](https://nmap.org/nsedoc/scripts/whois-domain.html),[xmlrpc-methods](https://nmap.org/nsedoc/scripts/xmlrpc-methods.html)NSE became the tool of choice for rapid vulnerability scanning with the advent of celebrity vulnerabilities in 2014. NSE scripts have you covered for Heartbleed (

[ssl-heartbleed](https://nmap.org/nsedoc/scripts/ssl-heartbleed.html)), Shellshock ([http-shellshock](https://nmap.org/nsedoc/scripts/http-shellshock.html)), POODLE ([ssl-poodle](https://nmap.org/nsedoc/scripts/ssl-poodle.html)), Misfortune Cookie ([http-vuln-misfortune-cookie](https://nmap.org/nsedoc/scripts/http-vuln-misfortune-cookie.html)), LOGJAM ([ssl-dh-params](https://nmap.org/nsedoc/scripts/ssl-dh-params.html)), Stuxnet ([smb-vuln-ms10-061](https://nmap.org/nsedoc/scripts/smb-vuln-ms10-061.html)), and even Slowloris ([http-slowloris-check](https://nmap.org/nsedoc/scripts/http-slowloris-check.html)). Of course if you're also worried about less-celebrated vulnerabilities, the other 41 new["vuln"-category](https://nmap.org/nsedoc/categories/vuln.html)scripts should keep you busy.NSE joins the rest of Nmap in being able to output parseable XML. Instead of just a text blob in

[Nmap's XML output](https://nmap.org/book/output-formats-xml-output.html), scripts can now return[structured information](https://nmap.org/book/nse-api.html#nse-structured-output)that can be quickly extracted with an XML parser. All new scripts produce structured output, most older scripts have been converted, and any script using the[vulns library](https://nmap.org/nsedoc/lib/vulns.html)is automatically upgraded.The venerable RPC grinder which used to run with -sV is now an NSE script:

[rpc-grind](https://nmap.org/nsedoc/scripts/rpc-grind.html). This allowed us to cull a bunch of old C code in favor of more maintainable Lua, as well as make a noticeable improvement in scanning speed, all while using a fifth of the number of code lines.HTTP and web scanning continued to dominate our NSE development. Over a third (57) of our new scripts were HTTP-related. Exceptionally exciting is the addition of NTLM authentication to the http library, which means

[http-brute](https://nmap.org/nsedoc/scripts/http-brute.html)can bruteforce Windows passwords, too. Script highlights include:[http-slowloris](https://nmap.org/nsedoc/scripts/http-slowloris.html)exploits a resource exhaustion denial-of-service in Apache and similar webservers, based on the 6-year-old Slowloris attack script from RSnake.[http-fetch](https://nmap.org/nsedoc/scripts/http-fetch.html)acts a bit like a multi-target curl or wget, fetching the files you specify from every discovered webserver.[http-server-header](https://nmap.org/nsedoc/scripts/http-server-header.html)grabs the Server header from webservers and uses it to fill in service version information if -sV failed to find a match.[http-webdav-scan](https://nmap.org/nsedoc/scripts/http-webdav-scan.html)detects WebDAV servers and grabs a directory listing.-
[http-cross-domain-policy](https://nmap.org/nsedoc/scripts/http-cross-domain-policy.html),[http-csrf](https://nmap.org/nsedoc/scripts/http-csrf.html),[http-dombased-xss](https://nmap.org/nsedoc/scripts/http-dombased-xss.html),[http-phpself-xss](https://nmap.org/nsedoc/scripts/http-phpself-xss.html), and[http-stored-xss](https://nmap.org/nsedoc/scripts/http-stored-xss.html)check for various generic Web vulnerabilities. Similarly,[http-errors](https://nmap.org/nsedoc/scripts/http-errors.html)checks for server-side bugs resulting in HTTP error codes.

Oops, there was a vulnerability in one of our NSE scripts. If you ran the (fortunately non-default)

[http-domino-enum-passwords](https://nmap.org/nsedoc/scripts/http-domino-enum-passwords.html)script with the (fortunately also non-default) domino-enum-passwords.idpath parameter against a malicious server, it could cause an arbitrarily named file to to be written to the client system. Thanks to Trustwave researcher Piotr Duszynski for discovering and reporting the problem. We've fixed that script, and also updated several other scripts to use a new stdnse.filename_escape function for extra safety. This broke our record of never having a vulnerability in the 16 years that Nmap has existed, but that's still a fairly good run!NSE libraries allow scripts to share code. In addition to the usual set of protocol helpers, some interesting additions include the LPeg parsing expression grammar library, a "ls" library for formatting directory listings, the "slaxml" XML parser, a pure-Lua Unicode library, and a unittest library currently used by 6 other libraries.

[anyconnect](https://nmap.org/nsedoc/lib/anyconnect.html),[base32](https://nmap.org/nsedoc/lib/base32.html),[bjnp](https://nmap.org/nsedoc/lib/bjnp.html),[cassandra](https://nmap.org/nsedoc/lib/cassandra.html),[eigrp](https://nmap.org/nsedoc/lib/eigrp.html),[formulas](https://nmap.org/nsedoc/lib/formulas.html),[ike](https://nmap.org/nsedoc/lib/ike.html),[isns](https://nmap.org/nsedoc/lib/isns.html),[jdwp](https://nmap.org/nsedoc/lib/jdwp.html),[lfs](https://nmap.org/nsedoc/lib/lfs.html),[lpeg](https://nmap.org/nsedoc/lib/lpeg.html),[lpeg-utility](https://nmap.org/nsedoc/lib/lpeg-utility.html),[ls](https://nmap.org/nsedoc/lib/ls.html),[ospf](https://nmap.org/nsedoc/lib/ospf.html),[rdp](https://nmap.org/nsedoc/lib/rdp.html),[re](https://nmap.org/nsedoc/lib/re.html),[slaxml](https://nmap.org/nsedoc/lib/slaxml.html),[tls](https://nmap.org/nsedoc/lib/tls.html),[unicode](https://nmap.org/nsedoc/lib/unicode.html),[unittest](https://nmap.org/nsedoc/lib/unittest.html)

### Mature IPv6 Support

It came as no surprise when ARIN ran out of IPv4 addresses this year, and Nmap was already riding the wave to full IPv6 deployment. Nmap has supported IPv6 in some way since 2002, but improvements keep coming:

**Idle scan**is now supported with IPv6. IPv6 packets don't usually come with fragment identifiers like IPv4 packets do, so new techniques had to be developed to make idle scan possible. The implementation is by Mathias Morbitzer, who made it the subject of his master's thesis.Unicast

**CIDR-style IPv6 range scanning**is now supported, so you can specify targets such as "en.wikipedia.org/120". Obviously it will take ages if you specify a huge space. For example, a /64 contains 18,446,744,073,709,551,616 addresses.In addition to ensuring IPv6 support in the majority of

**NSE scripts**, Nmap 7 adds several IPv6-specific scripts for advanced host discovery and even denial-of-service:[dns-ip6-arpa-scan](https://nmap.org/nsedoc/scripts/dns-ip6-arpa-scan.html)performs a quick reverse-DNS lookup of an IPv6 network using a technique which analyzes DNS server response codes to dramatically reduce the number of queries needed to enumerate large networks.[targets-ipv6-wordlist](https://nmap.org/nsedoc/scripts/targets-ipv6-wordlist.html)preys on the tendency of human network operators to use the enormous IPv6 address space and the hexadecimal alphabet to assign addresses that form words like "dead:beef". The wordlist is configurable, and the results are surprising![targets-ipv6-map4to6](https://nmap.org/nsedoc/scripts/targets-ipv6-map4to6.html)similarly searches for manually configured addresses that correspond to a smaller range of IPv4 addresses that may be assigned to the same network.[ipv6-ra-flood](https://nmap.org/nsedoc/scripts/ipv6-ra-flood.html)generates a flood of Router Advertisements (RA) with random source MAC addresses and IPv6 prefixes. Computers, which have stateless autoconfiguration enabled by default (every major OS), will start to compute IPv6 suffix and update their routing table to reflect the accepted announcement. This will cause 100% CPU usage on Windows and platforms, preventing to process other application requests.

Nmap's

**parallel reverse-DNS resolver**now handles IPv6 addresses. GSoC 2015 student Gioacchino Mazzurco rewrote the old C-style DNS code in beautiful C++ and a test suite, then fuzzed the living daylights out of it with[afl](http://lcamtuf.coredump.cx/afl/). In addition to being very safe, this should result in faster -6 scans.**IPv6 OS fingerprinting**is improved, thanks to the efforts of Mathias Morbitzer and Alexandru Geana. Building on Mathias's research into new IPv6 OS fingerprinting methods, Alexandru spent the spring and summer of 2015 testing and adding features to our machine learning OS classifier. Using IPv6 guessed initial Hop Limit (analogous to IPv4's TTL) and the ratio of TCP initial window size to Maximum Segment Size (MSS), the classifier now matches with more confidence than ever. He also completed an extension of the classifier's training process to impute missing values from dropped or filtered packets, which lets Nmap make better guesses when network conditions are poor.Nmap's

**advanced traceroute**is no longer limited to just using ICMP and TCP for tracing IPv6 hosts. The IPv6 --traceroute option is now equivalent to the IPv4 version and capable of using UDP, SCTP, and IPProto (Next Header) probes.

### SSL/TLS scanning *par excellence*

SSL 3 deprecation, SHA-1 certificate deprecation, Heartbleed, CCS injection, POODLE, LOGJAM, FREAK, and RC4 deprecation—Secure Sockets Layer (SSL) and its successor, Transport Layer Security (TLS), have received a lot of attention in the past few years for security problems, and Nmap has emerged as the gold standard scanning tool for these issues.

One of our most popular NSE scripts is

[ssl-enum-ciphers](https://nmap.org/nsedoc/scripts/ssl-enum-ciphers.html), which enumerates SSL/TLS protocol versions (SSL 3 deprecation!) and ciphersuites (RC4 deprecation and weak export ciphers!). It has been enhanced beyond the old behavior of simply reporting "weak" or "strong" for each ciphersuite—it now scores each handshake using guidance from Qualys SSL Labs and taking into account server certificate strength, Diffie-Hellman parameter size, and encryption bit strength. It can safely scan the most finicky of SSL servers, safely negotiating long handshake intolerance issues and fragmented TLS messages. And it can run independently of version scan, since it is now capable of detecting TLS on unusual ports on its own.Detection of SSL and TLS by -sV

[has been boosted](http://seclists.org/nmap-dev/2015/q2/17)by including more popular TLS ports in the default lists and adding a new TLS-only service probe. Also, NSE scripts can now do TLS checks against LDAP, IMAP, and POP3 services which support STARTTLS (FTP, SMTP, and XMPP were already supported).At the core of our TLS NSE scripts is the new

[tls](https://nmap.org/nsedoc/lib/tls.html)library, which enables quick development of robust scripts for checking vulnerabilities ([ssl-heartbleed](https://nmap.org/nsedoc/scripts/ssl-heartbleed.html),[ssl-poodle](https://nmap.org/nsedoc/scripts/ssl-poodle.html),[ssl-ccs-injection](https://nmap.org/nsedoc/scripts/ssl-ccs-injection.html),[ssl-dh-params](https://nmap.org/nsedoc/scripts/ssl-dh-params.html)) or reporting configurations ([tls-nextprotoneg](https://nmap.org/nsedoc/scripts/tls-nextprotoneg.html),[ssl-date](https://nmap.org/nsedoc/scripts/ssl-date.html)).

### Zenmap graphical front-end and results viewer

[Zenmap](https://nmap.org/zenmap/) is our cross-platform (Linux,
Windows, Mac OS X, etc.) Nmap GUI and results viewer. It aims to provide
advanced features for experienced Nmap users while also making Nmap easier for
beginners to use. Frequently used scans can be saved as profiles to make them
easy to run repeatedly. A command creator allows interactive creation of Nmap
command lines. Scan results can be saved and viewed later, or even compared with
one another to see how they differ. Our
[network topology viewer](https://nmap.org/book/zenmap-topology.html)
allows for interactive exploration of a network scanned with Nmap. Zenmap is now
a mature tool, but it still got several enhancements since 6.00:

Zenmap features a

[full translation capability](https://nmap.org/book/zenmap-lang.html)for all menus, labels, buttons, and messages. Translations are available for 11 languages, including new Italian, Japanese, Polish, Chinese, and Hindi translations. The German and French translations were also updated.Support for large scans has drastically improved. We solved a CPU usage bug in opening large files and prevented the most common cause of out-of-memory problems by dropping the scrolling output window if it becomes a problem. Don't worry! The output is still saved to disk. Additionally, scans which have a lot of anonymous (unresponsive) traceroute hops will take up less space on the Topology page, since Zenmap will now assume hops at the same distance are the same device.

Zenmap's display can filter hosts based on OS, ports, hostnames, and other criteria. Since 6.00 we also added negative matching, so you can exclude Windows systems for example with "os:!windows".

Another sign of a maturing codebase, we've enabled unittest discovery in Zenmap, so running "make check" will run most of the existing Zenmap tests. Watch for more improvements in this area in upcoming versions!


### Ncat

[Ncat](https://nmap.org/ncat/) is a feature-packed networking
utility which reads and writes data across networks from the command line. Ncat
was written for the Nmap Project as a much-improved reimplementation of the
venerable [Netcat](http://sectools.org/tool/netcat/). It uses both
TCP and UDP for communication and is designed to be a reliable back-end tool to
instantly provide network connectivity to other applications and users. Ncat
will not only work with IPv4 and IPv6 but provides the user with a virtually
limitless number of potential uses.

We are excited and proud to announce that Ncat has been adopted by the Red Hat/Fedora family of distributions as the default package to provide the "netcat" and "nc" commands! This cooperation has resulted in a lot of squashed bugs and enhanced compatibility with Netcat's options.

Some of the most exciting changes in Ncat 7 are:

Ncat now features an embedded Lua interpreter! Similar to the Nmap Scripting Engine, the "--lua-exec" option makes it easy to write simple traffic filters and daemons in easy-to-learn

[Lua](http://www.lua.org/). A collection of example scripts, including a simple HTTP server, is included with the Ncat source.Ncat now supports Unix domain sockets (named pipes) on systems where those sockets are available. This is another Netcat compatibility enhancement, and it makes testing of Unix local services possible with Ncat.

Ncat's proxy support was extended to support SOCKS5 with authentication.

More compatibility corrections resulted in correct handling of EOF on all sockets, whether running as a client or as a server. The new --no-shutdown option keeps Ncat up and receiving network input after stdin is closed, just like traditional netcat's -d option.


### Infrastructure Improvements

Keeping the Nmap project vibrant and productive (for developers and users) requires constant investment in our development. Improvements to Nmap's development and support infrastructure since Nmap 6 include:

The

[Nmap.org](https://nmap.org/)web site is now 100% HTTPS. This gives our users much-needed protection when downloading Nmap source and binary releases or submitting new service and OS fingerprints. Also, the GNU Mailman subscription pages for the[Nmap-Announce](https://nmap.org/mailman/listinfo/announce),[Nmap-Dev](https://nmap.org/mailman/listinfo/dev), and[Full Disclosure](https://nmap.org/mailman/listinfo/fulldisclosure)mailing lists are hosted on Nmap.org and HTTPS-protected, so your subscription settings are safe, too.The Nmap Project has fully embraced

[Github Issues](https://github.com/nmap/nmap/issues/)as its bug tracking solution. The Nmap-Dev mailing list is still going strong for discussion of Nmap development issues, but for user-submitted bug reports and enhancement requests, Github is the place to be. We also encourage code submissions to be made as Github pull requests. Even though the Github repo is still a read-only mirror of our authoritative[Subversion repository](https://nmap.org/book/install.html#inst-svn), Github offers a great code review and discussion interface, as well as integrated code-quality-checking tools. As a convenience,[issues.nmap.org](http://issues.nmap.org)is a redirector for issue numbers:[http://issues.nmap.org/229](http://issues.nmap.org/229)for example.On the subject of code quality, Nmap now integrates with Travis CI for continuous integration testing. If the build breaks, Nmap developers are notified immediately. Code contributions made as Github pull requests are automatically checked for build breakage, too. This is made possible by a concerted effort to enable "make check" to actually check and test Nmap code. So far, "make check" enables:

- Ncat test suite
- Nsock test suite
- Zenmap auto-discovered unit tests
- NSE tests through the
[unittest](https://nmap.org/nsedoc/scripts/unittest.html)NSE script - Ndiff tests
- Nmap's reverse-DNS engine test suite

Nmap's

[changelog page](https://nmap.org/changelog.html)is now displayed in linked and cross-referenced HTML, instead of as a simple dump of the CHANGELOG text file. URLs, issue numbers, script names, and NSE library names are all linked to the appropriate pages.[SecWiki.org](https://secwiki.org/)continues to be used by the Nmap development team for documentation and collaboration on long-term projects. Some popular pages are[Nmap Code Standards](https://secwiki.org/w/Nmap/Code_Standards),[Nmap on Android](https://secwiki.org/w/Nmap/Android),[NSE Script Ideas](https://secwiki.org/w/Nmap/Script_Ideas), and the[Nmap FAQ pages](https://secwiki.org/w/Nmap_FAQ).

### IPv4 Operating System Detection

Thanks to fingerprint submissions from thousands of Nmap users around the
world, our [remote operating system
detection system](https://nmap.org/book/osdetect.html) grew from 3572 signatures in Nmap 6 to 4985 now. These
include the latest versions of Windows, Linux, and Mac OS X as well as more
specialized entries such as PLCs, lightbulbs, televisions, mainframes, and much
more. Some of the newest fingerprints are for Apple iOS 9, Android 5.1, OpenBSD
5.7, FreeBSD 11.0, and a ton of new WAPs, switches, printers, and other
devices.

In addition to more than 1400 new fingerprints, we made several important performance improvements and bug fixes to the system. Most notably, if version detection determines a port to be "tcpwrapped," OS detection will prefer to use a different port for probing, since there's a good chance this is the result of a firewall interfering with TCP connections on that port.

### Version Detection

The days when we could assume what was running on an open port based on the
port number are long gone. These days, folks commonly run services on the
"wrong" port numbers in order to defeat filtering policies, hide traffic, or
work around various networking problems. Fortunately, Nmap's [version detection system](https://nmap.org/book/vscan.html) is able to
interrogate the service listening on the open port and tell you the service
running as well as (in many cases) the application name and version number.
Nmap 6 had an impressive 8165 signatures matching 862 protocols, but Nmap 7
improves that to a whopping 10299 signatures for 1091 protocols!

Additionally, Nmap 7 has 23 more service probes to pull information from remote services and more than double the number of softmatch lines (103), which help short-circuit the probing process to send the most-likely probes for the detected service.

### Performance Improvements

In Nmap's 18-year history, performance has always been a top priority. Whether scanning one target or 20 million, users want scans to run as fast as possible without sacrificing accuracy. Improvements since Nmap 6 include:

For scans of targets that use different routes or interfaces, Nmap may now partially rearrange its target list for more efficient host groups. Previously, a single target with a different interface, or with an IP address the same as a that of a target already in the group, would cause the group to be broken off at whatever size it was. Now, we buffer a small number of such targets, and keep looking through the input for more targets to fill out the current group.

Timeouts for many NSE scripts were reduced from tens of seconds to use a scaled timeout based on Nmap's portscan-phase timing determinations. A simple library function,

[stdnse.get_timeout](https://nmap.org/nsedoc/lib/stdnse.html#get_timeout), makes it easy for new script authors to do the same.Version scan is quicker now because of 56 more softmatch lines that prevent Nmap from sending irrelevant probes to certain services. Also, NSE scripts in the

[version category](https://nmap.org/nsedoc/categories/version.html)now obey the version intensity setting, so using an option like --version-light will prevent nearly all of these heavy-duty version probing scripts from running (unless you choose them by name).The old RPC Grinder, which used the original pos_scan engine from 1998, has been replaced by a much faster NSE script implementation. Scan times for version scanning (-sV) ought to improve greatly.

New poll and kqueue Nsock engines allow for increased socket performance in Nsock-based scan phases (NSE and version scanning) on Windows, OS X, and BSD-derived systems that previously had to use the old select-based engine. Linux has had an epoll engine since Nmap 6.00.


### Even More Improvements

In addition to the pages of changes listed above, we made many improvements which defy simple categorization:

The oft-requested

**--exclude-ports**option has now been implemented! Easily avoid scanning off-limits or troublesome ports, without constructing complicated port ranges to avoid them. Safely integrates with -p, -F, and --top-ports.Nsock (and by extension Nmap's -sV and NSE) now supports connecting through chained proxies. Nmap adds the

**--proxies**option to specify this proxy chain. While port scanning is not yet included, GSoC student and mentor Jacek Wielemborek has done groundbreaking work towards implementing TCP Connect scan in Nsock, so stay tuned!Instead of simply appending random data to Nmap scan packets with --data-length, try sending a message with the

**--data-string**or**--data**options. Safely attribute your research or taunt your foes—it's up to you.Though in most cases ARP ping is the stealthiest, fastest, and most reliable host discovery method, you can now force the usual layer-3 discovery probes with the

**--disable-arp-ping**option. This is useful in networks using proxy ARP, which make all addresses appear to be up using ARP scan. The previously recommended workaround for this situation, --send-ip, didn't work on Windows it is still missing raw socket support.For raw packet scans (i.e. not -sT), Nmap now reports the TTL of recieved packets in the Normal output if the --reason option is used. This was previously only available in the XML output, but is useful for detecting interfering firewalls in some cases. Additionally, --reason is enabled at verbosity 2 and higher.

Fixed a bug which caused Nmap to be unable to have any runtime interaction when called from sudo or from a shell script on Linux. This was especially appreciated on Debian-based systems where Nmap is usually invoked with sudo.

The beloved Nmap ASCII Dragon configure art now shares its spot with two other ASCII art pieces. Which one you get when you run ./configure is randomly chosen. Immediately below the art is a summary of what configure options were chosen, including a warning if OpenSSL could not be found and you didn't explicitly disable it.

[Nping](https://nmap.org/nping/)now checks for a matching ICMP ID to avoid colliding with other running ping processes.

These are all just highlights from the full list of changes you can
find in [our CHANGELOG](https://nmap.org/changelog.html).

## Moving Forward (Future Plans)

With this stable version out of the way, we are diving headfirst into the next development cycle. Many exciting features are in the queue, including:

A modern upgrade to the aging WinPcap is coming! We already have a working replacement called

[Npcap](https://github.com/nmap/npcap)developed by GSoC student Yang Luo that is updated to use the NDIS 6 API and LWF. Cooperating with the WinPcap group, we can be sure that these improvements will be available in Nmap very soon.Nmap on mobile devices is already a reality for Android, but we want to expand support to other mobile platforms and perhaps develop a really useful app interface, since console applications tend to be difficult to use on those tiny screens.

We are always working on improving performance, and you can expect we will deliver. Nmap's --min-rate option has the potential to scale to Internet-wide scans, and we intend to benchmark and demonstrate this ability. More large-scale scanning research should help us improve the port popularity rankings and fine-tune Nmap's internals for optimum performance.

It doesn't take a Nostrodamus to predict that NSE will continue to expand at a blinding pace. We have dozens of NSE scripts waiting in the wings, and pages of ideas for new ones. Maybe your name will grace our CHANGELOG as a script author in the next release!


You can read more of our short-term and longer-term plans from our
[public TODO list](https://svn.nmap.org/nmap/todo/nmap.txt).

For the latest Insecure.Org and Nmap announcements, join the 117,175-member
Nmap-announce announcement list. Traffic rarely exceeds one message per month.
[Subscribe here](https://nmap.org/mailman/listinfo/announce)
or [read the archives at SecLists.Org](http://seclists.org).
To participate in Nmap development, join the (high traffic)
[nmap-dev list](https://nmap.org/mailman/listinfo/dev). You can also
follow us on [Twitter](https://twitter.com/nmap),
[Facebook](https://www.facebook.com/nmap),
or [Google+](https://plus.google.com/+nmap).

## Acknowledgments

A free open source scanner as powerful as Nmap is only possible
thanks to the help of hundreds of developers and other contributors.
We would like to acknowledge and thank the many people who contributed
ideas and/or code since Nmap 6.00. Special thanks go out to:
**Adam Saponara**, **Adam Števko**,
**Aleksandar Nikolic**, **Alessandro Zanni**,
**Alexandru Geana**, **Alexey Meshcheryakov**,
**Alex Weber**, **Andreas Stieger**, **Andrew Farabee**, **Andrew Orr**,
**Andrew Waters**, **Andrey Olkhin**, **Ange Gutek**,
**Arturo Busleiman**, **Bill Parker**,
**Brad Johnson**, **Brandon Paulsen**,
**Brendan Coles**, **Chris Johnson**, **Chris Leick**,
**Claudio Criscione**, **Claudiu Perta**,
**Daniel Miller**, **Danila Poyarkov**,
**David Fifield**, **David Matousek**,
**Dhiru Kholia**, **Didier Stevens**,
**Dillon Graham**, **Djalal Harouni**,
**Dominik Schneider**, **Edward Napierała**,
**Elon Natovich**, **Eric Davisson**, **Forrest B.**,
**Fyodor**, **George Chatzisofroniou**, **Gioacchino Mazzurco**
**Giovanni Bechis**, **Greg Bailey**,
**Gyanendra Mishra**, **Hani Benhabiles**, **hejianet**,
**Henri Doreau**, **Jacek Wielemborek**,
**Jan Reister**, **Jacob Gajek**, **jah**,
**Jay Bosamiya**, **Jesper Kückelhahn**, **Jiayi Ye**,
**Joachim Henke**, **John Bond**, **John Spencer**,
**Jonathan Daugherty**, **jrchamp**, **Justin Cacak**,
**Kurt Grutzmacher**, **Marek Lukaszuk**,
**Marek Majkowski**, **Marin Maržić**,
**Mariusz Ziulek**, **Mathias Morbitzer**,
**Michael McTernan**, **Michael Meyer**,
**Michael Schierl**, **Michael Toecker**,
**Michael Wallner**, **Michal Hlavinka**,
**Nicolle Neulist**, **Niklaus Schiess**, **nnposter**,
**Olli Hauer**, **Patrick Donnelly**,
**Patrik Karlsson**, **Paul AMAR**, **Paul Hemberger**,
**Paulino Calderon**, **Pavel Kankovsky**,
**Peter Malecka**, **Petr Stodulka**,
**Philip Pickering**, **Pierluigi Vittori**,
**Pierre Lalet**, **Piotr Olma**, **Pontus Andersson**,
**Quentin Glidic**, **Raphael Hoegger**,
**Raúl Fuentes**, **riemann**, **Rob Nicholls**,
**Robin Wood**, **Ron Bowes**, **Sean Rivera**,
**Simon John**, **Soldier of Fortran**,
**Stephen Hilt**, **Tilik Ammon**, **Tom Sellers**,
**Tomas Hozza**, **Tyler Wagner**, **Ulrik Haugen**,
**Vasily Kulikov**, and **Vlatko Kosturjak**.

We would also like to thank the thousands of people who have submitted OS and service/version fingerprints, as well as everyone who has found and reported bugs or suggested features.

Special thanks go to Google, who has sponsored 73 students (total over the
last 11 years) to spend a summer working on Nmap as part of Google's
[Summer of Code program](https://developers.google.com/open-source/gsoc/).
This summer, we had a team of five amazing students who contributed mightily to
make Nmap even more powerful. We encourage you to
[read this year's project summary](http://seclists.org/nmap-announce/2015/4) to learn more.

## Download and Updates

Nmap is available for download from
[https://nmap.org/download.html](https://nmap.org/download.html)
in source and binary form. Nmap is free, open source software
([license](https://nmap.org/data/COPYING)).

To learn about Nmap announcements as they happen, subscribe to nmap-announce! It is a very low volume (7 messages so far in 2015), moderated list for announcements about Nmap, Insecure.org, and related projects. You can join the 117,175 current subscribers by submitting your e-mail address below.

Nmap-announce is archived at [SecLists.org](http://seclists.org) and has an [RSS feed](http://seclists.org/rss/nmap-announce.rss). To participate in Nmap
development, join the (high traffic)
[nmap-dev list](https://nmap.org/mailman/listinfo/dev) as well.

You are also encouraged to follow [@nmap on Twitter](http://twitter.com/nmap) and check out [our Facebook page](http://facebook.com/nmap):

Direct questions or comments to Fyodor
([fyodor@nmap.org](mailto:fyodor@nmap.org)).
Report any bugs as
[described here](https://nmap.org/man/man-bugs.html).