recog 2.3.22 → 2.3.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ci.yml +1 -1
  3. data/.github/workflows/verify.yml +1 -1
  4. data/.vscode/bin/monitor-recog-fingerprints.sh +54 -0
  5. data/.vscode/extensions.json +5 -0
  6. data/.vscode/settings.json +8 -0
  7. data/.vscode/tasks.json +77 -0
  8. data/CONTRIBUTING.md +2 -0
  9. data/bin/recog_verify +42 -7
  10. data/cpe-remap.yaml +20 -2
  11. data/features/data/schema_failure.xml +4 -0
  12. data/features/data/tests_with_failures.xml +6 -0
  13. data/features/support/hooks.rb +9 -0
  14. data/features/verify.feature +81 -17
  15. data/identifiers/hw_device.txt +2 -0
  16. data/identifiers/hw_product.txt +2 -0
  17. data/identifiers/os_device.txt +2 -0
  18. data/identifiers/os_family.txt +1 -0
  19. data/identifiers/os_product.txt +8 -1
  20. data/identifiers/service_product.txt +14 -0
  21. data/identifiers/vendor.txt +13 -1
  22. data/lib/recog/fingerprint.rb +21 -7
  23. data/lib/recog/fingerprint_parse_error.rb +10 -0
  24. data/lib/recog/verifier.rb +4 -4
  25. data/lib/recog/verify_reporter.rb +7 -6
  26. data/lib/recog/version.rb +1 -1
  27. data/requirements.txt +1 -1
  28. data/spec/data/external_example_fingerprint/hp_printer_ex_01.txt +1 -0
  29. data/spec/data/external_example_fingerprint/hp_printer_ex_02.txt +1 -0
  30. data/spec/data/external_example_fingerprint.xml +8 -0
  31. data/spec/data/external_example_illegal_path_fingerprint.xml +7 -0
  32. data/spec/lib/recog/db_spec.rb +84 -61
  33. data/spec/lib/recog/fingerprint_spec.rb +4 -4
  34. data/spec/lib/recog/verify_reporter_spec.rb +8 -8
  35. data/update_cpes.py +129 -36
  36. data/xml/apache_os.xml +61 -19
  37. data/xml/architecture.xml +15 -1
  38. data/xml/dhcp_vendor_class.xml +1 -1
  39. data/xml/dns_versionbind.xml +16 -13
  40. data/xml/favicons.xml +87 -5
  41. data/xml/fingerprints.xsd +9 -1
  42. data/xml/ftp_banners.xml +131 -141
  43. data/xml/h323_callresp.xml +2 -2
  44. data/xml/hp_pjl_id.xml +81 -81
  45. data/xml/html_title.xml +178 -9
  46. data/xml/http_cookies.xml +83 -27
  47. data/xml/http_servers.xml +409 -269
  48. data/xml/http_wwwauth.xml +70 -37
  49. data/xml/imap_banners.xml +2 -2
  50. data/xml/nntp_banners.xml +8 -5
  51. data/xml/ntp_banners.xml +33 -33
  52. data/xml/operating_system.xml +92 -77
  53. data/xml/pop_banners.xml +17 -17
  54. data/xml/sip_banners.xml +16 -5
  55. data/xml/sip_user_agents.xml +122 -27
  56. data/xml/smb_native_lm.xml +5 -5
  57. data/xml/smb_native_os.xml +25 -25
  58. data/xml/smtp_banners.xml +132 -131
  59. data/xml/smtp_help.xml +1 -1
  60. data/xml/snmp_sysdescr.xml +1227 -1227
  61. data/xml/snmp_sysobjid.xml +2 -2
  62. data/xml/ssh_banners.xml +9 -5
  63. data/xml/telnet_banners.xml +49 -0
  64. data/xml/tls_jarm.xml +22 -2
  65. data/xml/x11_banners.xml +3 -3
  66. data/xml/x509_issuers.xml +3 -2
  67. data/xml/x509_subjects.xml +3 -3
  68. metadata +19 -3
  69. data/lib/recog/verifier_factory.rb +0 -13
data/xml/http_wwwauth.xml CHANGED
@@ -289,7 +289,7 @@
289
289
 
290
290
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(?:SmartAX )?(MT\d+[^ ]*)(?: ADSL Router)?&quot;$">
291
291
  <description>Huawei xDSL routers</description>
292
- <example hw.product="MT882">Basic realm="SmartAX MT882"</example>
292
+ <example hw.product="MT882" service.product="MT882" os.product="MT882">Basic realm="SmartAX MT882"</example>
293
293
  <param pos="0" name="service.vendor" value="Huawei"/>
294
294
  <param pos="0" name="service.family" value="MT"/>
295
295
  <param pos="1" name="service.product"/>
@@ -322,10 +322,10 @@
322
322
 
323
323
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(WRT54G\w*)&quot;$">
324
324
  <description>Linksys WRT54G wireless access point (dozen of variants of the product)</description>
325
- <example hw.product="WRT54G">Basic realm="WRT54G"</example>
326
- <example hw.product="WRT54GL">Basic realm="WRT54GL"</example>
327
- <example hw.product="WRT54GSV4">Basic realm="WRT54GSV4"</example>
328
- <example hw.product="WRT54GCv3">Basic realm="WRT54GCv3"</example>
325
+ <example hw.product="WRT54G" os.product="WRT54G">Basic realm="WRT54G"</example>
326
+ <example hw.product="WRT54GL" os.product="WRT54GL">Basic realm="WRT54GL"</example>
327
+ <example hw.product="WRT54GSV4" os.product="WRT54GSV4">Basic realm="WRT54GSV4"</example>
328
+ <example hw.product="WRT54GCv3" os.product="WRT54GCv3">Basic realm="WRT54GCv3"</example>
329
329
  <param pos="0" name="os.vendor" value="Linksys"/>
330
330
  <param pos="0" name="os.device" value="WAP"/>
331
331
  <param pos="1" name="os.product"/>
@@ -336,9 +336,9 @@
336
336
 
337
337
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD-[VW8][A-Z0-9]+)(?:| \d+\.\d+)&quot;$">
338
338
  <description>TP-LINK SoHo Router - dash variant</description>
339
- <example os.product="TD-W8901G">Basic realm="TD-W8901G"</example>
340
- <example>Basic realm="TD-8840T 2.0"</example>
341
- <example hw.product="TD-8811">Basic realm="TD-8811"</example>
339
+ <example os.product="TD-W8901G" hw.product="TD-W8901G">Basic realm="TD-W8901G"</example>
340
+ <example os.product="TD-8840T" hw.product="TD-8840T">Basic realm="TD-8840T 2.0"</example>
341
+ <example hw.product="TD-8811" os.product="TD-8811">Basic realm="TD-8811"</example>
342
342
  <param pos="0" name="os.vendor" value="TP-LINK"/>
343
343
  <param pos="0" name="os.device" value="Router"/>
344
344
  <param pos="1" name="os.product"/>
@@ -349,10 +349,10 @@
349
349
 
350
350
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;(TD8[A-Z0-9]+)&quot;$">
351
351
  <description>TP-LINK SoHo Router</description>
352
- <example os.product="TD854W">Basic realm="TD854W"</example>
353
- <example hw.product="TD811">Basic realm="TD811"</example>
354
- <example>Basic realm="TD821"</example>
355
- <example>Basic realm="TD841"</example>
352
+ <example os.product="TD854W" hw.product="TD854W">Basic realm="TD854W"</example>
353
+ <example hw.product="TD811" os.product="TD811">Basic realm="TD811"</example>
354
+ <example os.product="TD821" hw.product="TD821">Basic realm="TD821"</example>
355
+ <example os.product="TD841" hw.product="TD841">Basic realm="TD841"</example>
356
356
  <param pos="0" name="os.vendor" value="TP-LINK"/>
357
357
  <param pos="0" name="os.device" value="Router"/>
358
358
  <param pos="1" name="os.product"/>
@@ -363,22 +363,22 @@
363
363
 
364
364
  <fingerprint pattern="^(?:Basic|Digest) realm=&quot;TP-LINK.*(?:Access Point|Extender|AP) ([A-Z0-9\-\+]+)&quot;">
365
365
  <description>TP-LINK SoHo Router - verbose variant</description>
366
- <example os.product="WA801N">Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
367
- <example hw.product="WA830RE">Basic realm="TP-LINK Wireless Range Extender WA830RE"</example>
368
- <example>Basic realm="TP-LINK Wireless Range Extender WA850RE"</example>
369
- <example>Basic realm="TP-LINK Wireless AP WA501G"</example>
370
- <example>Basic realm="TP-LINK Wireless N Access Point WA701ND"</example>
371
- <example>Basic realm="TP-LINK Wireless N Access Point WA901ND"</example>
372
- <example>Basic realm="TP-LINK Wireless AP WA601G"</example>
373
- <example>Basic realm="TP-LINK Wireless AP WR710N"</example>
374
- <example>Basic realm="TP-LINK Wireless AP WR700N"</example>
375
- <example>Basic realm="TP-LINK Wireless Range Extender WA750RE"</example>
376
- <example>Basic realm="TP-LINK Wireless AP WR702N"</example>
377
- <example>Basic realm="TP-LINK Wireless AP WR800N"</example>
378
- <example>Basic realm="TP-LINK Wireless Range Extender WA730RE"</example>
379
- <example>Basic realm="TP-LINK Wireless N Access Point WA805N"</example>
380
- <example>Basic realm="TP-LINK Wireless N Access Point WA701N"</example>
381
- <example>Basic realm="TP-LINK Wireless AP WR706N"</example>
366
+ <example os.product="WA801N" hw.product="WA801N">Basic realm="TP-LINK Wireless N Access Point WA801N"</example>
367
+ <example hw.product="WA830RE" os.product="WA830RE">Basic realm="TP-LINK Wireless Range Extender WA830RE"</example>
368
+ <example os.product="WA850RE" hw.product="WA850RE">Basic realm="TP-LINK Wireless Range Extender WA850RE"</example>
369
+ <example os.product="WA501G" hw.product="WA501G">Basic realm="TP-LINK Wireless AP WA501G"</example>
370
+ <example os.product="WA701ND" hw.product="WA701ND">Basic realm="TP-LINK Wireless N Access Point WA701ND"</example>
371
+ <example os.product="WA901ND" hw.product="WA901ND">Basic realm="TP-LINK Wireless N Access Point WA901ND"</example>
372
+ <example os.product="WA601G" hw.product="WA601G">Basic realm="TP-LINK Wireless AP WA601G"</example>
373
+ <example os.product="WR710N" hw.product="WR710N">Basic realm="TP-LINK Wireless AP WR710N"</example>
374
+ <example os.product="WR700N" hw.product="WR700N">Basic realm="TP-LINK Wireless AP WR700N"</example>
375
+ <example os.product="WA750RE" hw.product="WA750RE">Basic realm="TP-LINK Wireless Range Extender WA750RE"</example>
376
+ <example os.product="WR702N" hw.product="WR702N">Basic realm="TP-LINK Wireless AP WR702N"</example>
377
+ <example os.product="WR800N" hw.product="WR800N">Basic realm="TP-LINK Wireless AP WR800N"</example>
378
+ <example os.product="WA730RE" hw.product="WA730RE">Basic realm="TP-LINK Wireless Range Extender WA730RE"</example>
379
+ <example os.product="WA805N" hw.product="WA805N">Basic realm="TP-LINK Wireless N Access Point WA805N"</example>
380
+ <example os.product="WA701N" hw.product="WA701N">Basic realm="TP-LINK Wireless N Access Point WA701N"</example>
381
+ <example os.product="WR706N" hw.product="WR706N">Basic realm="TP-LINK Wireless AP WR706N"</example>
382
382
  <param pos="0" name="os.vendor" value="TP-LINK"/>
383
383
  <param pos="0" name="os.device" value="WAP"/>
384
384
  <param pos="1" name="os.product"/>
@@ -389,9 +389,9 @@
389
389
 
390
390
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;TP-LINK (.*Router.*)&quot;">
391
391
  <description>TP-LINK Routers</description>
392
- <example>Basic realm="TP-LINK Wireless N Router WR841N"</example>
393
- <example>Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
394
- <example>Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
392
+ <example hw.product="Wireless N Router WR841N">Basic realm="TP-LINK Wireless N Router WR841N"</example>
393
+ <example hw.product="Gigabit Broadband VPN Router R600VPN">Basic realm="TP-LINK Gigabit Broadband VPN Router R600VPN"</example>
394
+ <example hw.product="Wireless Lite N Router WR740N/WR741ND">Basic realm="TP-LINK Wireless Lite N Router WR740N/WR741ND"</example>
395
395
  <param pos="0" name="hw.vendor" value="TP-LINK"/>
396
396
  <param pos="0" name="hw.device" value="Router"/>
397
397
  <param pos="1" name="hw.product"/>
@@ -504,7 +504,7 @@
504
504
 
505
505
  <fingerprint pattern="(?i)^(?:Basic|Digest).*realm=&quot;ZXHN (\S+)&quot;">
506
506
  <description>ZTE ZXHN router</description>
507
- <example>Basic realm="ZXHN H108L"</example>
507
+ <example hw.product="H108L">Basic realm="ZXHN H108L"</example>
508
508
  <param pos="0" name="hw.vendor" value="ZTE"/>
509
509
  <param pos="0" name="hw.device" value="Router"/>
510
510
  <param pos="0" name="hw.family" value="ZXHN"/>
@@ -662,17 +662,41 @@
662
662
  <param pos="0" name="hw.family" value="Eurotherm"/>
663
663
  </fingerprint>
664
664
 
665
+ <fingerprint pattern="(?i)^Basic realm=&quot;TomatoUSB&quot;">
666
+ <description>TomatoUSB Router Firmware</description>
667
+ <example>Basic realm="TomatoUSB"</example>
668
+ <param pos="0" name="os.vendor" value="TomatoUSB"/>
669
+ <param pos="0" name="os.family" value="Linux"/>
670
+ <param pos="0" name="os.product" value="TomatoUSB"/>
671
+ <param pos="0" name="os.device" value="Router"/>
672
+ </fingerprint>
673
+
674
+ <fingerprint pattern="(?i)^Basic realm=&quot;FreshTomato&quot;">
675
+ <description>FreshTomato Router Firmware</description>
676
+ <example>Basic realm="FreshTomato"</example>
677
+ <param pos="0" name="os.vendor" value="FreshTomato"/>
678
+ <param pos="0" name="os.family" value="Linux"/>
679
+ <param pos="0" name="os.product" value="FreshTomato"/>
680
+ <param pos="0" name="os.device" value="Router"/>
681
+ </fingerprint>
682
+
665
683
  <!-- a variety of headers we currently just ignore -->
666
684
 
667
685
  <fingerprint pattern="(?i)^NTLM$">
668
- <description>Ignore NTLM-only</description>
686
+ <description>Ignore NTLM-only -- assert nothing</description>
669
687
  <example>NTLM</example>
670
688
  <example>Ntlm</example>
689
+ <param pos="0" name="hw.certainty" value="0.0"/>
690
+ <param pos="0" name="os.certainty" value="0.0"/>
691
+ <param pos="0" name="service.certainty" value="0.0"/>
671
692
  </fingerprint>
672
693
 
673
694
  <fingerprint pattern="^Negotiate$">
674
- <description>Ignore Negotiate-only</description>
695
+ <description>Ignore Negotiate-only -- assert nothing</description>
675
696
  <example>Negotiate</example>
697
+ <param pos="0" name="hw.certainty" value="0.0"/>
698
+ <param pos="0" name="os.certainty" value="0.0"/>
699
+ <param pos="0" name="service.certainty" value="0.0"/>
676
700
  </fingerprint>
677
701
 
678
702
  <!--
@@ -681,24 +705,33 @@
681
705
  -->
682
706
 
683
707
  <fingerprint pattern="^(?:Basic|Digest) .*realm=['&quot;](?:\/|\.|null|\/?index.html?)?['&quot;]">
684
- <description>Ignore null/empty/period/index.</description>
708
+ <description>Ignore null/empty/period/index -- assert nothing</description>
685
709
  <example>Basic realm="null"</example>
686
710
  <example>Basic realm="."</example>
687
711
  <example>Basic realm=""</example>
688
712
  <example>Basic realm="/"</example>
689
713
  <example>Basic realm='/'</example>
690
714
  <example>Basic realm="index.html"</example>
715
+ <param pos="0" name="hw.certainty" value="0.0"/>
716
+ <param pos="0" name="os.certainty" value="0.0"/>
717
+ <param pos="0" name="service.certainty" value="0.0"/>
691
718
  </fingerprint>
692
719
 
693
720
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)&quot;">
694
- <description>Ignore realms with an IPv4 address</description>
721
+ <description>Ignore realms with an IPv4 address -- assert nothing</description>
695
722
  <example>Basic realm="192.168.0.1"</example>
696
723
  <example>Digest qop="auth", realm="172.16.0.1", nonce="AAAAAAAAAAAAAP//DwHpM0IvM78=", algorithm="MD5"</example>
724
+ <param pos="0" name="hw.certainty" value="0.0"/>
725
+ <param pos="0" name="os.certainty" value="0.0"/>
726
+ <param pos="0" name="service.certainty" value="0.0"/>
697
727
  </fingerprint>
698
728
 
699
729
  <fingerprint pattern="^(?:Basic|Digest) .*realm=&quot;config&quot;">
700
- <description>Ignore generic 'config' realms</description>
730
+ <description>Ignore generic 'config' realms -- assert nothing</description>
701
731
  <example>Digest realm="config", nonce="1155041914", algorithm="MD5", qop="auth"</example>
732
+ <param pos="0" name="hw.certainty" value="0.0"/>
733
+ <param pos="0" name="os.certainty" value="0.0"/>
734
+ <param pos="0" name="service.certainty" value="0.0"/>
702
735
  </fingerprint>
703
736
 
704
737
  <!--
data/xml/imap_banners.xml CHANGED
@@ -168,8 +168,8 @@
168
168
 
169
169
  <fingerprint pattern="^(\S{1,512}) CallPilot IMAP4rev1 v(\S+) server ready\.?$">
170
170
  <description>Nortel CallPilot</description>
171
- <example>nottest.localdomain CallPilot IMAP4rev1 v42.02.05.22 server ready.</example>
172
- <example>test.localdomain CallPilot IMAP4rev1 v43.03.19.22 server ready.</example>
171
+ <example service.version="42.02.05.22" host.name="nottest.localdomain">nottest.localdomain CallPilot IMAP4rev1 v42.02.05.22 server ready.</example>
172
+ <example service.version="43.03.19.22" host.name="test.localdomain">test.localdomain CallPilot IMAP4rev1 v43.03.19.22 server ready.</example>
173
173
  <param pos="0" name="service.vendor" value="Nortel"/>
174
174
  <param pos="0" name="service.product" value="CallPilot"/>
175
175
  <param pos="2" name="service.version"/>
data/xml/nntp_banners.xml CHANGED
@@ -24,8 +24,8 @@
24
24
 
25
25
  <fingerprint pattern="^NNTP Service (?:.*) Version: (5.0.2195.[0-9]+)">
26
26
  <description>Microsoft IIS NNTP Server on Windows 2000</description>
27
- <example>NNTP Service 5.00.0984 Version: 5.0.2195.7034 Posting Allowed</example>
28
- <example>NNTP Service 5.00.0984 Version: 5.0.2195.5329 Posting Allowed</example>
27
+ <example service.version="5.0.2195.7034" ms.nttp.version="5.0.2195.7034">NNTP Service 5.00.0984 Version: 5.0.2195.7034 Posting Allowed</example>
28
+ <example service.version="5.0.2195.5329" ms.nttp.version="5.0.2195.5329">NNTP Service 5.00.0984 Version: 5.0.2195.5329 Posting Allowed</example>
29
29
  <param pos="0" name="service.vendor" value="Microsoft"/>
30
30
  <param pos="0" name="service.product" value="IIS"/>
31
31
  <param pos="0" name="service.family" value="IIS"/>
@@ -40,8 +40,8 @@
40
40
 
41
41
  <fingerprint pattern="^NNTP Service (?:.*) Version: (6.0.3790.[0-9]+)">
42
42
  <description>Microsoft IIS NNTP Server on Windows Server 2003</description>
43
- <example>NNTP Service 6.0.3790.3959 Version: 6.0.3790.3959 Posting Allowed</example>
44
- <example>NNTP Service 6.0.3790.206 Version: 6.0.3790.206 Posting Allowed</example>
43
+ <example service.version="6.0.3790.3959" ms.nttp.version="6.0.3790.3959">NNTP Service 6.0.3790.3959 Version: 6.0.3790.3959 Posting Allowed</example>
44
+ <example service.version="6.0.3790.206" ms.nttp.version="6.0.3790.206">NNTP Service 6.0.3790.206 Version: 6.0.3790.206 Posting Allowed</example>
45
45
  <param pos="0" name="service.vendor" value="Microsoft"/>
46
46
  <param pos="0" name="service.product" value="IIS"/>
47
47
  <param pos="0" name="service.family" value="IIS"/>
@@ -82,9 +82,12 @@
82
82
  </fingerprint>
83
83
 
84
84
  <fingerprint pattern="^NNTP server ready(?: \(no posting\))?$">
85
- <description>Non-specific NNTP</description>
85
+ <description>Non-specific NNTP -- assert nothing</description>
86
86
  <example>NNTP server ready (no posting)</example>
87
87
  <example>NNTP server ready</example>
88
+ <param pos="0" name="hw.certainty" value="0.0"/>
89
+ <param pos="0" name="os.certainty" value="0.0"/>
90
+ <param pos="0" name="service.certainty" value="0.0"/>
88
91
  </fingerprint>
89
92
 
90
93
  </fingerprints>
data/xml/ntp_banners.xml CHANGED
@@ -92,7 +92,7 @@
92
92
 
93
93
  <fingerprint pattern="version=&quot;ntpd (\S+)[^&quot;]+&quot;,.*system=&quot;Equallogic \(R\) storage array&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
94
94
  <description>ntpd running on an EqualLogic Storage Array that includes the NTP version</description>
95
- <example>
95
+ <example service.version="4.2.0-r">
96
96
  version="ntpd 4.2.0-r Fri Feb 5 15:18:30 EST 2010 (1)",
97
97
  processor="Working", system="EqualLogic (R) storage array", leap=0,
98
98
  stratum=3, precision=-7, rootdelay=102.894, rootdispersion=245.154,
@@ -140,7 +140,7 @@
140
140
 
141
141
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;Linux/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
142
142
  <description>ntpd running on Linux</description>
143
- <example>
143
+ <example service.version="4.2.4p3@1.1502-o" os.arch="i686" os.version="2.4.29">
144
144
  version="ntpd 4.2.4p3@1.1502-o Wed Jul 18 11:45:01 UTC 2007 (1)",
145
145
  processor="i686", system="Linux/2.4.29", leap=00, stratum=3,
146
146
  </example>
@@ -157,7 +157,7 @@
157
157
 
158
158
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?6\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
159
159
  <description>ntpd running on Mac OSX 10.2/Jaguar</description>
160
- <example service.version="4.1.1@1.786" os.version.version="8">
160
+ <example service.version="4.1.1@1.786" os.version.version="8" os.arch="Power Macintosh">
161
161
  version="ntpd 4.1.1@1.786 Tue Nov 12 09:30:41 PST 2002 (1)", processor="Power Macintosh", system="Darwin6.8",
162
162
  </example>
163
163
  <param pos="0" name="service.family" value="NTP"/>
@@ -190,7 +190,7 @@
190
190
 
191
191
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?8\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
192
192
  <description>ntpd running on Mac OSX 10.4/Tiger</description>
193
- <example>
193
+ <example service.version="4.2.0@1.1161-r" os.arch="i386" os.version.version="11.1">
194
194
  version="ntpd 4.2.0@1.1161-r Fri Jan 13 11:36:23 PST 2006 (1)",
195
195
  processor="i386", system="Darwin/8.11.1", leap=11, stratum=16,
196
196
  </example>
@@ -209,7 +209,7 @@
209
209
 
210
210
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?9\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
211
211
  <description>ntpd running on Mac OSX 10.5/Leopard</description>
212
- <example>
212
+ <example service.version="4.2.2@1.1532-o" os.arch="Power Macintosh" os.version.version="0.0">
213
213
  version="ntpd 4.2.2@1.1532-o Mon Sep 24 01:42:27 UTC 2007 (1)",
214
214
  processor="Power Macintosh", system="Darwin/9.0.0", leap=3, stratum=16,
215
215
  </example>
@@ -228,7 +228,7 @@
228
228
 
229
229
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?10\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
230
230
  <description>ntpd running on Mac OSX 10.6/Snow Leopard</description>
231
- <example>
231
+ <example service.version="4.2.4p4@1.1520-o" os.arch="i386" os.version.version="8.0">
232
232
  version="ntpd 4.2.4p4@1.1520-o Mon May 18 19:38:25 UTC 2009 (1)",
233
233
  processor="i386", system="Darwin/10.8.0", leap=0, stratum=3,
234
234
  </example>
@@ -267,7 +267,7 @@
267
267
 
268
268
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^&quot;]+)&quot;,.*system=&quot;Darwin/?11\.([^&quot;]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
269
269
  <description>ntpd running on Mac OSX 10.7/Lion</description>
270
- <example>
270
+ <example service.version="4.2.6@1.2089-o" os.arch="x86_64" os.version.version="2.0">
271
271
  version="ntpd 4.2.6@1.2089-o Fri May 28 01:20:53 UTC 2010 (1)",
272
272
  processor="x86_64", system="Darwin/11.2.0", leap=11, stratum=16,
273
273
  </example>
@@ -367,7 +367,7 @@
367
367
 
368
368
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;FreeBSD/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
369
369
  <description>ntpd running on FreeBSD</description>
370
- <example>
370
+ <example service.version="4.2.6p2@1.2194" os.arch="i386" os.version="7.4-PRERELEASE">
371
371
  version="ntpd 4.2.6p2@1.2194 Wed Nov 24 15:54:11 UTC 2010 (1)",
372
372
  processor="i386", system="FreeBSD/7.4-PRERELEASE", leap=00, stratum=3,
373
373
  </example>
@@ -400,7 +400,7 @@
400
400
 
401
401
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;NetBSD/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
402
402
  <description>ntpd running on NetBSD</description>
403
- <example>
403
+ <example service.version="4.2.4p6-o" os.arch="sparc64" os.version="5.0_STABLE">
404
404
  version="ntpd 4.2.4p6-o Thu Jan 8 21:02:40 MET 2009 (import)",
405
405
  processor="sparc64", system="NetBSD/5.0_STABLE", leap=00, stratum=1,
406
406
  </example>
@@ -420,34 +420,34 @@
420
420
  <example os.arch="i386" os.version="1.5.3">
421
421
  processor="i386", system="NetBSD1.5.3"
422
422
  </example>
423
- <example>
423
+ <example os.arch="i386" os.version="1.6">
424
424
  processor="i386", system="NetBSD1.6"
425
425
  </example>
426
- <example>
426
+ <example os.arch="i386" os.version="1.6.1">
427
427
  processor="i386", system="NetBSD1.6.1"
428
428
  </example>
429
- <example>
429
+ <example os.arch="i386" os.version="1.6.2_STABLE">
430
430
  processor="i386", system="NetBSD1.6.2_STABLE"
431
431
  </example>
432
- <example>
432
+ <example os.arch="sbmips" os.version="3.0">
433
433
  processor="sbmips", system="NetBSD3.0"
434
434
  </example>
435
- <example>
435
+ <example os.arch="se100" os.version="1.5.3">
436
436
  processor="se100", system="NetBSD1.5.3"
437
437
  </example>
438
- <example>
438
+ <example os.arch="seil3" os.version="1.6.1_STABLE">
439
439
  processor="seil3", system="NetBSD1.6.1_STABLE"
440
440
  </example>
441
- <example>
441
+ <example os.arch="seil3" os.version="1.6.2_STABLE">
442
442
  processor="seil3", system="NetBSD1.6.2_STABLE"
443
443
  </example>
444
- <example>
444
+ <example os.arch="seil4" os.version="1.6.1_STABLE">
445
445
  processor="seil4", system="NetBSD1.6.1_STABLE"
446
446
  </example>
447
- <example>
447
+ <example os.arch="seil4" os.version="1.6.2_STABLE">
448
448
  processor="seil4", system="NetBSD1.6.2_STABLE"
449
449
  </example>
450
- <example>
450
+ <example os.arch="siara2k" os.version="1.5.3">
451
451
  processor="siara2k", system="NetBSD1.5.3"
452
452
  </example>
453
453
  <param pos="0" name="os.vendor" value="NetBSD"/>
@@ -818,7 +818,7 @@
818
818
 
819
819
  <fingerprint pattern="system=&quot;UNIX/SunOS ([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
820
820
  <description>SunOS with no ntp version</description>
821
- <example>
821
+ <example os.version="4.x">
822
822
  system="UNIX/SunOS 4.x",
823
823
  </example>
824
824
  <param pos="0" name="os.vendor" value="Sun"/>
@@ -830,7 +830,7 @@
830
830
 
831
831
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;JUNOS/?([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
832
832
  <description>ntpd running on Juniper/Netscreen JunOS</description>
833
- <example>
833
+ <example service.version="4.2.0-a" os.arch="i386" os.version="9.3R4.4">
834
834
  version="ntpd 4.2.0-a Wed Aug 12 04:22:47 UTC 2009 (1)",
835
835
  processor="i386", system="JUNOS9.3R4.4", leap=11, stratum=16,
836
836
  </example>
@@ -860,11 +860,11 @@
860
860
 
861
861
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;Windows/?([^ ]+)?&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
862
862
  <description>ntpd running on Windows</description>
863
- <example>
863
+ <example service.version="4.2.4p7@copenhagen-o" os.arch="x86">
864
864
  version="ntpd 4.2.4p7@copenhagen-o May 22 11:25:36 (UTC+02:00) 2009 (3)",
865
865
  processor="x86", system="Windows", leap=00, stratum=2, precision=-19,
866
866
  </example>
867
- <example>
867
+ <example service.version="4.2.4p4@1.1520-modena-o" os.arch="unknown" os.version="NT">
868
868
  version="ntpd 4.2.4p4@1.1520-modena-o Dec 05 9:35:28 (UTC+01:00) 2007 (11)",
869
869
  processor="unknown", system="WINDOWS/NT", leap=00, stratum=2,
870
870
  </example>
@@ -881,7 +881,7 @@
881
881
 
882
882
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;HP-UX/?([^ ]+)?&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
883
883
  <description>ntpd running on HP-UX</description>
884
- <example>
884
+ <example service.version="4.2.2@1.1532-o" os.arch="9000/800" os.version="B.11.11">
885
885
  version="ntpd 4.2.2@1.1532-o Wed Sep 6 16:49:43 EDT 2006 (2)",
886
886
  processor="9000/800", system="HP-UX/B.11.11", leap=00, stratum=1,
887
887
  </example>
@@ -913,7 +913,7 @@
913
913
 
914
914
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;[^ ]+&quot;,.*system=&quot;([^ ]+)-hp-hpux([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
915
915
  <description>ntpd running on HP-UX, where the processor is in the 'system' variable</description>
916
- <example>
916
+ <example service.version="4.2.5p154@1.1802" os.arch="ia64" os.version="11.31">
917
917
  version="ntpd 4.2.5p154@1.1802 Tue Mar 22 22:09:00 UTC 2011 (39)",
918
918
  processor="unknown", system="ia64-hp-hpux11.31", leap=00, stratum=1,
919
919
  </example>
@@ -935,7 +935,7 @@
935
935
 
936
936
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*processor=&quot;([^ ]+)&quot;,.*system=&quot;VMkernel/?([^ ]+)?&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
937
937
  <description>ntpd running on VMware ESXi</description>
938
- <example>
938
+ <example service.version="4.2.4p6@1.1495" os.arch="x86_64" os.version="4.1.0">
939
939
  version="ntpd 4.2.4p6@1.1495 Wed Sep 22 02:33:15 UTC 2010 (1)",
940
940
  processor="x86_64", system="VMkernel/4.1.0", leap=11, stratum=16,
941
941
  </example>
@@ -1031,7 +1031,7 @@
1031
1031
 
1032
1032
  <fingerprint pattern="system=&quot;Data ONTAP/+(\S+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
1033
1033
  <description>NetApp file servers</description>
1034
- <example>
1034
+ <example os.version="8.1RC2">
1035
1035
  system="Data ONTAP/8.1RC2"
1036
1036
  </example>
1037
1037
  <param pos="0" name="os.vendor" value="NetApp"/>
@@ -1110,7 +1110,7 @@
1110
1110
 
1111
1111
  <fingerprint pattern="system=&quot;UNIX/Unixware([^ ]+)&quot;" flags="REG_ICASE">
1112
1112
  <description>SCO Unixware NTP</description>
1113
- <example>
1113
+ <example os.product="2">
1114
1114
  system="UNIX/Unixware2", leap=3, stratum=16, rootdelay=0.00,
1115
1115
  rootdispersion=0.00, peer=0, refid=0.0.0.0, reftime=0x00000000.00000000,
1116
1116
  poll=4, clock=0xd1d874b7.051ec000, phase=0.000, freq=0.00, error=0.00
@@ -1134,7 +1134,7 @@
1134
1134
 
1135
1135
  <fingerprint pattern="version=&quot;ntpd ([^ ]+)[^&quot;]+&quot;,.*\s*processor=&quot;([^ ]+)&quot;,.*system=&quot;SecureOS/([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
1136
1136
  <description>McAfee Network Firewall Enterprise NTP (SecureOS)</description>
1137
- <example>
1137
+ <example service.version="4.2.0-r" os.arch="i386" os.version="7.0.1.00">
1138
1138
  version="ntpd 4.2.0-r Thu Aug 11 12:41:19 CDT 2005 (1)",
1139
1139
  processor="i386", system="SecureOS/7.0.1.00", leap=0, stratum=3,
1140
1140
  precision=-19, rootdelay=27.044, rootdispersion=87.845, peer=2357,
@@ -1142,7 +1142,7 @@
1142
1142
  clock=0xd2636c8e.d5e2d427, state=4, offset=0.519, frequency=-3.027,
1143
1143
  jitter=5.132, stability=0.394
1144
1144
  </example>
1145
- <example>
1145
+ <example service.version="4.2.0-r" os.arch="i386" os.version="7.0.0.04">
1146
1146
  version="ntpd 4.2.0-r Thu Aug 11 12:41:19 CDT 2005 (1)",
1147
1147
  processor="i386", system="SecureOS/7.0.0.04", leap=0, stratum=2,
1148
1148
  precision=-19, rootdelay=56.480, rootdispersion=35.772, peer=8677,
@@ -1161,14 +1161,14 @@
1161
1161
 
1162
1162
  <fingerprint pattern="processor=&quot;([^ ]+)&quot;.*system=&quot;Linux([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
1163
1163
  <description>ntpd running on linux</description>
1164
- <example>
1164
+ <example os.arch="i686" os.version="2.6.10">
1165
1165
  processor="i686", system="Linux2.6.10", leap=0, stratum=2,
1166
1166
  precision=-17, rootdelay=44.644, rootdispersion=29.933, peer=13317,
1167
1167
  refid=A.B.C.D, reftime=0xd2c29f69.407570c5, poll=10,
1168
1168
  clock=0xd2c2a335.360999dc, state=4, phase=1.037, frequency=55.898,
1169
1169
  jitter=0.203, stability=0.004
1170
1170
  </example>
1171
- <example>
1171
+ <example os.arch="i686" os.version="2.6.23.waas">
1172
1172
  processor="i686", system="Linux2.6.23.waas", leap=0, stratum=2,
1173
1173
  precision=-18, rootdelay=37.550, rootdispersion=427.047, peer=40613,
1174
1174
  refid=172.20.62.191, reftime=0xd297a442.8b66c6de, poll=14,
@@ -1188,7 +1188,7 @@
1188
1188
 
1189
1189
  <fingerprint pattern="version=&quot;ntpd (\S+)[^&quot;]+&quot;,.*\s*processor=&quot;([^ ]+)&quot;.*system=&quot;Isilon OneFS/v([^ ]+)&quot;" flags="REG_DOT_NEWLINE,REG_ICASE">
1190
1190
  <description>Isilon OneFS NTP Server</description>
1191
- <example>
1191
+ <example service.version="4.2.4p4-o" os.arch="i386" os.version="5.5.4.21">
1192
1192
  version="ntpd 4.2.4p4-o Thu Feb 4 20:43:00 UTC 2010 (1)",
1193
1193
  processor="i386", system="Isilon OneFS/v5.5.4.21", leap=0, stratum=14,
1194
1194
  precision=-19, rootdelay=0.000, rootdispersion=11.260, peer=60044,