portscout - new distfile scanner

[Edwin Groothuis]

On Tue, Apr 04, 2006 at 10:54:51AM +0100, Shaun Amott wrote:
> 2 days? Wow, that's crazy. :)

Maybe yes, maybe no. If you check all n mastersites for all possible
version strings (1.2.3 -> 1.2.4, 1.3.0, 2.0.0), you end up with 3n
TCP connections per distfile. HTTP requests are cheap, but FTP
sessions are expensive. Then if you have a choked up connection,
this all might take a while.

> information you had put up. One of my goals was to make portscout as
> low-maintenance as possible, so I tried to avoid having lists of
> ports/hosts, etc. But, it seems like this is inevitable, so I might make
> use of your data files at some point.

Low-maintenance and getting-as-accurate as possible are not countering
each other. It's more usefull to get proper results for ports which
want the minor-version to be even, than to send out the wrong alerts
to people about "upgrades" being available.

Edwin

-- 
Edwin Groothuis      |            Personal website: http://www.mavetju.org
edwin at mavetju.org    |          Weblog: http://weblog.barnet.com.au/edwin/