Intro

This site is all about OS Fingerprining. I used to do a lot of active OS fingerprinting, but got into passive OS fingerprinting back in 2005 once I found out how much you can actually determine using it.

So far there are 2 papers I've written on the subject and a few programs.

Papers: DHCP Fingerprinting and OS Fingerprinting in general.

Programs: Satori does passive OS identification using multipe protocols. SAM does active fingprinting on the ARP stack.

News

Feb

2/15/14: Satori Update

Released 0.7.6 of Satori today. Cleanup on some stupid errors, recompiled all the dlls to make sure I wasn't missing things, updated some fingerprints and multiple little other things.

May

5/27/13: Satori Update

Released 0.7.5 of Satori today. Minor update to add a new icon for Windows 8. This required the .exe to be recompiled and the smb.dll. While doing that I updated some of the tcp.dll's and updated all of the fingerprint files. Some with just new headers and a number of others with new fingerprints.

March

3/12/13: Website move

It has been years coming, but finally paying for somewhere to host this. My ISP helped force it since they are dropping their free web hosting. All for the best I'm sure. Cept now I have to pay for hosting, but so is life.

July

7/4/12: Satori Update

Satori 0.7.4 released.

- Had a request from Randy to add a "not" feature to the filter. Added that and fixed the fact that it only filtered existing packets, not new packets. Thanks for the suggestion! Usage is: ![var] or just [var], sorry no ability to use && or || type logic.

- Also fixed a bug he noticed in the MAC Vendor not showing up in cases where it did know it.

- Last but not least packaged Satori with InstallForge (http://www.installforge.net/). For those that don't want to do a full blown install, nice thing is InstallForge, while making it an .exe it is actually a .zip, so it can be extracted with any zip program. You'll end up with an extra dir, but works sweet even when using unzip.

June

6/16/12: Satori Update

Updated a lot of fingerprints. Have access to lots of traffic again so updated a few things! More to come in the following weeks/months I'm sure.

March

3/7/12: General Update

I'm busy taking the SANS 503 course on IDS. Part of that course deals with BPF style filters for tcpdump. Satori uses these filters as a preprocessor to limit the amount of packets I need to process. In the past I had just done 'tcp', then changed that to 'tcp and vlan' when I found that vlan tagged packets were getting missed. Well knowing that that needed work, I upaded them further to help preprocess many of them. Not sure I got any time gain on most, but I did on some.

Also, new version of Satori, version 0.7.3 is released and should be uploaded shortly. Basic reason is it had been 1.5 years since the last one and I wanted a new download file with all the files included!

February

2/8/12: General Update

This site needs a major overhaul one of these days! Anyway, Satori is by no means dead. It is just stable! I haven't had to put a new satori.exe out in 1.5 years now, I'm quite amazed! I have updated some of the underlying .dll files and you can find that information in the documentation. Just figured I should post some type of update after such a long time! Oh and the fingerprint files are being updated as new things get added also.

September

9/14/10: Satori update

Just uploaded 0.7.2 of Satori.exe, main update with it goes with dhcpv6 files that I uploaded also. It is VERY early on dhcpv6 fingerprinting (only 1 fingerprint right now), but plan over the next few months to do some more research into it and bump out the fingerprints! Just run the updater.exe program in the Satori directory and you should be able to get all the new files.

July

7/11/10: Satori news

Since it had been a year since I updated the satori.zip file I took all the updates I've done over the past year and put them in a new .zip. I still recommend always running update.exe once you extract it and look for newer files though.

September

9/10/09: Satori news

Released 0.7.1 recently, plus quite a few new dlls after I found bugs here and there. Download the main program, think it is 0.6.4 and then run the updater. Should pull down about 30 or so updated files! I'll put a new zip out there one of these days. Also did some new dhcp and tcp fingerprints tonight.

9/9/09: Linux Satori news

Released 0.1.2, had a request to be able to load a pcap file. Was a quick fix, everything worked in my test, will wait for feedback.

August

8/22/09: Satori news

Released 0.7.0 the other day, expect 0.7.1 or 0.7.0.1 to fix some minor glitches I've run into in the new stuff I added. Hard to test for some of these things on a small home network. Most bugs seem to show up when you add a ton of traffic! Also updated the dhcp and mac.xml files this morning.

April

4/7/09: Started a command line version, for Linux, of Satori.

Version 0.1.1, so far it just does TCP and DHCP, not sure what other protocols I may add.

March

3/1/09: Updated Satori to 0.6.4, added legacy mode in .63 that was just available via the update.exe, lots of work on NativeOS and NativeLanMan stuff, added smb2_os based on what info comes back there and read in smb.xml now.

Tried to make the program a bit less "garage software" as my old team lead used to call it, making it a bit more professional, added some menu options, about, etc. Little baby steps! Oh, finally added an ini file, debated about writing to the registry, but I want its footprint on the system to be as small as possible. Read the history.txt for the rest.

February

Update: Due to stupidity on my part, I lost about 6 hours worth of dhcp.xml updates. Lastest one I have is as of 2/21 at 12:30ish, last one as of 6:30 that day is hosed, so will be redoing that cleanup to the file again. Live and Learn!

2/22/09: Updated Satori to 0.6.2, added the ability to read "any" dhcp type now that we integrated in packetfences information again. It had been removed for various reasons before, but was requested to be put back in. Got the latest .conf file and added the ability into Satori to use it. Also added an update program that can be run stand alone to pull updated dll's, satori.exe, or .xml files. Renamed 'fingerprint' directory to 'fingerprints'.

January

1/31/09: Updated Satori to 0.6.1, fix to a memory error I hope. Also give an overall os score for web_os and webserver_is now and added a few more right-click menu options to recompute stuff since, depending on timing, it does not always give an update at the root node.

1/25/09: Updated Satori to 0.6.0, update to "overall" os fingerprint for each type such as dhcp_os, tcp_os, etc. Also a slight speed increase in process packets (5.5 mins vs 7 mins on a 55 meg capture I use for all testing)

1/18/09: Updated Satori to 0.5.8, fingerprint updates, for bug updates see history.txt

December

12/24/08: First, new program out there using the dhcp.xml file from another author. It is called EDHCPFingerprint and can be found at http://secure.enterasys.com/support/tools.html

I've been working with Jeff from Enterasys quite a bit on some changes to the format for it (and now my other fingerprint files to get them all the same).

Lots of behind the scene tweaks to Satori to fix little bugs and bring the dll's in line to use the updated format since I missed some of the needed changes in the 0.5.5 release. Will put version 0.6 out sometime after Christmas/New Years

12/17/08: Lots of work on NetworkMiner, or lots of testing actually, trying to make it crash and found some nice bugs for the author.

Satori - 0.5.5 released: Been work with Jeff and Erik recently on updating the xml schema for the dhcp.xml file. After we finished tweaking it and adding a few new fingerprints, along with removing old ones that didn't provide dhcptype, I updated the schema on the tcp and icmp .xml files also. This change will help in the long run to use info from all 3 identification files for a common Desc for the device.

Thanks to Jeff for really pushing it and for Erik in his help also.

November

11/15/08: Blog Link: Added a link to my blog. Trying to list new things that come out that tie back into OS Fingerprinting.

11/13/08: Cert Update: Passed the GCFA exam (SANS 508 course) earlier today. My head hurts now! Now to try the GPEN without the course. We'll see how that goes in the near future! Anyway, with the first one out of the way, will try to put some time back into Satori in the near future, whenever I'm not trying to crash NetworkMiner betas!

September

9/27/08: Satori 0.5 released. Major overhaul and push of packets through it in the past month! Over 70 GB worth of packet captures have been pushed through it, fixes Buffer Overflows, adding fingerprints and general tweaks. See history.txt in program to find out most all of it!

9/12/08: Satori 0.3.5 released. New fingerprints and tweaks to tcp side of things for the most part

August

8/2/08: Satori 0.3 released. More SMB stuff, reading in ettercap and p0fv2 fingerprint files along with my own on the TCP side. Other bug fixes and some directory cleanup along with some new Fingerprints.

June

6/7/08: After going on probably 6 years I finally did some more cleanup on the site, mostly behind the scenes things. Broke up MortalX Software into: 'Software' and 'Papers'. Updated Suggested Links with some new material. Added an 'About' section. And got ride of the old MortalX graphic at the top of the page!

6/5/08: Finished up the SANS 504 mentor class. Very informative!

6/4/08: Updated Release of Satori 0.2. Lots of little fixes here and there.

May

5/21/08: Updated Release of Satori 0.1.4. Fixed the save to .csv file finally. Updated the tcp fingerprinting a bit, and updated/fixed the ospf parser.

April

4/3/08: Updated Release of SAM. Satori ARP/Mac Scanner. Still taking recommendations for a new name. A few bug fixes and a change to the trailer sent so I can tell if the remote devices echos info back or not. Yet another tweak to my arp.dll file too.

March

3/14/08: Initial Release of SAM. Satori ARP/Mac Scanner. Taking recommendations for a new name. Scanner based on arp-scan for Linux, with a few of my own twists, haven't done a comparison to see if I'm doing any better than them!

December

12/9/07: Another release of Satori! This time we've added the much waited for tree view! Check out version 0.1.3 under MortalX software

October

10/28/07: Back from BH Japan 2007 and a new release of Satori is ready. Also the whitepaper we based the presentation off of is now availabel for download
Look under MortalX software for the whitepaper on DHCP Fingerprinting and for Satori 0.1.2
The GFI files will be going away soon since they are extremely old still. The link is going away at least, some of the page/files may stay since I still like the SNMP OID file.

10/23/07: Off to present at Blackhat Japan on DHCP Fingerprinting
We got accepted to present on Passive OS Fingerprinting via DHCP for Blackhat Japan 2007!

September

9/16/07: 0.1.1 of Satori Released
I know nothing new on the site for a long time, but been working on a lot of DHCP research. Also a few new versions of Satori released, though not all uploaded or noted. Check MortalX Software to get the latest version of Satori.

9/5/06: 0.0.4.1 of Satori Released
Slight bug fix on DHCP.dll and new satori.exe since duplicates were showing up.

9/4/06: 0.0.4 of Satori Released
Better OS identification on web agent, dhcp stuff, and a few other places. Look under MortalX software for it.

July

7/30/06: 0.0.3 of Satori Released
Reads .xml files for some OS identification, sorting is much better, plus some other updated .dlls. Find it under MortalX Software.

April

4/14/06: 0.0.2 of Satori Released
Not as much as I wanted to do for the 2nd release of the program, but it is a start. See the history.txt file for updates.

January

1/27/06: G's Mail Cleaner 0.1 release
Used to clean .box files generated by Novell's Netmail program. Issue we had is some viruses got past our AV product and then since all the messages are stored in one big file, if an AV scan was run against it, the user lost their whole mailbox or folder that was infected. Look for it under MortalX software

August

8/6/05: OS Fingerprinting Paper
Version 1.0 is finally released of my OS Fingerprinting paper that takes in most of what I've put into Satori.

8/5/05: Satori
Ok, first numbered release: 0.0.1 Broke IPX SAP in the original 0.0.1, so this one is fixed. Also, added AARP and the start of ZIP to it, both Appletalk things. 21 .dll's now that make it work, more to be added eventually! Didn't get a chance to move the OS detection out of the product into .xml files yet, but eventually, that will be for 0.0.2!

July

7/27/05: Satori
Fixed a few more minor glitches, added STP packets to what it can parse and cleaned up a few other things. Added more graphics. Next version will export os identification to txt files so they can be easily modified.

7/20/05: Satori
Fixed a few minor glitches, added OSPF and IPX SAP packets to what it can parse

7/10/05: Satori
So early, not even numbered yet... Based on my Passive OS Fingerprinting Paper and DataDippers Replacement. One of my only programs with a decent front end! Still no where near complete, but wanted it out there for people to test. Please send feedback!

7/9/05: XPatcher 0.1.5.1
Reuploaded Xpatcher 0.1.5.1, CRC error when uploaded last time. Updated some of the .xml files for it too.

June

6/20/05: XPatcher 0.1.5.1
New defs updated for latest patches, still some work needs done to make sure all are downloadable, but short on time. Added multithreaded download, but it is flaky, so you'll have to hit download, when it gets done, hit it again, let it do downloads, hit it again, not sure why it is missing some, but again, short on time.

6/4/05: OS Finger Printing... Chatter on the Wire 0.1.2 released
ICMP, HTTP, additions to others that were already there. TOC and a few other odds and ends. Finally becoming a real paper. Fixes from feedback.
Also, latest version 0.1.2 of DataDipper. Added a new area that helps incorporate all the data on one screen, gives you the ability to load ethereal captures and other stuff.

May

5/4/05: OS Finger Printing... Chatter on the Wire 0.1.1 released
Name change on the paper, UPnP info added, grammer fixed in some cases, released as .pdf

5/3/05: DataDipper 0.1.1
Some new parsing, some bug fixes, mainly a quick release since I'll be taking about a 3 week break on this.

April

4/28/05: DataDipper and OS FingerPrint Document released
My OS Finger Print paper and a program that uses WinPCAP to listens to the packets on the network and determine the remote machines OS.

February

2/21/05: XPatcher 0.1.5.0 beta released
Added the ability to just list/scan for products you are interested in. No modification to the products.xml needed! Lots of little switch fixes and cleanup of duplicates on downloads. Still more work to be done, but getting there!

January

1/27/05: XPatcher 0.1.4.0 beta released
Lots of fixes and improvements. Web update feature for .xml files now and fixed it so it will actually do silent installs, plus many other things.

November

11/9/04: XPatcher 0.1.3.0 beta released
An addition for file checks in the products.xml and added xmlparser.exe which is what I use to create me .xml files. It is NOT well documented so email me if you have questions on it.

11/8/04: XPatcher 0.1.2.0 beta released
Fixed some more bone headed program errors. Added a few nice things, think I fixed the download bug for the 2nd or 3rd time now, we will see.

11/3/04: XPatcher 0.1.1.0 beta released
Fixed some bone headed program errors (hate having one line of code causing major headaches). Added individual Office products (word/excel/etc) detection. Added new .xml files, updated .xml files with latest hotfixes.

11/1/04: Home on a bit of leave from the Military before I leave to go to Iraq. Been working on a new program (set of them actually) in my spare time. New product added to my software MortalX - XPatcher 0.1 beta
Basically it allows you to download all the files to the local HD, burn it to cd, scan a local machine and patch it. No more doing a base install, plugging it into the network and having it infected before you can get it patched since you can now do that all offline.

June

6/5/04: More stupid little bugs in the mssecure.xml file. LNSS bases the name of the file, when it autodownloads a file off of the PatchName in the bulletin, well I found 60+ files that did not have a .exe extension on it. Therefore, when you downloaded the files and pushed them to the remote machine they were not of any type of executable format. For the most part this only effected products that are unsupported by LNSS anyway, but I found a few in products that I have provided support for through my products.xml info. Download the new xnih.zip file in the Unsupported files section.
New script: directx.vbs, detects what version of DirectX is installed and writes to a logfile. New script: msxml.vbs, detects what version(s) of MSXml are installed and writes to a logfile.

6/4/04: Updated wmp.txt. 6.4 for NT and 2000 should be better detected now and XP should be good now. Updated the xnih.zip file with the new products.xml (wmp stuff).

6/1/04: More patches that were undetectable before should now be detectable. Updated my downloadable copy of xnih.zip and a few other new Word/Excel patches are now detectable.

May

5/31/04: Created a replacement chunk of code for the Products section of the mssecure.xml. The information being downloaded from MS had some major holes in it. Granted a lot of the holes in it are for products LNSS does NOT support, but since I'm always adding new products to the products.xml file I thought it was time to fix it. At least as far as I could without adding new SP's and Products to other chunks of the file. Check out the Unofficial LNSS files section for more info.

5/24/04: Oops, a few mistakes in location places in the msloc.txt file, got that updated now. Also, had to add a new file, mslocid.txt which will need added to mssecure.xml also.

5/23/04: Well here is the scoop.... I took a new job about 2 months ago and have been short on time. I also had another child last week, so I'm even shorter on time. And to top it all off, I'll be leaving in June with the military for up to 18 months. SO........ I've given a friend access to post files to my website when he has time. As with the ones I did they will NOT be supported by GFI, but hey, they could help people out! Also, I just did a few new updates. Detection for MS04-003, MS04-013, and MS04-015. Look under Unoffical LNSS files as always for more info. for those that want to email me, try xnih@cableone.net and I'll update/read it when i can.

February

2/16/04: Finally updated object_ids.txt (1756 entries now).

2/3/04:  Posted some LNSS 5 scripts that were originally written for LNSS 3.x to my Unofficial LNSS Files section.  Original scripts were written by c200lab.  Look under of the Unofficial section for more info.

January

1/22/04:  Part 2:  office2000.txt and office2002.txt.  Both add support for Access, Excel, Frontpage, PowerPoint, Publisher, and Word since MS does put some patches out that are individual program based, not just Office based.

1/22/04:  Added mdac.txt and wmp.txt to the UnOfficial LNSS Files section.  Both add support to LNSS to detect what version of software is installed (MDAC or Windows Media Player).  See notes on both in that section.

1/6/04:  Updated Enterprise_numbers.txt.  Plan on updating the object_ids.txt file in the next few days if time permits me to get through all the emails I have on it, should be 50-100 new ones in there.  Also, have some new programs I'm thinking about adding online.  We will see.

October

10/13/03:  Updated Enterprise_numbers.txt, thanks Giga Wizard.  Also, updated telnet.txt, ftp.txt, www.txt and the all popular object_ids.txt.  All of them can be found under Unofficial LNSS files.

September

9/11/03:  MS03-039 file from OldManUnder for those that just want to scan for this patch missing.

Also added quick_list.xsl, just does a small quick listing of IP Address, Host Name, Host Name, Logged on user, OS and OS SP level if known.  You can find it under the Unofficial LNSS files.

August

8/21/03:  Updated MS03-26 file, has a disclaimer/readme file with instructions on its use with both LNSS and HFNetCheck.

8/18/03:  Thanks to OldManUnder there is a MSsecure.xml file just to check for MS03-26, it isn't something I've tested, but it is up in the Unofficial LNSS files section.  Also, thanks to Arjan (who disappeared forever there) there is a new version of ethercodes.txt.  Will try to get a new snmp_oids.txt file up one of these days too, got about 50-100 new ones I think sitting in email.

8/7/03:  Created drop_$_userID.xsl and posted it in the Unofficial LNSS Files area.  Also did a quick writeup on it in Advanced Features in LNSS.  Simply put it drops any user accounts that have a $ in them, so User Test$ no longer shows up in reports.

July

7/14/03:  Updated enterprise_numbers.txt (17489 entries) thanks GiGa WiZaRD, sorry for the slow posting of this.  Also, updated object_ids.txt file (1523 entries)

7/9/03:  LNSS 3.3 was released today.  Added patching to French, Italian and German, but only the default versions of the language, so 409 version of English, which is causing difficulties for those with UK English versions of windows, or one of the other versions.  Patched version is due out week of the 14th hopefully.

June

6/27/03:  Updated object_ids.txt file, 1509 entries now.

Lots of additions in LNSS:  Support for Win 2003, Win2k SP4, etc, etc.

Other than that, my full time job has me booked, so not much new, some new possible OS identification programs might be posted in the future, if I ever get a chance to finish up with them.

May

5/6/03:  Updated object_ids.txt file, 1426 entries now.

April

4/23/03:  Added 2 xsl files to change default share information.  You can find info under Advanced Features in LNSS and the files in the Unoffical LNSS Files area.

Updated the enterprise_numbers.txt also, thanks, as always Arjan.

4/4/03:  Updated object_ids.txt file, 1400 entries now.  Also, updated enterprise_numbers.txt a week after he sent it to me.... thanks Arjan.

March

3/12/03:  Wrote a little program, located in the Mortal X Software Section.  Tallies info for OS's and SNMP Desciptions generated by LNSS.

3/10/03:  Updated enterprise_numbers.txt - Thanks Arjan.

3/6/03:  Lots of changes to announce in the past month.  I just finished a new Advanced Document on using LNSS to push Office 2000 Service Packs and how to take care of the CD issue, not the best thing I've ever tried to do, but hey.  Updated the object_ids.txt file (1367 entries) - Haven't heard from Arjan in a while, so no 100+ updates.  A new version of LNSS was released yesterday.  Version 3.2 now supports Exchange and Office 2k/XP.  And other minor things.

Note:  Novell Client users, if you are using Novell Client 4.83 SP1 you may receive 1707 errors, this is caused by the Novell client, there is a patch that takes care of this.  There should be a KB article at GFI before long on it, and there is also something posted in the forums on it.

January

1/31/03:  Updated enterprise_numbers.txt (this is not in 3.1.5).  Also, new version of LNSS was released today.

1/27/03:  Updated object_ids.txt file, 1332 entries now (same thanks as always)

1/16/03:  Updated object_ids.txt file, 1298 entries now

1/2/03:  Updated object_ids.txt file, 1255 entries now (thanks Arjan 85+ were from him).  Updated enterprise_numbers.txt (thanks Yvan, this was updated on 12/22/02, but I'm just getting to uploading it today).

December

12/20/02:  Updated object_ids.txt file, 1165 entries now (plus a few updates), updated www.txt also, 1 new one there.

12/9/02:  Updated object_ids.txt file, 1111 entries now (thanks to Ulf, and Arjan, most of the 200 new ones came from them)

12/2/02:  Updated object_ids.txt file,  909 entries now.

November

11/18/02:  Updated object_ids.txt file, 856 entries now.

11/15/02:  Added a new article under Advanced Features in LNSS - How to push a prior SP to a machine (in some companies, the latest SP is not always supported)

Also, LNSS 3.1 beta is out on GFI's site, it is actually 3.0.7 (possibly 7a, not sure), but with all of the additions from 3.0 (SP pushing, Custom Patches, etc), it looks like that will officially be 3.1.

11/14/02:  Added Advanced Features in LNSS Section to the website.  It will be a FAQ on Advanced Features in LNSS that are currently not in the manual or at least were not at the time of posting.

11/13/02:  Updated object_ids.txt (846 entries), telnet, ftp.txt, enterprise_numbers.txt, thanks to everyone who sent updates in.

Added files that contain information about the XML output from LNSS. This includes the Document Type Definition which will aid users in importing the data into any other format/application they may be interested in doing so. Think of it as the XML equivalent to what an RFC is for networking.  

11/4/02:  Updated object_ids.txt (832 entries), also updated: www, telnet, and smtp.txt, thanks to everyone who sent updates in.

October

10/25/02:  Updated object_ids.txt 745 entries. Sheesh, I leave for 10 days and people flood me with new devices. Keep up the good work. Also, www.txt and telnet.txt were updated back on the 11th, but I hadn't upload them until today. And yet one more that I forgot about, a new enterprise_numbers.txt that I got back on the 20th while I was gone.

10/10/02:  Updated object_ids.txt 696 entries.

10/7/02:  Updated object_ids.txt 4 new, 2 updated. 1 new SMTP banner also in the smtp.txt file.

10/3/02:  Updated object_ids.txt 4 new.

10/2/02:  Updated object_ids.txt 5 new.

10/1/02:  Updated object_ids.txt 4 new. They just keep coming in. Thanks everyone who has been sending them to me.

September

9/30/02:  Updated object_ids.txt 4 new Bug that caused problems in 3.0.4 has been fixed in 3.0.5, but don't use this updated file in versions less than or equal to 3.0.4

9/27/02:  Updated object_ids.txt 7 new, 20 remmed out, 2 updated. There still seems to be a problem with LNSS 3.0.4 reading in more than 650 object_ids, but it could be an issue with the file also, all I know is that if I rem out 13 of them the file loads fine.

9/21/02:  Updated object_ids.txt 1 new, 13 remmed out. There seems to be a problem with LNSS 3.0.4 reading in more than 650 object_ids, but it could be an issue with the file also, all I know is that if I rem out 13 of them the file loads fine.

9/19/02:  Updated object_ids.txt, www.txt, indent.txt, ftp.txt, smtp.txt, telnet.txt. Thanks to everyone on new OID's and thanks an0n for the scans that provided info for ftp, www, telnet, etc on both today and the 17th and even before that.

9/17/02:  Updated object_ids.txt 6 new, 1 update

9/17/02:  Also updated www.txt, indent.txt, ftp.txt, smtp.txt, telnet.txt and enterprise_numbers.txt

9/10/02:  Updated object_ids.txt 6 new

9/7/02:  Updated object_ids.txt 7 new

9/3/02:  Updated object_ids.txt

9/2/02:  Updated object_ids.txt

August

8/30/02:  Ok it has been awhile! I had a kid, work got busy, etc, etc. Here is what is new: Updated enterprise_numbers.txt (14512 entries), object_ids.txt, www.txt, ftp.txt, telnet.txt

Note:  Not sure how much longer I'll be providing updates this way. LNSS 3.0 has an automatic update feature for the registered version. I'll still be updating the files, but most will probably be distributed through the update feature, still discussing if they should be distributed for unregistered users this way.

June

6/17/02:  Updated enterprise_numbers.txt (13749 entries), ethercodes.txt (do not use if you are not a beta tester using 3.0 beta 2 or higher), object_ids.txt (about 15 new and 2 updates)

6/6/02:  Updated FTP.txt (1 new and some cleanup/rearrage), WWW.txt (1 new and some cleanup/rearrage), object_ids.txt (12 new, 2 cleanup, total 609 entries) - thanks Arjan

6/3/02:  Updated enterprise_numbers.txt (13541 records now, thanks as always go out to GiGa WiZaRD)

     I put the old ethercodes.txt file up for download in case anyone needs it, ethercodes.bak you'll have to rename it once you download it

     Updated object_ids.txt (9 new, 1 updated, thanks Arjan)

     Updated www.txt (Updated for 3com and HP Printers, better detection, thanks Arjan)

     Updated indent.txt, telnet.txt, ftp.txt (some are my changes, some from numerous others

May

5/30/02:  Updated object_ids.txt (48 new devices, thanks to Arjan again)

     Also, I pulled the ethercodes.txt file off for now, causing errors on LNSS starting up, until we figure out why use the old one

5/28/02:  Lots of things:

1.     Removed old news

2.     Updated object_ids.txt (33 new entries, thanks Arjan)

3.     Updated enterprise_numbers.txt (13521 records, thanks GiGaWiZaRD)

4.     Added a newer version of ethercodes.txt (approx 90 new entries)

5.     Minor Addition to FSG - version 0.02.1 now out

All News prior to 5/28/02 was removed, getting too long.