BigFix User Group
You are not logged in.
#1 2009-09-14 21:31:36
NMAP 5 - Any plans / Update Timerframe?
BigFix is still using NMAP 4.52 which was released 1/1/08. NMAP 5 has been out a while now 7/16/09 and has better detection capabilites. Is an updated NMAP fixlet on the horizon? Has anyone manually updated the Bigfix NMAP scan point?
John
Offline
#2 2009-09-15 08:25:36
- annamin
- Product Engineer
- Registered: 2008-12-04
- Posts: 4
Re: NMAP 5 - Any plans / Update Timerframe?
Asset Discovery will be updated to use NMAP 5 by early October. The changes are currently undergoing testing.
-Anna
Offline
#4 2009-10-12 08:00:56
- mcalvi
- BES Guru
- Registered: 2007-07-24
- Posts: 113
Re: NMAP 5 - Any plans / Update Timerframe?
Anna,
Any update on the Asset Discovery update?
Offline
#5 2009-10-27 21:45:29
- JackCoates
- BigFix Product Manager
- From: Berkeley, CA
- Registered: 2009-08-28
- Posts: 7
- Website
Re: NMAP 5 - Any plans / Update Timerframe?
It's done today, announcement will be sent shortly.
Offline
#7 2009-11-03 06:27:58
Re: NMAP 5 - Any plans / Update Timerframe?
So we've found only minimal improvement with NMAP 5 
Perhaps I will visit the NMAP forums and see if there is any hope for better detection. If I get some answers, I'll post them here.
BigFix, thanks for the effort in getting this update out the door.
Offline
#8 2009-11-03 08:26:16
- JackCoates
- BigFix Product Manager
- From: Berkeley, CA
- Registered: 2009-08-28
- Posts: 7
- Website
Re: NMAP 5 - Any plans / Update Timerframe?
Can you scan the devices with a standalone nmap 5 and post the xml output? That would determine if it's NMAP or our integration at fault.
Offline
#9 2009-11-06 17:24:40
- JackCoates
- BigFix Product Manager
- From: Berkeley, CA
- Registered: 2009-08-28
- Posts: 7
- Website
Re: NMAP 5 - Any plans / Update Timerframe?
Found out today that there's a problem with upgrading. Until we can publish a fix, you should uninstall and reinstall the importer service on your bigfix server, that should fix it.
Offline
#10 2009-11-12 11:02:56
Re: NMAP 5 - Any plans / Update Timerframe?
I haven't gotten around to scanning with plain old NMAP yet. Hopefully by the end of the week.
Sooo, we didn't realize that the NMAP 5 update required us to recreate our NMAP 4 jobs. We thought we had bigger issues when no data was coming in after the upgrade. Was that documented anywhere?
So we recreated the jobs today and ran a test scan. It failed with this relevance being the cause:
continue if {(exists file whose (name of it starts with "nmap-" AND exists line whose (((exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESScanner-NMAP" whose (value "NmapVersion" of it as string as version < "4.52") of registry) AND it as lowercase contains "nmap run completed at") OR ((exists key "HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\EnterpriseClient\BESScanner-NMAP" whose (value "NmapVersion" of it as string as version >= "4.52") of registry) AND it as lowercase contains "nmap done at")) of it) of folder (pathname of windows folder & "\temp\nmap"))}
Here is the NMAP XML Output file from the scan point:
<?xml version="1.0" ?>
<?xml-stylesheet href="file:///C:/Program Files (x86)/BigFix Enterprise/BES Client/BESScanner-NMAP/NMAP/nmap.xsl" type="text/xsl"?>
<!-- Nmap 5.00 scan initiated Thu Nov 12 14:10:34 2009 as: C:\Program Files (x86)\BigFix Enterprise\BES Client\BESScanner-NMAP\NMAP\nmap.exe -sV -sS -sU -p T:22,T:23,T:80,T:135,T:139,T:235,T:445,T:61616,U:52311 --exclude 172.26.2.77 -O --osscan-guess -PE -PA80 -T 4 -oX C:\WINDOWS\temp\nmap\nmap-BIGFIX02-1258035033.xml 172.26.2.2-254 172.26.40.2-254 172.26.45.2-254 172.200.45.2-254 -->
<nmaprun scanner="nmap" args="C:\Program Files (x86)\BigFix Enterprise\BES Client\BESScanner-NMAP\NMAP\nmap.exe -sV -sS -sU -p T:22,T:23,T:80,T:135,T:139,T:235,T:445,T:61616,U:52311 --exclude 172.26.2.77 -O --osscan-guess -PE -PA80 -T 4 -oX C:\WINDOWS\temp\nmap\nmap-BIGFIX02-1258035033.xml 172.26.2.2-254 172.26.40.2-254 172.26.45.2-254 172.200.45.2-254" start="1258053034" startstr="Thu Nov 12 14:10:34 2009" version="5.00" xmloutputversion="1.03">
<scaninfo type="syn" protocol="tcp" numservices="8" services="22-23,80,135,139,235,445,61616" />
<scaninfo type="udp" protocol="udp" numservices="1" services="52311" />
<verbose level="0" />
<debugging level="0" />
Any ideas why this is now failing?
Offline