[Nmap-scanner-general] Re: [Nmap-scanner] Nmap::Scanner .7 alpha ready for use!

[Max <nm...@we...>]

Mario and others,

    As you all now know, the sourceforge mailing list is up and running.

    I will be turning off posting to the existing webwizarddesign.com
    list today.

    The new project page is

    http://nmap-scanner.sourceforge.net/

    Sourceforge provides us with many tools that I hope will make work and
    discussion on this project more productive, including a web-based
    forum :).

On Wed, 11 Feb 2004 18:43:47 +0100, Mario Manno wrote:
> > Good point!  If you patch things, please post your patch to the list
> > and I will apply it .. otherwise I can do this or we can divide the
> > work and do it that way ... any way is fine with me.
> 
> Ah, thats no work at all.. I'll append the patch, but i am not sure i
> got all the relevant "if defined" lines.
> The people who use strict and use warning are the same who use
> valdidating xml parsers I guess :-) ?

haha .. no, it is a good and recommended practice with perl to always
'use strict' .. eliminates a lot of otherwise hard-to-find problems.

> I like ruby, maybe I take a look into it.

The ruby version should be much faster to code than the perl version ..
that has been my experience with ruby at least.  I really enjoy 
coding with ruby.  We can upload as many modules to the sf account as
we like, so we could have separate ruby, python, PHP, <other language>
implementations.  I would really enjoy having multiple language support
once we reach version 1 with perl, but I think it is best to wait until
we are stable with perl as maintenance then becomes much more complex
with multiple language support.

2) I thought about distributed scanning some time ago.
> I came to the conclusion that it will only work if it is integrated in
> nmap itself. You can't really delegate all scan types. Os Detection for
> example wants an open port, it won't work if another node scans this
> port. So you could probably do simple distributed scanning via some kind
> of remote nmap starter. i tried it in ruby, but had to give up as i
> realized i had no idea when to distribute a scan to other nodes.
> there had to be some algorithm to decide who gets the scan.

Gotcha.  Have you checked out the existing distributed nmap scanning
project?  I think it is called rnmap.

The algorithm could be as simple as "I have 300 hosts and 5 peers,
each gets 60 hosts" .. that would speed up scans in and of itself
for most cases.

I understand and respect the argument for having things run as fast
as possible by adding them to nmap itself or by extending nmap ..
I personally prefer to have programs done in as high a level
language as they can be done in because they then become more
accessible and easier to maintain.  For just about any program
that is currently done in a lower-level language that same
program can be moved to a high level language N time later because
CPU / computer speeds consistenly increase over time (so far).

> But I want to build a "nmap to rdf feed" scanner.
> This could be done with Nmap::Scanner i think.
> The rdf feeds of different servers could be collected into one master
> rdf feed.=20

That sounds like a very cool project.

> 3)
> i'm looking into berkeleys xml db, it should not be to difficult to
> store results there. since this is my first contact with xml databases i
> can't tell you more at the moment, but the examples look simple enough.
> Maybe there is some open source equivalent which i can just apt-get ...

I would like to play with that as well .. nice idea.

> and)
> I would like to have Nmap::Scanner use the same method names, properties
> as the tag names in the xml file.
> I find it  disturbing to use portid in the xml and number in my perl
> code, what do you think, is renaming possible ?

That sounds good to me :) and makes good sense.  We have CVS access now
on sourceforge.net.  Sign up for an account on SF if you don't have one,
then send me your sf user name and I will add you as a developer on the
project so you can access CVS directly .. the caveat is that we need then
to still communicate, via this list, the online SF forums, somehow, to
talk about planned changes before doing them .. that goes for me as
well as you.  If you would rather just post patches and have me apply
them, that is fine.  Just let me know on or off list.

If anyone else is interested in becoming a developer, let me know .. 
once you contribute a few patches / non-trivial enhancements that
show your skill and competence (I don't mean that in a threatening
or demeaning way) I will be happy to add you as a developer to
the project.  

If you have an interest in doing something else for the project,
please let me know.  If you prefer to not do anything additional,
that is absolutely fine as well. :)

The SF project has a feature release / requested enhancements section!  
Everyone please feel free to post ideas there as well as
bug reports under the 'Bugs' section .. I think you can post anonymously
if you are shy or don't want the public to know who you are.

Feel free to ask questions that come up about using the new project on
sourceforge here if any come up!

Sourceforge is really a great service for OS projects.

Regards,
Max