Early Explorer release notes

View as Markdown

Explorer release notes prior to 1.7.9

Starting with version 1.7.9 all release notes have been consolidated into one page.

v1.7.8

2020-05-23

  • Fingerprint updates.

v1.7.7

2020-05-22

  • Fingerprint updates.

v1.7.6

2020-05-14

  • The dynamic MAC address filter now uses the new service attributes consistently.

v1.7.5

2020-05-14

  • Asset and Service attributes are now normalized. All keys are camelCase, and most service attributes carry the protocol name as a prefix.

v1.7.4

2020-05-13

  • Support for these database protocols has improved: Memcached (TCP), CouchDB, Cassandra, Redis, ElasticSearch, Riak (TCP/HTTP), MySQL, PostgreSQL, MongoDB, MSSQL, and Oracle.

v1.7.3

2020-05-07

  • Asset correlation now ignores Cisco HSRP MAC addresses.
  • Updated Ethernet fingerprints.

v1.7.2

2020-05-06

  • The mDNS probe no longer causes hung scans on some platforms.

v1.7.1

2020-05-06

  • The “systeminfo” response now includes diagnostic information.
  • Updated Ethernet fingerprints.

v1.7.0

2020-05-04

  • The bundled npcap driver is now version 0.9991.

  • The TLS probe now reports tls.notBeforeTS and tls.notAfterTS fields as unix timestamps.

  • Updated Ethernet fingerprints.

v1.6.10

2020-05-03

  • Updated Ethernet fingerprints.

v1.6.9

2020-05-01

  • The runZero Agent now verifies its own binary on startup and exits if the binary is corrupted.
  • Updated Ethernet fingerprints.

v1.6.8

2020-04-23

  • Updated Ethernet fingerprints.

v1.6.7

2020-04-23

  • The scan engine can now identify TCP services on the scanning system across all platforms.

v1.6.6

2020-04-22

  • The scan engine no longer hangs on misbehaving HTTP services.

v1.6.5

2020-04-22

  • Updated Ethernet and BACnet fingerprints.

v1.6.4

2020-04-17

  • The agent no longer associates relayed asset information with devices that relay mDNS from other networks (ex: Ubiquiti USG).

  • Screenshot collection now considers additional Google Chrome paths and no longer uses Snap packages of Chromium.

v1.6.3

2020-04-14

  • Scans no longer hang while processing HTTP services.

v1.6.2

2020-04-13

  • The Linux agent now restarts properly on Ubuntu 14.04, CentOS 6.10, and other Upstart-based platforms.
  • Fingerprint updates for Crestron, ELAN, MAC addresses, and BACnet.

v1.6.1

2020-04-08

  • The Windows agent now tries harder to work around temporary issues while installing an update.
  • The Windows agent now clears stale chrome.exe processes running as LocalSystem during an update.

v1.6.0

2020-04-06

  • Screenshot collection now limits the number of concurrent Chrome processes based on core count, available RAM, and architecture.
  • The bundled npcap build is now version 0.9990.

v1.5.6

2020-04-04

  • The RDP probe now collects the full NTLMSSP response for more platforms.
  • The HTTP probe now collects information about web forms and their inputs.

v1.5.5

2020-03-27

  • The SNMP probe no longer reports invalid MAC addresses found in ARP caches or MAC tables.

v1.5.4

2020-03-26

  • The TCP probe now handles more kinds of RDP responses.

v1.5.3

2020-03-26

  • The SMB probe now reports subprotocols (smb1, smb2, and smb3) consistently.
  • The SMB probe now collects hashing, encryption, and compression methods from SMBv3 servers.
  • The SMB probe now reports the server-allocated Session ID for smb2 and smb3.
  • The TCP probe now collects NTLM information from Remote Desktop endpoints and reports the protocol as rdp.
  • The HTTP probe now collects additional information from VMware SOAP endpoints.

v1.5.2

2020-03-20

  • The HTTP/2 probe no longer stalls during TLS negotiation.

v1.5.1

2020-03-14

  • Scans no longer deadlock when the system disk is full.
  • Fingerprint updates for Ethernet MAC addresses, BACnet vendors, and Enterprise IDs.
  • HTTP/1 probes now explicitly disable HTTP/2 upgrades, even when the server advertises them. The agent handles HTTP/2 separately.
  • The agent no longer attempts generic protocol negotiation on NDMP ports (10,000/30,000). A future release will support improved NDMP detection and negotiation.
  • The agent now uses an older runtime version to avoid a potential deadlock in the runtime library.

v1.5.0

2020-03-04

  • A new NTP probe reports the clock skew compared to the scanning instance.
  • A new TFTP discovery probe requests a non-existent file and stores the response. The TFTP probe supports port ranges.
  • A new OpenVPN probe can detect remote instances across multiple ports.
  • A new dTLS discovery probe handles both bare dTLS and CAPWAP-encoded variants.
  • The agent now fingerprints Microsoft Remote Desktop Gateway instances through dTLS and HTTP and reports the rdg.Transport service key.
  • The protocol handlers for NATPMP, WS-Discovery, and UPnP Device XML now parse out specific subfields to make matching easier and to support future fingerprinting.
  • The UPnP Device XML parser now downloads and reports the device icon.
  • The SYN scanner is now more reliable and reports progress more accurately.
  • The HTTP probe now identifies and reports web site icons as base64-encoded images along with their MD5 hashes.
  • The HTTP probe now extracts the generator meta tag from HTML responses.
  • The HTTP probe now extracts splunkd versions from HTML responses.
  • The RPCBind probe now sends a null call to every UDP service and probes the NFS daemon directly.
  • VMware ESXi detection has improved, and the agent now uses it as a fallback in more cases.
  • TCP protocol fingerprinting now retries more often on temporary network errors.
  • The JSON output now omits empty fields in the result structure.
  • Linux on ARM 64-bit (aarch64) is now a supported platform.
  • Detection and early rejection of invalid CIDRs have improved.

v1.4.5

2020-02-19

  • The SMB probe now records the NTLMSSP response from more operating systems.
  • The HTTP probe now stores both the response to GET / and the response after following any redirects. Key names for the redirect responses carry the last prefix, such as last.http.code.
  • The HTTP probe now handles compression and chunked transfer encoding properly and stores the normalized HTTP body.
  • The HTTP probe now reports a banner consisting of the raw HTTP response.
  • The HTTP probe now collects environment data from LANDesk Management Agents.
  • The agent now collects HTTP screenshots only when it sees a 2XX HTTP response code.
  • HTTP screenshot processing is now more reliable.

v1.4.4

2020-02-16

  • The agent now uses the SMB Server GUID attribute to correlate results to assets.
  • The agent now uses the SNMP sysName and sysObjectID attributes to unmatch assets that changed IPs or were mistakenly matched through another attribute (shared bogus MAC addresses or similar).
  • The ARP and SYN scanners now ignore interfaces with no global unicast addresses (including RFC1918).
  • The SYN scanner now ignores VLAN-tagged frames, so packets no longer go out on the wrong interface.
  • SYN scans now have a mandatory delay between retry attempts, which improves reliability and reduces change churn when scanning small network ranges.

v1.4.3

2020-02-13

  • Concurrent scans now use fewer resources and provide more accurate results.
  • Some HTTP requests are no longer sent with an empty Host header.
  • Versions 1.4.1 and 1.4.2 were internal test releases and were not deployed.

v1.4.0

2020-02-04

  • Version 1.4.0 is a rollup of post-1.3.0 point release work.

v1.3.2

2020-02-02

  • Agents now support concurrent scans, configured via the cloud console.
  • Agents now write log files and rotate them automatically.
  • Agents now scan faster on local segments within AWS VPCs.
  • Agents now support SNMP v3 Context values in the scan configuration.
  • Agents now try harder to recover from error cases during installation.

v1.3.1

2020-01-26

  • A race condition no longer leaves abandoned chrome.exe processes behind after a scan.

v1.3.0

2020-01-07

  • Version 1.3.0 is a rollup of post-1.2.0 point release work.

v1.2.3

2019-12-19

  • The agent now tracks virtual hosts better for reported HTTP and TLS services.

v1.2.2

2019-12-19

  • The agent now supports the BACnet protocol.

v1.2.1

2019-12-13

  • The protocol detection engine has several small improvements, including mongod recognition.

v1.2.0

2019-12-01

  • Version 1.2.0 is a rollup of post-1.1.0 point release work.

v1.1.15

2019-12-01

  • The wlan-list probe now normalizes wireless network fields better.

v1.1.14

2019-11-27

  • This release fixes more SNMP processing bugs.
  • The agent now has initial support for the wlan-list probe module.

v1.1.13

2019-11-26

  • The agent now handles truncated HTTP responses better.

v1.1.12

2019-11-24

  • The agent now handles invalid SNMP responses more efficiently.

v1.1.11

2019-11-24

  • Setting Max Group Size to zero no longer exhausts memory.

v1.1.10

2019-11-23

  • The SNMP probe no longer misses the last round of enumeration results.
  • Scans that use excessive memory now automatically upload a heap profile for support diagnostics.

v1.1.9

2019-11-22

  • Error handling and logging have improved, with a minor performance increase.

v1.1.8

2019-11-22

  • Scan reply deduplication now uses less memory.

v1.1.7

2019-11-19

  • CAM/MAC table enumeration now includes Cisco-specific MIBs.
  • The SNMP probe now queries SNMP v2 two ways to improve device compatibility.
  • SNMP v3 authenticated enumeration is now available.

v1.1.6

2019-11-19

  • The SNMP probe has several small bug fixes.

v1.1.5

2019-11-18

  • The SNMP probe now tries to obtain the full interface and MAC address list from each asset.

v1.1.4

2019-11-14

  • Miscellaneous fingerprinting improvements.

v1.1.3

2019-11-07

  • Protocol detection for the Click Modular Router daemon has improved.

v1.1.2

2019-11-05

  • The agent no longer gets stuck in “stopping” status when a scan is stopped.

v1.0.15

2019-11-04

  • Scans now support the Max Group Size option to limit the number of concurrent scan targets.
  • The MAC address prefix database is updated, along with other dependencies and fingerprints.

v1.0.9

2019-10-24

  • The SYN probe now sends retries with the same source port and sequence number to minimize duplicate responses. MAC address fingerprints are updated.

v1.0.8

2019-10-23

  • The SYN probe now retries twice if it receives no RST. This improves reliability at the cost of slightly longer scan times. The syn-max-retries parameter in the console controls this behavior.

v1.0.7

2019-10-21

  • Enabling the ARP probe for non-local scan targets no longer reduces scanner performance.

v1.0.3

2019-10-06

  • The macOS agent now supports additional interface types (loopback and tunnel adapters).

v1.0.2

2019-10-02

  • A race condition no longer causes the agent to crash mid-scan. Affected scans showed an error status of task lost to agent restart.

v1.0.1

2019-10-01

Updated