Early Scanner release notes

View as Markdown

Scanner release notes prior to 1.7.9

Starting with version 1.7.9 all release notes have been consolidated into one page.

v1.7.8

2020-05-23

  • Fingerprint updates.

v1.7.7

2020-05-22

  • Fingerprint updates.

v1.7.6

2020-05-14

  • The dynamic MAC address filter now uses the new service attributes consistently.

v1.7.5

2020-05-14

  • Asset and Service attributes are now normalized. All keys are camelCase, and most service attributes carry the protocol name as a prefix.

v1.7.4

2020-05-13

  • Support for these database protocols has improved: Memcached (TCP), CouchDB, Cassandra, Redis, ElasticSearch, Riak (TCP/HTTP), MySQL, PostgreSQL, MongoDB, MSSQL, and Oracle.

v1.7.3

2020-05-07

  • Asset correlation now ignores Cisco HSRP MAC addresses.
  • Updated Ethernet fingerprints.

v1.7.2

2020-05-06

  • The mDNS probe no longer causes hung scans on some platforms.

v1.7.1

2020-05-06

  • Updated Ethernet fingerprints.

v1.7.0

2020-05-04

  • The bundled npcap driver is now version 0.9991.
  • The TLS probe now reports tls.notBeforeTS and tls.notAfterTS fields as unix timestamps.
  • Updated Ethernet fingerprints.

v1.6.10

2020-05-03

  • Updated Ethernet fingerprints.

v1.6.9

2020-05-01

  • The scanner now supports Recog development with the --fingerprints and --fingerprints-debug options.
  • The Switch Topology and Network Bridges reports are now available in the CLI scanner.
  • Updated Ethernet fingerprints.

v1.6.8

2020-04-23

  • Updated Ethernet fingerprints.

v1.6.7

2020-04-23

  • The scan engine can now identify TCP services on the scanning system across all platforms.

v1.6.6

2020-04-22

  • The scan engine no longer hangs on misbehaving HTTP services.

v1.6.5

2020-04-22

  • The scanner now supports the runZero Starter Edition.
  • Updated Ethernet and BACnet fingerprints.

v1.6.4

2020-04-17

  • The scanner no longer associates relayed asset information with devices that relay mDNS from other networks (ex: Ubiquiti USG).

  • Screenshot collection now considers additional Google Chrome paths and no longer uses Snap packages of Chromium.

v1.6.3

2020-04-14

  • Scans no longer hang while processing HTTP services.

v1.6.2

2020-04-13

  • Fingerprint updates for Crestron, ELAN, MAC addresses, and BACnet.

v1.6.1

2020-04-08

  • The MAC address database fingerprints are updated.

v1.6.0

2020-04-06

  • Screenshot collection now limits the number of concurrent Chrome processes based on core count, available RAM, and architecture.
  • The bundled npcap build is now version 0.9990.

v1.5.6

2020-04-04

  • The RDP probe now collects the full NTLMSSP response for more platforms.
  • The HTTP probe now collects information about web forms and their inputs.

v1.5.5

2020-03-27

  • The SNMP probe no longer reports invalid MAC addresses found in ARP caches or MAC tables.

v1.5.4

2020-03-26

  • The TCP probe now handles more kinds of RDP responses.

v1.5.3

2020-03-26

  • The SMB probe now reports subprotocols (smb1, smb2, and smb3) consistently.
  • The SMB probe now collects hashing, encryption, and compression methods from SMBv3 servers.
  • The SMB probe now reports the server-allocated Session ID for smb2 and smb3.
  • The TCP probe now collects NTLM information from Remote Desktop endpoints and reports the protocol as rdp.
  • The HTTP probe now collects additional information from VMware SOAP endpoints.
  • A race condition in --nopcap mode no longer produces inconsistent results.

v1.5.2

2020-03-20

  • The HTTP/2 probe no longer stalls during TLS negotiation.

v1.5.1

2020-03-14

  • Fingerprint updates for Ethernet MAC addresses, BACnet vendors, and Enterprise IDs.
  • HTTP/1 probes now explicitly disable HTTP/2 upgrades, even when the server advertises them. The scanner handles HTTP/2 separately.
  • The scanner no longer attempts generic protocol negotiation on NDMP ports (10,000/30,000). A future release will support improved NDMP detection and negotiation.
  • The scanner now uses an older runtime version to avoid a potential deadlock in the runtime library.

v1.5.0

2020-03-04

  • A new NTP probe reports the clock skew compared to the scanning instance.
  • A new TFTP discovery probe requests a non-existent file and stores the response. The TFTP probe supports port ranges.
  • A new OpenVPN probe can detect remote instances across multiple ports.
  • A new dTLS discovery probe handles both bare dTLS and CAPWAP-encoded variants.
  • The scanner now fingerprints Microsoft Remote Desktop Gateway instances through dTLS and HTTP and reports the rdg.Transport service key.
  • The protocol handlers for NATPMP, WS-Discovery, and UPnP Device XML now parse out specific subfields to make matching easier and to support future fingerprinting.
  • The UPnP Device XML parser now downloads and reports the device icon.
  • The SYN scanner is now more reliable and reports progress more accurately.
  • The HTTP probe now identifies and reports web site icons as base64-encoded images along with their MD5 hashes.
  • The HTTP probe now extracts the generator meta tag from HTML responses.
  • The HTTP probe now extracts splunkd versions from HTML responses.
  • The RPCBind probe now sends a null call to every UDP service and probes the NFS daemon directly.
  • VMware ESXi detection has improved, and the scanner now uses it as a fallback in more cases.
  • TCP protocol fingerprinting now retries more often on temporary network errors.
  • The JSON output now omits empty fields in the result structure.
  • Linux on ARM 64-bit (aarch64) is now a supported platform.
  • Detection and early rejection of invalid CIDRs have improved.

v1.4.5

2020-02-19

  • The SMB probe now records the NTLMSSP response from more operating systems.
  • The HTTP probe now stores both the response to GET / and the response after following any redirects. Key names for the redirect responses carry the last prefix, such as last.http.code.
  • The HTTP probe now handles compression and chunked transfer encoding properly and stores the normalized HTTP body.
  • The HTTP probe now reports a banner consisting of the raw HTTP response.
  • The HTTP probe now collects environment data from LANDesk Management Agents.
  • The scanner now collects HTTP screenshots only when it sees a 2XX HTTP response code.
  • HTTP screenshot processing is now more reliable.

v1.4.4

2020-02-16

  • The scanner now uses the SMB Server GUID attribute to correlate results to assets.
  • The scanner now uses the SNMP sysName and sysObjectID attributes to unmatch assets that changed IPs or were mistakenly matched through another attribute (shared bogus MAC addresses or similar).
  • The ARP and SYN scanners now ignore interfaces with no global unicast addresses (including RFC1918).
  • The SYN scanner now ignores VLAN-tagged frames, so packets no longer go out on the wrong interface.
  • SYN scans now have a mandatory delay between retry attempts, which improves reliability and reduces change churn when scanning small network ranges.

v1.4.3

2020-02-13

  • Some HTTP requests are no longer sent with an empty Host header.

v1.4.2

2020-02-05

  • Version 1.4.2 improves fingerprinting and type classification of Windows operating systems.

v1.4.1

2020-02-04

  • Version 1.4.1 resolves a regression that ignored --input-targets.

v1.4.0

2020-02-04

  • Version 1.4.0 is a rollup of post-1.3.0 point release work.

v1.3.2

2020-02-02

  • The scanner now supports the --arp-fast option, which sends ARP probes at the configured --rate without additional delays. This option is on by default in AWS VPC environments.
  • The scanner now supports the --snmp-v3-context option, which specifies the SNMP v3 Context for queries.

v1.3.1

2020-01-26

  • The scanner now supports the --baseline option (-b), which loads a previous assets.jsonl and reuses its asset IDs in the new assets.jsonl output.
  • The scanner now accepts multiple --import files, so you can recombine multiple scans into a single output.
  • The scanner now supports the --upload option, which uses --api-key, --upload-site, and other API-related options to upload scan data to the runZero Console.
  • A race condition no longer leaves abandoned chrome.exe processes behind after a scan.
  • The scanner no longer uses or displays a blank virtual host for HTTP servers.

v1.3.0

2020-01-07

  • Version 1.3.0 is a rollup of post-1.2.0 point release work.

v1.2.3

2019-12-19

  • The CLI scanner now generates a protocols.csv file with a simplified list of services and their URLs.

v1.2.2

2019-12-19

  • The scanner now supports the BACnet protocol.

v1.2.1

2019-12-13

  • This release adds many new fingerprints for HTTP and SIP endpoints.
  • Asset correlation now runs after the scan completes rather than during the scan, for more consistent results.
  • The protocol detection engine has several small improvements, including mongod recognition.
  • The scanner now correctly handles network segments where a device responds to all ARP requests with the same MAC address.

v1.2.0

2019-12-01

  • Version 1.2.0 is a rollup of post-1.1.0 point release work.

v1.1.15

2019-12-01

  • The scanner now generates wireless.jsonl and wireless.csv reports automatically when the wlan-list probe returns results.
  • The wlan-list probe now normalizes wireless network fields better.

v1.1.14

2019-11-27

  • This release fixes more SNMP processing bugs.
  • The scanner now has initial support for the wlan-list probe module.

v1.1.13

2019-11-26

  • The scanner now handles truncated HTTP responses better.

v1.1.12

2019-11-24

  • The scanner now handles invalid SNMP responses more efficiently.

v1.1.11

2019-11-24

  • Setting Max Group Size to zero no longer exhausts memory.

v1.1.10

2019-11-23

  • The SNMP probe no longer misses the last round of enumeration results.

v1.1.9

2019-11-22

  • Error handling and logging have improved, with a minor performance increase.

v1.1.8

2019-11-22

  • Scan reply deduplication now uses less memory.

v1.1.7

2019-11-19

  • CAM/MAC table enumeration now includes Cisco-specific MIBs.
  • The SNMP probe now queries SNMP v2 two ways to improve device compatibility.
  • SNMP v3 authenticated enumeration is now available.

v1.1.6

2019-11-19

  • The SNMP probe has several small bug fixes.

v1.1.5

2019-11-18

  • The SNMP probe now tries to obtain the full interface and MAC address list from each asset.

v1.1.4

2019-11-14

  • The _links.* asset attributes now report network topology links.
  • Miscellaneous fingerprinting improvements.

v1.1.3

2019-11-07

  • Additional SSH fingerprints cover Debian, Ubuntu, Raspbian, and FreeBSD.
  • Protocol detection for the Click Modular Router daemon has improved.

v1.1.2

2019-11-05

  • The scan engine no longer hangs when a scan is interrupted.

v1.0.15

2019-11-04

  • The scanner now supports the --max-group-size option to limit the host working set (default is 4096).
  • A race condition in the --text mode output no longer causes rare crashes.
  • The MAC address prefix database is updated, along with other dependencies and fingerprints.

v1.0.10

2019-10-25

  • The scanner now supports the --overwrite option to reuse an existing output directory.

v1.0.9

2019-10-24

  • The SYN probe now sends retries with the same source port and sequence number to minimize duplicate responses. MAC address fingerprints are updated.

v1.0.8

2019-10-23

  • The SYN probe now retries twice if it receives no RST. This improves reliability at the cost of slightly longer scan times. The –syn-max-retries parameter controls this behavior.

v1.0.7

2019-10-21

  • Enabling the ARP probe for non-local scan targets no longer reduces scanner performance.

v1.0.3

2019-10-06

  • The macOS scanner now supports additional interface types (loopback and tunnel adapters).
  • The macOS scanner no longer prints warnings about unusable interfaces unless the verbose flag is set.
  • The --text interface of the scanner now reports the correct result count.

v1.0.2

2019-10-02

  • A race condition no longer causes the scanner to crash mid-scan.
  • The macOS scanner no longer crashes when it finds an unusable interface while not running as root.

v1.0.1

2019-10-01

Updated