--- nmap-service-probes.orig 2010-01-04 10:25:55.000000000 +0100 +++ nmap-service-probes 2010-01-04 10:58:59.000000000 +0100 @@ -783,6 +783,7 @@ match ftp m|^220-Local time is now [\d:]+\r\n220 You will be disconnected after 300 seconds of inactivity\.\r\n| p/DViCO TVIX 6500A set top box ftpd/ d/media device/ #(insert ftp) +match ftp m|^220 ET(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})(\w{2}) S300-S400 Series FTP Server ready\.\r\n| d/printer/ p/Lexmark S300-S400 Series FTP Server/ i/MAC: $1:$2:$3:$4:$5:$6/ # not already sure about the next. maybe too generic? it exists already above a signature for openftpd. embyte match ftp m|^220 OpenFTPD server([^ ]+)?| p/OpenFTPD/ v/$1/ @@ -8061,6 +8062,9 @@ match mdns m|^\0\0\x84\0\0\0\0\x05\0\0\0\0.Lexmark ([\x20-\x7f]+)\x0c_host-config\x04_udp\x05local\0|s p/Lexmark $1 printer mdns/ d/printer/ +match hbn3 m|^\0\0\x84\0\0\0\0\x05\0\0\0\0\x15S300-S400 Series \(32\).+ET(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})| p/Lexmark S302 HBN3 Service/ d/printer/ i/MAC: $1:$2:$3:$4:$5:$6/ +match hbn3 m|^\0\0\x84\0\0\0\0\x05\0\0\0\0\x15S300-S400 Series.+ET(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})| p/Lexmark S300-S400 Series HBN3 Service/ d/printer/ i/MAC: $1:$2:$3:$4:$5:$6/ + softmatch mdns m|^\0\0\x84\0\0\0\0\x05\0\0\0\0| # These first two probes only serve to determine the NTP version