Correction: Huawei router misidentified as Netgear switch (fingerprint included)

["gbfdhenr (Liang Xiangan)" <gbfdhenr () 163 com>]

Hi Nmap team,


I've encountered a clear OS detection misidentification that I believe should be corrected.


**Device in question**:
- A Huawei home router (MAC OUI: 30:A9:98 -> Huawei Device)
- Open ports: 53, 80, 443 (typical router/AP, not a headless switch)
- Running: Linux-based firmware (likely 3.18.24)


**Current incorrect result**:
Nmap 7.99 reports it as: "Netgear GS108Tv3, GS110Tv3, or GS308T switch (Linux 3.18.24)"


**Actual fingerprint obtained**:
OS:SCAN(V=7.99%E=4%D=7/31%OT=53%CT=1%CU=37776%PV=Y%DS=1%DC=D%G=Y%M=30A998%T
M=6A6C5546%P=x86_64-pc-linux-gnu)SEQ(SP=108%GCD=1%ISR=10C%TI=Z%CI=I%II=I
%TS=U)OPS(O1=M5B4NNSNW4%O2=M5B4NNSNW4%O3=M5B4NW4%O4=M5B4NNSNW4%O5=M5B4NN
SNW4%O6=M5B4NNS)WIN(W1=7210%W2=7210%W3=7210%W4=7210%W5=7210%W6=7210)ECN(
R=Y%DF=Y%T=40%W=7210%O=M5B4NNSNW4%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T
=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=
S)


**Suggested fix**:
Please add this fingerprint to the "Huawei router/AP" class rather than the Netgear switch class. The presence of ports 
53, 80, 443 and the MAC OUI strongly indicate a consumer-grade gateway device.


This device is very common in Asia-Pacific markets, so correcting this will significantly reduce false positives for 
many users.


Let me know if you need any further probes.


Thanks,
Liang Xiangan

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at https://seclists.org/nmap-dev/