Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Gordon Fyodor Lyon
Npcap Version 1.82 Released with VLAN Tagging and More
Nmap Announce mailing list archives From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Mon, 28 Apr 2025 14:48:31 -0700 Dear Nmap Community, In preparation for an imminent Nmap release (hopefully this week!), we have released Version 1.82 of our Npcap Windows packet capture and transmission driver. It builds upon the recent 1.81 release to add support for VLAN tagging. This allows you to select for packets directed to a certain VLAN or just inspect the VLAN headers on any packets received.
Re: Mail stoppage
Nmap Development mailing list archives From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Wed, 12 Feb 2025 15:43:36 -0800 Yes, this was my fault. Mail to the Nmap dev list from non-subscribers goes through moderation to keep out the spam. I regularly go through the moderation queue to find and approve the "real" messages, but I was a bit slow this time. We strongly recommend that folks posting to the list first subscribe to it.
Nmap 7.95 released: OS and service detection signatures galore!
Nmap Announce mailing list archives From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Sun, 5 May 2024 11:15:04 -0700 Dear Nmap Community, I just arrived in San Francisco for the RSA conference and am delighted to announce our Nmap Version 7.95 release! I'm most excited that we finally tackled our backlog of OS and service detection fingerprint submissions.
Npcap Celebrates its 10th Anniversary In Space!
Nmap Announce mailing list archives From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Thu, 5 Oct 2023 15:27:40 -0700 Dear Nmap community, Last month we celebrated Nmap's 26th birthday and today I'm happy to share another big milestone: Our Npcap driver for capturing and sending raw packets on Windows turned 10 this year! From humble beginnings as a security and modernization patch for the discontinued WinPcap project, Npcap has become an indispensable component for both Nmap and Wireshark.
Nmap 26th Birthday Announcement: Version 7.94
Nmap Announce mailing list archives From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Fri, 1 Sep 2023 20:05:56 -0700 Dear Nmap community, Today is Nmap’s 26th birthday, which reminded me that I hadn’t yet announced our Nmap 7.94 release from May. And it’s a great one! The biggest improvement was the Zenmap and Ndiff upgrades from the obsolete Python 2 language to Python 3 on all platforms.
Npcap Versions 1.70 and 1.71 improve Windows packet capturing performance, stability, security, and compatibility
Nmap Announce mailing list archives From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Thu, 1 Sep 2022 18:18:45 -0700 Hello folks. While the Nmap Project has been quiet lately (this is my first post of the year), I'm happy to share some great progress on both Nmap and Npcap development. Starting with our Npcap Windows packet capturing/sending library, I'm happy to report that we quietly released Version 1.70 in June and then 1.71 on August 19.
Nmap 7.93 - 25th Anniversary Release!
Nmap Announce mailing list archives From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Thu, 1 Sep 2022 19:26:21 -0700 Dear Nmap community, Twenty five years ago today, I released the first version of Nmap in a Phrack article named The Art of Port Scanning (https://nmap.org/p51-11.html). I never thought I'd still be at it a quarter of a century later, but that's because I also didn't anticipate such a wonderful community of users and contributors spanning those decades.
Re: Nmap uses PCRE library and scan tool report one vulnerability CVE-2022-1586 & CVE-2022-1587 to PCRE2 library
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev Nmap Development mailing list archives From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Mon, 20 Jun 2022 14:09:29 -0700 Hi Shivani. Thanks for the report. Those two vulnerabilities are in the PCRE2 (2nd generation) PCRE library. Although we plan to upgrade to PCRE2 soon, Nmap is currently still using the 1st generation PCRE which is not susceptible to these bugs.
Code Hardening, Compatibility, and Bug Fixes
Nmap Announce mailing list archives By Date By Thread Npcap 1.60 Release: Code Hardening, Compatibility, and Bug Fixes From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Wed, 8 Dec 2021 12:37:54 -0800 Hi Nmap (and Npcap) hackers! I hope you're enjoying the start of the holidays. For your first stocking stuffer, we're happy to release Npcap Version 1.60! We also released (but never actually announced) Version 1.55 in September. We put out Versions 1.12 and 1.11 of the SDK too.
npcap-1.55.exe flaged as malicious
Nmap Development mailing list archives By Date By Thread Re: npcap-1.55.exe flaged as malicious From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Wed, 24 Nov 2021 13:20:33 -0800 Hi Onno. Good question. Npcap Version 1.55 is absolutely not malicious or infected by anything, but unfortunately there are a many garbage antivirus engines out there which flood VirusTotal with false positives like this.
Nmap 7.92 Defcon Release!
Nmap Announce mailing list archives By Date By Thread Nmap 7.92 Defcon Release! From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Sat, 7 Aug 2021 20:19:38 -0700 Hi folks. Many of us can't attend Defcon in person this year due to global pandemic, but we won't let that stop our traditional Defcon Nmap release! We just posted Nmap 7.92 to https://nmap.org/download.html. It includes dozens of performance improvements, feature enhancements, and bug fixes that we've made over the last 10 months.
Npcap 1.50 Release Brings Nmap & Wireshark to Windows ARM devices
Nmap Announce mailing list archives By Date By Thread Npcap 1.50 Release Brings Nmap & Wireshark to Windows ARM devices From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Mon, 28 Jun 2021 13:44:57 -0700 Hi folks. The Nmap Project is pleased to release Npcap version 1.50 at https://npcap.org.
NPCAP GitHub Security Advisories
Nmap Development mailing list archives By Date By Thread Re: NPCAP GitHub Security Advisories From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Sat, 1 May 2021 11:22:06 -0700 Hi Jay. Good questions, and I'm glad you like Nmap and Npcap! We are not using GitHub's security feature at present. If we issued a security advisory for Npcap or Nmap, we would likely host it ourselves.
Raw WiFi + Better Performance
Nmap Announce mailing list archives By Date By Thread Npcap 1.30 Released: Raw WiFi + Better Performance From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Mon, 12 Apr 2021 14:27:58 -0700 Hi folks. The Nmap Project is pleased to release Npcap Version 1.30 at https://npcap.org. We hope Nmap and Wireshark users will be especially happy with the raw WiFi improvements, since you tend to be particularly savvy about low-level network inspection.
Npcap 1.20 released
Nmap Announce mailing list archives By Date By Thread Npcap 1.20 released From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Tue, 16 Mar 2021 14:38:37 -0700 Nmap/Npcap Community: I'm happy to report the release of version 1.20 of the Npcap Windows packet capturing/sending driver! It's the first release of 2021 and includes better capabilities for selecting timestamp methods as well as many other improvements and bug fixes.
Microsoft publishes Nmap NSE script for detecting Exchange Server SSRF Vulnerability (CVE-2021-26855)
Nmap Development mailing list archives By Date By Thread Microsoft publishes Nmap NSE script for detecting Exchange Server SSRF Vulnerability (CVE-2021-26855) From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Tue, 16 Mar 2021 12:47:35 -0700 It's kind of awesome to see that MS released an Nmap NSE script last week for detecting the new Exchange Server SSRF Vulnerability (CVE-2021-26855).
nping --ipv6 source determination
Nmap Development mailing list archives By Date By Thread Re: nping --ipv6 source determination From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Wed, 14 Oct 2020 15:26:12 -0700 Thanks for the reminder, Artem. We spent a long time super-focused on Npcap since that's such a critical part of Nmap. But this put us behind a lot of other Nmap "maintenance" (like reviewing pull requests and organizing issues and integrating OS/service fingerprint updates). We're working on that backlog now.
Nmap 7.91 Bugfix Release
Nmap Announce mailing list archives By Date By Thread Nmap 7.91 Bugfix Release From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Wed, 14 Oct 2020 12:28:50 -0700 Hello everyone. I'm glad Nmap 7.90 was so well received! There were so many improvements that the official announcement ( https://seclists.org/nmap-announce/2020/1) was a bit unwieldy.
Re: Crash Report
Nmap Development mailing list archives By Date By Thread Re: Crash Report From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Fri, 9 Oct 2020 13:18:00 -0700 Hi João. Thanks for the report. We believe we have fixed this in the Nmap code and we're hoping to put out a bugfix release very soon addressing this and a handful of other issues that have popped up. More details on this particular crash are at https://github.com/nmap/nmap/issues/2148.
Re: WlanHelper Problem
Nmap Development mailing list archives By Date By Thread Re: WlanHelper Problem From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Fri, 9 Oct 2020 13:21:42 -0700 Hi Mihai. Many adapters (specifically their Windows device driver software) don't support Monitor Mode very well.
Nmap Development: Re: crash report
Nmap Development mailing list archives By Date By Thread Re: crash report - new version 7.90 From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Fri, 9 Oct 2020 13:24:29 -0700 Hi Brent. Thanks for the report. Please see my recent answer to João Domingues here: https://seclists.org/nmap-dev/2020/q4/10 -Gordon "Fyodor" Lyon On Wed, Oct 7, 2020 at 2:08 PM Brent Roberts via dev <dev () nmap org> wrote: Hi, FYI...
"--script vuln" fails since upgrading to 7.90 on W64
Nmap Development mailing list archives By Date By Thread Re: "--script vuln" fails since upgrading to 7.90 on W64 From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Fri, 9 Oct 2020 13:38:35 -0700 Hi John. Thanks for the report. Unfortunately we didn't catch this "time result cannot be represented in this installation" problem in testing because it only affects time zones that are ahead of coordinated universal time (UTC).
Nmap 7.90 Released! First release since August 2019.
Nmap Announce mailing list archives By Date By Thread Nmap 7.90 Released! First release since August 2019. From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Sat, 3 Oct 2020 13:48:42 -0700 Hello everyone. Hot on the heels of the big Npcap 1.00 release ( https://seclists.org/nmap-announce/2020/0), we're delighted to announce a new Nmap--version 7.90! It's the first Nmap release since Defcon 2019, even though we've made 16 Npcap releases since then.
Npcap 1.00 was just released and a new Nmap is on the way!
Nmap Announce mailing list archives By Date By Thread Npcap 1.00 was just released and a new Nmap is on the way! From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Mon, 28 Sep 2020 14:09:33 -0700 Hello everyone. I hope you are all safe and well during this nasty pandemic. I obviously haven't been wearing my marketing hat enough given that this is my first mail to the Nmap Announcement list since last August's Nmap 7.80 release.
Re: Script phases
Nmap Development mailing list archives By Date By Thread Re: Script phases From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Thu, 3 Sep 2020 10:58:30 -0700 Hi Mehrin. Host and service script types (which are the vast majority of scripts) are both run during the "Script scanning" Nmap phase. Nmap has separate overall phases for prerule and postrule scripts specifically, so they are split out in the main Nmap scanning phase documentation.
Re: Remote Packet Capture
Nmap Development mailing list archives By Date By Thread Re: Remote Packet Capture From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Mon, 10 Aug 2020 17:20:57 -0700 Hi Tim. Npcap does not currently support rpcapd, but we might in the future. You are welcome to add any comments to the feature request on our tracker: https://github.com/nmap/npcap/issues/74 In the meantime, maybe you could use something like RDP to run tools like Wireshark on the remote system itself?
Probe submission for OpenText Gupta SQLBase
Nmap Development mailing list archives By Date By Thread Re: Probe submission for OpenText Gupta SQLBase From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Fri, 26 Jun 2020 10:36:13 -0700 Thanks Matthias! To better track this submission, I created an issue for it here: https://github.com/nmap/nmap/issues/2071 We've been really focused on Npcap for the last year (because it is critical infrastructure for Nmap), but we're about to turn a lot more of our attention to Nmap proper! Cheers, Fyodor...
Fix off-by-one error in stun.lua
Nmap Development mailing list archives By Date By Thread Re: Fix off-by-one error in stun.lua From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Thu, 12 Dec 2019 10:55:50 -0800 Thanks David. Good catch! Please check this fix in.
UDP payload for STUN
Nmap Development mailing list archives By Date By Thread Re: UDP payload for STUN From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Fri, 6 Dec 2019 12:52:42 -0800 Thanks David! Please check it in. -Fyodor On Fri, Dec 6, 2019 at 12:51 PM David Fifield <david () bamsoftware com> wrote: Here is a UDP payload for STUN, which normally runs on port 3478/udp. The payload is a Binding request, which asks the STUN server to return the client's external IP address.
Re: Problem with WinDump
Wireshark mailing list archives By Date By Thread Re: Problem with WinDump From: Gordon Fyodor Lyon <gordon () nmap org> Date: Tue, 29 Oct 2019 18:07:34 -0700 On Tue, Oct 29, 2019 at 5:43 PM Guy Harris <guy () alum mit edu> wrote: On Oct 29, 2019, at 4:53 AM, Cristian Soto <csoto () unitronics es> wrote: I’m having some issues with WinDump not showing the VLan although with WireShark I get it.
Need for a driver-debug version of the Npcap installer
Nmap Development mailing list archives By Date By Thread Re: Need for a driver-debug version of the Npcap installer From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Fri, 11 Oct 2019 22:23:24 -0700 On Fri, Oct 11, 2019 at 5:25 PM yu-jui woo <haich.woo () gmail com> wrote: Here https://nmap.org/npcap/guide/npcap-users-guide.html it says that we might get a debug version of the installed for generating the driver log, so I write this email in hope that I can have that from you. Hi Haich.
Wireless toolbar in Wireshark 3.0
Wireshark mailing list archives By Date By Thread Re: Wireless toolbar in Wireshark 3.0 From: Gordon Fyodor Lyon <gordon () nmap org> Date: Mon, 7 Oct 2019 10:03:47 -0700 On Fri, Sep 20, 2019 at 8:58 AM Maynard, Chris via Wireshark-users < wireshark-users () wireshark org> wrote: I'm not sure how up-to-date the https://secwiki.org/w/Npcap/WiFi_adapters page is.
Cisco Smart Install script
Nmap Development mailing list archives By Date By Thread Re: Cisco Smart Install script From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Wed, 18 Sep 2019 21:59:47 -0700 That sounds good. Once you're happy with the script, can you submit a Github pull request so people can start testing it out? Cheers, Fyodor On Mon, Sep 9, 2019 at 10:50 AM XenoN. w0w <e-net15 () hotmail com> wrote: I am really honored that I got response from you.
Cisco Smart Install script
Nmap Development mailing list archives By Date By Thread Re: Cisco Smart Install script From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Mon, 9 Sep 2019 10:33:39 -0700 On Mon, Aug 26, 2019 at 4:08 AM XenoN. w0w <e-net15 () hotmail com> wrote: Hello guys, during penetration testing engagements I often come to cisco devices which allows me to grab their config over smart install protocol. I would like to make a script and add functionality of testing and getting config within the script.
Re: Extending Npcap
Nmap Development mailing list archives By Date By Thread Re: Extending Npcap From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Sat, 7 Sep 2019 13:15:45 -0700 On Thu, Sep 5, 2019 at 11:51 PM Holger Pfrommer <HPfrommer () hilscher com> wrote: Cheers, I’d like to extend Npcap library to support an additional capture device. Goal is to contribute the code to your nice project so it’ll be available to the whole public in future.
Re: Next Nmap Release?
Nmap Development mailing list archives By Date By Thread Re: Next Nmap Release? From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Sat, 10 Aug 2019 15:21:04 -0700 On Mon, Jun 3, 2019 at 12:08 PM Daniel Cater <djcater () gmail com> wrote: Firstly, I know Nmap is free and largely run by volunteers, for which I'm very grateful.
Nmap Defcon Release! 80+ improvements include new NSE scripts/libs, new Npcap, etc.
Nmap Announce mailing list archives By Date By Thread Nmap Defcon Release! 80+ improvements include new NSE scripts/libs, new Npcap, etc. From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Sat, 10 Aug 2019 14:25:22 -0700 Fellow hackers, I'm here in Las Vegas for Defcon and delighted to release Nmap 7.80.
Nmap Defcon Dinner Invitation for TONIGHT (Saturday)
Nmap Development mailing list archives By Date By Thread Nmap Defcon Dinner Invitation for TONIGHT (Saturday) From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Sat, 10 Aug 2019 00:49:41 -0700 Hey folks! Sorry it is last minute, but we're hosting an Nmap developer dinner tonight at 6:30pm and I wanted to invite any community members who I might not already know are here at Defcon.
Ignore TCP RST #1616
Nmap Development mailing list archives By Date By Thread Re: Pull Request: Host Discovery: Ignore TCP RST #1616 From: Gordon Fyodor Lyon <fyodor () nmap org> Date: Mon, 10 Jun 2019 12:19:23 -0700 On Mon, Jun 3, 2019 at 8:24 AM Tom Sellers <nmap () fadedcode net> wrote: All, Since not everyone checks GitHub PRs I'm CCing this PR to the list. Hi Tom. Thanks for the patch! My only concern is whether TCP host discovery probes still provide much value if you are ignoring the RST responses.
Wireshark Windows installer no longer redistributable?
Wireshark mailing list archives By Date By Thread Re: Wireshark Windows installer no longer redistributable? From: Gordon Fyodor Lyon <gordon () nmap org> Date: Mon, 11 Mar 2019 14:15:55 -0700 On Mon, Mar 11, 2019 at 11:24 AM Laurence Perkins <lperkins () openeye net> wrote: So I notice with version 3 that wireshark now bundles npcap instead of winpcap. From a technical point of view this makes a lot of sense since npcap is actually maintained and has a better feature set.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Gordon Fyodor
Contact Gordon Fyodor, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack