Strange NMAP behavior

[Y C]

We recently upgraded from 1.3 (no nmap probe option available) to 2.1 (defaults to policy nodes having nmap probe enabled).

Long story short - it's profiled a bunch of our devices improperly as cisco-router. Xerox & Ricoh printers, some apple devices, etc. Seems random. Apparently it gathered info that the device is a Cisco 3925 running this version IOS, or a 6506 running that version IOS...

How exactly does NMAP determine OS version? The probe description mentions it looks for open ports and OS version. Surely it relies on more then just open ports to determine a specific version.

operating-system	Cisco 6506 router (IOS 12.2)
operating-system-result	Cisco 6506 router (IOS 12.2)

operating-system	Cisco 2811 router (IOS 12.2 - 12.4) (accuracy 95%)
operating-system-result	Cisco 2811 router (IOS 12.2 - 12.4) (accuracy 95%)

[marce1000]

 https://www.comparitech.com/net-admin/the-definitive-guide-to-nmap/#OS_Scanning

 M.

[Y C]

Well, I guess what I should say is... regardless of what it uses, if it's this inaccurate what's the point? And the idea how it favors Cisco products is amusing. It's forgivable if it recognizes an ipad as an iphone... but a printer as a 6506? Really?

[Surendra]

If not enough ports are open, there is something called an aggressive OS lookup that is done causing the misinterpretation of the operating system. ISE uses the operating system guess from nmap.org. It is an open source resource for nmap implementation.

[Y C]

operating-system	Cisco Nexus 7000 switch (NX-OS 4.2.6) (accuracy 99%)
operating-system-result	Cisco Nexus 7000 switch (NX-OS 4.2.6) (accuracy 99%)

That's an apple device - so it thinks it's wild guess was 99% accurate.

Sounds like turning it off was the right thing to do. It's a surprise this is enabled by default if it's known wild guesses like this can happen.