Nmap quake1-info NSE Script

Script Overview

Script source code: https://github.com/nmap/nmap/tree/master/scripts/quake1-info.nse
Script categories: default, discovery, safe, version
Target service / protocol: -
Target network port(s): -
List of CVEs: -

Script Description

The quake1-info.nse script extracts information from Quake game servers and other game servers which use the same protocol.

Quake uses UDP packets, which because of source spoofing can be used to amplify a denial-of-service attack. For each request, the script reports the payload amplification as a ratio. The format used is response_bytes/request_bytes=ratio

• http://www.gamers.org/dEngine/quake/QDP/qnp.html

Quake1-info NSE Script Arguments

The quake1-info.nse script does not have any arguments.

Quake1-info NSE Script Example Usage

Here's an example of how to use the quake1-info.nse script:

nmap -n -sU -Pn --script quake1-info -pU:26000-26004 -- <target>

Quake1-info NSE Script Example Output

Here's a sample output from the quake1-info.nse script:

PORT      STATE SERVICE
26000/udp open  quake
| quake1-info:
|   server info exchange payload amplification: 59/12=4.916667
|   listen address: 10.200.200.10:26000
|   server name: An anonymous Debian server
|   level name: dm1
|   players: 1/8
|   player table
|     player 1: fragmeister
|       player info exchange payload amplification: 49/6=8.166667
|       client address: 192.168.0.10:40430
|       connect time: 55587 secs
|       frags: -1
|       shirt: green3
|       pants: orange6
|_  protocol version: released (0x3)

Quake1-info NSE Script Example XML Output

Here's a sample XML output from the quake1-info.nse script produced by providing the -oX <file> Nmap option:

 <elem key="server_ratio">59/12=4.916667</elem>
 <elem key="listen_address">10.200.200.10:26000</elem>
 <elem key="server_name">An anonymous Debian server</elem>
 <elem key="level_name">dm1</elem>
 <elem key="players">1/8</elem>
 <table key="player_table">
   <table key="player 1">
     <elem key="player_ratio">49/6=8.166667</elem>
     <elem key="name">fragmeister</elem>
     <elem key="client_address">192.168.0.10:40430</elem>
     <elem key="connect_time">55587 secs</elem>
     <elem key="frags">-1</elem>
     <elem key="shirt">green3</elem>
     <elem key="pants">orange6</elem>
   </table>
 </table>
 <elem key="protocol_version">released (0x3)</elem>

Author

• Ulrik Haugen

References

• https://nmap.org/nsedoc/scripts/quake1-info.html
• https://github.com/nmap/nmap/tree/master/scripts/quake1-info.nse
• http://www.gamers.org/dEngine/quake/QDP/qnp.html

See Also

Visit Nmap NSE Library for more scripts.

The quake1-info.nse script may fail with the following error messages. Check for the possible causes by using the code snippets highlighted below found in the script source code. This can often times help in identifying the root cause of the problem.

Error parsing reply (packet type/ length)

Here is a relevant code snippet related to the "Error parsing reply (packet type/ length)" error message:

151:	  assert_w_table(rep_pkt_type == ctrl_pkt_type,
152:	    "Bad reply packet type", player_info)
153:	
154:	  -- frags and connect_time are sent little endian:
155:	  local rep_opc, player_id, name, colors, frags, connect_time, client_address, pos = string.unpack('>BBzBxxx<i4I4>z', rep_pl, pos)
156:	  assert_w_table(pos == term_pos, "Error parsing reply (packet type/ length)",
157:	    player_info)
158:	  assert_w_table(rep_opc == ccrep_player_info,
159:	    string.format("Incorrect operation code 0x%x in reply,"
160:	      .. " should be 0x%x",
161:	      rep_opc, ccrep_player_info),

Error parsing reply (packet type/length)

Here is a relevant code snippet related to the "Error parsing reply (packet type/length)" error message:

222:	  assert_w_table(rep_opc == ccrep_server_info,
223:	    string.format("Bad operation code 0x%x in reply,"
224:	      .. " expected 0x%x",
225:	    rep_opc, ccrep_server_info), server_info)
226:	  local server_address, server_host_name, level_name, cur_players, max_players, net_protocol_version, pos = string.unpack('>zzzBBB', rep_pl, pos)
227:	  assert_w_table(pos == term_pos, "Error parsing reply (packet type/length)",
228:	    server_info)
229:	
230:	  port.version.name = "quake"
231:	  port.version.product = "Quake 1 server"
232:	  port.version.version = net_protocol_versions[net_protocol_version]