NPSL License Restrictions and Open-Source Fingerprint Alternatives

Nmap is the gold standard of network scanning, and its fingerprint databases (nmap-os-db, nmap-service-probes) represent over two decades of accumulated knowledge. However, since Nmap 7.90 (2021), Nmap’s license was changed from GPLv2 to NPSL (Nmap Public Source License), adding many restrictions beyond standard GPL terms.

This means: even open-source projects that read or embed Nmap’s fingerprint data files may constitute derivative works of Nmap and must be released under an NPSL-compatible license. For closed-source commercial products, the compliance risk is even more severe—either open-source the entire project under NPSL, or pay a one-time OEM license fee of $59,980~$119,980.

This article provides an in-depth analysis of NPSL’s key clauses, evaluates compliance risks across various use cases, and recommends fully NPSL-free open-source fingerprint alternative solutions.

NPSL License Deep Dive

Nmap transitioned from GPLv2 to NPSL starting with version 7.90 (initial version v0.92), and updated to NPSL v0.95 with version 7.94. NPSL is restructured on the basis of GPLv2 but adds several restrictions beyond standard GPLv2.

NPSL Core Features

Key Differences: NPSL vs Standard GPLv2

Note: NPSL does not have an AGPL-style “network service” clause. If your SaaS service only consumes Nmap scan results via REST APIs (without distributing modified code or embedding fingerprint data), the distribution clauses may not apply. However, this does not grant blanket permission to use Nmap fingerprint data files—see the next section for details.

Derivative Works and Compliance Risks

NPSL’s broad definition of “derivative work” is the most critical clause in the entire license, and also the source of the greatest compliance risk for developers.

Broad Definition of Derivative Works

NPSL explicitly states that the following actions constitute derivative works:

flowchart TD
    A["Modified Nmap<br/>source code?"] --> B["Yes: Derivative work<br/>Must open-source<br/>under NPSL"]
    A --> C["No"]
    C --> D["Reads or embeds<br/>Nmap data files?"]
    D --> E["Yes: Derivative work<br/>NPSL-specific clause"]
    D --> F["No"]
    F --> G["Calls Nmap binary<br/>via subprocess?"]
    G --> H["Yes: Gray area<br/>Consult legal counsel"]
    G --> I["No: Not a<br/>derivative work"]
    style B fill:#f44336,color:#fff
    style E fill:#FF9800,color:#fff
    style H fill:#FF9800,color:#fff
    style I fill:#4CAF50,color:#fff

Decision tree explanation: Modifying Nmap source code (red) always constitutes a derivative work. Even without source modification, reading or embedding Nmap fingerprint data files (orange) still constitutes a derivative work—this is the critical clause where NPSL goes beyond standard GPL. Calling the Nmap binary via subprocess (orange) falls into a legal gray area. Completely avoiding Nmap code and data (green) is the safest approach.

Core Compliance Risks

The biggest risk point: NPSL explicitly states that any program that “reads or includes Covered Software data files, such as nmap-os-db or nmap-service-probes” is considered a derivative work of Nmap and must be released under an NPSL-compatible license. This means:

1. Direct fingerprint database loading: If your tool directly reads nmap-os-db or nmap-service-probes files, your tool is a derivative work and must be open-sourced (NPSL-compatible)
2. Embedding fingerprint data: Embedding Nmap fingerprint data into your binary (as some third-party libraries do) also constitutes a derivative work
3. Commercial product restrictions: Even if open-sourced, derivative works cannot be used in “competitive network scanning products”
4. naabu trap: naabu itself is MIT-licensed, but its -sV service detection feature directly uses nmap-service-probes, so it remains NPSL-constrained when using this feature

Commercial OEM Licensing

For projects that cannot comply with NPSL open-source requirements, Nmap offers commercial OEM licensing. Note that the license fee is a one-time permanent payment, with annual maintenance being optional.

Key benefits of OEM licensing:

• Permits embedding Nmap technology in proprietary/closed-source products
• Permits use in competitive products
• Includes technical support
• Permanent license fee is a one-time payment; annual maintenance is optional (includes upgrades and support)

Compliance Scenario Analysis

Key conclusion: If your project is a closed-source commercial product, or you do not wish to release your open-source project under NPSL, directly reading or embedding Nmap’s fingerprint databases (nmap-os-db, nmap-service-probes) presents serious compliance risks. This is the core motivation for seeking alternative fingerprint libraries.

Alternative Selection Criteria

When evaluating alternatives to Nmap’s fingerprint databases, consider the following dimensions:

Service Fingerprint Alternatives

fingerprintx (Praetorian) — Best Alternative

Supported protocols include: HTTP/HTTPS, SSH, RDP, MySQL, PostgreSQL, MSSQL, OracleDB, MongoDB, Redis, Kafka, MQTT, SMB, VNC, Telnet, DNS, LDAP, Modbus, IPMI, Diameter, SMPP, and vector databases ChromaDB/Milvus/Pinecone.

Key advantages:

• Completely independent of nmap-service-probes, all plugins are self-developed—a truly clean NPSL alternative
• JSON output, usable as a library
• Fast mode prioritizes default service ports
• Apache-2.0 license permits commercial closed-source use

masscan — High-Speed Scanning + Banner Grabbing

Key features: Self-developed async TCP/IP stack, 10 million packets/second on a single machine, can scan the entire internet in 5 minutes; output compatible with Nmap (XML/grepable/JSON); built-in banner grabbing (not dependent on Nmap libraries).

License risk: AGPL-3.0 includes a network service clause—if you provide the service over a network, you must open-source all code.

ZMap + ZGrab2 — Internet-Scale Scanning

Key features: Scans a single IPv4 port in 45 minutes on gigabit ethernet, 5 minutes on 10G with netmap/PF_RING; widely cited in academic research (USENIX Security); ZGrab2 performs application layer handshakes but requires pre-specified protocols, no automatic identification.

NPSL Warning About naabu

Important warning: naabu itself (github.com/projectdiscovery/naabu) is MIT-licensed, but its service version detection (-sV) directly uses nmap-service-probes (NPSL!). Therefore, from a service fingerprint perspective, it does not truly avoid NPSL. If your project depends on naabu’s -sV functionality for service version identification, you remain NPSL-constrained. Only the port scanning portion can be safely used.

OS Fingerprint Alternatives

p0f — Passive OS Fingerprinting

Key features: Purely passive sniffing (identifies OS from a single SYN), ideal for scenarios where Nmap’s active probing would be blocked or trigger alerts; provides unix socket API for third-party queries; MTU/uptime/NAT detection; includes p0f.fp fingerprint database.

Limitations: Project is no longer maintained, fingerprint database is not updated; passive mode cannot actively probe specific targets.

JA4+ (FoxIO) — Network Fingerprint Standard

Key features: a_b_c token format preserves locality for substring search; widely integrated by Wireshark/Zeek/Cloudflare/AWS/Palo Alto; supports both active scanning and passive detection; fingerprint database ja4db.com under active development.

License note: JA4 core is BSD-3 (permissive); FoxIO License 1.1 for other methods is permissive for academic/internal use, but commercial product resale requires OEM authorization.

Port Scanning Alternatives

naabu (ProjectDiscovery)

Key features: Lightweight, CDN/WAF exclusion, IPv4/IPv6, Shodan InternetDB passive enumeration, pipeline-friendly.

⚠️ Important warning: naabu is MIT-licensed, but its service version detection (-sV) directly uses nmap-service-probes (NPSL!). Therefore, from a service fingerprint perspective, it does not truly avoid NPSL. Only the port scanning portion can be safely used.

Port Scanner Comparison

Web Technology Fingerprint Alternatives

Nmap is not particularly strong in web technology fingerprinting. The following tools excel in this domain, and some have permissive licenses.

httpx (ProjectDiscovery) — Best Web Probe

Key features: Multi-threaded reliable probing, https↔http auto-fallback, pipeline-friendly, custom fingerprint file -cff, CPE output, built-in Wappalyzer dataset for technology detection -td.

WhatWeb — Web Scanner

Key features: Tiered probing (stealthy→aggressive→heavy), single-request identification; multiple log formats (XML/JSON/SQL/MongoDB/ElasticSearch); Google Dork integration; fuzzy matching.

Wappalyzer — Web Technology Fingerprints

Key features: Browser extension + CLI; CPE support; industry de facto standard; fingerprint rules in src/technologies/ (regex matching HTML/JS/headers/cookies/meta/DNS, etc.).

TideFinger — Chinese CMS Fingerprint Database

Key features: Integrates Wappalyzer, webanalyzer, fofa, WhatWeb rules; traditional + modern detection methods (MD5/URL/Header/Regex/Directory matching); suitable for Chinese CMS identification.

⚠️ License risk: TideFinger has no LICENSE file, creating legal uncertainty—not recommended for commercial use. Also note that the original TophantTechnology/ARL repository has been deleted; community-maintained forks (e.g., Aabyss-Team/ARL) use the MIT license.

Comprehensive Comparison Table

Fingerprint Capability Comparison (vs Nmap)

OS Fingerprint Dimension (vs nmap-os-db)

Service Fingerprint Dimension (vs nmap-service-probes)

Fully NPSL-Free Combination Stack

The following combination builds a complete system covering port scanning, service detection, OS identification, and web fingerprinting without touching any NPSL-licensed fingerprint libraries:

flowchart TD
    A["NPSL-Free<br/>Fingerprint System"] --> B["Port Scan Layer"]
    A --> C["Service FP Layer"]
    A --> D["OS FP Layer"]
    A --> E["Web FP Layer"]
    B --> B1["ZMap<br/>Apache-2.0<br/>Internet SYN scan"]
    B --> B2["naabu<br/>MIT<br/>Disable -sV"]
    B --> B3["masscan<br/>AGPL-3.0<br/>Ultra-fast scan"]
    C --> C1["fingerprintx<br/>Apache-2.0<br/>51 protocols"]
    C --> C2["ZGrab2<br/>Apache-2.0<br/>App handshake"]
    D --> D1["p0f<br/>Apache-2.0<br/>Passive TCP/IP"]
    D --> D2["JA4T/JA4TScan<br/>BSD-3/FoxIO<br/>Next-gen TCP"]
    E --> E1["httpx<br/>MIT<br/>HTTP full dim."]
    E --> E2["WhatWeb<br/>GPL-2.0<br/>1800+ plugins"]
    style A fill:#2196F3,color:#fff
    style B fill:#4CAF50,color:#fff
    style C fill:#4CAF50,color:#fff
    style D fill:#4CAF50,color:#fff
    style E fill:#4CAF50,color:#fff

Architecture explanation: Four-layer stack from bottom up. Port scanning uses ZMap (internet-scale), naabu without -sV (internal network), and masscan (note AGPL copyleft). Service fingerprinting centers on fingerprintx’s 51 self-developed protocol plugins, supplemented by ZGrab2 for application handshakes. OS fingerprinting pairs p0f’s passive sniffing with JA4T’s next-gen TCP fingerprints. Web fingerprinting is covered by httpx and WhatWeb for full-dimensional web technology stack detection.

Scenario-Based Recommendations

Combined Stack vs Nmap Coverage

Summary

Nmap’s NPSL license and its broad definition of fingerprint data file usage introduces significant compliance risks for projects building upon Nmap’s fingerprint databases. Key takeaways:

1. Understand NPSL boundaries: Reading or embedding nmap-os-db/nmap-service-probes constitutes a derivative work, requiring NPSL-compatible open-source release. Closed-source commercial products must purchase OEM licensing ($59,980~$119,980 one-time).

2. naabu’s -sV is a compliance trap: While naabu is MIT-licensed, its service version detection reuses Nmap’s nmap-service-probes, keeping it under NPSL constraints when using this feature.

3. Alternatives have matured: fingerprintx (51 self-developed protocols, Apache-2.0), p0f (passive OS fingerprinting, Apache-2.0), JA4+ (next-gen TCP fingerprint standard), ZMap+ZGrab2 (internet-scale scanning, Apache-2.0), httpx (web probing, MIT) are all production-ready solutions.

4. Combined approach works best: No single alternative can fully replace all of Nmap’s capabilities, but a four-layer stack combining port scanning + service fingerprinting + OS fingerprinting + web fingerprinting can cover core requirements without touching any NPSL-licensed fingerprint databases.

5. Gaps remain: The NPSL-Free combined stack still has gaps in service detection depth (~60% protocol coverage) and OS fingerprint scale (~40%). If you need Nmap-level fingerprint depth, you must either accept NPSL open-source obligations or purchase an OEM commercial license.