TCP/IP stack fingerprinting: Difference between revisions

Browse history interactively

← Previous edit

Content deleted Content added

VisualWikitext

Revision as of 19:25, 15 January 2007 edit 147.226.158.242 (talk) →Active OS Fingerprinting ← Previous edit		Latest revision as of 03:41, 11 August 2025 edit undo Bender the Bot (talk \| contribs) Bots 1,064,377 edits m →Protection against and detecting fingerprinting: HTTP to HTTPS for SourceForge Tag: AWB
(117 intermediate revisions by 73 users not shown)
Line 1: {{Short description\|Remote detection of the characteristics of a TCP/IP stack}} [[Image:passive figure.png\|thumbnail\|right\|200px\|Passive OS Fingerprinting method and diagram.]] ~~'''OS fingerprinting''' is a process of determining the [[operating system]] used by the remote target.~~ '''TCP/IP stack fingerprinting''' is the remote detection of the characteristics of a [[TCP/IP stack]] implementation. The combination of parameters may then be used to infer the remote machine's operating system (aka, '''OS fingerprinting'''), or incorporated into a [[device fingerprint]]. ~~There are two types of OS Fingerprinting; '''Active OS fingerprinting''' and '''Passive OS fingerprinting'''~~ == TCP/IP Fingerprint Specifics == == Passive OS Fingerprinting ==▼ Passive fingerprinting is undetectable by an [[Intrusion-detection system\|IDS]] on the network. A passive fingerprinter (a person or an application) does not send any data across the network (wire); because of this nature it’s undetectable. The down side to passive fingerprinting is the fact that the fingerprinter must be on the same [[Ethernet hub\|hub]] as the other servers and clients in order to capture any packets on the wire. Certain parameters within the [[TCP protocol]] definition are left up to the implementation. Different operating systems, and different versions of the same operating system, set different defaults for these values. By collecting and examining these values, one may differentiate among various operating systems and implementations of TCP/IP. The TCP/IP fields that may vary ~~== Active OS Fingerprinting ==~~ include the following: Active fingerprinting is aggressive in nature. An active fingerprinter transmits to and receives from the targeted device. It can be located anywhere in the network and with the active fingerprinting method you can learn more information about the target than passive OS fingerprinting. The downside to this method is that the fingerprinter can be identified by an [[Intrusion-detection_system\|IDS]] on the network. * Initial [[Network packet\|packet]] size (16 bits) ~~== Active Fingerprinting Methods ==~~ * Initial [[Time to live\|TTL]] (8 bits) ~~TCP Stack Querying:~~ * Window size (16 bits) * [[Internet Control Message Protocol\|ICMP]] [[Maximum segment size\|Max segment size]] (16 bits) [[Transmission Control Protocol\|TCP]] * Window scaling value (8 bits) * [[Simple Network Management Protocol\|SNMP]] * "don't fragment" flag (1 bit) * "sackOK" flag (1 bit) * "nop" flag (1 bit) These values may be combined to form a 67-bit signature, or fingerprint, for the target machine.<ref>Chuvakin A. and Peikari, C: "Security Warrior.", page 229. O'Reilly Media Inc., 2004.</ref> Just inspecting the Initial TTL and window size fields is often enough to successfully identify an operating system, which eases the task of performing manual OS fingerprinting.<ref>{{cite web\|url=http://www.netresec.com/?page=Blog&month=2011-11&post=Passive-OS-Fingerprinting \|title=Passive OS Fingerprinting, NETRESEC Network Security Blog \|publisher=Netresec.com \|date=2011-11-05 \|accessdate=2011-11-25}}</ref> ~~Banner Grabbing~~ * [[File Transfer Protocol\|FTP]] * [[TELNET]] * [[Hypertext Transfer Protocol\|HTTP]] == Protection against and detecting fingerprinting == ~~Port Probing~~ Protection against the fingerprint doorway to attack is achieved by limiting the type and amount of traffic a defensive system responds to. Examples include blocking ''address masks'' and ''timestamps'' from outgoing [[Internet Control Message Protocol\|ICMP]] control-message traffic, and blocking [[ICMP Echo Reply\|ICMP echo replies]]. A security tool can alert to potential fingerprinting: it can match another machine as having a fingerprinter configuration by detecting ''its'' fingerprint.<ref>{{cite web\|url=https://ojnk.sourceforge.net/stuff/iplog.readme \|title=iplog \|date= \|accessdate=2011-11-25}}</ref> ~~== Protecting and Detecting Against Fingerprinting ==~~ ~~Block all unnecessary outgoing ICMP traffic especially unusual ones like address mask and timestamp also block any [[ICMP Echo Reply\|ICMP echo replies]]. Watch for excessive TCP SYN packets.~~ Disallowing TCP/IP fingerprinting provides protection from [[vulnerability scanner]]s looking to target machines running a certain operating system. Fingerprinting makes attacks easier. Blocking these ICMP messages is just one of a number of defenses needed to fully protect against attacks.<ref>{{cite web\|url=http://seclists.org/pen-test/2007/Sep/0030.html \|title=OS detection not key to penetration \|publisher=Seclists.org \|date= \|accessdate=2011-11-25}}</ref> ~~== Fingerprinting Tools ==~~ [[Nmap]] is a tool that performs active TCP/IP stack fingerprinting.▼ Targeting the ICMP datagram, an obfuscator running on top of IP in the internet layer acts as a "scrubbing tool" to confuse the TCP/IP fingerprinting data. These exist for [[Microsoft Windows]],<ref>{{cite web\|url=http://www.irongeek.com/i.php?page=security/osfuscate-change-your-windows-os-tcp-ip-fingerprint-to-confuse-p0f-networkminer-ettercap-nmap-and-other-os-detection-tools \|title=OSfuscate \|publisher=Irongeek.com \|date=2008-09-30 \|accessdate=2011-11-25}}</ref> [[Linux]]<ref>{{cite web\|author=Carl-Daniel Hailfinger, carldani@4100XCDT \|url=https://ippersonality.sourceforge.net/ \|title=IPPersonality \|publisher=Ippersonality.sourceforge.net \|date= \|accessdate=2011-11-25}}</ref> and [[FreeBSD]].<ref>{{cite web\|url=http://www.usenix.org/events/sec00/full_papers/smart/smart_html/index.html \|title=Defeating TCP/IP stack fingerprinting \|publisher=Usenix.org \|date=2002-01-29 \|accessdate=2011-11-25}}</ref> [[p0f]] and [[Ettercap (computing)\|Ettercap]] are tools that performs passive TCP/IP stack fingerprinting.▼ == ~~External~~Fingerprinting ~~links~~tools == ▲==A ~~Passive~~list of TCP/OS Fingerprinting ==Tools * [http://lcamtuf.coredump.cx/p0f-help/ p0f v2 signature contribution page] * [[Zardaxt.py]]<ref>{{cite web\|url=https://github.com/NikolaiT/zardaxt \|title=Zardaxt.py \|publisher=Github \|date=2021-11-25 \|accessdate=2021-11-25}}</ref> – Passive open-source TCP/IP Fingerprinting Tool. * [http://www.darknet.org.uk/2006/12/sinfp-204-os-detection-now-works-on-windows/ SinFP OS Fingerprinting Tool] ▲~~[[p0f]] and~~* [[Ettercap (computing)\|Ettercap]] ~~are tools that performs~~– passive TCP/IP stack fingerprinting. * [http://insecure.org/nmap/osdetect/ Remote OS detection via TCP/IP Stack FingerPrinting (2nd Generation)]▼ ▲* [[Nmap]] is– ~~a tool that performs~~comprehensive active ~~TCP/IP~~ stack fingerprinting. * [http://www.usenix.org/publications/library/proceedings/sec2000/full_papers/smart/smart_html/ Defeating TCP/IP Stack Fingerprinting] * [[p0f]] – comprehensive passive TCP/IP stack fingerprinting. * [http://lcamtuf.coredump.cx/newtcp/ Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later] * NetSleuth – free passive fingerprinting and analysis tool * [[PacketFence]]<ref>{{cite web\|url=http://www.packetfence.org/ \|title=PacketFence \|publisher=PacketFence \|date=2011-11-21 \|accessdate=2011-11-25}}</ref> – open source [[Network access control\|NAC]] with passive DHCP fingerprinting. * Satori – passive [[Cisco Discovery Protocol\|CDP]], DHCP, ICMP, [[HP Switch Protocol\|HPSP]], [[HTTP]], TCP/IP and other stack fingerprinting. * SinFP – single-port active/passive fingerprinting. * XProbe2 – active TCP/IP stack fingerprinting. * queso - well-known tool from the late 1990s which is no longer being updated for modern operating systems. == References == ~~{{compu-network-stub}}~~ {{reflist\|1}} == External links == [[Category:TCP/IP]]▼ ▲* [http://insecure.org/nmap/osdetect/ Remote OS detection via TCP/IP Stack FingerPrinting (2nd Generation)] * [https://bilisim.ahmetcadirci.com/ Bilişim Kodları ve Kısaltmaları] {{DEFAULTSORT:Tcp Ip Stack Fingerprinting}} ~~[[fr:Prise d'empreinte de la pile TCP/IP]]~~ [[Category:Attacks against TCP\|Stack Fingerprinting]] ▲[[Category:~~TCP/IP~~Internet Protocol]] [[Category:Fingerprinting algorithms]]