TCP/IP stack fingerprinting: Difference between revisions

Revision as of 12:57, 20 March 2011

Latest revision as of 03:41, 11 August 2025

(47 intermediate revisions by 35 users not shown)

Line 1:

{{Short description|Remote detection of the characteristics of a TCP/IP stack}}

[[Image:passive figure.png|thumbnail|right|200px|Passive OS Fingerprinting method and diagram.]]

'''TCP/IP stack fingerprinting''' is the passiveremote collectiondetection of configurationthe attributescharacteristics fromof a remote device during standard [[OSITCP/IP model|layer 4stack]] network communicationsimplementation. The combination of parameters may then be used to infer the remote machine's operating system (aka, '''OS fingerprinting'''), or incorporated into a [[device fingerprint]].

== TCP/IP Fingerprint Specifics ==

Certain parameters within the [[TCP protocol]] definition are left up to the implementation.   Different operating systems, and different versions of the same operating system, set different defaults for these values.  By collecting and examining these values, one may differentiate among various operating systems, and implementations of TCP/IP<ref>[http://project.honeynet.org/papers/finger/ Know Your Enemy: Passive Fingerprinting]</ref>. The TCP/IP fields that may vary

include the following:

* Initial [[Network packet|packet]] size (16 bits)

* Initial [[Time to live|TTL]] (8 bits)

* Window size (16 bits)

*[[Maximum segment size|Max segment size]] (16 bits)

* Window scaling value (8 bits)

* "don't fragment" flag (1 bit)

Line 17 ⟶ 18:

* "nop" flag (1 bit)

These values may be combined to form a 67-bit signature, or fingerprint, for the target machine.<ref>Chuvakin A. and Peikari, C: "Security Warrior.", page 229. O'Reilly Media Inc., 2004.</ref> Just inspecting the Initial TTL and window size fields is often enough to successfully identify an operating system, which eases the task of performing manual OS fingerprinting.<ref>{{cite web|url=http://www.netresec.com/?page=Blog&month=2011-11&post=Passive-OS-Fingerprinting |title=Passive OS Fingerprinting, NETRESEC Network Security Blog |publisher=Netresec.com |date=2011-11-05 |accessdate=2011-11-25}}</ref>

== Protection against and detecting fingerprinting ==

Protection against all types of TCP/IP fingerprinting is achieved through TCP/IP fingerprint obfuscators. Also known as fingerprint scrubbing, tools exist for MS Windows<ref>[http://www.irongeek.com/i.php?page=security/osfuscate-change-your-windows-os-tcp-ip-fingerprint-to-confuse-p0f-networkminer-ettercap-nmap-and-other-os-detection-tools OSfuscate]</ref>, Linux<ref>[http://ippersonality.sourceforge.net/ IPPersonality]</ref>, FreeBSD<ref>[http://www.usenix.org/events/sec00/full_papers/smart/smart_html/index.html Defeating TCP/IP stack fingerprinting]</ref>, and likely others.

Moreover, protectionProtection against activethe fingerprintingfingerprint doorway to attemptsattack is achieved by limiting the type and amount of traffic a defensive system responds to. Examples include theblocking following:''address blockingmasks'' ofand all''timestamps'' unnecessaryfrom outgoing ICMP[[Internet traffic,Control especiallyMessage unusualProtocol|ICMP]] packetcontrol-message types like address maskstraffic, and timestamps. Also, blocking of any [[ICMP Echo Reply|ICMP echo replies]]. BeA warnedsecurity that blocking things without knowing exactly what they are fortool can very well leadalert to apotential brokenfingerprinting: network;it forcan instance,match youranother networkmachine couldas becomehaving a [[Blackfingerprinter holeconfiguration (networking)|blackby hole]].detecting Alternatively,''its'' active fingerprinting tools themselves have fingerprints that can be detectedfingerprint.<ref>[http{{cite web|url=https://ojnk.sourceforge.net/stuff/iplog.readme |title=iplog] |date= |accessdate=2011-11-25}}</ref>.

DefeatingDisallowing TCP/IP fingerprinting may provide limitedprovides protection from potential attackers who employ a [[vulnerability scanner]]s looking to selecttarget machines ofrunning a specificcertain targetoperating OSsystem. Fingerprinting However,makes aattacks determinedeasier. adversaryBlocking maythese simplyICMP trymessages is just one of a seriesnumber of differentdefenses attacksneeded untilto onefully isprotect successfulagainst attacks.<ref>{{cite web|url=http://seclists.org/pen-test/2007/Sep/0030.html |title=OS detection not key to penetration |publisher=Seclists.org |date= |accessdate=2011-11-25}}</ref>

ProtectionTargeting againstthe allICMP typesdatagram, ofan TCP/IPobfuscator fingerprintingrunning ison achievedtop throughof TCP/IP fingerprintin obfuscators.the internet Alsolayer knownacts as fingerprinta "scrubbing, toolstool" to confuse the TCP/IP fingerprinting data. These exist for MS[[Microsoft Windows]],<ref>[{{cite web|url=http://www.irongeek.com/i.php?page=security/osfuscate-change-your-windows-os-tcp-ip-fingerprint-to-confuse-p0f-networkminer-ettercap-nmap-and-other-os-detection-tools |title=OSfuscate] |publisher=Irongeek.com |date=2008-09-30 |accessdate=2011-11-25}}</ref>, [[Linux]]<ref>[http{{cite web|author=Carl-Daniel Hailfinger, carldani@4100XCDT |url=https://ippersonality.sourceforge.net/ |title=IPPersonality] |publisher=Ippersonality.sourceforge.net |date= |accessdate=2011-11-25}}</ref>, and [[FreeBSD]].<ref>[{{cite web|url=http://www.usenix.org/events/sec00/full_papers/smart/smart_html/index.html |title=Defeating TCP/IP stack fingerprinting] |publisher=Usenix.org |date=2002-01-29 |accessdate=2011-11-25}}</ref>, and likely others.

== Fingerprinting tools ==

A list of TCP/OS Fingerprinting Tools

* [[Zardaxt.py]]<ref>{{cite web|url=https://github.com/NikolaiT/zardaxt |title=Zardaxt.py |publisher=Github |date=2021-11-25 |accessdate=2021-11-25}}</ref> – Passive open-source TCP/IP Fingerprinting Tool.

* [[PRADS]] - Passive comprehensive TCP/IP stack fingerprinting and service detection

* [[Ettercap (computing)|Ettercap]] -– passive TCP/IP stack fingerprinting.

* [[NetworkMinerNmap]] -– passivecomprehensive [[DHCP]] and TCP/IPactive stack fingerprinting (combines p0f, Ettercap and Satori databases).

* [[Nmapp0f]] -– comprehensive activepassive TCP/IP stack fingerprinting.

* [[p0f]]NetSleuth -– comprehensivefree passive TCP/IPfingerprinting stackand fingerprinting.analysis tool

* [[PacketFence]]<ref>[{{cite web|url=http://www.packetfence.org/ |title=PacketFence] |publisher=PacketFence |date=2011-11-21 |accessdate=2011-11-25}}</ref> -– open source [[Network Accessaccess Controlcontrol|NAC]] with passive DHCP fingerprinting.

* Satori -– passive [[Cisco Discovery Protocol|CDP]], DHCP, ICMP, [[HP Switch Protocol|HPSP]], [[HTTP]], TCP/IP and other stack fingerprinting.

* SinFP -– single-port active/passive fingerprinting.

* XProbe2 -– active TCP/IP stack fingerprinting.

* queso - well-known tool from the late 1990s which is no longer being updated for modern operating systems.

== External links ==

* [http://lcamtuf.coredump.cx/p0f-help/ p0f v2 signature contribution page]

* [http://www.darknet.org.uk/2006/12/sinfp-204-os-detection-now-works-on-windows/ SinFP OS Fingerprinting Tool]

* [http://insecure.org/nmap/osdetect/ Remote OS detection via TCP/IP Stack FingerPrinting (2nd Generation)]

* [http://www.usenix.org/publications/library/proceedings/sec2000/full_papers/smart/smart_html/ Defeating TCP/IP Stack Fingerprinting]

* [http://lcamtuf.coredump.cx/newtcp/ Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later]

* [http://www.darknet.org.uk/2006/03/security-cloak-mask-against-tcpip-fingerprinting-for-windows/ Security Cloak - Mask against TCP/IP Fingerprinting in Windows]

* [http://www.darknet.org.uk/2006/03/sealing-wafter-defend-against-os-fingerprinting-for-openbsd-ready/ Sealing Wafter - Defend against OS Fingerprinting on OpenBSD]

* [http://autoscan-network.com/ AutoScan Network - Network Monitoring and Management Tool]

== References ==

{{reflist|1}}

== External links ==

{{DEFAULTSORT:Tcp/Ip Stack Fingerprinting}}

* [http://insecure.org/nmap/osdetect/ Remote OS detection via TCP/IP Stack FingerPrinting (2nd Generation)]

[[Category:TCP/IP|Stack Fingerprinting]]

* [https://bilisim.ahmetcadirci.com/ Bilişim Kodları ve Kısaltmaları]

[[de{{DEFAULTSORT:OS-Tcp Ip Stack Fingerprinting]]}}

[[Category:Attacks against TCP/IP|Stack Fingerprinting]]

[[fr:Prise d'empreinte de la pile TCP/IP]]

[[Category:Internet Protocol]]

[[it:P0f]]

[[Category:Fingerprinting algorithms]]

[[ka:TCP/IP ფენების ანაბეჭდის დადგენა]]

[[pl:P0f]]