TCP/IP stack fingerprinting: Difference between revisions

Revision as of 23:44, 27 March 2011

Revision as of 09:16, 5 April 2011

Line 5:

== TCP/IP Fingerprint Specifics ==

Certain parameters within the [[TCP protocol]] definition are left up to the implementation.  Different operating systems, and different versions of the same operating system, set different defaults for these values.  By collecting and examining these values, one may differentiate among various operating systems, and implementations of TCP/IP.<ref>[http://project.honeynet.org/papers/finger/ Know Your Enemy: Passive Fingerprinting]</ref>. The TCP/IP fields that may vary

include the following:

Line 20:

== Protection against and detecting fingerprinting ==

Protection against all types of TCP/IP fingerprinting is achieved through TCP/IP fingerprint obfuscators. Also known as fingerprint scrubbing, tools exist for [[MS Windows]],<ref>[http://www.irongeek.com/i.php?page=security/osfuscate-change-your-windows-os-tcp-ip-fingerprint-to-confuse-p0f-networkminer-ettercap-nmap-and-other-os-detection-tools OSfuscate]</ref>, [[Linux]],<ref>[http://ippersonality.sourceforge.net/ IPPersonality]</ref>, [[FreeBSD]],<ref>[http://www.usenix.org/events/sec00/full_papers/smart/smart_html/index.html Defeating TCP/IP stack fingerprinting]</ref>, and likely others.

Moreover, protection against active fingerprinting attempts is achieved by limiting the type and amount of traffic a system responds to. Examples include the following: blocking of all unnecessary outgoing [[Internet Control Message Protocol|ICMP]] traffic, especially unusual packet types like address masks and timestamps. Also, blocking of any [[ICMP Echo Reply|ICMP echo replies]]. Be warned that blocking things without knowing exactly what they are for can very well lead to a broken network; for instance, your network could become a [[Black hole (networking)|black hole]]. Alternatively, active fingerprinting tools themselves have fingerprints that can be detected.<ref>[http://ojnk.sourceforge.net/stuff/iplog.readme iplog]</ref>.

Defeating TCP/IP fingerprinting may provide limited protection from potential attackers who employ a [[vulnerability scanner]] to select machines of a specific target OS. However, a determined adversary may simply try a series of different attacks until one is successful.<ref>http://seclists.org/pen-test/2007/Sep/0030.html OS detection not key to penetration</ref>

Line 35:

* [[PacketFence]]<ref>[http://www.packetfence.org/ PacketFence]</ref> - open source [[Network Access Control|NAC]] with passive DHCP fingerprinting.

* Satori - passive [[Cisco Discovery Protocol|CDP]], DHCP, ICMP, [[HP Switch Protocol|HPSP]], [[HTTP]], TCP/IP and other stack fingerprinting.

* SinFP - single-port active/passive fingerprinting.

* XProbe2 - active TCP/IP stack fingerprinting.