OS fingerprinting is a process of determining the operating system used by the remote target.
There are two types of OS Fingerprinting; Active OS fingerprinting and Passive OS fingerprinting.
Passive OS Fingerprinting
Passive fingerprinting is undetectable by an IDS on the network. A passive fingerprinter (a person or an application) does not send any data across the network (wire); because of this nature it’s undetectable. The downside to passive fingerprinting is the fact that the fingerprinter must be on the same hub as the other servers and clients in order to capture any packets on the wire.
How Passive OS Fingerprinting Works
Passive fingerprinting works because TCP/IP flag settings are specific to various operating system stacks. These settings vary from one TCP stack implementation to another and include the following:
- Initial TTL (8 bits)
- Window size (16 bits)
- Maximum segment size (16 bits)
- "Don't fragment" flag (1 bit)
- sackOK option (1 bit)
- nop option (1 bit)
- Window scaling option (8 bits)
- Initial packet size (16 bits)
When combined, these flag settings provide a unique, 67-bit signature for every system.[1]
Active OS Fingerprinting
Active fingerprinting is aggressive in nature. An active fingerprinter transmits to and receives from the targeted device. It can be located anywhere in the network and with the active fingerprinting method you can learn more information about the target than passive OS fingerprinting. The downside to this method is that the fingerprinter can be identified by an IDS on the network.
Active Fingerprinting Methods
TCP Stack Querying:
Banner Grabbing
Port Probing
Protecting and Detecting Against Fingerprinting
Block all unnecessary outgoing ICMP traffic especially unusual ones like address mask and timestamp also block any ICMP echo replies. Watch for excessive TCP SYN packets.
Fingerprinting Tools
Nmap is a tool that performs active TCP/IP stack fingerprinting.
p0f and Ettercap are tools that perform passive TCP/IP stack fingerprinting.
External links
References
- ^ Peikari, C: "Security Warrior.", page 229. O'Reilly Media Inc., 2004.
 | This computer networking article is a stub. You can help Wikipedia by expanding it. |