Wikipedia

TCP/IP stack fingerprinting

This is an old revision of this page, as edited by Frap (talk | contribs) at 13:20, 6 January 2007. The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

OS fingerprinting is a process of determining the operating system used by the remote target.

There are two types of OS Fingerprinting; Active OS fingerprinting and Passive OS fingerprinting

Passive OS Fingerprinting

Passive fingerprinting is undetectable by an IDS on the network. A passive fingerprinter (a person or an application) does not send any data across the network (wire); because of this nature it’s undetectable. The down side to passive fingerprinting is the fact that the fingerprinter must be on the same hub as the other servers and clients in order to capture any packets on the wire.

 

Active OS Fingerprinting

Active fingerprinting is aggressive in nature. An active fingerprinter transmits to and receives from the targeted device. It can be located anywhere in the network and with the active fingerprinting method you can learn more information about the target then passive OS fingerprinting. The down side to this method is that the fingerprinter can be identified by an IDS on the network.

Active Fingerprinting Methods

TCP Stack Querying:

Banner Grabbing

Port Probing

Protecting and Detecting Against Fingerprinting

Block all unnecessary outgoing ICMP traffic especially unusual ones like address mask and timestamp also block any ICMP echo replies. Watch for excessive TCP SYN packets.

Fingerprinting Tools

Nmap is a tool that performs active TCP/IP stack fingerprinting.

p0f and Ettercap are tools that performs passive TCP/IP stack fingerprinting.

 

This computer networking article is a stub. You can help Wikipedia by expanding it.

Retrieved from "https://en.wikipedia.org/w/index.php?title=TCP/IP_stack_fingerprinting&oldid=98866924"