TCP/IP stack fingerprinting

From Wikipedia, the free encyclopedia

OS Fingerprinting is a process of determining the Operating System used by the remote target.

There are two types of OS Fingerprinting:
Active OS Fingerprinting and Passive OS Fingerprinting

1 Passive OS Fingerprinting
2 Active OS Fingerprinting
3 Active Fingerprinting Methods
4 Protecting and Detecting Against Fingerprinting
5 Fingerprinting Tools
6 External links

[edit] Passive OS Fingerprinting

Passive fingerprinting is undetectable by an IDS on the network. A passive fingerprinter (a person or an application) does not send any data across the network (wire); because of this nature it’s undetectable. The down side to passive fingerprinting is the fact that the fingerprinter must be on the same hub as the other servers and clients in order to capture any packets on the wire.

[edit] Active OS Fingerprinting

Active fingerprinting is aggressive in nature. An active fingerprinter transmits to and receives from the targeted device. It can be located anywhere in the network and with the active fingerprinting method you can learn more information about the target then passive OS fingerprinting. The down side to this method is that the fingerprinter can be identified by an IDS on the network.

[edit] Active Fingerprinting Methods

• TCP Stack Querying:

 o ICMP
 o TCP
 o SNMP

• Banner Grabbing

 o FTP
 o Telnet
 o HTTP

• Port Probing

[edit] Protecting and Detecting Against Fingerprinting

Block all unnecessary outgoing ICMP traffic especially unusual ones like address mask and timestamp also block any ICMP echo replies. watch for excessive TCP SYN packets.