TCP/IP stack fingerprinting
TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote machine's operating system (aka, OS fingerprinting), or incorporated into a device fingerprint.
TCP/IP Fingerprint Specifics
Certain parameters within the TCP protocol definition are left up to the implementation. Different operating systems, and different versions of the same operating system, set different defaults for these values. By collecting and examining these values, one may differentiate among various operating systems, and implementations of TCP/IP. The TCP/IP fields that may vary include the following:
- Initial packet size (16 bits)
- Initial TTL (8 bits)
- Window size (16 bits)
- Max segment size (16 bits)
- Window scaling value (8 bits)
- "don't fragment" flag (1 bit)
- "sackOK" flag (1 bit)
- "nop" flag (1 bit)
These values may be combined to form a 67-bit signature, or fingerprint, for the target machine.[1] Just inspecting the Initial TTL and window size fields is often enough in order to successfully identify an operating system, which eases the task of performing manual OS fingerprinting.[2]
Protection against and detecting fingerprinting
Protection against the fingerprint doorway to attack is achieved by limiting the type and amount of traffic a defensive system responds to. Examples include blocking address masks and timestamps from outgoing ICMP control-message traffic, and blocking ICMP echo replies. A security tool can alert to potential fingerprinting: it can match another machine as having a fingerprinter configuration by detecting its fingerprint.[3]
Disallowing TCP/IP fingerprinting provides protection from vulnerability scanners looking to target machines running a certain operating system. Fingerprinting facilitates attacks. Blocking those ICMP messages is only one of an array of defenses required for full protection against attacks.[4]
Targeting the ICMP datagram, an obfuscator running on top of IP in the internet layer acts as a "scrubbing tool" to confuse the TCP/IP fingerprinting data. These exist for MS Windows,[5] Linux[6] and FreeBSD,.[7]
Fingerprinting tools
A list of TCP/OS Fingerprinting Tools
- Ettercap – passive TCP/IP stack fingerprinting.
- NetworkMiner – passive DHCP and TCP/IP stack fingerprinting (combines p0f, Ettercap and Satori databases)
- Nmap – comprehensive active stack fingerprinting.
- p0f – comprehensive passive TCP/IP stack fingerprinting.
- NetSleuth – free passive fingerprinting and analysis tool
- PacketFence[8] – open source NAC with passive DHCP fingerprinting.
- PRADS – Passive comprehensive TCP/IP stack fingerprinting and service detection
- Satori – passive CDP, DHCP, ICMP, HPSP, HTTP, TCP/IP and other stack fingerprinting.
- SinFP – single-port active/passive fingerprinting.
- XProbe2 – active TCP/IP stack fingerprinting.
- Device Fingerprint Website[9] - Displays the passive TCP SYN fingerprint of your browser's computer (or intermediate proxy)
- queso - well-known tool from the late 1990s which is no longer being updated for modern operating systems
References
- ↑ Chuvakin A. and Peikari, C: "Security Warrior.", page 229. O'Reilly Media Inc., 2004.
- ↑ "Passive OS Fingerprinting, NETRESEC Network Security Blog". Netresec.com. 2011-11-05. Retrieved 2011-11-25.
- ↑ "iplog". Retrieved 2011-11-25.
- ↑ "OS detection not key to penetration". Seclists.org. Retrieved 2011-11-25.
- ↑ "OSfuscate". Irongeek.com. 2008-09-30. Retrieved 2011-11-25.
- ↑ Carl-Daniel Hailfinger, carldani@4100XCDT. "IPPersonality". Ippersonality.sourceforge.net. Retrieved 2011-11-25.
- ↑ "Defeating TCP/IP stack fingerprinting". Usenix.org. 2002-01-29. Retrieved 2011-11-25.
- ↑ "PacketFence". PacketFence. 2011-11-21. Retrieved 2011-11-25.
- ↑ http://noc.to