OS Fingerprinting

Question 1

Define passive OS Fingerprinting

Answer 1

Passive - also known as packet sniffing, where an attempt is made to identify the OS by listening to, or sniffing, the system packets.

Matches well known values in packets. E.g.
TTL
Windows size
Dont fragment (DF Flag on packet)

Avoid being detected

Not 100% accurate

Attackers use this technique

Question 2

Define TTL

Answer 2

Time To Live
In order to prevent infinite packet loops a packet is given a limit in its existence.
Done through maximum hops on the network layer.

Question 3

Devine Active Os Fingerprinting.

Answer 3

Active - Also known as scanning, where specially crafted packets are sent to the target system and the response is noted.

Question 4

Describe p0f Fingerprinting tool

Answer 4

Linux command line based
Monitors, captures and examines traffic.
Does not send any packets to the target.

Question 5

Describe NetworkMiner OS Fingerprinting tool

Answer 5

Passive Fingerprinting tool for windows .
Has GUI
Two versions open source and pro