LNCS 2820 - Ambiguity Resolution via Passive OS Fingerprinting

Ambiguity Resolution via Passive OS Fingerprinting 203
when all available memory resources are consumed, the memory manager calls
back into these cache routines to free memory, effectively wiping out as much
of the cache as needed for the system to continue monitoring. When memory
resources become available again, the cache can be rebuilt.
7 Experiments and Results
Using the mapping tool described in Section 4, we were able to map almost 1,200
hosts and identify 42 different operating systems.
The TCP options tests gathered 223 unique responses from different operating
systems 3 , which is a wealth of information that can be used to identify
hosts.
Further examination of TCP traffic, as shown in Table 4, yielded several
common TCP SYN segments, that show the dispersion of SYNs to cover just
over 50% (9 of 16) of the 16 SYNACK sub-tables.
Table 4. Common options and variations of a TCP SYN Segment and the corresponding
encoded options for the SYNACK sub-table lookup.
# TCP options Encoding
1) 1
2) 2
3) 5
4) 5
5) 5
6) 13
7) 7
8) 15
9) 15
10) 15
11) 14
12) 2
13) 9
7.1 Drawbacks
This solution suffers from the cold start dilemma: If no traffic has been seen
by the IDS for a particular host that can be used to identify its ambiguity
resolution policies, then nothing can be done if the first packets the IDS sees
contain ambiguities.
3 This number does not consider the TTL value since the TTL varies depending on
the path taken from the scanner to the host.