LNCS 2820 - Ambiguity Resolution via Passive OS Fingerprinting
LNCS 2820 - Ambiguity Resolution via Passive OS Fingerprinting
LNCS 2820 - Ambiguity Resolution via Passive OS Fingerprinting
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
200 G. Taleck<br />
Table 2. Encoding of TCP options present in TCP SYN segments: bit 3: timestamp,<br />
2: wscale, 1: sackok, 0: mss.<br />
TCP options<br />
Bits Value<br />
no options 0000 0<br />
mss 0001 1<br />
sackok 0010 2<br />
sackok mss 0011 3<br />
wscale 0100 4<br />
wscale mss 0101 5<br />
wscale sackok 0110 6<br />
wscale sackok mss 0111 7<br />
timestamp 1000 8<br />
timestamp mss 1001 9<br />
timestamp sackok 1010 10<br />
timestamp sackok mss 1011 11<br />
timestamp wscale 1100 12<br />
timestamp wscale mss 1101 13<br />
timestamp wscale sackok 1110 14<br />
timestamp wscale sackok mss 1111 15<br />
segment contained a non-zero TSval field. This is not necessarily a violation of<br />
the specification, but it does provide useful information that can be used to<br />
differentiate operating systems when monitored passively.<br />
Window Sizes. Additionally, some stacks will adjust their initial window size<br />
depending on whether the timestamp or other options were requested by the<br />
client. Table 3 illustrates some differences and similarities between operating<br />
systems and the initial window size.<br />
Table 3. Initial Window Sizes (WS) of various operating systems with and without<br />
the TCP timestamp (TS) option requested.<br />
Operating System WS without TS WS with TS<br />
Linux 2.4.0 5840 5792<br />
Microsoft Windows NT4.0 64240 65160<br />
Mac<strong>OS</strong> 10.1 32768 33000<br />
OpenBSD 3.3 64240 65160<br />
FreeBSD 2.2 16384 17520<br />
FreeBSD 4.6 57344 57344
Change language