Red Hat NETWORK 3.6 - Guía de usuario descargar pdf (Pagina 49)

P0f2 TCP Options

N NOP option

Wnnn window scaling option, value nnn (or * or %nnn)

Mnnn maximum segment size option, same as above

S selective ACK is permitable

T timestamp options are present

T0 a timestamp option is present with a zero value

?n unrecognized option number n

P0f2 "Quirks"

E End-Of-Line terminated options

P Options are present past the EOL entry

Z The IP packet ID number is ‘zero’

I IP options are present

U The TCP ‘urgent’ value is non-zero

X The unused (x2) TCP header option is non-zero

A The ACK number is non-zero

T The second timestamp option is non-zero

F Unusual TCP flags are set

D There is a data payload

! There are broken options

Keep in mind that these checks are applied to the “SYN” packets that are emitted by the

servers we are monitoring with the PVS. Based on the fields of the SYN packet, the

operating system can be determined.

ADDING NEW FINGERPRINTS

In operation though, it is common for a specific server to have no match at all. If a match

does not occur, the variables in the fields of the SYN will be reported by the PVS. For

example, within a test system, the PVS may report the following:

The remote host OS could not be recognized. Its fingerprint is:

16384:255:1460:1:0:1:1:48

If the operating system of this packet was known, it could be added to the end of the

osfingerprints.txt file. The PVS would require a restart prior to using the new passive

operating system plugin.

Tenable encourages PVS users to submit their passive plugins to either Tenable via email or

directly to the P0f home page.

FOR FURTHER INFORMATION

Tenable regularly updates PVS’s plugins and these can be viewed online at

http://static.tenable.com/dev/tenable_plugins.pdf. An RSS feed of the latest plugins is available

here: http://www.tenable.com/pvs.xml. Tenable Network Security, Inc. may be contacted via

1 2 ... 44 45 46 47 48 49 50 51 52 53 54 ... 60 61

Sin comentarios

Red Hat NETWORK 3.6 - Guía de usuario Pagina 49