A qualitative survey of active TCP/IP fingerprinting tools and techniques for operating systems identification

Authors:
João Paulo S. Medeiros;Agostinho De Medeiros Brito Júnior;Paulo S. Motta Pires
Affiliations:
Security Information Laboratory, Elements of Information Processing Laboratory, Department of Exact and Applied Sciences, Federal University of Rio Grande do Norte, Natal, RN, Brazil;Security Information Laboratory, Elements of Information Processing Laboratory, Department of Computer Engineering and Automation, Federal University of Rio Grande do Norte, Natal, RN, Brazil;Security Information Laboratory, Elements of Information Processing Laboratory, Department of Computer Engineering and Automation, Federal University of Rio Grande do Norte, Natal, RN, Brazil
Venue:
CISIS'11 Proceedings of the 4th international conference on Computational intelligence in security for information systems
Year:
2011

Citing 6
Cited 0

Defeating TCP/IP stack fingerprinting

SSYM'00 Proceedings of the 9th conference on USENIX Security Symposium - Volume 9
Network intrusion detection: evasion, traffic normalization, and end-to-end protocol semantics

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
Virtual honeypots: from botnet tracking to intrusion detection

Virtual honeypots: from botnet tracking to intrusion detection
A new method for recognizing operating systems of automation devices

ETFA'09 Proceedings of the 14th IEEE international conference on Emerging technologies & factory automation
Application of kohonen maps to improve security tests on automation devices

CRITIS'07 Proceedings of the Second international conference on Critical Information Infrastructures Security
An effective TCP/IP fingerprinting technique based on strange attractors classification

DPM'09/SETOP'09 Proceedings of the 4th international workshop, and Second international conference on Data Privacy Management and Autonomous Spontaneous Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

TCP/IP fingerprinting is the process of identifying the Operating System (OS) of a remote machine through a TCP/IP based computer network. This process has applications close related to network security and both intrusion and defense procedures may use this process to achieve their objectives. There are a large set of methods that performs this process in favorable scenarios. Nowadays there are many adversities that reduce the identification performance. This work compares the characteristics of four active fingerprint tools (Nmap, Xprobe2, SinFP and Zion) and how they deal with test environments under adverse conditions. The results show that Zion outperforms the other tools for all test environments and it is suitable even for use in sensible systems.