This –O1 flag told Nmap to use the file nmap-os-fingerprints instead of the new standard. In prior versions of Nmap, if you wanted to utilize the original style of OS fingerprinting, you had the option of invoking it by using an –O1 flag. Released in 2006, the nmap-os-db file is part of the second generation of OS fingerprinting featured in Nmap. Thus, in the end, Nmap can take a very intelligent guess at just what OS the remote computer is running by conducting a rather low signature set of probes. Nmap uses this comparison to try to determine an OS fingerprint match. These unique sets of OS traits are kept in the nmap-os-db file. Ultimately, the information gathered via these specialized probes is used to generate the unique fingerprint that is compared in a database of known operating systems characteristics. It can also take much longer depending on how high the activity level of the target system is. Drawbacks of passive fingerprinting are that it is usually less accurate than a targeted active fingerprinting session and it relies on an existing traffic stream to which you have access. If your target is running publicly available services, passive fingerprinting may be a good way to start off your fingerprinting. Unlike the active method, this style of fingerprinting does not send any packets, but relies on sniffing techniques to analyze the information sent in normal network traffic. You can achieve higher degrees of accuracy by combining TCP/UDP and ICMP methods, assuming that no device in between you and the target is reshaping packets and mismatching the signatures.įor the ultimate in stealthy detection, you can use passive fingerprinting. Typically, ICMP-based methods use fewer packets than TCP-based methods, so in an environment where you need to be stealthier and can afford a less specific fingerprint, ICMP may be the way to go. Usually several different TCP packets are sent and the responses are compared to known baselines (or fingerprints) to determine the remote OS. The TCP fingerprinting process involves setting flags in the header that different operating systems and versions respond to differently. The more common active methods use responses sent to TCP or ICMP packets.

There are two common methods of performing system fingerprinting: active and passive scanning. The goal of system fingerprinting is to determine the operating system version and type. Jeremy Faircloth, in Penetration Tester's Open Source Toolkit (Third Edition), 2011 3.3.2.3 Fingerprinting

Tcp test tool 2.3 download