Packets with Non-standard IP or TCP Flags
Setting unexpected or illegal flags in the IP or TCP header sections canenable us to detect the remote OS, as vendors have interpreted (or
ignored) the RFC in different ways.
The target's handling of overlapping IP fragments can lead to
identification. Some OS' will place greater precedence on the first
packets received, others on the latter.
TCP headers present us with a number of interesting techniques. By
RFC793, a stack receiving an unsolicited FIN flag (or indeed a NULL
headed packet) should offer no response. Many implementations,
including Microsoft and CISCO, deviate from the RFC and return an
RST packet.
No comments:
Post a Comment