{"id":33,"date":"2005-03-05T00:19:31","date_gmt":"2005-03-05T00:19:31","guid":{"rendered":""},"modified":"2015-01-28T11:37:57","modified_gmt":"2015-01-28T11:37:57","slug":"host_fingerprinting","status":"publish","type":"post","link":"https:\/\/www.snoopdos.com\/blog\/host_fingerprinting\/","title":{"rendered":"Host fingerprinting"},"content":{"rendered":"

The technique of OS fingerprinting has been well documented<\/a>. It lets you identify the operating system used by a remote host with a fair degree of certainty. Indeed, OpenBSD<\/a> even supports this in its filter engine<\/a>; for example, you can write a rule that assigns mail traffic from Windows machines to a lower-priority bandwidth queue than that from other machines (since such traffic is usually the result of a virus).<\/p>\n

However, researcher Tadayoshi Kohno<\/a> has come up with a much more sophisticated approach, based on measuring clock skew across TCP packets. The idea is that every machine has a slightly different skew to their internal clock, and almost all TCP stacks timestamp packets using their internal clock as a reference point. By identifying the clock skew used for a particular PC, e.g. a laptop, you can track that machine’s movement as it moves around the Internet, perhaps connecting from several different countries or via different dial-up nodes.<\/p>\n

All very ingenious, and with no end of big brother implications. Read more in this article<\/a> at ZDNet Australia, or for the full technical details, check out his original research paper<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

The technique of OS fingerprinting has been well documented. It lets you identify the operating system used by a remote host with a fair degree of certainty. Indeed, OpenBSD even supports this in its filter engine; for example, you can write a rule that assigns mail traffic from Windows machines to a lower-priority bandwidth queue … Continue reading Host fingerprinting<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[6],"tags":[],"class_list":["post-33","post","type-post","status-publish","format-standard","hentry","category-networking"],"_links":{"self":[{"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/posts\/33","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/comments?post=33"}],"version-history":[{"count":1,"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/posts\/33\/revisions"}],"predecessor-version":[{"id":131,"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/posts\/33\/revisions\/131"}],"wp:attachment":[{"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/media?parent=33"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/categories?post=33"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.snoopdos.com\/blog\/wp-json\/wp\/v2\/tags?post=33"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}