1 .\" $OpenBSD: pf.os.5,v 1.5 2003/10/25 07:55:27 jmc Exp $
3 .\" Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
5 .\" Permission to use, copy, modify, and distribute this software for any
6 .\" purpose with or without fee is hereby granted, provided that the above
7 .\" copyright notice and this permission notice appear in all copies.
9 .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 .Nd format of the operating system fingerprints file
27 program can both fingerprint the operating system of hosts that
28 originate an IPv4 TCP connection.
29 The file consists of newline-separated records, one per fingerprint,
33 These fields are as follows:
35 .Bl -tag -width Description -offset indent -compact
41 The presence of the IPv4 don't fragment bit.
43 The size of the initial TCP packet.
45 An ordered list of the TCP options.
47 The class of operating system.
49 The version of the operating system.
51 The subtype of patchlevel of the operating system.
53 The overall textual description of the operating system, version and subtype.
58 field corresponds to the th->th_win field in the TCP header and is the
59 source host's advertised TCP window size.
60 It may be between zero and 65,535 inclusive.
61 The window size may be given as a multiple of a constant by prepending
62 the size with a percent sign
64 and the value will be used as a modulus.
65 Three special values may be used for the window size:
67 .Bl -tag -width xxx -offset indent -compact
69 An asterisk will wildcard the value so any window size will match.
71 Allow any window size which is a multiple of the maximum segment size (MSS).
73 Allow any window size which is a multiple of the maximum transmission unit
79 value is the initial time to live in the IP header.
80 The fingerprint code will account for the volatility of the packet's TTL
81 as it traverses a network.
85 bit corresponds to the Don't Fragment bit in an IPv4 header.
86 It tells intermediate routers not to fragment the packet and is used for
88 It may be either a zero or a one.
92 is the literal size of the full IP packet and is a function of all of
93 the IP and TCP options.
97 field is an ordered list of the individual TCP options that appear in the
99 Each option is described by a single character separated by a comma and
100 certain ones may include a value.
103 .Bl -tag -width Description -offset indent -compact
105 maximum segment size (MSS) option.
106 The value is the maximum packet size of the network link which may
109 modulus or match all MSSes with the
113 the NOP option (NO Operation).
115 the timestamp option.
116 Certain operating systems always start with a zero timestamp in which
117 case a zero value is added to the option; otherwise no value is appended.
119 the Selective ACKnowledgement OK (SACKOK) option.
121 window scaling option.
122 The value is the size of the window scaling which may include the
124 modulus or match all window scalings with the
129 No TCP options in the fingerprint may be given with a single dot
132 An example of OpenBSD's TCP options are:
134 .Dl M*,N,N,S,N,W0,N,N,T
138 is the MSS option and will match all values.
139 The second and third options
144 will match the SACKOK option.
147 will match another NOP.
150 will match a window scaling option with a zero scaling size.
151 The seventh and eighth
153 options will match two NOPs.
154 And the ninth and final option
156 will match the timestamp option with any time value.
158 The TCP options in a fingerprint will only match packets with the
159 exact same TCP options in the same order.
163 field is the class, genre or vender of the operating system.
167 is the version of the operating system.
168 It is used to distinguish between different fingerprints of operating
169 systems of the same class but different versions.
173 is the subtype or patch level of the operating system version.
174 It is used to distinguish between different fingerprints of operating
175 systems of the same class and same version but slightly different
180 is a general description of the operating system, its version,
181 patchlevel and any further useful details.
183 The fingerprint of a plain
187 16384:64:1:64:M*,N,N,S,N,W0,N,N,T:OpenBSD:3.3::OpenBSD 3.3
190 The fingerprint of an
192 host behind a PF scrubbing firewall with a no-df rule would be:
194 16384:64:0:64:M*,N,N,S,N,W0,N,N,T:OpenBSD:3.3:!df:OpenBSD 3.3 scrub no-df
197 An absolutely braindead embedded operating system fingerprint could be:
199 65535:255:0:40:.:DUMMY:1.1:p3:Dummy embedded OS v1.1p3
206 # tcpdump -s128 -c1 -nv 'tcp[13] == 2'
207 03:13:48.118526 10.0.0.1.3377 > 10.0.0.0.2: S [tcp sum ok] \e
208 534596083:534596083(0) win 57344 <mss 1460> (DF) [tos 0x10] \e
212 almost translates into the following fingerprint
214 57344:64:1:44:M1460: exampleOS:1.0::exampleOS 1.0
218 does not explicitly give the packet length.
219 But it can usually be derived by adding the size of the IPv4 header to
220 the size of the TCP header to the size of the TCP options.
221 The size of both headers is typically twenty each and the usual
222 sizes of the TCP options are:
224 .Bl -tag -width timestamp -offset indent -compact
237 In the above example, the packet size comes out to 44 bytes.