PF.OS ( 5 ) OpenBSD Programmer's Manual PF.OS ( 5 )
pf.os - format of the operating system fingerprints file
The pf(4) firewall and the tcpdump(8) program can both fingerprint the operating system of hosts that
originate an IPv4 TCP connection. The file consists of newline-separated records, one per fingerprint,
containing nine colon ( `:' ) separated fields. These fields are as follows:
window |
The TCP window size. |
The window field corresponds to the th->th_win field in the TCP header and is the source host's adver-
tised TCP window size. It may be between zero and 65,535 inclusive. The window size may be given as
a multiple of a constant by prepending the size with a percent sign `%' and the value will be used as a mod-
ulus. Three special values may be used for the window size:
* |
An asterisk will wildcard the value so any window size will match. | |
S |
Allow any window size which is a multiple of the maximum segment size (MSS). |
The ttl value is the initial time to live in the IP header. The fingerprint code will account for the volatility
of the packet's TTL as it traverses a network.
The df bit corresponds to the Don't Fragment bit in an IPv4 header. It tells intermediate routers not to
fragment the packet and is used for path MTU discovery. It may be either a zero or a one.
The packet size is the literal size of the full IP packet and is a function of all of the IP and TCP op-
tions.
The TCP options field is an ordered list of the individual TCP options that appear in the SYN packet.
Each option is described by a single character separated by a comma and certain ones may include a val-
ue. The options are:
Mnnn |
maximum segment size (MSS) option. The value is the maximum packet size of the network link which may include the `%' modulus or match all MSSes with the `*' value. |
||
N |
the NOP option (NO Operation). |
||
S |
the Selective ACKnowledgement OK (SACKOK) option. |
No TCP options in the fingerprint may be given with a single dot `.'.
An example of OpenBSD's TCP options are:
M*,N,N,S,N,W0,N,N,T
OpenBSD 3.6 August 18, 2003 1
PF.OS ( 5 ) OpenBSD Programmer's Manual PF.OS ( 5 ) The first option M* is the MSS option and will match all values. The second and third options N will match |
The TCP options in a fingerprint will only match packets with the exact same TCP options in the same or- der. The class field is the class, genre or vendor of the operating system. The version is the version of the operating system. It is used to distinguish between different finger- prints of operating systems of the same class but different versions. The subtype is the subtype or patch level of the operating system version. It is used to distinguish be- tween different fingerprints of operating systems of the same class and same version but slightly different patches or tweaking. The description is a general description of the operating system, its version, patchlevel and any fur- ther useful details. |
The fingerprint of a plain OpenBSD 3.3 host is: 16384:64:1:64:M*,N,N,S,N,W0,N,N,T:OpenBSD:3.3::OpenBSD 3.3 The fingerprint of an OpenBSD 3.3 host behind a PF scrubbing firewall with a no-df rule would be: 16384:64:0:64:M*,N,N,S,N,W0,N,N,T:OpenBSD:3.3:!df:OpenBSD 3.3 scrub no-df An absolutely braindead embedded operating system fingerprint could be: 65535:255:0:40:.:DUMMY:1.1:p3:Dummy embedded OS v1.1p3 The tcpdump(8) output of # tcpdump -s128 -c1 -nv 'tcp[13] == 2' almost translates into the following fingerprint 57344:64:1:44:M1460: exampleOS:1.0::exampleOS 1.0 tcpdump(8) does not explicitly give the packet length. But it can usually be derived by adding the size of mss four bytes. In the above example, the packet size comes out to 44 bytes. |
pf(4), pf.conf(5), pfctl(8), tcpdump(8)
OpenBSD 3.6 August 18, 2003 2