Messages in this thread | | | Date | Thu, 29 Apr 1999 22:08:19 +0000 ( ) | From | Gerhard Mack <> | Subject | questions about linux in the nmap documentation |
| |
I've been reading the documentation to nmap http://www.insecure.org/nmap and they mention linux a coupple times.
Just 2 questions:
In the first section why are we diffrent? And in the second why is 2.1.x less random than 2.0.x ?
Here are the relevent 2 paragraphs:
Type of Service -- For the ICMP port unreachable messages I look at the type of service (TOS) value of the packet sent back. Almost all implementations use 0 for this ICMP error although Linux uses 0xC0. This does not indicate one of the standard TOS values, but instead is part of the unused (AFAIK) precedence field. I do not know why this is set, but if they change to 0 we will be able to keep identifying the old versions _and_ we will be able to identify between old and new.
and also:
TCP Options -- These are truly a gold mine in terms of leaking information. The beauty of these options is that: 1) They are generally optional (duh!) :) so not all hosts implement them. 2) You know if a host implements them by sending a query with an option set. The target generally show support of the option by setting it on the reply. 3) You can stuff a whole bunch of options on one packet to test everything at once.
Nmap sends these options along with almost every probe packet:
Window Scale=10; NOP; Max Segment Size = 265; Timestamp; End of Ops;
When you get your response, you take a look at which options were returned and thus are supported. Some operating systems such as recent FreeBSD boxes support all of the above, while others, such as Linux 2.0.X support very few. The latest Linux 2.1.x kernels do support all of the above. On the other hand, they are more vulnerable to TCP sequence prediction. Go figure.
-- gmack@imag.net
As a computer I find your faith in technology amusing.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |