Detecting OS fingerprint on open TCP connection?

I know you can detect the OS fingerprint by doing an nmap scan, but I was
curious whether there is any facility in the Linux kernel that can do
remote OS detection on-the-fly, for an open TCP connection.

The reason I ask is I ran into this, from an OpenBSD user:
http://use.perl.org/~merlyn/journal/17094

Now this is very neat... because nearly all spam and viruses arrive through
infected Microsoft Windows hosts (proxies, relays, zombies, etc.) this guy
has used his firewall to impose a total 56k bandwidth restriction for all
mail traffic coming from Windows hosts.

This means that all other mail traffic goes at full speed, while the
transactions with Windows hosts (heavily suspect) proceed very slowly.
During worm outbreaks and spamruns this can save a site significant
bandwidth.

If there were some way to do that on my Linux host, I would give it a try!

--
Jem Berkes
http://www.sysdesign.ca/

Jem Berkes wrote:

> I know you can detect the OS fingerprint by doing an nmap scan, but I
> was curious whether there is any facility in the Linux kernel that can
> do remote OS detection on-the-fly, for an open TCP connection.
>
> The reason I ask is I ran into this, from an OpenBSD user:
> http://use.perl.org/~merlyn/journal/17094
>
> Now this is very neat... because nearly all spam and viruses arrive
> through infected Microsoft Windows hosts (proxies, relays, zombies,
> etc.) this guy has used his firewall to impose a total 56k bandwidth
> restriction for all mail traffic coming from Windows hosts.
>
> This means that all other mail traffic goes at full speed, while the
> transactions with Windows hosts (heavily suspect) proceed very slowly.
> During worm outbreaks and spamruns this can save a site significant
> bandwidth.
>
> If there were some way to do that on my Linux host, I would give it a
> try!
>

Have a look at p0f. That is the underlying package in OpenBSD.

EJ
--
Remove the obvious part (including the dot) for my email address.
http://www.vanwesten.net for examples of ipf and pf.

Jem Berkes <(E-Mail Removed)> wrote in
news:Xns94CF661A22A7Ajbuserspc9org@130.179.16.24:

> I know you can detect the OS fingerprint by doing an nmap scan, but I
> was curious whether there is any facility in the Linux kernel that can
> do remote OS detection on-the-fly, for an open TCP connection.
>
> This means that all other mail traffic goes at full speed, while the
> transactions with Windows hosts (heavily suspect) proceed very slowly.
> During worm outbreaks and spamruns this can save a site significant
> bandwidth.
>
> If there were some way to do that on my Linux host, I would give it a
> try!
>

Hello,

take a look at:
http://www.netfilter.org/patch-o-mat...l#pom-base-osf

It's a port of OpenBSD's opf to Linux as a netfilter module.


--
P.Krumins