Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was wondering how OS detection really works on Nmap. I know it is about to send different tcp probes to see how the target machine responds to them.

But what kind of probes would distinguish a Linux system or a Windows system? A Linux 2.4 or 2.6 system? Windows XP or Windows 7 system etc?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

you can check the following links NMap OS Detection and Paper About Nmap Detection you will find on them different methods used for OS detection By Fyodor the Creator of Nmap and if you want to dig dive you can purchase his book from amazon.

From NMap OS Detection:

...dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID sampling, and the initial window size check, Nmap compares the results to its nmap-os-db database of more than 2,600 known OS fingerprints and prints out the OS details if there is a match

share|improve this answer
    
The link to the NMAP detection paper does not work anymore. –  Jon Oct 16 at 11:13
    
The section of the Nmap book on OS detection is very good, too: nmap.org/book/osdetect.html –  bonsaiviking Oct 16 at 13:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.