Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not trying to solve a current technical problem but I came across this and have been wondering how it's done. Intrusion Prevention Systems are supposed to let all network traffic pass through and implement Intrusion Detection methods to detect and stop packets with malicious payloads. I would think that an IPS does not on it's own create any answer message (that could be used to fingerprint it) but rather either passes the packet or not. Then how can it be "fingerprinted"?

Perhaps a very first suggestion would be to send specifically crafted packets to a (e.g. web) server you know is connected beyond the IPS and based on the server's answers to infer on the IPS engine/rules. But is this practical? Is there a "proper" way to do it?



share|improve this question
up vote 3 down vote accepted

You can read more about Active Filter Detection on the PureHacking website. The tool they are discussing is called osstmm-afd, available for download as a source tarball or NASL script. However, since that link isn't working -- I suggest you search for this tool elsewhere for now or email/contact PureHacking.

share|improve this answer
This was more or less what i was looking for: not so much the tool itself but rather the network methodology it employs. Many thanks! – Georgios Apr 5 '11 at 7:58

Sending different types of packets, including bogus ones, and judging the return values is how IP stacks are fingerprinted. Similarly, for web application firewalls, "WAFW00F" will do the same. Fingerprinting an IPS is no different. You find differences between in what IPS systems do for certain packets / attacks and use those to determine what you're probably looking at.

Perhaps one IPS sends an RST where another drops, etc.

share|improve this answer

You probably would be interested in the research by Simple Nomad. He has done lots of research in this area and has been fingerprinting IPS devices for a while now.

Any in-line proxy that makes changes to the traffic can be fingerprinted. Understanding the signatures used by the IPS is important to create packets to thwart them or to validate an IPS is in stream modifying the packets.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.