This article describes how to fool
nmap in it's OS fingerprinting detection.
nmap sends malformed packets to open and closed ports and listens to the responses. Because every OS implements it's own TCP/IP stack, the response can be matched against a database of known signatures and the OS guessed.
The two ways of mitigating this are
- Patch the kernel source with "stealth patch"
This patch simply discards the TCP/IP packets received with the following matches:
Packets with both SYN and FIN activated (tcp_ignore_synfin) (QueSO probe).
Bogus Packets: if the TCP header has the res1 bit active (one of the reserved bits, then it's a bogus packet) or it does not have any of the following activated: ACK, SYN, RST, FIN (Nmap test 2).
Packets with FIN, PUSH and URG activated (Nmap test 7).
- Patch the kernel sources with "IP Personality" in order to modify the TCP/IP stack's behaviour in those corner-case situations, emulating another OS (Sega Dreamcast for example)
While the latter approach can have some efficiency/stability issues:
Tweaking those allow to fool a scanner but might break regular connectivity by changing network parameters. It could also make the system weaker if the emulated IP stack is not as strong as the initial one
the former has no drawbacks mentioned.
Why is this not default behaviour. Why do operating systems respond to those packets?