I am trying to understand remote OS detection techniques using Scapy. I came across the following article SANS article on Remote OS detection using Scapy and have been trying to follow it.

The technique, as I understand from the above, is that if after the initial successful TCP 3 way handshake, if a data packet is sent with flags NOT set to ACK , then all the operating systems, except Linux, should respond with a RST packet. Linux does not follow this RFC requirement and hence responds back with an ACK packet.

This is one way how we can say if it the remote machine is a Linux or any other. There may be other ways of figuring this out as well, but I would like to understand this very technique and what is supposedly going wrong with my scapy script below.

from scapy.all import *

seq = 12345
sport = 1040
dport = 80

ip_packet = IP(dst='')
syn_packet = TCP(sport=sport, dport=dport, flags='S', seq=seq)

packet = ip_packet/syn_packet
synack_response = sr1(packet)

next_seq = seq + 1
my_ack = synack_response.seq + 1

ack_packet = TCP(sport=sport, dport=dport, flags='A', seq=next_seq, ack=my_ack)


payload_packet = TCP(sport=sport, dport=dport, flags='', seq=next_seq)
payload = "this is a test"

In the script above, the machine is a Linux machine running Inetsim and perfectly simulating HTTP among other services. The way I am sure it is working fine is because I am able to successfully do the below:

nc 80

and then send some random data, say the string "abcd" to it. And then when I analyze it with wireshark, it clearly shows that post the TCP 3 way handshake, in response to the "abcd" data packet it sends back an ACK packet.

While if I do the same thing with my script above, and analyze it with Wireshark, the TCP 3 way handshake happens successfully, but post that the server does not respond back with an ACK packet (while it should being a Linux system, which as noted above does not follow the RFC).

What is more strange is that the server does not even respond back with a RST packet either.

The linux system is an Ubuntu system, if that makes any difference.

Please help me understand what possibly am I doing wrong here ?

  • Have you read the complication chapter from your article and try setting iptables ? – Xavier59 Nov 12 '16 at 0:08
  • Yes. That is taken care of. – qre0ct Nov 12 '16 at 1:39
  • What version of Ubuntu are you testing against? This works fine on my Ubuntu box, running 17.10 – waymobetta Jul 20 '18 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.