I am trying to understand remote OS detection techniques using Scapy. I came across the following article SANS article on Remote OS detection using Scapy and have been trying to follow it.
The technique, as I understand from the above, is that if after the initial successful TCP 3 way handshake, if a data packet is sent with flags NOT set to ACK , then all the operating systems, except Linux, should respond with a RST packet. Linux does not follow this RFC requirement and hence responds back with an ACK packet.
This is one way how we can say if it the remote machine is a Linux or any other. There may be other ways of figuring this out as well, but I would like to understand this very technique and what is supposedly going wrong with my scapy script below.
from scapy.all import * seq = 12345 sport = 1040 dport = 80 ip_packet = IP(dst='192.168.56.107') syn_packet = TCP(sport=sport, dport=dport, flags='S', seq=seq) packet = ip_packet/syn_packet synack_response = sr1(packet) next_seq = seq + 1 my_ack = synack_response.seq + 1 ack_packet = TCP(sport=sport, dport=dport, flags='A', seq=next_seq, ack=my_ack) send(ip_packet/ack_packet) payload_packet = TCP(sport=sport, dport=dport, flags='', seq=next_seq) payload = "this is a test" send(ip_packet/payload_packet/payload)
In the script above, the machine 192.168.56.107 is a Linux machine running Inetsim and perfectly simulating HTTP among other services. The way I am sure it is working fine is because I am able to successfully do the below:
nc 192.168.56.107 80
and then send some random data, say the string "abcd" to it. And then when I analyze it with wireshark, it clearly shows that post the TCP 3 way handshake, in response to the "abcd" data packet it sends back an ACK packet.
While if I do the same thing with my script above, and analyze it with Wireshark, the TCP 3 way handshake happens successfully, but post that the server does not respond back with an ACK packet (while it should being a Linux system, which as noted above does not follow the RFC).
What is more strange is that the server does not even respond back with a RST packet either.
The linux system is an Ubuntu system, if that makes any difference.
Please help me understand what possibly am I doing wrong here ?