Can we use the tools such as P0f, OSSIM and other passive fingerprinting tools to build a comprehensive network topology of how the devices are interconnected ?

or is there a passive finger printing way of building network topology ? without any active probing, traceroute, nmap etc


Passive methods analysing traffic that comes into a single system are unlikely to work for you unless you have a very small network topology. Using tools like P0f or OSSIM you will learn what other subnets exist, but only if they connect to your box. You won't learn where they are in relation to each other, or even necessarily get a full picture of all the subnets in a network.

What you want to capture is the routing protocol traffic. Routers use protocols such as OSPF, EIGRP, and the like to send routing updates to each other. If you can see those you could build at least a partial network topology, how complete depends on the protocol and where your collector is in it. If you are in an OSPF stub area it will be extremely limited, if you are closer to the core it would be much more complete. Your system won't get any of this information unless you are running a span off of a network device because your system isn't participating in the routing protocol's multicast groups.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.