I'm looking at TCP, and what options may affect the global configuration so that I can detect a repeat visitor.

What TCP commands (for lack of a better word) affect the global TCP stack? Or that or a session to an existing server?

One example is window size. I could open a connection to a server using Javascript in IE and then open up an in-private session in Chrome. I would assume that this window size, maintained by the OS) would pick up where the IE client left off. That number, might be enough to identify a user.

Is that a valid scenario, or what other aspects of TCP may persist in a OS stack, useful for fingerprinting?

  • Are you looking at this from the perspective of watching others' packets, or other people watching your packets? Are you looking for things that can't be spoofed?
    – Steve
    Jun 13 '15 at 0:18

TCP fingerprinting doesn't really help you identify a client.

When we talk about TCP fingerprinting, we're talking about the configuration details that, taken together, help identify the habitual configuration of an OS. Different OSes have different default TTL values, for example.

You're asking about identifying non-habitual (unique) aspects of TCP traffic from a given host, but these details rarely vary from one installation of that OS to another. If 100 visitors to your web site are running Windows 7, then those 100 visitors will share TCP characteristics that are essentially indistinguishable from each other. For this reason TCP fingerprinting is used to identify a generic aspect (the OS) of a single system, not identifying aspects of multiple systems.

(The exception is actually TTL - if a remote machine is trying to spoof IP addresses, their traffic may be distinct by the TTL of packets as they arrive, because they all start with the same default TTL and they generally will decrement by the same amount as they follow the same network path to you).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.