312-50V11 · Question #868
Henry Is a cyber security specialist hired by BlackEye - Cyber security solutions. He was tasked with discovering the operating system (OS) of a host. He used the Unkornscan tool to discover the OS…
The correct answer is B. 128. Default TTL values in IP packets are OS-specific and can be used as a passive OS fingerprinting technique. Windows systems use a default TTL of 128, making it identifiable during network scanning.
Question
Henry Is a cyber security specialist hired by BlackEye - Cyber security solutions. He was tasked with discovering the operating system (OS) of a host. He used the Unkornscan tool to discover the OS of the target system. As a result, he obtained a TTL value, which Indicates that the target system is running a Windows OS. Identify the TTL value Henry obtained, which indicates that the target OS is Windows.
Options
- A64
- B128
- C255
- D138
How the community answered
(53 responses)- A2% (1)
- B92% (49)
- C2% (1)
- D4% (2)
Why each option
Default TTL values in IP packets are OS-specific and can be used as a passive OS fingerprinting technique. Windows systems use a default TTL of 128, making it identifiable during network scanning.
A TTL of 64 is the default for Linux and Unix-based systems, not Windows.
Windows operating systems initialize IP packets with a default TTL of 128. When a scanning tool like Unicornscan receives a response with a TTL at or near 128, it infers the target is running a Windows OS. This passive fingerprinting technique works because each OS vendor sets a distinct starting TTL value in their network stack.
A TTL of 255 is typically associated with network infrastructure devices such as Cisco routers or Solaris systems.
138 is not a standard or recognized default TTL value assigned by any major operating system vendor.
Concept tested: Passive OS fingerprinting via IP TTL values
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/default-ttl-value-for-operating-systems
Topics
Community Discussion
No community discussion yet for this question.