312-50V11 · Question #993
Harris is attempting to identify the OS running on his target machine. He inspected the initial TTL in the IP header and the related TCP window size and obtained the following results: TTL: 64…
The correct answer is D. Linux OS. OS fingerprinting via IP TTL and TCP window size values allows identification of the target operating system without direct access.
Question
Harris is attempting to identify the OS running on his target machine. He inspected the initial TTL in the IP header and the related TCP window size and obtained the following results:
TTL: 64 Window Size: 5840 What is the OS running on the target machine?
Options
- ASolaris OS
- BWindows OS
- CMac OS
- DLinux OS
How the community answered
(31 responses)- A3% (1)
- B3% (1)
- D94% (29)
Why each option
OS fingerprinting via IP TTL and TCP window size values allows identification of the target operating system without direct access.
Solaris typically uses a default TTL of 255, not 64, making it distinguishable from this result.
Windows systems commonly use a default TTL of 128 and a TCP window size of 65535 or 8192, not the values observed here.
macOS also uses a default TTL of 64 but its typical TCP window size is 65535, not 5840, distinguishing it from Linux.
A default TTL of 64 combined with a TCP window size of 5840 bytes is a well-known fingerprint of Linux kernels. Linux sets TTL to 64 by default in the IP stack, and the 5840-byte window size (4 x MSS of 1460) is characteristic of older Linux TCP implementations. These values differ from Windows (TTL 128, window 65535) and Solaris (TTL 255).
Concept tested: OS fingerprinting via TTL and TCP window size
Source: https://nmap.org/book/osdetect-methods.html
Topics
Community Discussion
No community discussion yet for this question.