nerdexam
EC-Council

312-50V11 · Question #993

Harris is attempting to identify the OS running on his target machine. He inspected the initial TTL in the IP header and the related TCP window size and obtained the following results: TTL: 64…

The correct answer is D. Linux OS. OS fingerprinting via IP TTL and TCP window size values allows identification of the target operating system without direct access.

Scanning Networks

Question

Harris is attempting to identify the OS running on his target machine. He inspected the initial TTL in the IP header and the related TCP window size and obtained the following results:

TTL: 64 Window Size: 5840 What is the OS running on the target machine?

Options

  • ASolaris OS
  • BWindows OS
  • CMac OS
  • DLinux OS

How the community answered

(31 responses)
  • A
    3% (1)
  • B
    3% (1)
  • D
    94% (29)

Why each option

OS fingerprinting via IP TTL and TCP window size values allows identification of the target operating system without direct access.

ASolaris OS

Solaris typically uses a default TTL of 255, not 64, making it distinguishable from this result.

BWindows OS

Windows systems commonly use a default TTL of 128 and a TCP window size of 65535 or 8192, not the values observed here.

CMac OS

macOS also uses a default TTL of 64 but its typical TCP window size is 65535, not 5840, distinguishing it from Linux.

DLinux OSCorrect

A default TTL of 64 combined with a TCP window size of 5840 bytes is a well-known fingerprint of Linux kernels. Linux sets TTL to 64 by default in the IP stack, and the 5840-byte window size (4 x MSS of 1460) is characteristic of older Linux TCP implementations. These values differ from Windows (TTL 128, window 65535) and Solaris (TTL 255).

Concept tested: OS fingerprinting via TTL and TCP window size

Source: https://nmap.org/book/osdetect-methods.html

Topics

#OS fingerprinting#TTL values#TCP window size#passive OS detection

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice