312-50V12 · Question #302
Harris is attempting to identify the OS running on his target machine. He inspected the initial TTL in the IP header and the related TCP window size and obtained the following results: TTL: 64…
The correct answer is C. Linux OS. The observed initial TTL of 64 and TCP window size of 5840 are characteristic network parameters often associated with Linux operating systems. This combination helps in OS fingerprinting by network analysis.
Question
Options
- AWindows OS
- BMac OS
- CLinux OS
- DSolaris OS
How the community answered
(46 responses)- A11% (5)
- B7% (3)
- C80% (37)
- D2% (1)
Why each option
The observed initial TTL of 64 and TCP window size of 5840 are characteristic network parameters often associated with Linux operating systems. This combination helps in OS fingerprinting by network analysis.
Windows OS typically uses an initial TTL of 128 for outgoing IP packets, not 64.
While Mac OS can use an initial TTL of 64, its default TCP window size is typically larger, often a multiple of 16384, not 5840.
Linux operating systems commonly employ an initial Time To Live (TTL) value of 64 for outgoing IP packets, indicating one hop from the source. Additionally, a default TCP window size of 5840 bytes is a widely recognized characteristic of many Linux kernel versions, making these combined values a strong fingerprint for Linux OS identification.
Solaris OS commonly uses an initial TTL of 255 for outgoing IP packets, not 64.
Concept tested: OS fingerprinting using TTL and TCP window size
Topics
Community Discussion
No community discussion yet for this question.