nerdexam
GIAC

GCIH · Question #177

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used…

The correct answer is C. nmap -O -p. Nmap's -O flag enables OS detection by analyzing TCP/IP stack responses from a target host. Combined with -p to specify ports, this is the standard method for OS fingerprinting.

Reconnaissance, Scanning, and Enumeration

Question

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint. Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

Options

  • Anmap -sS
  • Bnmap -sU -p
  • Cnmap -O -p
  • Dnmap -sT

How the community answered

(38 responses)
  • A
    3% (1)
  • B
    5% (2)
  • C
    89% (34)
  • D
    3% (1)

Why each option

Nmap's -O flag enables OS detection by analyzing TCP/IP stack responses from a target host. Combined with -p to specify ports, this is the standard method for OS fingerprinting.

Anmap -sS

nmap -sS performs a TCP SYN (half-open) stealth scan to discover open ports, not to fingerprint the operating system.

Bnmap -sU -p

nmap -sU -p performs a UDP port scan on specified ports, which is used to discover open UDP services rather than perform OS fingerprinting.

Cnmap -O -pCorrect

The -O switch instructs Nmap to perform OS detection by sending a series of specially crafted TCP and UDP probes and analyzing the responses to identify unique characteristics of the target's TCP/IP stack implementation. The -p flag specifies which ports to probe, which is required for effective fingerprinting. Together, nmap -O -p constitutes the standard Nmap OS fingerprinting command.

Dnmap -sT

nmap -sT performs a full TCP connect scan to identify open TCP ports, and does not perform OS or TCP/IP stack fingerprinting.

Concept tested: Nmap OS detection and TCP/IP stack fingerprinting

Source: https://nmap.org/book/man-os-detection.html

Topics

#Nmap#OS fingerprinting#TCP/IP stack#network scanning

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice