TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint. Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

Question

Accepted Answer

A. nmap -O -p The nmap -O switch instructs Nmap to perform OS detection by sending a series of specially crafted TCP and UDP probes and comparing the responses against its OS fingerprint database, directly implementing TCP/IP stack fingerprinting. The -p flag allows targeting specific ports to improve accuracy of the fingerprinting process.

Answer

B. nmap -sS nmap -sS performs a TCP SYN half-open stealth scan to enumerate open ports, and does not analyze TCP/IP stack attributes or produce an OS fingerprint.

Answer

C. nmap -sU -p nmap -sU -p performs a UDP port scan to discover open UDP services, and does not collect TCP/IP stack configuration attributes for OS inference.

Answer

D. nmap -sT nmap -sT performs a full TCP connect scan that completes the three-way handshake to identify open ports, but does not perform OS detection or TCP/IP stack fingerprinting.

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used…

Question

Options

How the community answered

Why each option

Topics

Community Discussion