nerdexam
GIAC

GSNA · Question #298

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used…

The correct answer is C. nmap -O -p. The nmap -O -p switch can be used to perform TCP/IP stack fingerprinting. Nmap is a free open- source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a "map" of the network. Just like many…

Network & Perimeter Auditing

Question

TCP/IP stack fingerprinting is the passive collection of configuration attributes from a remote device during standard layer 4 network communications. The combination of parameters may then be used to infer the remote operating system (OS fingerprinting), or incorporated into a device fingerprint. Which of the following Nmap switches can be used to perform TCP/IP stack fingerprinting?

Options

  • Anmap -sS
  • Bnmap -sU -p
  • Cnmap -O -p
  • Dnmap -sT Explanation:

How the community answered

(25 responses)
  • A
    16% (4)
  • B
    8% (2)
  • C
    72% (18)
  • D
    4% (1)

Explanation

The nmap -O -p switch can be used to perform TCP/IP stack fingerprinting. Nmap is a free open- source utility for network exploration and security auditing. It is used to discover computers and services on a computer network, thus creating a "map" of the network. Just like many simple port scanners, Nmap is capable of discovering passive services. In addition, Nmap may be able to determine various details about the remote computers. These include operating system, device type, uptime, software product used to run a service, exact version number of that product, presence of some firewall techniques and, on a local area network, even vendor of the remote network card. Nmap runs on Linux, Microsoft Windows etc. Answer: B is incorrect. The nmap -sU -p switch can be used to perform UDP port scanning. Answer: A is incorrect. The nmap -sS switch is used to perform a TCP half scan. TCP SYN scanning is also known as half-open scanning because in this a full TCP connection is never Answer: D is incorrect. The nmap -sT switch is used to perform a TCP full scan.

Topics

#Nmap#TCP/IP fingerprinting#OS fingerprinting#network scanning

Community Discussion

No community discussion yet for this question.

Full GSNA Practice