Investigating the Accuracy of Wired and Wireless TCP/IP Fingerprinting on Honeyd
Suen Yek · Australasian Journal of Paramedicine · 2006
TCP/IP fingerprinting is a technique used to identify the unique network stack characteristics of an Operating System (OS) and may identify a digital device by its version, vendor and operating platform. The popular network scanning tool Network Mapper (NMAP) employs TCP/IP fingerprinting to discover host to a high degree of granularity from the manipulation of flag settings in packets. In this research, the honeyd honeynet was configured to test the accuracy of NMAP OS name resolution over a wired and wireless medium. The results indicated how the TCP/IP spoofing capabilities of honeyd could be a realistic network countermeasure.