doc/p0f.fp

   1 #
   2 # p0f - SYN fingerprints
   3 # ----------------------
   4 #
   5 # .-------------------------------------------------------------------------.
   6 # | The purpose of this file is to cover signatures for incoming TCP/IP     |
   7 # | connections (SYN packets). This is the default mode of operation for    |
   8 # | p0f. This is also the biggest and most up-to-date set of signatures     |
   9 # | shipped with this project. The file also contains a detailed discussion |
  10 # | of all metrics examined by p0f, and some practical notes on how to      |
  11 # | add new signatures.                                                     |
  12 # `-------------------------------------------------------------------------'
  13 #
  14 # (C) Copyright 2000-2006 by Michal Zalewski <lcamtuf@coredump.cx>
  15 #
  16 # Each line in this file specifies a single fingerprint. Please read the
  17 # information below carefully before attempting to append any signatures
  18 # reported by p0f as UNKNOWN to this file to avoid mistakes. Note that
  19 # this file is compatible only with the default operation mode, and not
  20 # with -R or -A options (SYN+ACK and RST+ modes).
  21 #
  22 # We use the following set metrics for fingerprinting:
  23 #
  24 # - Window size (WSS) - a highly OS dependent setting used for TCP/IP
  25 #   performance control (max. amount of data to be sent without ACK).
  26 #   Some systems use a fixed value for initial packets. On other
  27 #   systems, it is a multiple of MSS or MTU (MSS+40). In some rare
  28 #   cases, the value is just arbitrary.
  29 #
  30 #   NEW SIGNATURE: if p0f reported a special value of 'Snn', the number
  31 #   appears to be a multiple of MSS (MSS*nn); a special value of 'Tnn'
  32 #   means it is a multiple of MTU ((MSS+40)*nn). Unless you notice the
  33 #   value of nn is not fixed (unlikely), just copy the Snn or Tnn token
  34 #   literally. If you know this device has a simple stack and a fixed
  35 #   MTU, you can however multiply S value by MSS, or T value by MSS+40,
  36 #   and put it instead of Snn or Tnn. One system may exhibit several T
  37 #   or S values. In some situations, this might be a source of some
  38 #   additional information about the setup if you have some time to dig
  39 #   thru the kernel sources; in some other cases, like Windows, there seem
  40 #   to be a multitude of variants and WSS selection algorithms, but it's
  41 #   rather difficult to find a pattern without having the source.
  42 #
  43 #   If WSS looks like a regular fixed value (for example is a power of two),
  44 #   or if you can confirm the value is fixed by looking at several
  45 #   fingerprints, please quote it literaly. If there's no apparent pattern
  46 #   in WSS chosen, you should consider wildcarding this value - but this
  47 #   should be the last option.
  48 #
  49 #   NOTE: Some NAT devices, such as Linux iptables with --set-mss, will
  50 #   modify MSS, but not WSS. As a result, MSS is changed to reflect
  51 #   the MTU of the NAT device, but WSS remains a multiple of the original
  52 #   MSS. Fortunately for us, the source device would almost always be
  53 #   hooked up to Ethernet. P0f handles it automatically for the original
  54 #   MSS of 1460, by adding "NAT!" tag to the result.
  55 #
  56 #   In certain configurations, Linux erratically (?) uses MTU from another
  57 #   interface on the default gw interface. This only happens on systems with
  58 #   two network interfaces. Thus, some Linux systems that do not go thru NAT,
  59 #   but have multiple interfaces instead, will be also tagged this way.
  60 #
  61 #   P0f recognizes and automatically wildcards WSS of 12345, as generated
  62 #   by sendack and sendsyn utilities shipped with the program, when
  63 #   reporting a new signature. See test/sendack.c and test/sendsyn.c for more
  64 #   information about this.
  65 #
  66 # - Overall packet size - a function of all IP and TCP options and bugs.
  67 #   While this is partly redundant in the real world, we record this value
  68 #   to capture rare cases when there are IP options (which we do not currently
  69 #   examine) or packet data past the headers. Both situations are rare.
  70 #
  71 #   Packet size MAY be wildcarded, but the meaning of the wildcard is
  72 #   very special, and means the packet must be larger than PACKET_BIG
  73 #   (defined in config.h as 100). This is usually not necessary, except
  74 #   for some really broken implementations in RST+ mode. For more information,
  75 #   see p0fr.fp. P0f automatically wildcards big packets when reporting
  76 #   new signatures.
  77 #
  78 #   NEW SIGNATURE: Copy this value literally.
  79 #
  80 # - Initial TTL - We check the actual TTL of a received packet. It can't
  81 #   be higher than the initial TTL, and also shouldn't be dramatically
  82 #   lower (maximum distance is defined in config.h as 40 hops).
  83 #
  84 #   NEW SIGNATURE: *Never* copy TTL from a p0f-reported signature literally.
  85 #   You need to determine the initial TTL. The best way to do it is to
  86 #   check the documentation for a remote system, or check its settings.
  87 #   A fairly good method is to simply round the observed TTL up to
  88 #   32, 64, 128, or 255, but it should be noted that some obscure devices
  89 #   might not use round TTLs (in particular, some shoddy appliances and
  90 #   IRIX and Tru64 are known to use "original" initial TTL settings). If not
  91 #   sure, use traceroute or mtr to see how far you are from the host.
  92 #
  93 #   Note that -F option overrides this check if no signature can be found.
  94 #
  95 # - Don't fragment flag (DF) - some modern OSes set this to implement PMTU
  96 #   discovery. Others do not bother.
  97 #
  98 #   NEW SIGNATURE: Copy this value literally. Note: this setting is
  99 #   sometimes cleared by firewalls and/or certain connectivity clients.
 100 #   Try to find out what's the actual state for a given OS if you see both,
 101 #   and add the right one. P0f will automatically detect a case when a
 102 #   firewall removed the DF flag and will append "(firewall!)" suffix to
 103 #   the signature, so if the DF version is the right one, don't add no-DF
 104 #   variant, unless it has a different meaning.
 105 #
 106 # - Maximum segment size (MSS) - this setting is usually link-dependent. P0f
 107 #   uses it to determine link type of the remote host.
 108 #
 109 #   NEW SIGNATURE: Always wildcard this value, except for rare cases when
 110 #   you have an appliance with a fixed value, know the system supports only
 111 #   a very limited number of network interface types, or know the system
 112 #   is using a value it pulled out of nowhere. I use specific unique MSS
 113 #   to tell Google crawlbots from the rest of Linux population, for example.
 114 #
 115 #   If a specific MSS/MTU is unique to a certain link type, be sure to
 116 #   add it to mtu.h instead of creating several variants of each signature.
 117 #
 118 # - Window scaling (WSCALE) - this feature is used to scale WSS.
 119 #   It extends the size of a TCP/IP window to 32 bits, of sorts. Some modern
 120 #   systems implement this feature.
 121 #
 122 #   NEW SIGNATURE: Observe several signatures. Initial WSCALE is often set
 123 #   to zero or other low value. There's usually no need to wildcard this
 124 #   parameter.
 125 #
 126 # - Timestamp - some systems that implement timestamps set them to
 127 #   zero in the initial SYN. This case is detected and handled appropriately.
 128 #
 129 #   NEW SIGNATURE: Copy T or T0 option literally.
 130 #
 131 # - Selective ACK permitted - a flag set by systems that implement
 132 #   selective ACK functionality,
 133 #
 134 #   NEW SIGNATURE: copy S option literally.
 135 #
 136 # - NOP option - its presence, count and sequence is a useful OS-dependent
 137 #   characteristic,
 138 #
 139 #   NEW SIGNATURE: copy N options literally.
 140 #
 141 # - Other and unrecognized options (TTCP-related and such) - implemented by
 142 #   some eccentric or very buggy TCP/IP stacks ;-),
 143 #
 144 #   NEW SIGNATURE: copy ? options literally.
 145 #
 146 # - EOL option. Contrary to the popular belief, the presence of EOL
 147 #   option is actually quite rare, most systems just NOP-pad to the
 148 #   packet boundary.
 149 #
 150 #   NEW SIGNATURE: copy E option literally.
 151 #
 152 # - The sequence of TCP all options mentioned above - this is very
 153 #   specific to the implementation,
 154 #
 155 #   NEW SIGNATURE: Copy the sequence literally.
 156 #
 157 # - Quirks. Some buggy stacks set certain values that should be zeroed in a
 158 #   TCP packet to non-zero values. This has no effect as of today, but is
 159 #   a valuable source of information. Some systems actually seem to leak
 160 #   memory there. Other systems just exhibit harmful but very specific
 161 #   behavior. This section captures all unusual yes-no properties not
 162 #   related to the main and expected header layout. We detect the following:
 163 #
 164 #   - Data past the headers. Neither SYN nor SYN+ACK packets are supposed
 165 #     to carry any payload. If they do, we should take notice. The actual
 166 #     payload is not examined, but will be displayed if use the -X option.
 167 #     Note that payload is not unusual in RST+ mode (see p0fr.fp), very
 168 #     rare otherwise.
 169 #
 170 #   - Options past EOL. Some systems have some trailing data past EOL
 171 #     in the options section of TCP/IP headers. P0f does not examine this
 172 #     data as of today, simply detects its presence. If there is a
 173 #     confirmed sizable population of systems that have data past EOL, it
 174 #     might be a good idea to look at it. Until then, you have to recompile
 175 #     p0f with DEBUG_EXTRAS set or use -x to display this data,
 176 #
 177 #   - Zero IP ID. This again is a (mostly) harmless setting to use a fixed
 178 #     IP ID for packets with DF set. Some systems reportedly use zero ID,
 179 #     most OSes do not. There is a very slight probability of a false
 180 #     positive when IP ID is "naturally" chosen to be zero on a system
 181 #     that otherwise does set proper values, but the probability is
 182 #     neglible (if it becomes a problem, recompile p0f with IGNORE_ZEROID
 183 #     set in the sources).
 184 #
 185 #   - IP options specified. Usually, packets do not have any IP options
 186 #     set, but there can be some. Until there is a confirmed sizable
 187 #     population of systems that do have IP options in a packet, p0f
 188 #     does not examine those in detail, but it might change (use
 189 #     DEBUG_EXTRAS or -x to display IP options if any found),
 190 #
 191 #   - URG pointer value. SYN packets do not have URG flag set, so the
 192 #     value in URG pointer in TCP header is ignored. Most systems set it
 193 #     to zero, but some OSes (some versions of Windows, for example) do
 194 #     not zero this field or even simply leak memory; the actual value is
 195 #     not examined, because most cases seem to be just random garbage
 196 #     (you can use DEBUG_EXTRAS or -x to report this information though);
 197 #     see doc/win-memleak.txt for more information,
 198 #
 199 #   - "Unused" field value. This should be always zero, but some systems
 200 #     forget to clear it. This might result in some funny issues in the
 201 #     future. P0f checks for non-zero value (and will display it if
 202 #     DEBUG_EXTRAS is set, or you can use -x),
 203 #
 204 #   - ACK number non-zero. ACK value in SYN packets with no ACK flag
 205 #     is disregarded and is usually set to zero (just like with URG
 206 #     pointer), but some systems forget to do it. The exact value is
 207 #     not examined (but will be displayed with DEBUG_EXTRAS, or you can
 208 #     use -x). Note that this is not an anomaly in SYN+ACK and RST+ modes,
 209 #
 210 #   - Non-zero second timestamp. The initial SYN packet should have the
 211 #     second timestamp always zeroed. SYN+ACK and RST+ may "legally" have
 212 #     this quirk though,
 213 #
 214 #   - Unusual flags. If, in addition to SYN (or SYN+ACK), there are some
 215 #     auxilinary flags that do not modify the very meaning of a packet,
 216 #     p0f records this (this can be URG, PUSH, or something else).
 217 #
 218 #     Note: ECN flags (ECE and CWR) are ignored and denoted in a separate
 219 #     way. ECN is never by default, because some systems can't handle it,
 220 #     and it probably does not make much sense to include it in signatures
 221 #     right now.
 222 #
 223 #   - TCP option segment parsing problems. If p0f fails to decode options
 224 #     because of a badly broken packet, it records this fact.
 225 #
 226 #   There are several other quirks valid only in RST+ mode, see p0fr.fp for
 227 #   more information. Those quirks are unheard of in SYN and SYN+ACK
 228 #   modes.
 229 #
 230 #   NEW SIGNATURE: Copy "quirks" section literally.
 231 #
 232 # We DO NOT use ToS for fingerprinting. While the original TCP/IP
 233 # fingerprinting research believed this value would be useful for this
 234 # purpose, it is not. The setting is way too often tweaked by network
 235 # devices.
 236 #
 237 # To wildcard MSS, WSS or WSCALE, replace it with '*'. You can also use a
 238 # modulo operator to match any values that divide by nnn - '%nnn' (and,
 239 # as stated above, WSS also supports special values Snn and Tnn).
 240 #
 241 # Fingerprint entry format:
 242 #
 243 # wwww:ttt:D:ss:OOO...:QQ:OS:Details
 244 #
 245 # wwww     - window size (can be * or %nnn or Sxx or Txx)
 246 #            "Snn" (multiple of MSS) and "Tnn" (multiple of MTU) are allowed.
 247 # ttt      - initial TTL
 248 # D        - don't fragment bit (0 - not set, 1 - set)
 249 # ss       - overall SYN packet size (* has a special meaning)
 250 # OOO      - option value and order specification (see below)
 251 # QQ       - quirks list (see below)
 252 # OS       - OS genre (Linux, Solaris, Windows)
 253 # details  - OS description (2.0.27 on x86, etc)
 254 #
 255 # If OS genre starts with '*', p0f will not show distance, link type
 256 # and timestamp data. It is useful for userland TCP/IP stacks of
 257 # network scanners and so on, where many settings are randomized or
 258 # bogus.
 259 #
 260 # If OS genre starts with @, it denotes an approximate hit for a group
 261 # of operating systems (signature reporting still enabled in this case).
 262 # Use this feature at the end of this file to catch cases for which
 263 # you don't have a precise match, but can tell it's Windows or FreeBSD
 264 # or whatnot by looking at, say, flag layout alone.
 265 #
 266 # If OS genre starts with - (which can prefix @ or *), the entry is
 267 # not considered to be a real operating system (but userland stack
 268 # instead). It is important to mark all scanners and so on with -,
 269 # so that they are not used for masquerade detection (also add this
 270 # prefix for signatures of application-induced behavior, such as
 271 # increased window size with Opera browser).
 272 #
 273 # Option block description is a list of comma or space separated
 274 # options in the order they appear in the packet:
 275 #
 276 # N        - NOP option
 277 # E        - EOL option
 278 # Wnnn     - window scaling option, value nnn (or * or %nnn)
 279 # Mnnn     - maximum segment size option, value nnn (or * or %nnn)
 280 # S        - selective ACK OK
 281 # T        - timestamp
 282 # T0       - timestamp with zero value
 283 # ?n       - unrecognized option number n.
 284 #
 285 # P0f can sometimes report ?nn among the options. This means it couldn't
 286 # recognize this option (option number nn). It's either a bug in p0f, or
 287 # a faulty TCP/IP stack, or, if the number is listed here:
 288 #
 289 #   http://www.iana.org/assignments/tcp-parameters
 290 #
 291 # ...the stack might be simply quite exotic.
 292 #
 293 # To denote no TCP options, use a single '.'.
 294 #
 295 # Quirks section is usually an empty list ('.') of oddities or bugs of this
 296 # particular stack. List items are not separated in any way. Possible values:
 297 #
 298 # P     - options past EOL,
 299 # Z     - zero IP ID,
 300 # I     - IP options specified,
 301 # U     - urg pointer non-zero,
 302 # X     - unused (x2) field non-zero,
 303 # A     - ACK number non-zero,
 304 # T     - non-zero second timestamp,
 305 # F     - unusual flags (PUSH, URG, etc),
 306 # D     - data payload,
 307 # !     - broken options segment.
 308 #
 309 # WARNING WARNING WARNING
 310 # -----------------------
 311 #
 312 # Do not add a system X as OS Y just because NMAP says so. It is often
 313 # the case that X is a NAT firewall. While nmap is talking to the
 314 # device itself, p0f is fingerprinting the guy behind the firewall
 315 # instead.
 316 #
 317 # When in doubt, use common sense, don't add something that looks like
 318 # a completely different system as Linux or FreeBSD or LinkSys router.
 319 # Check DNS name, establish a connection to the remote host and look
 320 # at SYN+ACK (p0f -A -S should do) - does it look similar?
 321 #
 322 # Some users tweak their TCP/IP settings - enable or disable RFC1323,
 323 # RFC1644 or RFC2018 support, disable PMTU discovery, change MTU, initial
 324 # TTL and so on. Always compare a new rule to other fingerprints for
 325 # this system, and verify the system isn't "customized". It is OK to
 326 # add signature variants caused by commonly used software (PFs, security
 327 # packages, etc), but it makes no sense to try to add every single
 328 # possible /proc/sys/net/ipv4/* tweak on Linux or so.
 329 #
 330 # KEEP IN MIND: Some packet firewalls configured to normalize outgoing
 331 # traffic (OpenBSD pf with "scrub" enabled, for example) will, well,
 332 # normalize packets. Signatures will not correspond to the originating
 333 # system (and probably not quite to the firewall either).
 334 #
 335 # NOTE: Try to keep this file in some reasonable order, from most to
 336 # least likely systems. This will speed up operation. Also keep most
 337 # generic and broad rules near ehe end.
 338 #
 339 # Still decided to add signature? Let us know - mail a copy of your discovery
 340 # to lcamtuf@coredump.cx. You can help make p0f better, and I can help you
 341 # make your signature more accurate.
 342 #
 343
 344 ##########################
 345 # Standard OS signatures #
 346 ##########################
 347
 348 # ----------------- AIX ---------------------
 349
 350 # AIX is first because its signatures are close to NetBSD, MacOS X and
 351 # Linux 2.0, but it uses a fairly rare MSSes, at least sometimes...
 352 # This is a shoddy hack, though.
 353
 354 45046:64:0:44:M*:.:AIX:4.3
 355
 356 16384:64:0:44:M512:.:AIX:4.3.2 and earlier
 357
 358 16384:64:0:60:M512,N,W%2,N,N,T:.:AIX:4.3.3-5.2 (1)
 359 32768:64:0:60:M512,N,W%2,N,N,T:.:AIX:4.3.3-5.2 (2)
 360 65535:64:0:60:M512,N,W%2,N,N,T:.:AIX:4.3.3-5.2 (3)
 361
 362 65535:64:0:64:M*,N,W1,N,N,T,N,N,S:.:AIX:5.3 ML1
 363
 364 # ----------------- Linux -------------------
 365
 366 S1:64:0:44:M*:A:Linux:1.2.x
 367 512:64:0:44:M*:.:Linux:2.0.3x (1)
 368 16384:64:0:44:M*:.:Linux:2.0.3x (2)
 369
 370 # Endian snafu! Nelson says "ha-ha":
 371 2:64:0:44:M*:.:Linux:2.0.3x (MkLinux) on Mac (1)
 372 64:64:0:44:M*:.:Linux:2.0.3x (MkLinux) on Mac (2)
 373
 374 S4:64:1:60:M1360,S,T,N,W0:.:Linux:2.4 (Google crawlbot)
 375 S4:64:1:60:M1430,S,T,N,W0:.:Linux:2.4-2.6 (Google crawlbot)
 376
 377 S2:64:1:60:M*,S,T,N,W0:.:Linux:2.4 (large MTU?)
 378 S3:64:1:60:M*,S,T,N,W0:.:Linux:2.4 (newer)
 379 S4:64:1:60:M*,S,T,N,W0:.:Linux:2.4-2.6
 380
 381 S3:64:1:60:M*,S,T,N,W1:.:Linux:2.6, seldom 2.4 (older, 1)
 382 S4:64:1:60:M*,S,T,N,W1:.:Linux:2.6, seldom 2.4 (older, 2)
 383 S3:64:1:60:M*,S,T,N,W2:.:Linux:2.6, seldom 2.4 (older, 3)
 384 S4:64:1:60:M*,S,T,N,W2:.:Linux:2.6, seldom 2.4 (older, 4)
 385 T4:64:1:60:M*,S,T,N,W2:.:Linux:2.6 (older, 5)
 386
 387 S4:64:1:60:M*,S,T,N,W5:.:Linux:2.6 (newer, 1)
 388 S4:64:1:60:M*,S,T,N,W6:.:Linux:2.6 (newer, 2)
 389 S4:64:1:60:M*,S,T,N,W7:.:Linux:2.6 (newer, 3)
 390 T4:64:1:60:M*,S,T,N,W7:.:Linux:2.6 (newer, 4)
 391
 392
 393 S20:64:1:60:M*,S,T,N,W0:.:Linux:2.2 (1)
 394 S22:64:1:60:M*,S,T,N,W0:.:Linux:2.2 (2)
 395 S11:64:1:60:M*,S,T,N,W0:.:Linux:2.2 (3)
 396
 397 # Popular cluster config scripts disable timestamps and
 398 # selective ACK:
 399
 400 S4:64:1:48:M1460,N,W0:.:Linux:2.4 in cluster
 401
 402 # This happens only over loopback, but let's make folks happy:
 403 32767:64:1:60:M16396,S,T,N,W0:.:Linux:2.4 (loopback)
 404 32767:64:1:60:M16396,S,T,N,W2:.:Linux:2.6 (newer, loopback)
 405 S8:64:1:60:M3884,S,T,N,W0:.:Linux:2.2 (loopback)
 406
 407 # Opera visitors:
 408 16384:64:1:60:M*,S,T,N,W0:.:-Linux:2.2 (Opera?)
 409 32767:64:1:60:M*,S,T,N,W0:.:-Linux:2.4 (Opera?)
 410
 411 # Some fairly common mods & oddities:
 412 S22:64:1:52:M*,N,N,S,N,W0:.:Linux:2.2 (tstamp-)
 413 S4:64:1:52:M*,N,N,S,N,W0:.:Linux:2.4 (tstamp-)
 414 S4:64:1:52:M*,N,N,S,N,W2:.:Linux:2.6 (tstamp-)
 415 S4:64:1:44:M*:.:Linux:2.6? (barebone, rare!)
 416 T4:64:1:60:M1412,S,T,N,W0:.:Linux:2.4 (rare!)
 417
 418 # ----------------- FreeBSD -----------------
 419
 420 16384:64:1:44:M*:.:FreeBSD:2.0-4.2
 421 16384:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.4 (1)
 422
 423 1024:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.4 (2)
 424
 425 57344:64:1:44:M*:.:FreeBSD:4.6-4.8 (RFC1323-)
 426 57344:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.6-4.9
 427
 428 32768:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.8-5.1 (or MacOS X 10.2-10.3)
 429 65535:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.7-5.2 (or MacOS X 10.2-10.4) (1)
 430 65535:64:1:60:M*,N,W1,N,N,T:.:FreeBSD:4.7-5.2 (or MacOS X 10.2-10.4) (2)
 431
 432 65535:64:1:60:M*,N,W0,N,N,T:Z:FreeBSD:5.1 (1)
 433 65535:64:1:60:M*,N,W1,N,N,T:Z:FreeBSD:5.1 (2)
 434 65535:64:1:60:M*,N,W2,N,N,T:Z:FreeBSD:5.1 (3)
 435 65535:64:1:64:M*,N,N,S,N,W1,N,N,T:.:FreeBSD:5.3-5.4
 436 65535:64:1:64:M*,N,W1,N,N,T,S,E:P:FreeBSD:6.x (1)
 437 65535:64:1:64:M*,N,W0,N,N,T,S,E:P:FreeBSD:6.x (2)
 438
 439 65535:64:1:44:M*:Z:FreeBSD:5.2 (RFC1323-)
 440
 441 # 16384:64:1:60:M*,N,N,N,N,N,N,T:.:FreeBSD:4.4 (tstamp-)
 442
 443 # ----------------- NetBSD ------------------
 444
 445 16384:64:0:60:M*,N,W0,N,N,T:.:NetBSD:1.3
 446 65535:64:0:60:M*,N,W0,N,N,T0:.:-NetBSD:1.6 (Opera)
 447 16384:64:1:60:M*,N,W0,N,N,T0:.:NetBSD:1.6
 448 65535:64:1:60:M*,N,W1,N,N,T0:.:NetBSD:1.6W-current (DF)
 449 65535:64:1:60:M*,N,W0,N,N,T0:.:NetBSD:1.6X (DF)
 450 32768:64:1:60:M*,N,W0,N,N,T0:.:NetBSD:1.6Z or 2.0 (DF)
 451 32768:64:1:64:M1416,N,W0,S,N,N,N,N,T0:.:NetBSD:2.0G (DF)
 452 32768:64:1:64:M*,N,W0,S,N,N,N,N,T0:.:NetBSD:3.0 (DF)
 453
 454 # ----------------- OpenBSD -----------------
 455
 456 16384:64:1:64:M*,N,N,S,N,W0,N,N,T:.:OpenBSD:3.0-3.9
 457 57344:64:1:64:M*,N,N,S,N,W0,N,N,T:.:OpenBSD:3.3-3.4
 458 16384:64:0:64:M*,N,N,S,N,W0,N,N,T:.:OpenBSD:3.0-3.4 (scrub)
 459 65535:64:1:64:M*,N,N,S,N,W0,N,N,T:.:-OpenBSD:3.0-3.4 (Opera?)
 460 32768:64:1:64:M*,N,N,S,N,W0,N,N,T:.:OpenBSD:3.7
 461
 462 # ----------------- Solaris -----------------
 463
 464 S17:64:1:64:N,W3,N,N,T0,N,N,S,M*:.:Solaris:8 (RFC1323 on)
 465 S17:64:1:48:N,N,S,M*:.:Solaris:8 (1)
 466 S17:255:1:44:M*:.:Solaris:2.5-7 (1)
 467
 468 # Sometimes, just sometimes, Solaris feels like coming up with
 469 # rather arbitrary MSS values ;-)
 470
 471 S6:255:1:44:M*:.:Solaris:2.5-7 (2)
 472 S23:64:1:48:N,N,S,M*:.:Solaris:8 (2)
 473 S34:64:1:48:M*,N,N,S:.:Solaris:9
 474 S34:64:1:48:M*,N,N,N,N:.:Solaris:9 (no sack)
 475 S44:255:1:44:M*:.:Solaris:7
 476
 477 4096:64:0:44:M1460:.:SunOS:4.1.x
 478
 479 S34:64:1:52:M*,N,W0,N,N,S:.:Solaris:10 (beta)
 480 32850:64:1:64:M*,N,N,T,N,W1,N,N,S:.:Solaris:10 (1203?)
 481 32850:64:1:64:M*,N,W1,N,N,T,N,N,S:.:Solaris:9.1
 482
 483 # ----------------- IRIX --------------------
 484
 485 49152:60:0:44:M*:.:IRIX:6.2-6.4
 486 61440:60:0:44:M*:.:IRIX:6.2-6.5
 487 49152:60:0:52:M*,N,W2,N,N,S:.:IRIX:6.5 (RFC1323+) (1)
 488 49152:60:0:52:M*,N,W3,N,N,S:.:IRIX:6.5 (RFC1323+) (2)
 489
 490 61440:60:0:48:M*,N,N,S:.:IRIX:6.5.12-6.5.21 (1)
 491 49152:60:0:48:M*,N,N,S:.:IRIX:6.5.12-6.5.21 (2)
 492
 493 49152:60:0:64:M*,N,W2,N,N,T,N,N,S:.:IRIX:6.5 IP27
 494
 495 # ----------------- Tru64 -------------------
 496 # Tru64 and OpenVMS share the same stack on occassions.
 497 # Relax.
 498
 499 32768:60:1:48:M*,N,W0:.:Tru64:4.0 (or OS/2 Warp 4)
 500 32768:60:0:48:M*,N,W0:.:Tru64:5.0 (or OpenVMS 7.x on Compaq 5.0 stack)
 501 8192:60:0:44:M1460:.:Tru64:5.1 (no RFC1323) (or QNX 6)
 502 61440:60:0:48:M*,N,W0:.:Tru64:v5.1a JP4 (or OpenVMS 7.x on Compaq 5.x stack)
 503
 504 # ----------------- OpenVMS -----------------
 505
 506 6144:64:1:60:M*,N,W0,N,N,T:.:OpenVMS:7.2 (Multinet 4.3-4.4 stack)
 507
 508 # ----------------- MacOS -------------------
 509
 510 S2:255:1:48:M*,W0,E:.:MacOS:8.6 classic
 511
 512 16616:255:1:48:M*,W0,E:.:MacOS:7.3-8.6 (OTTCP)
 513 16616:255:1:48:M*,N,N,N,E:.:MacOS:8.1-8.6 (OTTCP)
 514 32768:255:1:48:M*,W0,N:.:MacOS:9.0-9.2
 515
 516 32768:255:1:48:M1380,N,N,N,N:.:MacOS:9.1 (OT 2.7.4) (1)
 517 65535:255:1:48:M*,N,N,N,N:.:MacOS:9.1 (OT 2.7.4) (2)
 518
 519 # ----------------- Windows -----------------
 520
 521 # Windows TCP/IP stack is a mess. For most recent XP, 2000 and
 522 # even 98, the pathlevel, not the actual OS version, is more
 523 # relevant to the signature. They share the same code, so it would
 524 # seem. Luckily for us, almost all Windows 9x boxes have an
 525 # awkward MSS of 536, which I use to tell one from another
 526 # in most difficult cases.
 527
 528 8192:32:1:44:M*:.:Windows:3.11 (Tucows)
 529 S44:64:1:64:M*,N,W0,N,N,T0,N,N,S:.:Windows:95
 530 8192:128:1:64:M*,N,W0,N,N,T0,N,N,S:.:Windows:95b
 531
 532 # There were so many tweaking tools and so many stack versions for
 533 # Windows 98 it is no longer possible to tell them from each other
 534 # without some very serious research. Until then, there's an insane
 535 # number of signatures, for your amusement:
 536
 537 S44:32:1:48:M*,N,N,S:.:Windows:98 (low TTL) (1)
 538 8192:32:1:48:M*,N,N,S:.:Windows:98 (low TTL) (2)
 539 %8192:64:1:48:M536,N,N,S:.:Windows:98 (13)
 540 %8192:128:1:48:M536,N,N,S:.:Windows:98 (15)
 541 S4:64:1:48:M*,N,N,S:.:Windows:98 (1)
 542 S6:64:1:48:M*,N,N,S:.:Windows:98 (2)
 543 S12:64:1:48:M*,N,N,S:.:Windows:98 (3
 544 T30:64:1:64:M1460,N,W0,N,N,T0,N,N,S:.:Windows:98 (16)
 545 32767:64:1:48:M*,N,N,S:.:Windows:98 (4)
 546 37300:64:1:48:M*,N,N,S:.:Windows:98 (5)
 547 46080:64:1:52:M*,N,W3,N,N,S:.:Windows:98 (RFC1323+)
 548 65535:64:1:44:M*:.:Windows:98 (no sack)
 549 S16:128:1:48:M*,N,N,S:.:Windows:98 (6)
 550 S16:128:1:64:M*,N,W0,N,N,T0,N,N,S:.:Windows:98 (7)
 551 S26:128:1:48:M*,N,N,S:.:Windows:98 (8)
 552 T30:128:1:48:M*,N,N,S:.:Windows:98 (9)
 553 32767:128:1:52:M*,N,W0,N,N,S:.:Windows:98 (10)
 554 60352:128:1:48:M*,N,N,S:.:Windows:98 (11)
 555 60352:128:1:64:M*,N,W2,N,N,T0,N,N,S:.:Windows:98 (12)
 556
 557 # What's with 1414 on NT?
 558 T31:128:1:44:M1414:.:Windows:NT 4.0 SP6a (1)
 559 64512:128:1:44:M1414:.:Windows:NT 4.0 SP6a (2)
 560 8192:128:1:44:M*:.:Windows:NT 4.0 (older)
 561
 562 # Windows XP and 2000. Most of the signatures that were
 563 # either dubious or non-specific (no service pack data)
 564 # were deleted and replaced with generics at the end.
 565
 566 65535:128:1:48:M*,N,N,S:.:Windows:2000 SP4, XP SP1+
 567 %8192:128:1:48:M*,N,N,S:.:Windows:2000 SP2+, XP SP1+ (seldom 98)
 568 S20:128:1:48:M*,N,N,S:.:Windows:SP3
 569 S45:128:1:48:M*,N,N,S:.:Windows:2000 SP4, XP SP1+ (2)
 570 40320:128:1:48:M*,N,N,S:.:Windows:2000 SP4
 571
 572 S6:128:1:48:M*,N,N,S:.:Windows:XP, 2000 SP2+
 573 S12:128:1:48:M*,N,N,S:.:Windows:XP SP1+ (1)
 574 S44:128:1:48:M*,N,N,S:.:Windows:XP SP1+, 2000 SP3
 575 64512:128:1:48:M*,N,N,S:.:Windows:XP SP1+, 2000 SP3 (2)
 576 32767:128:1:48:M*,N,N,S:.:Windows:XP SP1+, 2000 SP4 (3)
 577
 578 # Windows 2003 & Vista
 579
 580 8192:128:1:52:M*,W8,N,N,N,S:.:Windows:Vista (beta)
 581 32768:32:1:52:M1460,N,W0,N,N,S:.:Windows:2003 AS
 582 65535:64:1:52:M1460,N,W2,N,N,S:.:Windows:2003 (1)
 583 65535:64:1:48:M1460,N,N,S:.:Windows:2003 (2)
 584
 585 # Odds, ends, mods:
 586
 587 S52:128:1:48:M1260,N,N,S:.:Windows:XP/2000 via Cisco
 588 65520:128:1:48:M*,N,N,S:.:Windows:XP bare-bone
 589 16384:128:1:52:M536,N,W0,N,N,S:.:Windows:2000 w/ZoneAlarm?
 590 2048:255:0:40:.:.:Windows:.NET Enterprise Server
 591 44620:64:0:48:M*,N,N,S:.:Windows:ME no SP (?)
 592 S6:255:1:48:M536,N,N,S:.:Windows:95 winsock 2
 593 32000:128:0:48:M*,N,N,S:.:Windows:XP w/Winroute?
 594 16384:64:1:48:M1452,N,N,S:.:Windows:XP w/Sygate? (1)
 595 17256:64:1:48:M1460,N,N,S:.:Windows:XP w/Sygate? (2)
 596
 597 # No need to be more specific, it passes:
 598 *:128:1:48:M*,N,N,S:U:-Windows:XP/2000 while downloading (leak!)
 599
 600 # ----------------- HP/UX -------------------
 601
 602 32768:64:1:44:M*:.:HP-UX:B.10.20
 603 32768:64:1:48:M*,W0,N:.:HP-UX:11.00-11.11
 604
 605 # Whoa. Hardcore WSS.
 606 0:64:0:48:M*,W0,N:.:HP-UX:B.11.00 A (RFC1323+)
 607
 608 # ----------------- RiscOS ------------------
 609
 610 16384:64:1:68:M1460,N,W0,N,N,T,N,N,?12:.:RISC OS:3.70-4.36 (inet 5.04)
 611 12288:32:0:44:M536:.:RISC OS:3.70 inet 4.10
 612 4096:64:1:56:M1460,N,N,T:T:RISC OS:3.70 freenet 2.00
 613
 614 # ----------------- BSD/OS ------------------
 615
 616 8192:64:1:60:M1460,N,W0,N,N,T:.:BSD/OS:3.1-4.3 (or MacOS X 10.2)
 617
 618 # ---------------- NetwonOS -----------------
 619
 620 4096:64:0:44:M1420:.:NewtonOS:2.1
 621
 622 # ---------------- NeXTSTEP -----------------
 623
 624 S8:64:0:44:M512:.:NeXTSTEP:3.3 (1)
 625 S4:64:0:44:M1024:.:NeXTSTEP:3.3 (2)
 626
 627 # ------------------ BeOS -------------------
 628
 629 1024:255:0:48:M*,N,W0:.:BeOS:5.0-5.1
 630 12288:255:0:44:M*:.:BeOS:5.0.x
 631
 632 # ------------------ OS/400 -----------------
 633
 634 8192:64:1:60:M1440,N,W0,N,N,T:.:OS/400:V4R4/R5
 635 8192:64:0:44:M536:.:OS/400:V4R3/M0
 636 4096:64:1:60:M1440,N,W0,N,N,T:.:OS/400:V4R5 + CF67032
 637
 638 28672:64:0:44:M1460:A:OS/390:?
 639
 640 # ------------------ ULTRIX -----------------
 641
 642 16384:64:0:40:.:.:ULTRIX:4.5
 643
 644 # ------------------- QNX -------------------
 645
 646 S16:64:0:44:M512:.:QNX:demodisk
 647 16384:64:0:60:M1460,N,W0,N,N,T0:.:QNX:6.x
 648
 649 # ------------------ Novell -----------------
 650
 651 16384:128:1:44:M1460:.:Novell:NetWare 5.0
 652 6144:128:1:44:M1460:.:Novell:IntranetWare 4.11
 653 6144:128:1:44:M1368:.:Novell:BorderManager ?
 654
 655 # According to rfp:
 656 6144:128:1:52:M*,W0,N,S,N,N:.:Novell:Netware 6 SP3
 657
 658 # -------------- SCO UnixWare ---------------
 659
 660 S3:64:1:60:M1460,N,W0,N,N,T:.:SCO:UnixWare 7.1
 661 S17:64:1:60:M*,N,W0,N,N,T:.:SCO:UnixWare 7.1.x
 662 S23:64:1:44:M1380:.:SCO:OpenServer 5.0
 663
 664 # ------------------- DOS -------------------
 665
 666 2048:255:0:44:M536:.:DOS:Arachne via WATTCP/1.05
 667 T2:255:0:44:M984:.:DOS:Arachne via WATTCP/1.05 (eepro)
 668 16383:64:0:44:M536:.:DOS:Unknown via WATTCP (epppd)
 669
 670 # ------------------ OS/2 -------------------
 671
 672 S56:64:0:44:M512:.:OS/2:4
 673 28672:64:0:44:M1460:.:OS/2:Warp 4.0
 674
 675 # ----------------- TOPS-20 -----------------
 676
 677 # Another hardcore MSS, one of the ACK leakers hunted down.
 678 0:64:0:44:M1460:A:TOPS-20:version 7
 679
 680 # ------------------ AMIGA ------------------
 681
 682 S32:64:1:56:M*,N,N,S,N,N,?12:.:AMIGA:3.9 BB2 with Miami stack
 683
 684 # ------------------ Minix ------------------
 685
 686 # Not quite sure.
 687 # 8192:210:0:44:M1460:X:@Minix:?
 688
 689 # ------------------ Plan9 ------------------
 690
 691 65535:255:0:48:M1460,W0,N:.:Plan9:edition 4
 692
 693 # ----------------- AMIGAOS -----------------
 694
 695 16384:64:1:48:M1560,N,N,S:.:AMIGAOS:3.9 BB2 MiamiDX
 696
 697 # ----------------- FreeMiNT ----------------
 698
 699 S44:255:0:44:M536:.:FreeMiNT:1 patch 16A (Atari)
 700
 701 ###########################################
 702 # Appliance / embedded / other signatures #
 703 ###########################################
 704
 705 # ---------- Firewalls / routers ------------
 706
 707 S12:64:1:44:M1460:.:@Checkpoint:(unknown 1)
 708 S12:64:1:48:N,N,S,M1460:.:@Checkpoint:(unknown 2)
 709 4096:32:0:44:M1460:.:ExtremeWare:4.x
 710
 711 S32:64:0:68:M512,N,W0,N,N,T,N,N,?12:.:Nokia:IPSO w/Checkpoint NG FP3
 712 S16:64:0:68:M1024,N,W0,N,N,T,N,N,?12:.:Nokia:IPSO 3.7 build 026
 713
 714 S4:64:1:60:W0,N,S,T,M1460:.:FortiNet:FortiGate 50
 715
 716 8192:64:1:44:M1460:.:@Eagle:Secure Gateway
 717
 718 # ------- Switches and other stuff ----------
 719
 720 4128:255:0:44:M*:Z:Cisco:7200, Catalyst 3500, etc
 721 S8:255:0:44:M*:.:Cisco:12008
 722 S4:255:0:44:M536:Z:Cisco:IOS 11.0
 723 60352:128:1:64:M1460,N,W2,N,N,T,N,N,S:.:Alteon:ACEswitch
 724 64512:128:1:44:M1370:.:Nortel:Contivity Client
 725
 726 # ---------- Caches and whatnots ------------
 727
 728 8190:255:0:44:M1428:.:Google:Wireless Transcoder (1)
 729 8190:255:0:44:M1460:.:Google:Wireless Transcoder (2)
 730 8192:64:1:64:M1460,N,N,S,N,W0,N,N,T:.:NetCache:5.2
 731 16384:64:1:64:M1460,N,N,S,N,W0,N:.:NetCache:5.3
 732 65535:64:1:64:M1460,N,N,S,N,W*,N,N,T:.:NetCache:5.3-5.5 (or FreeBSD 5.4)
 733 20480:64:1:64:M1460,N,N,S,N,W0,N,N,T:.:NetCache:4.1
 734 S44:64:1:64:M1460,N,N,S,N,W0,N,N,T:.:NetCache:5.5
 735
 736 32850:64:1:64:N,W1,N,N,T,N,N,S,M*:.:NetCache:Data OnTap 5.x
 737
 738 65535:64:0:60:M1460,N,W0,N,N,T:.:CacheFlow:CacheOS 4.1
 739 8192:64:0:60:M1380,N,N,N,N,N,N,T:.:CacheFlow:CacheOS 1.1
 740
 741 S4:64:0:48:M1460,N,N,S:.:Cisco:Content Engine
 742
 743 27085:128:0:40:.:.:Dell:PowerApp cache (Linux-based)
 744
 745 65535:255:1:48:N,W1,M1460:.:Inktomi:crawler
 746 S1:255:1:60:M1460,S,T,N,W0:.:LookSmart:ZyBorg
 747
 748 16384:255:0:40:.:.:Proxyblocker:(what's this?)
 749
 750 65535:255:0:48:M*,N,N,S:.:Redline: T|X 2200
 751
 752 # ----------- Embedded systems --------------
 753
 754 S9:255:0:44:M536:.:PalmOS:Tungsten T3/C
 755 S5:255:0:44:M536:.:PalmOS:3/4
 756 S4:255:0:44:M536:.:PalmOS:3.5
 757 2948:255:0:44:M536:.:PalmOS:3.5.3 (Handera)
 758 S29:255:0:44:M536:.:PalmOS:5.0
 759 16384:255:0:44:M1398:.:PalmOS:5.2 (Clie)
 760 S14:255:0:44:M1350:.:PalmOS:5.2.1 (Treo)
 761 16384:255:0:44:M1400:.:PalmOS:5.2 (Sony)
 762
 763 S23:64:1:64:N,W1,N,N,T,N,N,S,M1460:.:SymbianOS:7
 764 8192:255:0:44:M1460:.:SymbianOS:6048 (Nokia 7650?)
 765 8192:255:0:44:M536:.:SymbianOS:(Nokia 9210?)
 766 S22:64:1:56:M1460,T,S:.:SymbianOS:? (SE P800?)
 767 S36:64:1:56:M1360,T,S:.:SymbianOS:60xx (Nokia 6600?)
 768 S36:64:1:60:M1360,T,S,W0,E:.:SymbianOS:60xx
 769
 770 32768:32:1:44:M1460:.:Windows:CE 3
 771
 772 # Perhaps S4?
 773 5840:64:1:60:M1452,S,T,N,W1:.:Zaurus:3.10
 774
 775 32768:128:1:64:M1460,N,W0,N,N,T0,N,N,S:.:PocketPC:2002
 776
 777 S1:255:0:44:M346:.:Contiki:1.1-rc0
 778
 779 4096:128:0:44:M1460:.:Sega:Dreamcast Dreamkey 3.0
 780 T5:64:0:44:M536:.:Sega:Dreamcast HKT-3020 (browser disc 51027)
 781 S22:64:1:44:M1460:.:Sony:Playstation 2 (SOCOM?)
 782
 783 S12:64:0:44:M1452:.:AXIS:Printer Server 5600 v5.64
 784
 785 3100:32:1:44:M1460:.:Windows:CE 2.0
 786
 787 ####################
 788 # Fancy signatures #
 789 ####################
 790
 791 1024:64:0:40:.:.:-*NMAP:syn scan (1)
 792 2048:64:0:40:.:.:-*NMAP:syn scan (2)
 793 3072:64:0:40:.:.:-*NMAP:syn scan (3)
 794 4096:64:0:40:.:.:-*NMAP:syn scan (4)
 795
 796 1024:64:0:40:.:A:-*NMAP:TCP sweep probe (1)
 797 2048:64:0:40:.:A:-*NMAP:TCP sweep probe (2)
 798 3072:64:0:40:.:A:-*NMAP:TCP sweep probe (3)
 799 4096:64:0:40:.:A:-*NMAP:TCP sweep probe (4)
 800
 801 1024:64:0:60:W10,N,M265,T,E:P:-*NMAP:OS detection probe (1)
 802 2048:64:0:60:W10,N,M265,T,E:P:-*NMAP:OS detection probe (2)
 803 3072:64:0:60:W10,N,M265,T,E:P:-*NMAP:OS detection probe (3)
 804 4096:64:0:60:W10,N,M265,T,E:P:-*NMAP:OS detection probe (4)
 805
 806 1024:64:0:60:W10,N,M265,T,E:PF:-*NMAP:OS detection probe w/flags (1)
 807 2048:64:0:60:W10,N,M265,T,E:PF:-*NMAP:OS detection probe w/flags (2)
 808 3072:64:0:60:W10,N,M265,T,E:PF:-*NMAP:OS detection probe w/flags (3)
 809 4096:64:0:60:W10,N,M265,T,E:PF:-*NMAP:OS detection probe w/flags (4)
 810
 811 32767:64:0:40:.:.:-*NAST:syn scan
 812
 813 12345:255:0:40:.:A:-p0f:sendsyn utility
 814
 815 # UFO - see tmp/*:
 816 56922:128:0:40:.:A:-@Mysterious:port scanner (?)
 817 5792:64:1:60:M1460,S,T,N,W0:T:-@Mysterious:NAT device (2nd tstamp)
 818 S12:128:1:48:M1460,E:P:@Mysterious:Chello proxy (?)
 819 S23:64:1:64:N,W1,N,N,T,N,N,S,M1380:.:@Mysterious:GPRS gateway (?)
 820
 821 #####################################
 822 # Generic signatures - just in case #
 823 #####################################
 824
 825 *:128:1:52:M*,N,W0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w, tstamp-)
 826 *:128:1:52:M*,N,W*,N,N,S:.:@Windows:XP/2000 (RFC1323+, w+, tstamp-)
 827 *:128:1:52:M*,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w-, tstamp+)
 828 *:128:1:64:M*,N,W0,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w, tstamp+)
 829 *:128:1:64:M*,N,W*,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w+, tstamp+)
 830
 831 *:128:1:48:M536,N,N,S:.:@Windows:98
 832 *:128:1:48:M*,N,N,S:.:@Windows:XP/2000
 833
 834