SYNSCAN : Towards Complete TCP / IP Fingerprinting

A tool for TCP stack testing and TCP/IP fingerprinting (a.k.a. OS detection) is introduced. While tools presently exist to do either OS detection[1, 2] or TCP stack testing[3, 4], the methods they employ are limited by the techniques and analysis performed, sometimes resulting in incorrect results or no results at all. We introduce synscan, a tool whose objective is to fingerprint every aspect of a TCP/IP implementation. synscan is not meant as a proof-of-concept tool; rather, it is a robust and useful tool which can be used in addition to others for TCP/IP stack testing and OS detection. synscan incorporates most of the techiques used by the existing tools and introduces a number of new ones. synscan’s primary advantage is that each test begins with a TCP SYN segment (hence the name) to an open port, giving it the ability to test and fingerprint even the most fortified hosts. Conclusive data from large network scans and comparisons to results from existing tools are also reported.