You are not logged in.
- Topics: Active | Unanswered
#1 2008-10-30 08:45:46
- coderoar
- Member
- Registered: 2008-09-18
- Posts: 10
How to hide or change TCP/IP fingerprint?
After executing 'nmap -O -A 127.0.0.1', it returns some lines starting with 'OS:'. How to change it?
Offline
#2 2008-10-30 10:58:55
- dav7
- Member
- From: Australia
- Registered: 2008-02-08
- Posts: 674
Re: How to hide or change TCP/IP fingerprint?
Look in the sourcecode for nmap, find how it figures out the Linux part, then rewrite your TCP/IP stack to not operate in a way nmap can detect.
Windows was made for looking at success from a distance through a wall of oversimplicity. Linux removes the wall, so you can just walk up to success and make it your own.
--
Reinventing the wheel is fun. You get to redefine pi.
Offline
#3 2008-10-30 11:30:42
- coderoar
- Member
- Registered: 2008-09-18
- Posts: 10
Re: How to hide or change TCP/IP fingerprint?
Yeah, but I don't know about linux system api at all.
Offline
#4 2008-10-30 12:32:15
- dav7
- Member
- From: Australia
- Registered: 2008-02-08
- Posts: 674
Re: How to hide or change TCP/IP fingerprint?
Well, since nmap's fingerprint is based on the way the TCP/IP stack works, there's no real way except to rewrite the appropriate parts of said stack. 
Windows was made for looking at success from a distance through a wall of oversimplicity. Linux removes the wall, so you can just walk up to success and make it your own.
--
Reinventing the wheel is fun. You get to redefine pi.
Offline
#5 2008-10-30 13:25:57
- byte
- Member
- From: Düsseldorf (DE)
- Registered: 2006-05-01
- Posts: 2,046
Re: How to hide or change TCP/IP fingerprint?
If that box isn't connected to the internet directly and behind a router it doesn't matter anyway.
1000
Offline
#6 2008-10-30 14:50:17
- coderoar
- Member
- Registered: 2008-09-18
- Posts: 10
Re: How to hide or change TCP/IP fingerprint?
However, I really need to avoid these messages. Can iptables do this work?
Offline
#7 2008-10-30 16:15:28
- byte
- Member
- From: Düsseldorf (DE)
- Registered: 2006-05-01
- Posts: 2,046
Re: How to hide or change TCP/IP fingerprint?
What messages, just the OS: fingerprint lines from nmap? Well, don't use OS detection or version scanning, read the manpage, grep -v the output...
1000
Offline
#8 2008-10-30 22:16:53
- fukawi2
- Ex-Administratorino
- From: .vic.au
- Registered: 2007-09-28
- Posts: 6,222
- Website
Re: How to hide or change TCP/IP fingerprint?
Perhaps if you tell us what your goal is, rather than how you think you need to get there, we will be able to give more accurate answers 
Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?
BlueHackers // fscanary // resticctl
Offline
#9 2008-10-31 00:29:47
- broch
- Banned
- From: L.A. California
- Registered: 2006-11-13
- Posts: 975
Re: How to hide or change TCP/IP fingerprint?
protecting against tcp/ip fingerprinting is possible. None of the methods used tries to modify tcp/ip stack.
shrug
Offline
#10 2008-10-31 10:19:12
- coderoar
- Member
- Registered: 2008-09-18
- Posts: 10
Re: How to hide or change TCP/IP fingerprint?
What messages, just the OS: fingerprint lines from nmap? Well, don't use OS detection or version scanning, read the manpage, grep -v the output...
Yes, only fingerprint. I want to prevent others from knowing the type of my OS.
Offline
#11 2008-10-31 11:48:04
- filou.linux
- Member
- From: Zurich
- Registered: 2008-04-17
- Posts: 87
Re: How to hide or change TCP/IP fingerprint?
So aren't you proud of the OS that you are using? ;-)
Offline
#12 2008-10-31 15:55:44
- coderoar
- Member
- Registered: 2008-09-18
- Posts: 10
Re: How to hide or change TCP/IP fingerprint?
So aren't you proud of the OS that you are using? ;-)
I like and rely on Arch but I have to hide myself because of some restrictions by my ISP.
Offline
#13 2008-10-31 17:27:23
- kclive18
- Member
- From: Columbus, Ohio, USA
- Registered: 2008-05-08
- Posts: 219
Re: How to hide or change TCP/IP fingerprint?
That's weird...so they restrict you from using Linux? 
My Rigs:
- Mid-2007 iMac 20", Intel 2GHz Core 2 Duo, 2x1GB DDR2-800, 250GB SATA HDD, and...MIGHTY MOUSE!!! , OSX 10.5 Leopard, ATI Radeon 2400XT 128MB
- HP zv6203cl, AMD Athlon 64 3200 S939, 2x512MB DDR400, 80GB 4200rpm HDD, ATI Radeon Xpress 200M 128MB, Arch i686 
- 1986 Gibson SG Junior Cherry Red, Ibanez 15W amp, DigiTech RP250 modeling processor
Offline
#14 2008-11-01 03:47:02
- coderoar
- Member
- Registered: 2008-09-18
- Posts: 10
Re: How to hide or change TCP/IP fingerprint?
No, they only restict routers. But perhaps they can't distinguish between a Linux PC and a router.
Offline
#15 2008-11-01 08:41:02
- daf666
- Member
- Registered: 2007-04-08
- Posts: 470
- Website
Re: How to hide or change TCP/IP fingerprint?
Just close all ports tightly with IP tables.., no one will get no reply thus not knowing whats hehind that IP.
Offline