How can I detect OS by sniffing network traffic?

Question

Is it possible to sniff a network (WLAN) and find out what operating system are installed on network clients (PCs/Phones etc)?

I am using Ubuntu.

http://lcamtuf.coredump.cx/p0f3/ – Dog eat cat world Jul 06 '14 at 19:38 — Dog eat cat world, Jul 06 '14 at 19:38

score 3 · Accepted Answer · answered Jul 06 '14 at 20:14

3

nmap has the ability to guess the operating system by looking at variations in how a device reacts to TCP/IP probes (see the nmap website for details).

You can also make a guess at the identity of a device by looking at who its MAC address was allocated to. For example, something with an address in a Hewlett-Packard block is probably a network printer.

answered Jul 06 '14 at 20:14

Mark

34,646
9
87
137

Nmap uses active fingerprinting. Sniffing, as mentioned by the OP, in the sctrict sense, however would be entirely passive. Passive fingerprinting is not supported by Nmap, as stated in their manual here: https://nmap.org/book/osdetect-other-methods.html#osdetect-passive – Marcel Sep 07 '16 at 07:15

score 3 · Answer 2 · answered Jul 07 '14 at 04:10

If you are able to monitor the network, and assuming that the clients are not network devices like routers that may hide behind them other devices, it is possible to determine (with some accuracy) what operating system the device owning that IP address has just by monitoring what IPs that device connects to.

For instance, a device that connects regularly to IPs and looks up DNS for known Microsoft Update servers could be running a flavor of Windows. Same goes for Ubuntu, if said IP address connects regularly to a Ubuntu update server.

This, of course, precludes things like the device having an automated script that connects to many types of servers, in order to befuddle this kind of analysis.

score 0 · Answer 3 · answered Sep 07 '16 at 07:06

0

Try p0f http://lcamtuf.coredump.cx/p0f3/ this is a passive fingerprinter which determines the OS by looking at characteristics in the network traffic.

answered Sep 07 '16 at 07:06

beamzer

1
1

score 0 · Answer 4 · answered Jul 07 '14 at 06:46

From your question I understood that you want to use Passive sniffing. So, you can sniff ICMP reply packets, since default OS types can vary by their TTL values. But, if the value has changed, this may not be good choice. If so, I also suggest using @Mark s answer. Using nmap with OS detection would be much better. ;)

How can I detect OS by sniffing network traffic?

4 Answers4