loading
Papers

Research.Publish.Connect.

Paper

Paper Unlock

Authors: Petr Matoušek ; Ondřej Ryšavý ; Matěj Grégr and Martin Vymlátil

Affiliation: Brno University of Technology, Czech Republic

ISBN: 978-989-758-042-0

Keyword(s): Operating Systems, Identification, Fingerprinting, Clustering, Monitoring, IPFIX.

Related Ontology Subjects/Areas/Topics: Data Communication Networking ; Network Monitoring and Control ; Telecommunications

Abstract: This paper deals with identification of operating systems (OSs) from the Internet traffic. Every packet injected on the network carries a specific information in its packet header that reflects the initial settings of a host’s operating system. The set of such features forms a fingerprint. The OS fingerprint usually includes an initial TTL time, a TCP initial window time, a set of specific TCP options, and other values obtained from IP and TCP headers. Identification of OSs can be useful for monitoring a traffic on a local network and also for security purposes. In our paper we focus on the passive fingerprinting using TCP SYN packets that is incorporated to a IPFIX probe. Our tool enhances standard IPFIX records by additional information about OSs. Then, it sends the records to an IPFIX collector where network statistics are stored and presented to the network administrator. If identification is not successful, a further HTTP header check is employed and the fingerprinting database i n the probe is updated. Our fingerprinting technique can be extended using cluster analysis as presented in this paper. As we show the clustering adds flexibility and dynamics to the fingerprinting. We also discuss the impact of IPv6 protocol on the passive fingerprinting. (More)

PDF ImageFull Text

Download
CC BY-NC-ND 4.0

Sign In Guest: Register as new SciTePress user now for free.

Sign In SciTePress user: please login.

PDF ImageMy Papers

You are not signed in, therefore limits apply to your IP address 3.227.249.234

In the current month:
Recent papers: 100 available of 100 total
2+ years older papers: 200 available of 200 total

Paper citation in several formats:
Matoušek, P.; Ryšavý, O.; Grégr, M. and Vymlátil, M. (2014). Towards Identification of Operating Systems from the Internet Traffic - IPFIX Monitoring with Fingerprinting and Clustering.In Proceedings of the 5th International Conference on Data Communication Networking - Volume 1: DCNET, (ICETE 2014) ISBN 978-989-758-042-0, pages 21-27. DOI: 10.5220/0005099500210027

@conference{dcnet14,
author={Petr Matoušek. and Ond\v{r}ej Ryšavý. and Matěj Grégr. and Martin Vymlátil.},
title={Towards Identification of Operating Systems from the Internet Traffic - IPFIX Monitoring with Fingerprinting and Clustering},
booktitle={Proceedings of the 5th International Conference on Data Communication Networking - Volume 1: DCNET, (ICETE 2014)},
year={2014},
pages={21-27},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0005099500210027},
isbn={978-989-758-042-0},
}

TY - CONF

JO - Proceedings of the 5th International Conference on Data Communication Networking - Volume 1: DCNET, (ICETE 2014)
TI - Towards Identification of Operating Systems from the Internet Traffic - IPFIX Monitoring with Fingerprinting and Clustering
SN - 978-989-758-042-0
AU - Matoušek, P.
AU - Ryšavý, O.
AU - Grégr, M.
AU - Vymlátil, M.
PY - 2014
SP - 21
EP - 27
DO - 10.5220/0005099500210027

Login or register to post comments.

Comments on this Paper: Be the first to review this paper.