Reconnaissance Techniques · Topic 6 of 8
OS Discovery and Evading IDS and Firewalls
Learn banner grabbing and OS fingerprinting, how scans try to slip past IDS and firewalls at concept level, and the countermeasures defenders use.
- 5 min
- Banner grabbing can be active or passive, and so can fingerprinting.
- Initial TTL: 64 Linux, 128 Windows, 255 many network devices and Solaris.
- Nmap -O is active OS detection, and p0f is passive.
What it is
Once ports are found, the attacker wants to know the operating system and the software version, because weaknesses are specific to them. This is OS discovery, done by banner grabbing and by fingerprinting.
Scanning beyond an IDS or firewall covers the ideas used to make probes look less suspicious or to pass filters. The page ends with the countermeasures that defenders apply.
How it works
Banner grabbing
A banner is the text a service returns when a client connects. It often names the product, the version and sometimes the operating system.
| Type | How it works |
|---|---|
| Active banner grabbing | The tester connects to the service and reads what it says, or sends a request and reads the headers |
| Passive banner grabbing | The tester reads traffic or error pages already available, without sending probes to the target |
Telnet, Netcat and Nmap's version detection are classic tools for active grabbing. A simple HTTP request with a header-only tool shows the Server header, and an error page may show the software.
OS fingerprinting
Every operating system implements the TCP/IP stack a little differently. Fingerprinting measures those differences.
| Method | Description |
|---|---|
| Active fingerprinting | Sends crafted probes and compares the responses with a database, as Nmap -O does |
| Passive fingerprinting | Observes normal traffic without sending anything, as the tool p0f does |
Details examined include the initial TTL, the TCP window size, the Don't Fragment bit and TCP options. Typical initial TTL values are 64 for Linux and many Unix systems, 128 for Windows and 255 for many network devices and Solaris. A packet seen with TTL 117 probably started at 128 and passed 11 hops.
Other sources are the web server banner, SMB or SNMP data and the ICMP replies. Wireshark can inspect captured traffic by hand for the same signals.
Scanning beyond IDS and firewalls
Intrusion detection systems and firewalls inspect traffic against rules. Several well-known scanning ideas try to slip through. They are listed here so you can recognize them, and the countermeasures follow.
| Idea | What it tries to do | Nmap option |
|---|---|---|
| Packet fragmentation | Split the probe into small pieces so a simple filter cannot match it | -f, --mtu |
| Decoys | Mix the real source with fake source addresses | -D |
| Source address spoofing | Send probes with another source address | -S |
| Source port manipulation | Use a trusted port such as 53 as the source | -g or --source-port |
| MAC address spoofing | Change the apparent hardware address | --spoof-mac |
| Slow timing | Send probes slowly to stay under detection thresholds | -T0, -T1 |
| Randomized targets and padding | Remove predictable order and size | --randomize-hosts, --data-length |
| Idle scan | Let a zombie host appear to be the scanner | -sI |
| FTP bounce scan | Use an FTP server to relay the scan | -b |
| Proxies and anonymizers | Hide the true source behind relays such as Tor or proxy chains | proxy tools |
| Bad checksum probes | Probe a filter to see which device replies | --badsum |
IDS evasion works because inspection has limits. A system that does not reassemble fragments, or that cannot inspect encrypted content, can miss what a stricter one would catch.
Firewalls also leak information when the attacker can find the rules. Firewalking uses TTL expiry to learn which ports a gateway lets through. Banner grabbing on the firewall itself reveals its make and software.
Countermeasures
- Close unneeded ports and disable unused services.
- Use a stateful firewall and an IPS that reassembles fragments before inspection.
- Configure alerts for port scans, SYN floods and unusual flag combinations.
- Block packets with spoofed or private source addresses at the border (ingress and egress filtering).
- Hide banners and version numbers, and tune the TCP/IP stack to resist fingerprinting.
- Use ARP monitoring and port security for local spoofing.
- Run your own scans to see what an outsider sees.
- Drop external ICMP types that reveal information, while keeping those needed for path discovery.
- Monitor logs and use rate limits to slow scans.
A worked example
An analyst sees a flow of single SYN packets to many ports from one address, each separated by a few minutes. The pattern matches a slow scan designed to stay under the alert threshold. The fix is a detection rule based on long time windows and a block rule at the firewall, as well as reducing the exposed ports.
How the exam asks about this
- "A tester reads the greeting returned by a service to learn its version. What is this?" -> Banner grabbing.
- "Which tool performs passive OS fingerprinting?" -> p0f.
- "Which Nmap option mixes fake source addresses with the real one?" -> -D, the decoy option.
What to remember for the exam
- Banner grabbing can be active or passive, and so can fingerprinting.
- Initial TTL: 64 Linux, 128 Windows, 255 many network devices and Solaris.
- Nmap -O is active OS detection, and p0f is passive.
- -f fragments, -D uses decoys, -S spoofs, -g sets the source port.
- Defenses: close ports, stateful inspection, IPS with reassembly, hidden banners.
A fragmentation or decoy question asks what the option does for the scanner, not whether it is "safe" or "legal". Answer from the mechanism.
Common mistakes
Treating TTL as an exact fingerprint. It falls with each hop, so you round up to the nearest common initial value.
Believing evasion makes a scan invisible. It only raises the cost of detection, and good logging still finds it.
Hiding the banner and calling the host secure. Removing banners reduces information but does not fix the vulnerability.
Check yourself
What is the difference between active and passive fingerprinting?
Active sends crafted probes to the target, while passive only observes traffic that already exists.
What initial TTL do Windows hosts usually use?
128.
Name two defenses against port scanning.
Closing unused ports and using an IPS or stateful firewall with scan detection.
Topic 6 of 8 in Reconnaissance Techniques
Test yourself on Reconnaissance Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.