full screen background image

Detect Operating System by Using Ping Command

Ping is a network administration software utility, which used to identify the availability of a host on a Network.
Ping working by sending ICMP echo request packets to the target host and waiting for a ICMP echo reply.
TTL is simply means, how long a resolver is supposed to cache the DNS query before the query expires and a new one needs to be done.
These TTL values differs between the Operating system.
Here you find TTL value for Range of servers.

Operating SystemVersionProtocolTTL
AIXTCP60
AIXUDP30
AIX3.2, 4.1ICMP255
BSDIBSD/OS 3.1 and 4.0ICMP255
CompaTru64 v5.0ICMP64
CiscoICMP254
DEC PathworksV5TCP and UDP30
FoundryICMP64
FreeBSD2.1RTCP and UDP64
FreeBSD3.4, 4.0ICMP255
FreeBSD5ICMP64
HP-UX9.0xTCP and UDP30
HP-UX10.01TCP and UDP64
HP-UX10.2ICMP255
HP-UX11ICMP255
HP-UX11TCP64
Irix5.3TCP and UDP60
Irix6.xTCP and UDP60
Irix6.5.3, 6.5.8ICMP255
JuniperICMP64
MPE/IX (HP)ICMP200
Linux2.0.x kernelICMP64
Linux2.2.14 kernelICMP255
Linux2.4 kernelICMP255
LinuxRed Hat 9ICMP and TCP64
MacOS/MacTCP2.0.xTCP and UDP60
MacOS/MacTCPX (10.5.6)ICMP/TCP/UDP64
NetBSDICMP255
Netgear FVG318ICMP and UDP64
OpenBSD2.6 & 2.7ICMP255
OpenVMS07.01.2002ICMP255
OS/2TCP/IP 3.064
OSF/1V3.2ATCP60
OSF/1V3.2AUDP30
Solaris2.5.1, 2.6, 2.7, 2.8ICMP255
Solaris2.8TCP64
StratusTCP_OSICMP255
StratusTCP_OS (14.2-)TCP and UDP30
StratusTCP_OS (14.3+)TCP and UDP64
StratusSTCPICMP/TCP/UDP60
SunOS4.1.3/4.1.4TCP and UDP60
SunOS5.7ICMP and TCP255
UltrixV4.1/V4.2ATCP60
UltrixV4.1/V4.2AUDP30
UltrixV4.2 – 4.5ICMP255
VMS/MultinetTCP and UDP64
VMS/TCPwareTCP60
VMS/TCPwareUDP64
VMS/Wollongong1.1.1.1TCP128
VMS/Wollongong1.1.1.1UDP30
VMS/UCXTCP and UDP128
Windowsfor WorkgroupsTCP and UDP32
Windows95TCP and UDP32
Windows98ICMP32
Windows98, 98 SEICMP128
Windows98TCP128
WindowsNT 3.51TCP and UDP32
WindowsNT 4.0TCP and UDP128
WindowsNT 4.0 SP5-32
WindowsNT 4.0 SP6+128
WindowsNT 4 WRKS SP 3, SP 6aICMP128
WindowsNT 4 Server SP4ICMP128
WindowsMEICMP128
Windows2000 proICMP/TCP/UDP128
Windows2000 familyICMP128
WindowsServer 2003128
WindowsXPICMP/TCP/UDP128
WindowsVistaICMP/TCP/UDP128
Windows7ICMP/TCP/UDP128
WindowsServer 2008ICMP/TCP/UDP128
Windows10ICMP/TCP/UDP128

 

DETECT AN OPERATING SYSTEM BY USING PING COMMAND
At first we need to run a traceroute to find the hops between our host and the destination.

Now we need to ping the destination host

TTL values is (49) . If we take the summary of the TTL and the number of hops we can define the Operating System (49 + 30 = 79) we can now conclude that the destination is a Linux OS.

Lets confirm that with an nmap scan

Thats it , this is how we can detect Operating System with ping command

Note: TTL values can be changed by administrators to confuse attackers about the operating system

 

 

Πηγή : hackholics

 

 

MNb3WYb.png

QwAFf7V.png

dfIK0AV.png


Anastasis Vasileiadis

PC Technical || Penetration Tester || Ethical Hacker || Cyber Security Expert || Cyber Security Analyst || Information Security Researcher || Part-Time Hacker || Child Pornography & Sexual Abuse Combat


One thought on “Detect Operating System by Using Ping Command

Leave a Reply

Your email address will not be published. Required fields are marked *