TCP Stack Fingerprinting
¨Used to determining operating system of target
¨Nmap sends various abnormal packets
–NULL packet to open port
–SYN/FIN/URG/PSH packet to open port
–SYN packet to closed port
–ACK packet to closed port
–FIN/PSH/URG packet to closed port
–UDP packet to closed port
¨Nmap sends series of SYN packets to determine predictability of Initial Sequence Number
¨Nmap compares responses against database describing how
various systems respond to illegal code bit
combinations and sequence number prediction
check