基于TCP指纹的远程操作系统探测技术  

Probing Techniques for Remote Operating Systems Based on TCP Fingerprint

作　　者：陈钢[1] 夏靖波[1] 蔡小勇[2] 

机构地区：[1]空军工程大学电讯工程学院,陕西西安710077 [2]空军雷达学院,湖北武汉430019

出　　处：《无线电工程》2006年第9期7-11,共5页Radio Engineering

摘　　要：将不同操作系统在TCP协议中的差异视为指纹,据此来探测远程操作系统的类型。探测可分为被动探测和主动探测2类,论述了其探测原理和常用的指纹特征。介绍了为实施探测而涉及的活动TCP端口的扫描技术以及利用TCP指纹特征辨别操作系统类型的3种方法,最后简要讨论了防范探测的基本策略。Seemed as the fingerprint, the diversities in TCP implementations can be used to probe the remote operating systems. The probing methods can be categorized to passive methods and active methods. The paper introduces the theory on probing the remote operating systems based on TCP fingerprint and some applied fingerprint. Furthermore, the paper introduces the technologies scanning active TCP ports and three methods recognizing the remote operating systems according to the character fields. At the last part, we briefly discussed some primary policies preventing the probing based on the TCP fingerprint.

关 键 词：计算机网络 网络安全 操作系统探测 TCP 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]