基于TCP的操作系统远程探测技术  

Techniques of probing remote operating systems based on TCP

作　　者：蔡小勇[1] 王一兵[2] 

机构地区：[1]空军雷达学院四系,湖北武汉430019 [2]第二炮兵指挥学院三系,湖北武汉430012

出　　处：《系统工程与电子技术》2006年第9期1438-1441,1459,共5页Systems Engineering and Electronics

摘　　要：利用TCP协议实现中的差异来探测远程操作系统是获取远程操作系统类型信息的一种有效途径。TCP协议上的差异体现为与TCP有关的特征行为和某些字段的特征值。列举了一些探测远程操作系统类型时常使用的TCP协议特征字段和特征行为。将探测的实施分为两个基本步骤:获取远程系统的TCP报文和分析、判断获取的TCP报文。端口扫描是获取远程系统TCP报文前期的一种重要活动,通过对端口扫描原理和三种确定操作系统类型方法的分析,阐明了基于TCP的远程操作系统探测技术的可用性。It is an efficient way to probe the types and versions of the remote operating systems from the diversities in these TCP implementations. These diversities are the different actions and the values in some fields in the TCP implementations among the different operating systems. Some characteristic actions and values used in probing the remote OS are presented. The probing process is divided into two phases： gathering the TCP diagrams of the remote OS and analyzing these diagrams to determine OS version and type. In these actions, scanning ports is an important action prior to gather the TCP diagrams. By introducing the technique scanning ports and three methods of determining the OS type from TCP, it presents the usability of the technique probing the remote OS based on TCP.

关 键 词：操作系统探测 传输控制协议 计算机网络 网络安全 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]