13

Is there some way to run a command (such as ICMP message or another protocol), get a response from a remote machine (not on my own private local network) and analyze the message to find some evidence that this machine is running a Windows or a Linux operating system?

3
  • What do you plan to do with this information? It may not be reliable...
    – pjc50
    Feb 24, 2012 at 16:24
  • Actually I was on a custumer last week and he was using a system that prevent anyone to use a Windows system on his network. It was made by a remote server that was not one the same network, I thout it very strange because I didn't know how it was made.
    – Diogo
    Feb 24, 2012 at 16:33
  • There are any number of ways you might do that. For example, if you are using DHCP to provide network addresses, the DHCP request includes information about the client OS. Feb 28, 2012 at 21:15

8 Answers 8

19

It isn't definitive but nmap will do this with the command nmap -O -v (see docs for more details) If you're running windows or want a gui, look at zenmap

2
  • 2
    Mind you - some providers will detect port scanning using nmap as abuse. Nov 9, 2012 at 1:42
  • 3
    @JeroenBaert namelly AWS sent me a scary email Feb 21, 2018 at 13:50
11

If you're on an IPv4 network, just use ping. If the response has a TTL of 128, the target is probably running Windows. If the TTL is 64, the target is probably running some variant of Unix.

7
  • What do you mean by propably?
    – Dchris
    Sep 5, 2013 at 9:00
  • What about TTL=255? I think is Unix..
    – Dchris
    Sep 5, 2013 at 9:01
  • 1
    I don't think I've ever seen a TTL of 255. Sep 5, 2013 at 21:32
  • What is the explanation for this/Why is this the case.
    – Hervian
    Apr 23, 2018 at 6:57
  • 2
    @Hervian, if you mean why were those particular TTLs chosen, you'd have to ask the original programmers. If you mean why are most or all UNIX variants all the same and/or why the TTL is the same for every version of Windows, that would just be inertia - in the absence of any particular reason to change something, it tends to stay the same. Apr 23, 2018 at 9:37
2
: Presumes ping service enabled on Windows local and remote hosts
:
del _IX.txt, Windows.txt
ping -n 1 [computername|ipaddress] | findstr /i /c:"Reply" > ttl.txt
for /f "tokens=1-9* delims=:=< " %%a in (ttl.txt) do (
    if %%i leq 130 (
       if %%i geq 100 (
          echo Windows & rem or echo %%c >> Windows.txt
       ) else (
          if %%i equ 64 (
             echo *IX & rem or echo %%c >> _IX.txt
          )
       )
    )
)
1
  • Can this modified to work with a range of IP's? If I wanted to run this to find all of the ttl's for my whole server stack. May 2, 2017 at 18:44
1

One way to go is to use NMap. From the response, it can guess the remote OS.

0
1

Package: xprobe 'OR' xprobe2
Description: Remote OS identification Xprobe2 allows you to determine what operating system is running on a remote host. It sends several packets to a host and analyses the returned answers. Xprobe2's functionality is comparable to the OS fingerprinting feature in nmap.

Example:
$ sudo apt-get install xprobe
$ sudo xprobe2 -T21-23,80,53,110 ###.###.###.###

Reference:
http://www.sys-security.com/html/projects/X.html
http://sourceforge.net/projects/xprobe/

0

Old post but thought I would add to this too, if the device is SNMP enabled you can also query for the sysDescr which will tell you the OS it is using.

Download a MIB browser, a good one that I use is here: http://www.ireasoning.com/downloadmibbrowserfree.php. You basically give it the IP address of the device and do a walk operation.

2
  • Can you expand your answer to explain how to accomplish that? Thanks.
    – fixer1234
    Jul 22, 2015 at 8:14
  • You can download a MIB browser, a good one that I use is here ireasoning.com/downloadmibbrowserfree.php. You basically give it the ip address of the device and do a walk operation Jul 22, 2015 at 9:21
0

Following the suggestion of Johnathon64, you could use SNMP to query directly on the server - assuming the remote server itself is configured to use SNMP. You could launch a command-line query such as the one below to do it:

snmpget -v1 -c public <RemoteServerIP> sysDescr.0 | sed -n 's/.*STRING: //p' | tr -d \"

Explaining the command itself:

  1. snmpget will query the object sysDescr, which contains the object's default name.
  2. The following sed will exclude the beginning output, which only contains the polled OID and the beginning of the string.
  3. The last command, tr, will exclude any double-quotes, usually found in the SNMP query.

The last two commands are only for formatting the output - if you don't need them, may use the very first command to extract the complete output.

-1

cd is a common command between Windows and Linux systems.

If you send something erroneous like cd + The Linux systems I've tested will give you something like,

-bash: cd: +: No such file or directory

Always starting with a shell ID, a reference to the problem character, and ending with "No such file or directory"

Windows always gives,

The system cannot find the path specified.

Even simpler...

cd in Linux gives no output

cd in Windows gives the current directory as output

Programmatically you can identify the system based on the output of 0 or >0 characters.

I created a switch using these patterns so that I could run a simple project on either Linux or Windows without modifying anything.

1
  • OP asked about remote machine, so obviously one can't run a local command
    – michael
    Sep 23, 2023 at 4:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .