Is there some way to run a command (such as ICMP message or another protocol), get a response from a remote machine (not on my own private local network) and analyze the message to find some evidence that this machine is running a Windows or a Linux operating system?
-
What do you plan to do with this information? It may not be reliable...– pjc50Feb 24, 2012 at 16:24
-
Actually I was on a custumer last week and he was using a system that prevent anyone to use a Windows system on his network. It was made by a remote server that was not one the same network, I thout it very strange because I didn't know how it was made.– DiogoFeb 24, 2012 at 16:33
-
There are any number of ways you might do that. For example, if you are using DHCP to provide network addresses, the DHCP request includes information about the client OS.– Harry JohnstonFeb 28, 2012 at 21:15
8 Answers
If you're on an IPv4 network, just use ping. If the response has a TTL of 128, the target is probably running Windows. If the TTL is 64, the target is probably running some variant of Unix.
-
-
-
1
-
-
2@Hervian, if you mean why were those particular TTLs chosen, you'd have to ask the original programmers. If you mean why are most or all UNIX variants all the same and/or why the TTL is the same for every version of Windows, that would just be inertia - in the absence of any particular reason to change something, it tends to stay the same. Apr 23, 2018 at 9:37
: Presumes ping service enabled on Windows local and remote hosts
:
del _IX.txt, Windows.txt
ping -n 1 [computername|ipaddress] | findstr /i /c:"Reply" > ttl.txt
for /f "tokens=1-9* delims=:=< " %%a in (ttl.txt) do (
if %%i leq 130 (
if %%i geq 100 (
echo Windows & rem or echo %%c >> Windows.txt
) else (
if %%i equ 64 (
echo *IX & rem or echo %%c >> _IX.txt
)
)
)
)
-
Can this modified to work with a range of IP's? If I wanted to run this to find all of the ttl's for my whole server stack. May 2, 2017 at 18:44
Package: xprobe 'OR' xprobe2
Description: Remote OS identification
Xprobe2 allows you to determine what operating system is running on a remote
host. It sends several packets to a host and analyses the returned answers.
Xprobe2's functionality is comparable to the OS fingerprinting feature in nmap.
Example:
$ sudo apt-get install xprobe
$ sudo xprobe2 -T21-23,80,53,110 ###.###.###.###
Reference:
http://www.sys-security.com/html/projects/X.html
http://sourceforge.net/projects/xprobe/
Old post but thought I would add to this too, if the device is SNMP enabled you can also query for the sysDescr which will tell you the OS it is using.
Download a MIB browser, a good one that I use is here: http://www.ireasoning.com/downloadmibbrowserfree.php. You basically give it the IP address of the device and do a walk operation.
-
Can you expand your answer to explain how to accomplish that? Thanks. Jul 22, 2015 at 8:14
-
You can download a MIB browser, a good one that I use is here ireasoning.com/downloadmibbrowserfree.php. You basically give it the ip address of the device and do a walk operation Jul 22, 2015 at 9:21
Following the suggestion of Johnathon64, you could use SNMP to query directly on the server - assuming the remote server itself is configured to use SNMP. You could launch a command-line query such as the one below to do it:
snmpget -v1 -c public <RemoteServerIP> sysDescr.0 | sed -n 's/.*STRING: //p' | tr -d \"
Explaining the command itself:
snmpget
will query the object sysDescr, which contains the object's default name.- The following
sed
will exclude the beginning output, which only contains the polled OID and the beginning of the string. - The last command,
tr
, will exclude any double-quotes, usually found in the SNMP query.
The last two commands are only for formatting the output - if you don't need them, may use the very first command to extract the complete output.
cd
is a common command between Windows and Linux systems.
If you send something erroneous like cd +
The Linux systems I've tested will give you something like,
-bash: cd: +: No such file or directory
Always starting with a shell ID, a reference to the problem character, and ending with "No such file or directory"
Windows always gives,
The system cannot find the path specified.
Even simpler...
cd
in Linux gives no output
cd
in Windows gives the current directory as output
Programmatically you can identify the system based on the output of 0
or >0
characters.
I created a switch using these patterns so that I could run a simple project on either Linux or Windows without modifying anything.
-
OP asked about remote machine, so obviously one can't run a local command– michaelSep 23, 2023 at 4:13