Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am learning how nmap operates by testing it with another workstation in my network. When I entered

nmap -v -A -sS 192.xxx.xxx.xxx

Part of the output produced the line below.

TCP Sequence Prediction: Difficulty=260 (Good luck!)

How is 260 calculated and what makes it difficult to predict the next sequence?

Any answer or reference would greatly be appreciated!

Thank you

share|improve this question
up vote 2 down vote accepted

The topic of TCP sequence prediction is covered pretty well in the online Nmap book's OS detection page under "TCP Sequence Prediction." Essentially, statistical methods such as the Greatest Common Denominator (GCD) are used to predict the sequence's variability. There is more discussion on the OS detection methods page, and you can look at the code in osscan2.cc in the HostOsScan::makeTSeqFP function.

share|improve this answer
    
Perfect! Just what I was looking for. Thank you! – tray Aug 1 '13 at 6:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .