5

Although I have heard this a few times before, I was reading a webpage regarding IDS (Intrusion Detection Systems) which mentioned that Hackers looking for a computer to exploit may ping yours to see if it’ll reply; if it does, the answer lets them know what operating system your computer is running - MacWorld

I thought it curious that a ICMP ping response would reveal an OS, and I theorised that the answer may be in the format of the computers response, however a cursory search of the internet revealed no useful information and that I fully expect the answer to be more complicated.

In summary, my question is: How do pings reveal an Operating System?

5

Every time when you ping any IP address this PING request should be digested and reply generated using a operating system. Ether the destination IP might belongs to Network box (Router, L3 Switch or firewall and so on) or a Machine (XP, UNIX, Linux, Mac).

Every machine has its own assigned TTL value which will be decremented hop by hop.

As an example if you ping Microsoft Windows 7 machine which has 128 as the default TTL value, your machine receives echo response with the TTL value 128 that means this coming from a Windows machine, in case if you receive echo response with the value 64, this is a Linux based machine.

Here is the reference link which talks about the TTL/OS: Click

| improve this answer | |
  • I like how your answer goes into a specific detail.. mentioning a field(in this case TTL) and giving a list of OSs. I notice though that TTL can be adjusted with the windows ping command. Also TOS is another field that is apparently used, so for example in the link at the other answer, "TOS value" specifically TOS unused bit, is mentioned. – barlop Feb 6 '17 at 4:18
3

Each operating system implement ICMP in a slightly different way and will respond differently to some ICMP requests.

Examining the answer to some specially crafted ICMP request, you can deduce from the response wich O.S. replied.

You will find more detailed explanations here for example.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.