For several reasons, I need to either prevent my OS X machine from showing up as an OS X machine in TCP/IP fingerprinting, or make it show up as, say, a Linux machine. Is there an OS X program out there to do it, or a set of network settings I can use to accomplish this?

  • Also - is there a way to do this by just mucking with my MTU and TTL, etc? I'm not really worried about a performance drop, just need to scrape by a little while longer, until network admin gets around to changing the firewall settings lol. – Chris May 5 '12 at 21:40
  • 1
    What program is doing the TCP/IP fingerprinting? it's entirely possible that different programs do it different ways. It would be very unlikely that all Macs exhibit a particular TCP/IP fingerprint, and so your question makes very little sense to me. Do you really think MTU and TTL values vary in uniformly detectable ways between Windows, Linux, and Macs? – Warren P May 5 '12 at 21:45
  • @WarrenP ya, I'm unfamiliar with the concept myself, I'm just working off what Wikipedia told me. As far as I understand it, it uses MTU and TTL along with a bunch of other fields in the handshake packet to sniff the OS. And lol no, I'd highly doubt that they're uniformly detectable. I'm presuming that the sniffing program (Cisco NAC) has some knowledge of that kinda stuff, but I'm also presuming that this is a pretty limited way of doing things. So my hypothesis is, if one or two of these fields was vastly off... but like I said, I'm pretty unfamiliar with this stuff. – Chris May 5 '12 at 21:54

In brief, TCP fingerprinting works by looking at what network ports are open on a machine, and then sending several different TCP packets to the machine and then looks at the responses. All the different operating systems handle those packets slightly differently in terms of fields that are set (or not) in the TCP header, and between all that information you can usually put together a good guess about the remote system.

There's a few papers that talk about how to disguise the fingerprint (http://www.dtic.mil/dtic/tr/fulltext/u2/a439228.pdf and http://static.usenix.org/events/sec00/full_papers/smart/smart_html/index.html). It looks like the best ways to do this are to look at changing what network ports are open on your system, and also to change your network settings, and see what changes that makes to your system when you try to fingerprint scan it (nmap is a free download).

| improve this answer | |
  • Awesome, thanks! I didn't know about nmap, but my mucking about seems to have worked quite well - I've taken my system from nmap seeing it clearly as OS X to having it churn for 60 seconds and come back with "wtf?". Thanks alot! – Chris May 6 '12 at 2:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.