Re: Fingerprinting DNS implementations.

[Dean Anderson <dean@av8.com>]

On Wed, 10 Dec 2003, Roy Arends wrote:

> Vendors do not obscure responses. How do you obscure responses ? Create
> but not send ? Response-Sensorship ?

Nmap fingerprints OS's by TCP signatures, using much the same methods as
you described, in principle anyway.  There are tools for linux and I think
*BSD that will alter the responses so that this fingerprinting fails to
identify the true OS.

This could get into a sort of war of fingerprinting and obscuring changes,
which would seem to be destructive...

		--Dean


--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>