System for remotely distinguishing an operating system

摘要

A method for remotely identifying an operating system comprises sending a first User Datagram Protocol (UDP) packet to a port that is not in use on a target and monitoring a response evoked by the first sent UDP packet. At least one Internet Control Message Protocol (ICMP) packet is sent to the target and the response evoked by the sent ICMP packet(s) monitored. A second UDP packet is sent to the port with an Internet Protocol (IP) timestamp option set in an IP header and a response evoked by the second sent UDP packet is monitored. The operating system is identified at least partially based on the responses to the first and second sent UDP packets.