There are two common methods of performing system fingerprinting: active and passive scanning.
The more common active methods use responses sent to TCP or ICMP packets. The TCP fingerprinting process involves setting flags in the header that different operating systems and versions respond to differently. Usually several different TCP packets are sent and the responses are compared to known baselines (or fingerprints) to determine the remote OS.
For stealthy detection, there’s the option of passive fingerprinting. Unlike the active method, this style of fingerprinting does not send any packets, but relies on sniffing techniques to analyze the information sent in normal network traffic. This way there are no deliberate changes or actions against the network.
Passive OS Fingerprinting is a more stealth, but far slower process and usually less accurate than a targeted active fingerprinting session.
This type of software is often used for a variety of activities including, but not limited to, reconnaissance during penetration tests, routine network monitoring, detection of unauthorized network interconnects in corporate environments, providing signals for abuse-prevention tools, and miscellaneous forensics.
Here’s our verdict captured in a legendary LinuxLinks chart. Only free and open source software is included.
Let’s explore the 7 fingerprinting tools at hand. For each title we have compiled its own portal page, a full description with an in-depth analysis of its features, a screenshot of the software in action, together with links to relevant resources.
| Passive OS Fingerprinting | |
|---|---|
| Ettercap | Comprehensive suite for man in the middle attacks |
| PacketFence | Network access control solution with passive DHCP fingerprinting |
| PRADS | Passive Real-time Asset Detection System |
| p0f | Array of passive traffic fingerprinting mechanisms that are highly scalable |
| satori | Python rewrite of passive OS fingerprinting tool |
| MuonFP | Enterprise-ready passive TCP fingerprinter |
| Leetha | Passive network fingerprinting and analysis engine |
This article has been updated to reflect the changes outlined in our recent announcement.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.
As the author of Satori I love to see that it is on the list, though I’m sad to see I’m beat out by a number of programs that haven’t been updated in years!
But is their software better than yours? There’s lots of great Linux software that’s not under active development. For many types of software the last update is not necessarily a big factor.
It depends on what you want to fingerprint. Satori handles tons of protocols, where most of the others primarily only do TCP fingerprinting. Pros/cons of to all of them for sure though.
The important thing is that we have choices.