Re: Passive OS Fingerprinting was Cisco CTR etc

From: Raistlin (raistlin_at_s0ftpj.org)
Date: 11/27/03 

To: "Andy Cuff [Talisker]" <talisker@securitywizardry.com>, "Teicher, Mark (Mark)" <teicher@avaya.com>, "Ron Gula" <rgula@tenablesecurity.com>, <focus-ids@securityfocus.com>
Date: Thu, 27 Nov 2003 11:40:30 +0100

> LTNS ! I was under the impression that anti-sniff was (thinking of a
polite
> word) prone to false positives.

We @ s0ftpj played around with that concept some time ago. Sorry that some
documentation may be in Italian, but the code is basically there:
http://www.s0ftpj.org/tools/aasniff.tgz

We have also a couple of tools related with os fingerprinting, check out the
tools page:
http://www.s0ftpj.org/en/tools.html

Raistlin

S0ftPj - Digital Security for Y2K

---------------------------------------------------------------------------
---------------------------------------------------------------------------

Relevant Pages

  • Re: TLD S-100 motherboard info request
    ... Now, being from Italy, and having a "name ending with a vowel" imply that I'm *Italian*, so english is not my mother tongue, and indeed there was some mistakes in writing. ... If those interested want facts and not spurious "suspicions" ... can obtain adequate documentation from on-line sources for free, ... I'm sad that after the first misunderstandment you have taken nearly all what I have written in the most negative sense. ...
    (comp.os.cpm)
  • Re: Walnut Creek ISO
    ... > | documentation. ... I have looked in my 1994 version, and the archive contains MSDOS executables. ... Perhaps these was removed because of viruses or false positives? ...
    (comp.os.cpm)
  • Re: PHP v Python: fair comparison?
    ... mod_python is difficult to set up, and use, and is buggy and prone to ... read the documentation for the ...
    (comp.lang.php)
  • Re: Alarm response strategies
    ... > are far less prone to false positives. ... Your UDP DOS may have an impact ... any false positives - because it only triggers on anomalies - which are ...
    (Focus-IDS)
  • Re: Gap between BB flange and shell
    ... is it an 'English' or 'Italian' version? ... An Italian right cup, being right-hand threaded, will be more prone to ... loosening so it'll be more important to check it sooner rather than later. ...
    (uk.rec.cycling)