Intrusion Detection In Depth

This paper examines methods to identify vulnerabilities within a network by only passively listening to network traffic. Since these techniques do not write any packets to the network, they could also be used in network forensics analysis. First, a history of operating system identification implementations using active TCP/IP stack fingerprinting is summarized. Second, current operating system identification implementations using passive techniques are discussed. Third, information cannot be trusted if it is crafted, but crafted packets also leave signatures. Therefore there is a discussion identifying the level of packet crafting. Fourth, vulnerabilities cannot be determined from OS alone, and passive banner grabbing technique is discussed. Finally, passive techniques for discovering the network topology and data flow are discussed.