SYN and SYN+ACK Packets

TCP packets are the backbone of network communication, and two of the most significant types are SYN and SYN+ACK.
TCP fingerprinting analyzes the behavior and characteristics of these packets to infer the operating system (OS) of the client or server, and the geographic or logical distance (network hop count).

TCP Signature

For TCP traffic, signature layout is as follows:

sig = ver:ittl:olen:mss:wsize,scale:olayout:quirks:pclass

  • ver: signature for IPv4 ('4'), IPv6 ('6'), or both ('*').

  • ittl: initial TTL used by the OS. Almost all operating systems use 64, 128, or 255; ancient versions of Windows sometimes used 32, and several obscure systems sometimes resort to odd values such as 60.

  • olen: length of IPv4 options or IPv6 extension headers.

  • mss: maximum segment size, if specified in TCP options. Special value of '*' can be used to denote that MSS varies depending on the parameters of sender's network link, and should not be a part of the signature. In this case, MSS will be used to guess the type of network hookup according to the [mtu] rules.

  • wsize: window size. Can be expressed as a fixed value, but many operating systems set it to a multiple of MSS or MTU, or a multiple of some random integer. P0f automatically detects these cases, and allows notation such as 'mss*4', 'mtu*4', or '%8192' to be used. Wilcard ('*') is possible too.

  • scale: window scaling factor, if specified in TCP options. Fixed value or '*'.

  • olayout: comma-delimited layout and ordering of TCP options, if any. This is one of the most valuable TCP fingerprinting signals. Supported values:

    eol+n explicit end of options, followed by n bytes of padding.

    nop no-op option.

    mss maximum segment size.

    ws window scaling.

    sok selective ACK permitted.

    sack selective ACK (should not be seen).

    ts timestamp.

    ?n unknown option ID n.

  • quirks: comma-delimited properties and quirks observed in IP or TCP headers:

    df"don't fragment" set (probably PMTUD); ignored for IPv6

    id+ DF set but IPID non-zero; ignored for IPv6

    id- DF not set but IPID is zero; ignored for IPv6

    ecn explicit congestion notification support

    0+ "must be zero" field not zero; ignored for IPv6

    flow non-zero IPv6 flow ID; ignored for IPv4

    seq- sequence number is zero

    ack+ ACK number is non-zero, but ACK flag not set

    ack- ACK number is zero, but ACK flag set

    uptr+ URG pointer is non-zero, but URG flag not set

    urgf+ URG flag used

    pushf+ PUSH flag used

    ts1- own timestamp specified as zero

    ts2+ non-zero peer timestamp on initial SYN

    opt+ trailing non-zero data in options segment

    exws excessive window scaling factor (> 14)

    bad malformed TCP options

  • pclass: payload size classification: '0' for zero, '+' for non-zero, '*' for any. The packets we fingerprint right now normally have no payloads, but some corner cases exist.

SYN Packet

Initiate a TCP connection. Sent by the client to a server.

SYN Packet Analyzed 

.-[ 1.2.3.4/1524 -> 4.3.2.1/80 (syn) ]-
|
| client   = 1.2.3.4/1524
| os       = Windows XP
| dist     = 8
| params   = none
| raw_sig  = 4:120+8:0:1452:65535,0:mss,nop,nop,sok:df,id+:0
|
`----

SYN Key Fields

  • client: The source IP and port initiating the connection.

  • os: The identified operating system matches the signature in the database.

  • dist: The distance in network hops to the server.

  • params: Optional TCP parameters.

  • raw_sig: The raw TCP signature, representing how the packet is structured.

SYN+ACK Packet

Sent by the server in response to a SYN, signaling acknowledgment and readiness to establish the connection.

SYN+ACK Packet Analyzed 

.-[ 1.2.3.4/1524 -> 4.3.2.1/80 (syn+ack) ]-
|
| server   = 4.3.2.1/80
| os       = Linux 3.x
| dist     = 0
| params   = none
| raw_sig  = 4:64+0:0:1460:mss*10,0:mss,nop,nop,sok:df:0
|
`----

SYN+ACK Key Fields

  • server: The destination IP and port of the server connection.

  • os: The identified operating system matches the signature in the database.

  • dist: The distance in network hops (it's always 0).

  • params: Optional TCP parameters.

  • raw_sig: The raw TCP signature, representing how the packet is structured.
← Quick Example MTU →