CAPEC-323 TCP (ISN) Counter Rate Probe

This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.

• The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

• Confidentiality: Read Data • Confidentiality, Access Control, Authorization: Bypass Protection Mechanism, Hide Activities