Timeline for Modifying linux ping icmp payload [closed]
Current License: CC BY-SA 4.0
7 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Feb 14, 2019 at 15:06 | comment | added | jimbobmcgee |
No, not for certain. You could infer it with some limited confidence, but you could still be wrong. Just because the common Linux ping command doesn't give you an exact means to duplicate the pattern of a Windows ping.exe , doesn't mean that someone couldn't ever duplicate it with some custom ICMP-generating code. Any requirement that has you trying to detect Windows machines based on their ping traffic alone is a requirement I would consider trying to get myself out of...
|
|
Feb 13, 2019 at 20:11 | comment | added | PDHide | @jimbobmcgee Does this means that i could tell that a ping initiator was a windows machine with 100 % confidence if the payload content was the one I mentioned? Thank you so much for replying. | |
Feb 13, 2019 at 18:34 | comment | added | jimbobmcgee |
ping -s32 -p$(echo 'abcdefghijklmnop' | hexdump -e '"%02X"') 8.8.8.8 will get you close; -s specifies the size; -p specifies a pattern (in hex). The standard Linux ping -p will only accept 16 bytes for its repeating pattern (a-p ), though, whereas the Windows ping uses a 24-byte repeating pattern (a-w ), so the Linux one is effectively sending abcdefghijklmnopabcdefghijklmnop . nping would probably be more-suitable, as it allows you to specify a full payload.
|
|
Feb 13, 2019 at 16:45 | comment | added | jonathanjo | At the network level, there's only ICMP's echo request and reply mechanism: "ping" is just the conventional name for a program which sends them. You can send whatever data you like in the packet, it's not impersonating Windows. Many OS give a method to change the data, see man ping(1) on your computer. But do read RFC 792 for the explanation. | |
Feb 13, 2019 at 16:34 | history | closed |
user36472 Ron Maupin♦ |
Not suitable for this site | |
Feb 13, 2019 at 16:34 | comment | added | Ron Maupin♦ | Unfortunately, questions about host/server configurations are off-topic here. This probably involves programming that is more appropriate on Stack Overflow, but they are not going to hand you the code; you will need to show some work. You can ask about Linux configurations on Unix & Linux. | |
Feb 13, 2019 at 16:31 | history | asked | PDHide | CC BY-SA 4.0 |