1

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was

"abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes

Could this behavior be mimicked in any other system like Linux, means could someone create a ping request from Linux to impersonate as a windows ping request,

ping -t 128 -s 40 192.2.x.x ,

the above command in kali linux, gives ping request packet with icmp time stamp in linux (84 byte frame size)

enter image description here

Questions:

  1. can os footprinting be done using icmp packet analysis and how
  2. can someone send ping packets from linux with windows ping structure
  3. how to modify icmp payload in linux to abcdefghijklmnopqrstuvwabcdefghi
  4. why ping packets in linux gives time stamp , and is there away to send them without it

New to wireshark, and icmp. Thank you so much for help

Improve this question
5
  • Unfortunately, questions about host/server configurations are off-topic here. This probably involves programming that is more appropriate on Stack Overflow, but they are not going to hand you the code; you will need to show some work. You can ask about Linux configurations on Unix & Linux.
    – Ron Maupin ♦
    Commented Feb 13, 2019 at 16:34
  • At the network level, there's only ICMP's echo request and reply mechanism: "ping" is just the conventional name for a program which sends them. You can send whatever data you like in the packet, it's not impersonating Windows. Many OS give a method to change the data, see man ping(1) on your computer. But do read RFC 792 for the explanation.
    – jonathanjo
    Commented Feb 13, 2019 at 16:45
  • 2
    ping -s32 -p$(echo 'abcdefghijklmnop' | hexdump -e '"%02X"') 8.8.8.8 will get you close; -s specifies the size; -p specifies a pattern (in hex). The standard Linux ping -p will only accept 16 bytes for its repeating pattern (a-p), though, whereas the Windows ping uses a 24-byte repeating pattern (a-w), so the Linux one is effectively sending abcdefghijklmnopabcdefghijklmnop. nping would probably be more-suitable, as it allows you to specify a full payload.
    – jimbobmcgee
    Commented Feb 13, 2019 at 18:34
  • @jimbobmcgee Does this means that i could tell that a ping initiator was a windows machine with 100 % confidence if the payload content was the one I mentioned? Thank you so much for replying.
    – PDHide
    Commented Feb 13, 2019 at 20:11
  • No, not for certain. You could infer it with some limited confidence, but you could still be wrong. Just because the common Linux ping command doesn't give you an exact means to duplicate the pattern of a Windows ping.exe, doesn't mean that someone couldn't ever duplicate it with some custom ICMP-generating code. Any requirement that has you trying to detect Windows machines based on their ping traffic alone is a requirement I would consider trying to get myself out of...
    – jimbobmcgee
    Commented Feb 14, 2019 at 15:06

0

Reset to default

Browse other questions tagged or ask your own question.