Improving Network Fingerprinting
Promotor(s) : Donnet, Benoît
Date of defense : 26-Jun-2017/27-Jun-2017 • Permalink :
|Improving Network Fingerprinting
|Date of defense :
|Committee's member(s) :
|Number of pages :
|[en] Network fingerprinting
[en] initial time-to-live
[en] network measurement
|Engineering, computing & technology > Computer science
|Target public :
Professionals of domain
|Complementary URL :
|Université de Liège, Liège, Belgique
|Master en ingénieur civil en informatique, à finalité spécialisée en "computer systems and networks"
|Master thesis of the Faculté des Sciences appliquées
[en] Network fingerprinting is a technique that has several applications such as having a better knowledge of the components of a network, improving network security and helping alias resolution techniques. In this thesis, a network fingerprinting technique is developed based on certain values found in ICMP and TCP replies from routers. The main focus of the method is on initial time-to-live values used in those responses. Others values found in the same responses are then considered to obtain a more accurate classification.
This work is the continuation of a previous research on network fingerprinting where only two initial time-to-live values were considered. The focus of this master thesis is then to improve it by considering other possible values.
Results obtained by testing the technique in a campaign are promising. Major router brands could be discriminated in disjoint classes. This thesis also highlights values that can improve directly the classification and other that may be less useful. The correlation between the different values is also analyzed.
Cite this master thesis
The University of Liège does not guarantee the scientific quality of these students' works or the accuracy of all the information they contain.