Improving Network Fingerprinting

Abstract

Network fingerprinting is a technique that has several applications such as having a better knowledge of the components of a network, improving network security and helping alias resolution techniques. In this thesis, a network fingerprinting technique is developed based on certain values found in ICMP and TCP replies from routers. The main focus of the method is on initial time-to-live values used in those responses. Others values found in the same responses are then considered to obtain a more accurate classification.

This work is the continuation of a previous research on network fingerprinting where only two initial time-to-live values were considered. The focus of this master thesis is then to improve it by considering other possible values.

Results obtained by testing the technique in a campaign are promising. Major router brands could be discriminated in disjoint classes. This thesis also highlights values that can improve directly the classification and other that may be less useful. The correlation between the different values is also analyzed.