Linux – reliable way to detect OS of the network hosts from linux workstation

linuxmonitoringnmap

How to detect OS of running computers on the network.

We use linux. I want to write wrapper on the python, which will periodically scan network and write results to google spreadsheet. I tried nmap -O and -A, but unfortunately this commands in not reliable. Because

It's depend on running services and nmap database of fingerprints.
If there are no fingerprints in installed nmap database – scanner cannot determine OS version.

Is there no reliable os detection method for windows/linux hosts with free tools?

Best Answer

Here's a list of what you can read into:

you could ssh in and use uname -o
use you can use ping to sort determine OS, nice link for some OS's here.
if your machines are stock then just use nmap, it is the definitive project for this.
or you can read into IP Stack Fingerprinting and have a machine intercept packets.

Related Solutions

Linux – n00bie Linode VPS – am I reasonably secure? How to audit

It sounds like you're on the right track. If you end up getting compromised, it's most likely that it'll happen through vulnerabilities in your application software (you mentioned Wordpress and Drupal). To mitigate these risks, you need to keep abreast of any vulnerability announcements for those products (including any plugins/modules you have installed), and install patches as soon as possible.

Additionally, set up a bullet-proof backup system for the server and do test restores regularly. If you do get compromised, you're going to need to do a complete re-install of your server and data. If you have a good backup system, this process is much less painful.

Linux NICs – How to Identify Connections to Same Switch

The switches may already be sending you the information you want. If they are Cisco switches, by default they will be using a process called CDP (Cisco Discovery Protocol) which will provide you information about the switch where it is connected.

You can use tcpdump to view this information with the following (substituting the appropriate interface):

tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether[20:2] == 0x2000'

The standard based version of CDP is LLDP (link layer discovery protocol). Some vendors will have this on by default and others off, so your mileage will vary. There are some LLDP implementations for Linux, but if you want something similar to the above you can use this (set up LLDP on a Cisco switch and tested the below, which is more consistent with above):

tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether proto 0x88cc'

Barring that, I would say that a modification of option 1 you provide might work, however, instead of sending out a broadcast ICMP, you can try a normal ICMP (to a host not in the ARP table) and capture the ARP packets. If ARP request is sent out eth0 and you receive it on eth1 and eth3, then you know those are on the same VLAN. Simplest command for that is as follows:

tcpdump -i eth0 arp

Best Answer

Related Solutions

Linux – n00bie Linode VPS – am I reasonably secure? How to audit

Linux NICs – How to Identify Connections to Same Switch

Related Topic