ICMP IP Total Length Field Probe
Attack Pattern ID: 331 (Detailed Attack Pattern)Typical Severity: LowStatus: Draft
+ Description

Summary

An attacker sends a UDP packet to a closed port on the target machine to solicit an IP Header's total length field value within the echoed 'Port Unreachable" error message. RFC1122 specifies that the Header of the request must be echoed back when an error is sent in response, but some operating systems and firmware alter the integrity of the original header. Non-standard ICMP/IP implementations result in response that are useful for individuating remote operating system or router firmware versions. There are four general response types that can be used to distinguish operating systems apart.

1. The IP total length field may be calculated correctly.

2. An operating system may add 20 or more additional bytes to the length calculation.

3. The operating system may subtract 20 or more bytes from the correct length of the field

4. The IP total length field is calculated with any other incorrect value.

This type of behavior is useful for building a signature-base of operating system responses, particularly when error messages contain other types of information that is useful identifying specific operating system responses.

+ Target Attack Surface

Target Attack Surface Description

Targeted OSI Layers: Network Layer

Target Attack Surface Localities

Server-side

Target Attack Surface Types: Host

Target Functional Services

Target Functional Service 1: None
Protocol 1: ICMP
Protocol Header 1
Protocol RFCProtocol Field NameProtocol Field DescriptionProtocol Operation CodeProtocol Data
RFC 792
Type
The ICMP Type Field determines the function of the ICMP query. A Type 8 message directs the target to reply to the sender of the echo request message with an echo reply message. In forming an echo reply the source and destination addresses are switched, the Type field is set to '0', any data contained in the data portion of the echo request is sent "echoed" back to the host, and the checksum is recalculated.
8
ICMP echo requests may contain arbitrary data as a payload. When the ICMP Type is 8 (echo request), the data received in the echo message must be returned in the echo reply message.
Related Protocol: Internet Protocol
Relationship Type
Uses Protocol
+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern316ICMP Fingerprinting Probes 
Mechanism of Attack (primary)1000
+ References
Stuart McClure, Joel Scambray, George Kurtz. "Hacking Exposed: Network Security Secrets & Solutions". 6th Edition. McGraw Hill, ISBN: 978-0-07-161374-3. 2009.
Defense Advanced Research Projects Agency (DARPA). "RFC792 - Internet Control Messaging Protocol". 1981. <http://www.faqs.org/rfcs/rfc792.html>.
Defense Advanced Research Projects Agency (DARPA). "RFC1122 - Requirements for Internet Hosts - Communication Layers". 1981. <http://www.faqs.org/rfcs/rfc1122.html>.
Ofir Arkin, et.al. "A Remote Active OS Fingerprinting Tool using ICMP". 2008. <http://ofirarkin.files.wordpress.com/2008/11/login.pdf>.