| 名称 |
TCP Window Scan |
|
|
| 摘要 |
An adversary engages in TCP Window scanning to analyze port status and operating system type. TCP Window scanning uses the ACK scanning method but examine the TCP Window Size field of response RST packets to make certain inferences. While TCP Window Scans are fast and relatively stealthy, they work against fewer TCP stack implementations than any other type of scan. Some operating systems return a positive TCP window size when a RST packet is sent from an open port, and a negative value when the RST originates from a closed port. TCP Window scanning is one of the most complex scan types, and its results are difficult to interpret. Window scanning alone rarely yields useful information, but when combined with other types of scanning is more useful. It is a generally more reliable means of making inference about operating system versions than port status. |
| 前置条件 |
TCP Window scanning requires the use of raw sockets, and thus cannot be performed from some Windows systems (Windows XP SP 2, for example). On Unix and Linux, raw socket manipulations require root privileges. |
| 执行流程 |
| 步骤 |
阶段 |
描述 |
技术手法 |
| 1 |
Experiment |
An adversary sends TCP packets with the ACK flag set and that are not associated with an existing connection to target ports. |
|
| 2 |
Experiment |
An adversary uses the response from the target to determine the port's state. Specifically, the adversary views the TCP window size from the returned RST packet if one was received. Depending on the target operating system, a positive window size may indicate an open port while a negative window size may indicate a closed port. |
|
|
| 解决方案 | |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-200 |
Exposure of Sensitive Information to an Unauthorized Actor |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-300 |
An adversary uses a combination of techniques to determine the state of the ports on a remote target. Any service or application available for TCP or UDP networking will have a port open for communications over the network. |
|