Operating system identification with Nmap

Although TTL analysis can be helpful in identifying remote operating systems, more comprehensive solutions are ideal. Nmap has an operating system identification function that goes far beyond simple TTL analysis. This specific recipe will demonstrate how to use Nmap to perform operating system identification based on probe-response analysis.

Getting ready

To use Nmap to perform operating system identification, you will need to have a remote system running network services that can be probed and inspected. In the examples provided, an installation of Windows XP is used to perform this task. For more information on setting up a Windows system, please refer to the Installing Windows Server recipe in Chapter 1, Getting Started.

How to do it…

To perform an Nmap operating system identification scan, Nmap should be called with the IP address specification and the -O option:

root@KaliLinux:~# nmap 172.16.36.134 -O

Starting Nmap 6.25 ( http://nmap.org ) at 2013...