COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-327

TCP Options Probe

This OS fingerprinting probe analyzes the type and order of any TCP header options present within a response segment. Most operating systems use unique ordering and different option sets when options are present. RFC 793 does not specify a required order when options are present, so different implementations use unique ways of ordering or structuring TCP options. TCP options can be generated by ordinary TCP traffic.

Abstraction

Detailed

Typical severity

Low

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

This OS fingerprinting probe analyzes the type and order of any TCP header options present within a response segment. Most operating systems use unique ordering and different option sets when options are present. RFC 793 does not specify a required order when options are present, so different implementations use unique ways of ordering or structuring TCP options. TCP options can be generated by ordinary TCP traffic.

Requirements

What does the attack require?

Prerequisites

  • The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.

Skills required

Not stated in the MITRE record.

Resources required

  • A tool capable of sending and receiving packets from a remote system.

Impact

What does a successful attack lead to?

Read Data

Affected scopes: Confidentiality

Bypass Protection MechanismHide Activities

Affected scopes: Confidentiality, Access Control, Authorization