TTL Response To Detect The Target’s OS Family and Explaining How ICMP Echoing Works

Hello Again My Friend, I Wish You Are Good Today; The Topic of this Write-Up is How to Know the OS System of the Target’s Device From Just ICMP(Internet Control Message Protocol) Echoing Via The Ping Command .

Before We Proceed To the Topic, You Must Know That TTL and Ping Response Cannot Tell You the Exact OS Version It will Tell You the Os System ItSelf To Get the Exact Os Version and It’s, Also Not Too Accurate , It Gives Guesses is nmap -O That is not our Topic To Talk or Know What Can You Do With Nmap For Know !

ICMP Under the Hood :

It’s Seperated to Echo Request, Echo Reply :

Echo Request :

Type -> 8 (Request)

ICMP_Seq (ID-ForthePacket) -> ? number

DataPayload (Optional) -> ? Bytes

Echo Reply :

Type -> 0 (Reply)

ICMP_Seq (I Replied To Your Request Packet and This is the ID Of It ) -> ? number

DataPayload (If You Sent It Will Mirrors the Data You Sent) -> ? Bytes

TTL-Header (Time To Live) -> ? Seconds

in the Ping command :

RTT : (Round Time Trip)

It Calculates The Time Between After Packet Sent and Response Got in MS (Millie Seconds)

Packet Loss :

The Packet Loss are the packets That Dropped Because anything

To See All Of What I Explained We Will Open the WireShark With My Lab Modem and My Device :

Ping icmp_seqs, Requests&Replies&TTL Header

DataPayload Mirroring

*id=0x322a[HEX](Plain:2) This Header is For If You Want To Run Multiple ping Commands To Know What is For This and The Another Ping Processes .**

Know We Understood How ICMP Works Very Well , Let’s Know the Features of the Ping Tool itself .

Ping Tool :

ping [IP] or [DOMAIN]

-c Breaks after <count> replies Was Recieved

ping -c 2 192.168.1.1

-w exit the Ping Command After Amount of Seconds

ping -w 2 192.168.1.1
# Exit After 2 Seconds

-W time to wait for response not the Whole Ping Process, If The Time Passed What You Time You Set in Seconds It Will be a Packet Loss .

ping -W 1 192.168.1.1

-s Send Data with This Size of Bytes :

ping -W 1 192.168.1.1 -t 23 -s 8

-t Set TTL Header Seconds

ping -W 1 -t 188 192.168.1.1

-i Wait Between Sending Every Request From ? number of Seconds

ping -i 2 -c 2 192.168.1.1

Before

After

-I Specify the Device Interface that Packets Will Sent and Recieved from

ping -c 2 -I eno1 192.168.1.1

Okay now We Understood the Whole Thing Know Let’s Enter the Something We Knew All of This For, Which is the Response TTL .

TTL responses Table : (For Most OS Systems)

Note : With Every Hop (Node) That the Packet Go on, the TTL — 1 Like if the TTL was 64 and It Went into a hop It Will Come To You Witl TTL=63; Hop is One Device Usually a Router, So From Router1 → Router2 the TTL Decreased 1 So If the Other Device Was Linux Which It’s Packets has the TTL=64 and Came To You as TTL=60 That Means in Went into 4 Hops Until it Arrived to You, If The TTL Decreased Until It 0 The Packet Will Be Dropped

List of Them :

Android → 64 Second AIX 3.2, 4.1 → 255 Second BSDI BSD/OS 3.1 and 4.0 → 255 Second Compa Tru64 v5.0 → 64 Second Cisco → 254 Second Foundry → 64 Second FreeBSD 3.4, 4.0 → 255 Second FreeBSD 5 → 64 Second HP-UX 10.2 → 255 Second HP-UX 11 → 255 Second Irix 6.5.3, 6.5.8 → 255 Second juniper → 64 Second MPE/IX (HP) → 200 Second Linux 2.0.x kernel → 64 Second Linux 2.2.14 kernel → 255 Second Linux 2.4 kernel → 255 Second Linux Red Hat 9 → 64 Second MacOS/MacTCP X (10.5.6) → 64 Second NetBSD → 255 Second Netgear FVG318 → 64 Second OpenBSD 2.6 & 2.7 → 255 Second OpenVMS 07.01.2002 → 255 Second Solaris 2.5.1, 2.6, 2.7, 2.8 → 255 Second Stratus TCP_OS → 255 Second Stratus STCP → 60 Second SunOS 5.7 → 255 Second Ultrix V4.2–4.5 → 255 Second Windows 98 → 32 Second Windows 98, 98 SE → 128 Second Windows NT 4 WRKS SP 3, SP 6a → 128 Second Windows NT 4 Server SP4 → 128 Second Windows ME → 128 Second Windows 2000 pro → 128 Second Windows 2000 family → 128 Second Windows XP → 128 Second Windows Vista → 128 Second Windows 7 → 128 Second Windows Server 2008 → 128 Second Windows 10 → 128 Second

Examples :

Windows 7 :

ttl 128 (windows)

But For Sorry, With Ping Only We Cannot Know the Exact Version of the Windows Machine or Any Other Machine !

Linux :

ttl 64 (Linux)

in The End, It’s a Very Fast Way To Know the Target’s OS Family Only and We Learn How ICMP Works Every Single Detail in The Way It’s 2 in One; Goodbye My Dear Friend And Remember Steal Legally and For Good !