# US 10,320,881 B2 · Operating system fingerprint detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,881 B2
- Document ID: US10320881B2
- Status: Granted
- Kind: B2
- Application number: 15/534,226
- Filed: 2015-12-09
- Published: 2017-12-21
- Granted: 2019-06-11
- Earliest claimed: 2014-12-09
- Assignees: Cronus Cyber Technologies Ltd
- Applicants: Cronus Cyber Technologies Ltd.
- Inventors: Doron Sivan; Matan Michael Azugi
- Web page: https://patentgrep.com/patent/US10320881B2

## CPC

- H04L 67/025: for remote control or remote monitoring of applications
- H04L 67/04: specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
- H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L 69/22: Parsing or analysis of headers
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

One primary aspect of the present disclosure is a method of remotely identifying operating system of a remote network element, wherein the remote network element has a plurality of ports and an Internet connection, the method comprising: scanning the ports of the remote network element for determining which ports are open of the plurality of ports; sending, by a processor, a sequence of packets to the remote network element over the internet, and wherein packets in the sequence of packets are different from one another; receiving reply-packets from the remote network element, wherein the reply-packets are the reply of the remote network element to the packets, and analyzing a signature of the reply-packets; and identifying the operating system of remote network element by comparing the signature with documented signatures of existing operating systems.

## Claims

### Claim 1

A method of remotely identifying an operating system of a remote network element, wherein the remote network element has a plurality of ports and an Internet connection, the method comprising:
scanning the ports of the remote network element for determining which ports are open of the plurality of ports;
sending, by a processor, a sequence of packets to the remote network element over the internet, and wherein packets in the sequence of packets are different from one another;
receiving reply-packets from the remote network element, wherein the reply-packets are the reply of the remote network element to the packets, and analyzing a signature of the reply-packets, wherein the sequence of packets and the reply packets are selected from the group consisting of internet control message protocol (ICMP), transmission control protocol (TCP), and user datagram protocol (UDP), and wherein the sequence of packets comprises:
a first packet that is a standard ICMP ping packet;
a second packet that is a nonstandard ICMP ping packet comprising a nonzero code, a don't fragment flag, and a random type of service value;
a third packet that is an ICMP standard time-stamp packet;
a fourth packet that is an ICMP standard information-request packet;
a fifth packet that is an ICMP address-mask request packet;
a sixth packet that is a TCP packet comprising at least one option, and a synchronization (SYN) flag, wherein the sixth packet is addressed to an open port of the remote network element;
a seventh packet that is a TCP packet comprising at least one option, and an acknowledge (ACK) plus push (PSH) flags, wherein the seventh packet is addressed to an open port of the remote network element;
an eighth packet that is a TCP packet comprising at least one option and a finished (FIN) flag, wherein the eighth packet is addressed to a closed port of the remote network element;
a ninth packet that is a TCP packet comprising at least one option and a FIN plus ACK flags, wherein the ninth packet is addressed to a closed port of the remote network element; and
a tenth packet that is an UDP packet addressing port zero; and
identifying the operating system of the remote network element by comparing the signature with documented signatures of existing operating systems.

### Claim 2 (depends on 1)

The method of claim 1, wherein the documented signatures of existing operating systems are stored in a data repository.

### Claim 3 (depends on 1)

The method of claim 1, wherein said sending the sequence of packets is sending the sequence of packets to a plurality of remote network elements in parallel.

### Claim 4 (depends on 1)

The method of claim 1, wherein said receiving the reply-packets is receiving the reply-packets from a plurality of remote network elements in parallel.

### Claim 5 (depends on 1)

The method of claim 1, wherein said identifying the operating system of the remote network element further comprises identifying the version of the operating system.

### Claim 6 (depends on 1)

The method of claim 1, wherein the network element is selected from the group consisting of computers smart phones, laptops, handheld computers, printers, and electronic device consisting devices each comprising a software operating system.