Mobile Device Signatures - DHCP Fingerprints

Guru Elite Guru Elite
Guru Elite

Here are a list of DHCP fingerprints

 

More information about DHCP fingerprinting can be found here  http://myweb.cableone.net/xnih/ and here http://www.fingerbank.org/signatures.html

 

Common OS/Devices - option 55 signatures


OS Match Option (dec/hex) Match Type Fingerprint


Android 2.x 55/0x37 starts-with 37017921030

 

Android 2.355/0x37 equals 3701792103061c333a3b

(Samsung Galaxy S with Android 2.3)

 

Blackberry55/0x37 equals 370103060F

(unknown model of Blackberry)

 

iPad 55/0x37 equals 370103060F77FC

 

Macbook55/0x37 equals 370103060F775FFC2C2E2F

(Apple Mac Book - assumed OS X)

 

Maemo OS55/0x37 equals 370103060c0f111c28292a

(Nokia N900 running Maemo OS)

 

Nintendo DS 55/0x37 equals 37010306

 

Playstation 3 55/0x37 equals 3701031c060f

 

Symbian OS55/0x37 equals 370C060F01031C78

(Nokia N97 / SonyEricsson)

 

Win Mob 6.x 55/0x37 equals 370103060f2c2e2f

(Seen on HTC phones with Win Mobile 6.x)

 

Win XP55/0x37 equals 37010f03062c2e2f1f21f92b

(exact match on WinXP)

 

Win Vista55/0x37 equals 37010f03062c2ef1f2179f92b

(exact match on Vista)

 

Win7 (Kor)55/0x37 equals 37010f03062c2ef1f2179f92b

(exact match on Win7 - korean edition)

 

Win7 (eng)55/0x37 equals 37010f03062c2ef1f2179f92b

(exact match on Win7)

 

Win (Multi)55/0x37 starts-with 37010F03062C2E2F1

(Generic multi-version "windows")

 

Cisco 1750 55/0x37 equals 3701060F2C0321962B

(cisco 1750 VPN)

 

Linux generic 55/0x37 starts-with 37011C02030F0677

(Debian/Linux 2.6 generic)

 

Linux (unknown) 55/0x37 equals 37011C02030F06770C2C2F1A792A 

 

Linux Debian 2.6.35 55/0x37 equals 37011c02030f06770c2c2f1a

(Backtrack 4 R2 dhclient)

 

Palm PDA 55/0x37 equals 37011C02030F060C

(unknown model of Palm)

 

Samsung s8000 55/0x37 starts-with 370102030405060708090C0D0F1011171A1C2A2C3233353638 

 

Win CE Casio Scanner 55/0x37 equals 370103060F2C2E2F unknown model of Casio scanner 

 

Win CE Symbol Scanner 55/0x37 equals 370103060F2C2E2F4243 unknown model of Symbol scanner 

 

Windows phone 7 55/0x37 equals 370103060f2c2e2f

 

 

Common OS/Devices - option 60 signatures

 

OS Match Option (dec/hex) Match Type Fingerprint

 

Android 2.x (multiple) 60/0x3c starts-with 3c6468637063642034

(partial match on “dhcpcd 4” – caution: may match some linux)

 

BlackBerry 60/0x3c equals 3c426c61636b4265727279

(match 'BlackBerry' option)

 

Maemo OS 60/0x3c starts-with 3c756468637020302e392e39

(partial match on "udhcpd 0.9.9", used in Nokia N900 Phones)

 

Windows CE 60/0x3c equals 3c4d6963726f736f66742057696e646f777320434500

(match "Microsoft)

 

Windows (Multiple) 60/0x3c equals 3c4D53465420352E30

(match multiple windows versions with “MSFT 5.0”)

 

Version history
Revision #:
4 of 4
Last update:
‎12-05-2011 12:10 PM
Updated by:
 
Labels (1)
Contributors
Comments

I have a problem with an AppleTV.

Is there a special fingerprint? The wireshark tells it is 37060103060F77FC. Some communities tell it would be the same as the ipad fingerprint.

This 37060103060F77FC doens not work. The TV says in logon role. With the ipad fingerprint the log of the controller shows, the correct match of the rule it should match, but the TV does not get an ip adress via dhcp.

 

Mar 27 13:03:53 authmgr[1828]: <522019> <INFO> |authmgr| MAC=9c:20:7b:c8:22:f0 IP=0.0.0.0 Derived role 'Role_Set_VLAN515' from user rules: utype=L2

 

I try to use a user derivation rule matching on the mac adress of the TV. This works fine, but it dhould not be the final solution because there will be more AppleTVs in future.

 

Its the ALU Version of the controller: 6.1.3.5

 

Any Idea?

Thanks a lot!

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: 
Is this a frequent problem?

Request an official Aruba knowledge base article to be written by our experts.