Wireless Access

Reply

DHCP Fingerprinting

Hi All,

Has anyone got a list of DHCP fingerprints? I've had a quick google but couldn't fine one..

I've got iOS, Android & Blackberry (as CJoseph mentioned them here) but was hoping for Windows Phone 7 too and any other mobile devices...

I don't have the devices handy to get fingerprints..

We have a table at show and we were hoping that we could demo this feature.

Thanks
James

Cheers
James

-------------------------------------------------------
-------------------@whereisjrw-------------------
------------------------blog-------------------------
ACCX #540 | ACMX #353 | ACDX #216
-----------Mobility First Expert #11----------
-------------------------------------------------------

If a reply adequately addresses your issue, please click on the "Accept as Solution" and "Give Kudos" button so this information can benefit other users via search.
Guru Elite

Re: DHCP Fingerprinting

We have not had enough time to clean this up, so I apologize in advance. It also does not have Windows Phone 7. If you want to demonstrate at least detection, remember that the controller will detect and display the OS of any device in the user table for ArubaOS 6.0 and above:

Common OS/Devices - option 55 signatures

OS Match Option (dec/hex) Match Type Fingerprint
Android 2.x 55/0x37 starts-with 37017921030
Android 2.3 55/0x37 equals 3701792103061c333a3b Samsung Galaxy S with Android 2.3
Blackberry 55/0x37 equals 370103060F unknown model of Blackberry
iPad 55/0x37 equals 370103060F77FC
Macbook 55/0x37 equals 370103060F775FFC2C2E2F Apple Mac Book (assumed OS X)
Maemo OS 55/0x37 equals 370103060c0f111c28292a Nokia N900 running Maemo OS
Nintendo DS 55/0x37 equals 37010306
Playstation 3 55/0x37 equals 3701031c060f
Symbian OS 55/0x37 equals 370C060F01031C78 Nokia N97 / SonyEricsson
Win Mobile 6.x 55/0x37 equals 370103060f2c2e2f Seen on HTC phones with Win Mobile 6.x
Win XP 55/0x37 equals 37010f03062c2e2f1f21f92b exact match on WinXP
Win Vista 55/0x37 equals 37010f03062c2ef1f2179f92b exact match on Vista
Win 7 (korean) 55/0x37 equals 37010f03062c2ef1f2179f92b exact match on Win7 (korean edition)
Win 7 (eng) 55/0x37 equals 37010f03062c2ef1f2179f92b exact match on Win7
Win (Multiple) 55/0x37 starts-with 37010F03062C2E2F1 Generic multi-version "windows"

Common OS/Devices - option 60 signatures

OS Match Option (dec/hex) Match Type Fingerprint
Android 2.x (multiple) 60/0x3c starts-with 3c6468637063642034 partial match on “dhcpcd 4” – caution: may match some linux
BlackBerry 60/0x3c equals 3c426c61636b4265727279 match 'BlackBerry' option
Maemo OS 60/0x3c starts-with 3c756468637020302e392e39 partial match on "udhcpd 0.9.9", used in Nokia N900 Phones
Windows CE 60/0x3c equals 3c4d6963726f736f66742057696e646f777320434500 match "Microsoft Windows CE" - this may match MANY devices
Windows (Multiple) 60/0x3c equals 3c4D53465420352E30 match multiple windows versions with “MSFT 5.0”

Not so common

OS Match Option (dec/hex) Match Type Fingerprint
Cisco 1750 55/0x37 equals 3701060F2C0321962B cisco 1750 VPN
Linux generic 55/0x37 starts-with 37011C02030F0677 Debian/Linux 2.6 generic
Linux (unknown) 55/0x37 equals 37011C02030F06770C2C2F1A792A tbd
Linux Debian 2.6.35 55/0x37 equals 37011c02030f06770c2c2f1a Backtrack 4 R2 dhclient
Palm PDA 55/0x37 equals 37011C02030F060C unknown model of Palm
Samsung s8000 55/0x37 starts-with 370102030405060708090C0D0F1011171A1C2A2C3233353638
Win CE Casio Scanner 55/0x37 equals 370103060F2C2E2F unknown model of Casio scanner
Win CE Symbol Scanner 55/0x37 equals 370103060F2C2E2F4243 unknown model of Symbol scanner


Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Re: DHCP Fingerprinting

Excellent! That's more that I could have asked for.
Cheers
James

-------------------------------------------------------
-------------------@whereisjrw-------------------
------------------------blog-------------------------
ACCX #540 | ACMX #353 | ACDX #216
-----------Mobility First Expert #11----------
-------------------------------------------------------

If a reply adequately addresses your issue, please click on the "Accept as Solution" and "Give Kudos" button so this information can benefit other users via search.
MVP

Re: DHCP Fingerprinting




Isn't this going to be such a pain in the behind to keep up to date its nearly unusable?
I mean, how am I to know whether a new BlackBerry or iPhone and probably the real pain, Androids will have the same fingerprint?

And can a skilled hacker 'spoof' these fingerprints or is this a non-issue?

Koen (ACMX #351 | ACDX #547 | ACCP)

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Guru Elite

Re: DHCP Fingerprinting

We only put out a list of a few fingerprints because someone asked. I am not sure if we plan to maintain a list, because in the DHCP fingerprinting note we wrote, there is a way to find out the DHCP fingerprint of any device. Just like any other means of security, there is always someone who is willing to compromise it, so adding a layer of security on top of whatever method you are using is always recommended.


Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Re: DHCP Fingerprinting

Has anyone got a Windows Phone 7 DHCP finger print handy? I don't have a phone to find one with but it'd be ideal if we had it available to demo at a roadshow we're doing in a weeks time..
Cheers
James

-------------------------------------------------------
-------------------@whereisjrw-------------------
------------------------blog-------------------------
ACCX #540 | ACMX #353 | ACDX #216
-----------Mobility First Expert #11----------
-------------------------------------------------------

If a reply adequately addresses your issue, please click on the "Accept as Solution" and "Give Kudos" button so this information can benefit other users via search.
Aruba Employee

Re: DHCP Fingerprinting

I think we only have one guy using that OS at HQ, not sure of anyone else. We can see if we can borrow if for a bit and get back to you.

Also, we're in the process of writing up an app note on this topic, should be out in a few weeks with fingerprints and a howto on grabbing your own.

-awl
Andy Logan, ACDX
Director, Strategic Account Solutions
Aruba Networks
Aruba Employee

Windows Phone 7 fingerprint

Folks,

I got access to one of the few Windows Phone 7 units floating around.

Device: Windows Phone 7
Make: Samsung
Model: SGH-i917
DHCP Option: 55
Fingerprint: 370103060f2c2e2f

Hope this is helpful

-Rajiv

More information about the phone:
Name/Model: Samsung SGH-i917
Carrier: AT&T Wireless
Software: Windows Phone 7
OS version: 7.0.7004.0
Firmware revision number: 2103.10.10.1
Harware revision number: 3.1.0.7
Radio sofware version: 2103.10.10.1
Radio hardware version: 0.0.0.3
Bootloader version: 4.10.0.1
Chip SOC version: 0.36.2.0
Guru Elite

Re: DHCP Fingerprinting

Rajiv, Thanks!


Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Re: DHCP Fingerprinting


Folks,

I got access to one of the few Windows Phone 7 units floating around.

Device: Windows Phone 7
Make: Samsung
Model: SGH-i917
DHCP Option: 55
Fingerprint: 370103060f2c2e2f

Hope this is helpful

-Rajiv

More information about the phone:
Name/Model: Samsung SGH-i917
Carrier: AT&T Wireless
Software: Windows Phone 7
OS version: 7.0.7004.0
Firmware revision number: 2103.10.10.1
Harware revision number: 3.1.0.7
Radio sofware version: 2103.10.10.1
Radio hardware version: 0.0.0.3
Bootloader version: 4.10.0.1
Chip SOC version: 0.36.2.0




Excellent! Thank you.
Cheers
James

-------------------------------------------------------
-------------------@whereisjrw-------------------
------------------------blog-------------------------
ACCX #540 | ACMX #353 | ACDX #216
-----------Mobility First Expert #11----------
-------------------------------------------------------

If a reply adequately addresses your issue, please click on the "Accept as Solution" and "Give Kudos" button so this information can benefit other users via search.
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: