Mobile Device Signatures - DHCP Fingerprints

By cjoseph posted Dec 05, 2011 03:10 PM


Here are a list of DHCP fingerprints


More information about DHCP fingerprinting can be found here and here


Common OS/Devices - option 55 signatures

OS Match Option (dec/hex) Match Type Fingerprint

Android 2.x 55/0x37 starts-with 37017921030


Android 2.355/0x37 equals 3701792103061c333a3b

(Samsung Galaxy S with Android 2.3)


Blackberry55/0x37 equals 370103060F

(unknown model of Blackberry)


iPad 55/0x37 equals 370103060F77FC


Macbook55/0x37 equals 370103060F775FFC2C2E2F

(Apple Mac Book - assumed OS X)


Maemo OS55/0x37 equals 370103060c0f111c28292a

(Nokia N900 running Maemo OS)


Nintendo DS 55/0x37 equals 37010306


Playstation 3 55/0x37 equals 3701031c060f


Symbian OS55/0x37 equals 370C060F01031C78

(Nokia N97 / SonyEricsson)


Win Mob 6.x 55/0x37 equals 370103060f2c2e2f

(Seen on HTC phones with Win Mobile 6.x)


Win XP55/0x37 equals 37010f03062c2e2f1f21f92b

(exact match on WinXP)


Win Vista55/0x37 equals 37010f03062c2ef1f2179f92b

(exact match on Vista)


Win7 (Kor)55/0x37 equals 37010f03062c2ef1f2179f92b

(exact match on Win7 - korean edition)


Win7 (eng)55/0x37 equals 37010f03062c2ef1f2179f92b

(exact match on Win7)


Win (Multi)55/0x37 starts-with 37010F03062C2E2F1

(Generic multi-version "windows")


Cisco 1750 55/0x37 equals 3701060F2C0321962B

(cisco 1750 VPN)


Linux generic 55/0x37 starts-with 37011C02030F0677

(Debian/Linux 2.6 generic)


Linux (unknown) 55/0x37 equals 37011C02030F06770C2C2F1A792A 


Linux Debian 2.6.35 55/0x37 equals 37011c02030f06770c2c2f1a

(Backtrack 4 R2 dhclient)


Palm PDA 55/0x37 equals 37011C02030F060C

(unknown model of Palm)


Samsung s8000 55/0x37 starts-with 370102030405060708090C0D0F1011171A1C2A2C3233353638 


Win CE Casio Scanner 55/0x37 equals 370103060F2C2E2F unknown model of Casio scanner 


Win CE Symbol Scanner 55/0x37 equals 370103060F2C2E2F4243 unknown model of Symbol scanner 


Windows phone 7 55/0x37 equals 370103060f2c2e2f



Common OS/Devices - option 60 signatures


OS Match Option (dec/hex) Match Type Fingerprint


Android 2.x (multiple) 60/0x3c starts-with 3c6468637063642034

(partial match on “dhcpcd 4” – caution: may match some linux)


BlackBerry 60/0x3c equals 3c426c61636b4265727279

(match 'BlackBerry' option)


Maemo OS 60/0x3c starts-with 3c756468637020302e392e39

(partial match on "udhcpd 0.9.9", used in Nokia N900 Phones)


Windows CE 60/0x3c equals 3c4d6963726f736f66742057696e646f777320434500

(match "Microsoft)


Windows (Multiple) 60/0x3c equals 3c4D53465420352E30

(match multiple windows versions with “MSFT 5.0”)


1 comment
1 view


Mar 27, 2013 08:06 AM

I have a problem with an AppleTV.

Is there a special fingerprint? The wireshark tells it is 37060103060F77FC. Some communities tell it would be the same as the ipad fingerprint.

This 37060103060F77FC doens not work. The TV says in logon role. With the ipad fingerprint the log of the controller shows, the correct match of the rule it should match, but the TV does not get an ip adress via dhcp.


Mar 27 13:03:53 authmgr[1828]: <522019> <INFO> |authmgr| MAC=9c:20:7b:c8:22:f0 IP= Derived role 'Role_Set_VLAN515' from user rules: utype=L2


I try to use a user derivation rule matching on the mac adress of the TV. This works fine, but it dhould not be the final solution because there will be more AppleTVs in future.


Its the ALU Version of the controller:


Any Idea?

Thanks a lot!