RING is a new remote operating system fingerprinting tool based on temporal response analysis.
Carefully studying the way TCP works, especially some timer value inside the TCP stack, we have derived on a new technique for remote OS detection, based on temporal response analysis. The idea is quite simple: send a TCP SYN packet to an open port on a remote system, and listen the different answers (usually successive SYN/ACK packets). By measuring the number of response, the delay between retries, and the optional presence of a "RST" packet after a few answers, we can easily recognize some operating systems.
As a proof of concept, we also developed the standalone tool "RING" that will perform these testings and identifications, using a signature file.
