DHCP Fingerprinting
DHCP Fingerprinting is a method of detecting the end device OS based on the dhcp exchange packets. In today’s network where we are talking about IoE , BYOD it is required to identify the devices in your network and mark them accordingly.
Why do we need Fingerprinting:
With BYOD personal devices are making their way into the workplace, and it is a tough job for the network administrators to dynamically detect these devices and make sure these devices are compliant and to enforce required polices on these devices. Detecting the devices type/OS is also part of the play.
Due to the proliferation of BYOD (Bring Your Own Devices)/mobile devices connecting mostly over the Wireless Network, it becomes difficult to identify and control the types of devices that can connect to the network, and once connected, to determine what access privileges they might have.
With DHCP Fingerprinting, DHCP Servers or devices like IPAM Controllers or Wireless Controllers, can use DHCP Fingerprinting to identify the device type, manufacturer name and OS of the clients/devices connecting to the network, categorize them into ACLs, and control which device can connect to the network and what it can do.
How it works:
DHCP Fingerprinting is one of the methods that help us in identifying the OS on the devices bases on the dhcp option.
The complete DHCP process is like this:
The DHCP packets contain multiple options. One of the most important option which is used for dhcp fingerprinting is the option : 55 called Parameter request list, this option is present in the packets sent from the client end i.e the Discover and Request Packets.
The option 55: Parameter Request list in the above capture is :
1,6,15,44,3,33,150 and 43
A DHCP discover request asks for DHCP options in a specific sequence. This makes DHCP Fingerprinting possible – identifying a device or OS requesting an IP address based on the requested DHCP options.
Fingerbank has got a repository of such fingerprints:
https://fingerbank.inverse.ca/
Some of the captured fingerprints in hex:
Android_device 3C64686370636420342E302E3135
Android 2.X 3c6468637063642034
Android 2.2 3701792103061c333a3b
Android 2.3.X 0c616E64726F69645F
Android 4.0.X 37012103060f1c333a3b
Android 4.0.X(2) 37012103061c333a3b
Blackberry 2 3C426C61636B4265727279
Blackberry(2) 370103060F775ffc2c2e2f
iOS Device 370103060F77FC
iPad 37011c02030f06770c2c2f1a792a
OS X 10.6 370103060f775ffc2c2e2f
OS X 10.7 370103060f775ffc2c2e
Win Mobile 3c4d6963726f736f66742057696e646f77732043450
Win Mobile6 370103060f2c2e2f
Aruba implementation of DHCP Fingerprinting:
Happy Reading….