Remote Physical Device Fingerprinting

T. Kohno; A. Broido; K.C. Claffy

doi:10.1109/tdsc.2005.26

IEEE Transactions on Professional Communication Feb 2005

Remote Physical Device Fingerprinting

T. Kohno ; A. Broido ; K.C. Claffy

Abstract

We introduce the area of remote physical device fingerprinting, or fingerprinting a physical device, as opposed to an operating system or class of devices, remotely, and without the fingerprinted device's known cooperation. We accomplish this goal by exploiting small, microscopic deviations in device hardware: clock skews. Our techniques do not require any modification to the fingerprinted devices. Our techniques report consistent measurements when the measurer is thousands of miles, multiple hops, and tens of milliseconds away from the fingerprinted device and when the fingerprinted device is connected to the Internet from different locations and via different access technologies. Further, one can apply our passive and semipassive techniques when the fingerprinted device is behind a NAT or firewall, and. also when the device's system time is maintained via NTP or SNTP. One can use our techniques to obtain information about whether two devices on the Internet, possibly shifted in time or IP addresses, are actually the same physical device. Example applications include: computer forensics; tracking, with some probability, a physical device as it connects to the Internet from different public access points; counting the number of devices behind a NAT even when the devices use constant or random IP IDs; remotely probing a block of addresses to determine if the addresses correspond to virtual hosts, e.g., as part of a virtual honeynet; and unanonymizing anonymized network traces.

Journal: IEEE Transactions on Professional Communication
Published: 2005-02-01
DOI: 10.1109/tdsc.2005.26
CompPile
Open Access: Closed
Topics: digital rhetoric
Export: BibTeX RIS

Citation Context

Cited by in this index (0)

No articles in this index cite this work.

References (37)

(2004)

Endace measurement systems
(2004)

Nmap free security scanner
(2004)

Project details for p0f
(2004)

VMware virtual infrastructure
(2004)

Xprobe official home

Show all 37 →

10.1109/INFCOM.2003.1209232

↗
10.1145/637201.637243

↗
10.1007/978-3-540-45172-3_24

↗
10.1007/978-3-540-31966-5_22

↗
Broido

Radon Spectroscopy of Inter-Packet Delay
10.1145/885651.781077

↗
Donnelly (2002)

High Precision Timing In Passive Measurements of Data Networks
10.1137/0213003

↗
10.1145/885651.781049

↗
Graham (1997)

Dag—A Cell Capture Board for ATM Measurement Systems
Graham (1972)

An Efficient Algorithm for Determining the Convex Hull of a Finite Planar Set

Information Processing Letters ↗
10.1145/863955.863968

↗
10.17487/rfc1323

↗
Keys

The Architecture of the Coralreef Internet Traffic Monitoring Software Suite
10.1109/SP.2005.18

↗
McDanel (2001)

TCP Timestamping and Remotely Gathering Uptime Information
10.1137/0212052

↗
10.1145/505202.505236

↗
10.17487/rfc2030

↗
10.17487/rfc1305

↗
10.1109/INFCOM.1999.749287

↗
10.1145/570681.570689

↗
10.1145/511399.511336

↗
10.1145/277858.277865

↗
10.17487/rfc0792

↗
Provos

A Virtual Honeypot Framework
Rager (2005)

XMIT_ID version 2.61
10.1145/584091.584093

↗
10.1145/1028788.1028817

↗
Veysset (2002)

New Tool and Technique for Remote Operating System Fingerprinting
10.1145/505202.505234

↗
10.1109/ICNP.2002.1181415

↗

CrossRef global citation count: 402 View in citation network → Build reading path →

Remote Physical Device Fingerprinting

Abstract

Citation Context

Cited by in this index (0)

References (37)

Related Articles