What Is TCP/IP Fingerprinting and How Does It Work?

All devices connected to the internet leave digital traces that go beyond just their IP addresses. When connecting and responding to network requests, devices can reveal their operating system and a number of other features.

This is the basic principle of TCP/IP fingerprinting. Based on analysis of data from the TCP/IP packet and behavior of the machine, network administrators and security software can build a fingerprint that might suggest the source of the traffic, the operating system, or TCP/IP stack used to produce it.

TCP/IP fingerprinting is used for traffic monitoring and security purposes. Knowing the basics of TCP/IP fingerprinting is handy when you use proxies and VPNs in your everyday activities, as going through an intermediary machine changes some of the fingerprint features.

In this tutorial, we will describe how TCP/IP fingerprinting works, what kind of data it provides, the difference between active and passive TCP/IP fingerprinting, as well as the influence of proxies and virtual private networks on the fingerprint.

What is TCP/IP fingerprinting?

TCP/IP fingerprinting is a method for identifying and profiling a device based on the characteristics of the traffic it generates, specifically by looking at how this device communicates using the TCP/IP protocol suite.

When a device establishes a TCP connection, it sends packets containing technical information. Packet organization and the type of information sent may differ, depending on the device.

These characteristics form a recognizable pattern, known as a TCP/IP fingerprint, produced by what's called TCP/IP stack fingerprinting.

For example, a device may always use a particular window size, TTL value, or a specific combination of TCP options when establishing a connection. A device fingerprint is formed when several of these indicators are taken into account together.

TCP/IP fingerprinting is closely related to OS fingerprinting; however, these two terms aren’t the same thing. OS fingerprinting is about determining which OS is being used, while TCP/IP fingerprinting encompasses a broader range of characteristics.

Is a TCP/IP fingerprint unique?

Generally, a TCP/IP fingerprint shouldn’t be treated as a unique identifier, and it doesn’t necessarily show who’s behind the connection. Different devices running the same OS can leave similar fingerprints, while the same devices can display different characteristics depending on their network configuration or connection path.

Instead, multiple signals should be looked at as a combination of indicators, including TTL, TCP options, window size, and IP or network information. This way, you can distinguish between different traffic sources with better accuracy.

Active vs passive fingerprinting

The main difference between active and passive fingerprinting lies in whether the fingerprinting system actively interacts with the target or simply monitors the existing traffic.

Active fingerprinting

Active fingerprinting involves sending specific requests to a device and analyzing how it responds. It can also include testing how the device handles different TCP conditions, including unusual or unexpected packets.

Since it directly interacts with the target, active fingerprinting can be performed even when a device isn’t generating much traffic. It’s commonly used for network discovery, device inventory, and security testing. Keep in mind that you should only perform active fingerprinting against systems you own or are authorized to test.

Passive fingerprinting

On the contrary, passive fingerprinting doesn't send additional probes to the target. Instead, it analyzes network traffic that is already being generated, looking for patterns in packets and connection behavior. As a result, it’s less intrusive and more suitable for continuous network monitoring.

How does TCP/IP fingerprinting work?

TCP/IP fingerprinting works by collecting characteristics from packets exchanged between a device and a server, and then comparing them with known fingerprint patterns. Here are several parts of TCP/IP communications that can provide useful information.

TCP connection and packet analysis

The TCP/IP stack is responsible for handling network communication on a device. Since different operating systems may implement them differently, it might affect how packets are organized and how connections are handled.

Fingerprinting can begin with the TCP connection itself. During the three-way handshake, a device and server exchange SYN, SYN-ACK, and ACK packets to establish a connection. These packets contain several characteristics that can be examined, including TTL, window size, maximum segment size (MSS), and TCP options. Window scaling can also be considered as part of TCP behavior when analyzing connection characteristics.

Other indicators can also contribute to a fingerprint. These include SACK (Selective Acknowledgment) support, TCP timestamps, the TCP options order, as well as certain IP header behaviors. The TCP header also contains fields that can provide useful information about how a connection is established and handled. Tools like Nmap use combinations of these characteristics when probing a target, while passive fingerprinting tools can analyze the same types of information by observing the traffic.

Signature matching

Once all characteristics are collected, fingerprinting systems can now compare them with known patterns associated with operating systems and TCP/IP stacks. A match can be based on a combination of similar values.

The result is usually an estimate rather than a definitive identification. Fingerprinting tools might estimate the confidence level or return several possible matches when the results are ambiguous. This helps account for variations produced by different network configurations, routing, firewalls, and other intermediary devices.

TCP/IP vs browser and TLS fingerprinting

TCP/IP fingerprinting is only one of the layers that can be used to analyze the network connection. Other layers, such as browser and TLS fingerprinting, examine different characteristics, while IP intelligence provides details about the network associated with the connection.

The layers also operate at different stages of connection. TCP/IP characteristics can be observed from network traffic, while TLS fingerprinting looks at the TLS handshake, and browser fingerprinting can collect additional information after a webpage loads. Therefore, browser fingerprinting can reveal details that TCP/IP fingerprinting can’t, and the other way around.

How proxies and VPNs affect TCP/IP fingerprints

Proxies and VPNs can affect which TCP/IP characteristics are visible to the destination server.

Proxies and VPNs

Both can look similar from the destination server’s perspective because both can display an intermediary's IP address rather than the original device’s. The main difference is how they operate: a VPN usually creates an encrypted tunnel for traffic from the device to the VPN server, while a proxy usually handles traffic for a particular application or protocol.

The distinction is greater than first seems evident. In the case of a proxy closing down the TCP connection, the proxy server itself opens up a new connection with the destination, and therefore the destination sees the TCP/IP stack of the proxy server rather than that of the actual device.

In contrast, a VPN takes in the entire packet and forwards it on behalf of the original device; hence, the destination typically sees the TCP properties of the original device even under an alternate IP address.

NAT, firewalls, and other middleboxes

The TCP/IP fingerprint can also be affected by network devices between the source and destination. NAT devices can rewrite source IP addresses and ports, while firewalls and other middleboxes may filter, alter, or entirely block some packets or connection features.

Routing can also influence what a fingerprinting system observes. For instance, the TTL of a packet shrinks as it passes through routers, which means that the original value and the value that reaches the destination might differ. Overall, changes in the network path can therefore make fingerprinting less precise.

Can you hide or change a TCP/IP fingerprint?

A TCP/IP fingerprint can sometimes be changed, but it’s way more difficult to completely control or hide it. Various privacy tools operate at different levels, so changing browser settings doesn’t necessarily change the underlying TCP/IP behavior.

What privacy tools can change

Browser privacy features, like incognito mode, cookie deletion, or browser fingerprint protection, can’t hide the TCP/IP characteristics, because they don’t have any influence over how the OS constructs TCP packets.

Proxies and VPNs can change what the destination observes by moving the connection endpoint to another server. Depending on the connection architecture, the destination server may see the characteristics associated with the intermediary rather than the original device.

But keep in mind that it doesn’t necessarily hide every signal. For example, other characteristics, including user agent and TLS characteristics, may still be visible to the destination server.

Manual modification and consistency

Some TCP/IP characteristics can be modified through network or operating-system configuration. At the same time, modifying individual values doesn’t automatically create a new plausible fingerprint. If other characteristics remain unchanged, it will create even more inconsistencies that can make the traffic stand out.

Manual changes can also affect network performance or compatibility. For example, altering your TCP parameters without considering the rest of the connection can result in unusual device behavior rather than a fingerprint coming from a normal device.

That’s why consistency across many layers is important. TCP/IP characteristics, TLS behavior, browser information, and IP or ASN data should form a coherent picture.

How to check a TCP/IP fingerprint

There are several ways to check a TCP/IP fingerprint.

Testing tools

p0f and Nmap are widely used testing tools to analyze fingerprints. p0f is an efficient tool for passive fingerprinting; thus, active probing is not necessary when using it. On the other hand, Nmap allows performing active OS detection through probing and analyzing the response.

Another solution would be to use online fingerprint checkers to analyze your connection patterns. However, your results may differ depending on the path in the network, intermediate devices, and the active or passive nature of fingerprinting techniques used by tools.

Interpreting the results

Depending on the tools, you may see such information as estimated operating system, TTL, MSS, TCP options, user agent, TLS fingerprint, IP address, and ASN.

Comparing different values located at different layers can help spot inconsistencies. For example, the TCP/IP fingerprint may suggest one operating system, while the user agent points to another.

Because routing and network devices can affect the observed values, a result from one connection won’t be reliable enough to draw any conclusions.

Conclusion

TCP/IP fingerprinting analyzes patterns in packet and connection behavior to estimate characteristics, such as an operating system or TCP/IP stack. Because fingerprints are probabilistic and proxies or VPNs can change the observation point, comparing direct and proxied connections can help show which characteristics remain visible.