Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

hping or lightweight freeware to test Tcp_timestamps

Posted on 2014-11-14
8
Medium Priority
?
235 Views
Last Modified: 2014-12-28
I don't want wireshark or heavyweight tools but could not find hping for Windows (XP & Win 7)
anymore.

Q1:
Where can I get hping for Win XP & 7 ?

Q2:
I have an old nmap for windows but can nmap test if Tcp_timestamp has been disabled?
Any other lightweight freeware for Windows to test this?
0
Comment
Question by:sunhux
  • 4
  • 4
8 Comments
 
LVL 65

Assisted Solution

by:btan
btan earned 2000 total points
ID: 40443972
1. looks like it si not readily available and not update since 2005 from the forum. there are a few couple with src and tar based but not the windows though. I believe Backtrack has that too e.g. hping3. Or even nessus plugin tcp_timestamps.nasl

2. Better to see if nping will help  http://nmap.org/nping/ (or if open to linux, tcptest https://code.google.com/p/tcptest/). Specifically nmap has shared in the uptime (http://www.exploresecurity.com/testing-for-tcp-ip-timestamps/) aspect
The uptime guess is labeled a “guess” because various factors can make it completely inaccurate. Some operating systems do not start the timestamp counter at zero, but initialize it with a random value, making extrapolation to zero meaningless. Even on systems using a simple counter starting at zero, the counter eventually overflows and wraps around. With a 1,000 Hz counter increment rate, the counter resets to zero roughly every 50 days. So a host that has been up for 102 days will appear to have been up only two days. Even with these caveats, the uptime guess is accurate much of the time for most operating systems, so it is printed when available, but only in verbose mode. The uptime guess is omitted if the target gives zeros or no timestamp options in its SYN/ACK packets, or if it does not reply at all. The line is also omitted if Nmap cannot discern the timestamp increment rate or it seems suspicious (like a 30-year uptime).
Not all operating systems send TCP timestamps unless incoming TCP SYN packets will have this option enabled. http://ithitman.blogspot.sg/2013/02/enabling-tcp-timestamp-linux-and-windows.html
0
 

Author Comment

by:sunhux
ID: 40445612
Hping.org is not around anymore.  Got nping but did not quite figure how it can be used to scan for tcp timestamp.  Havent manage to locate a windows copy of hping3
0
 
LVL 65

Assisted Solution

by:btan
btan earned 2000 total points
ID: 40445644
indeed, probably looking at baacktrack CD will help to retrieve but i doubt you find the windows exe. it seems the most "accurate" tool so far is hping. better to go into running in it linux form else the packet capture analysis based on wireshark is another (though not straightforward) means
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 

Author Comment

by:sunhux
ID: 40452871
Will nmap be able to do this (ie detect if Tcp timestamping is enabled or off) ?
0
 

Author Comment

by:sunhux
ID: 40452898
The closest I get with nmap:

D:\nmap-4.62>nmap |find/i "timestamp"
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes


D:\nmap-4.62>nmap -PP localhost

Starting Nmap 4.62 ( http://nmap.org ) at 2014-11-20 01:12
Skipping SYN Stealth Scan against localhost (127.0.0.1) because Windows does not
 support scanning your own machine (localhost) this way.
0 ports scanned on localhost (127.0.0.1)

Nmap done: 1 IP address (1 host up) scanned in 0.328 seconds
0
 
LVL 65

Accepted Solution

by:
btan earned 2000 total points
ID: 40453946
Check this out as it tested for uptime using nmap, snmpwalk and rsysinfo (and also hping3)
https://maciejkola.wordpress.com/security-tips-2/why-uptime-can-be-dangerous/
NMAP
root@tester# nmap -v -O victim.com
Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-25 20:29 CEST
Initiating Ping Scan at 20:29
(…) Uptime guess: 15.414 days (since Mon Sep 10 10:23:32 2012)

Open in new window

SNMP:

root@tester# snmpwalk -v 1 -c public victim.com .1.3.6.1.2.1.25.1.1.0
iso.3.6.1.2.1.25.1.1.0 = Timeticks: (156851524) 18 days, 3:41:55.24

Open in new window

RPC:

root@tester# rsysinfo victim.com
System Information for: victim.com

uptime:   18 days,  6:27, load average: 0.04 0.03 0.00

Open in new window

0
 

Author Comment

by:sunhux
ID: 40496578
The syntax I have for my Windows version of snmpwalk & nmap don't have those options
0
 
LVL 65

Assisted Solution

by:btan
btan earned 2000 total points
ID: 40497404
it is better then to get the non windows instead since hping is already not avail as well. I saw another tool called nemesis that is a network packet crafting and injection utility for UNIX-like and Windows systems. I did not explore further though
http://nemesis.sourceforge.net/
http://nemesis.sourceforge.net/manpages/nemesis-icmp.1.html
http://nemesis.sourceforge.net/manpages/nemesis-tcp.1.html
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Today as you open your Outlook, you witness an error message: “Outlook is using an old copy of your Outlook Data File…”. Probably, Outlook is accessing an old OST file.
Each password manager has its own problems in dealing with certain websites and their login methods. In Part 1, I review the Top 5 Password Managers that I've found to be the best. In Part 2 we'll look at which ones co-exist together and why it'…
XMind Plus helps organize all details/aspects of any project from large to small in an orderly and concise manner. If you are working on a complex project, use this micro tutorial to show you how to make a basic flow chart. The software is free when…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
Suggested Courses

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question