Netsec is Dead(?): Modern Network Fingerprinting for...
summary
Passive network fingerprinting roadmap from p0f to J4 and MonFP, showing real detections, tools, and limits: J3 MD5 hash instability (Chrome’s TLS extension shuffle breaks reproducibility), J4 human-readable header plus two truncated SHA256s that let teams cluster C2 and scanners, and MonFP four-value tuple (win, options, MSS, scale) that fingerprints Windows/Ubuntu/iPhone, reveals proxies and VPN overhead, and distinguishes zmap/masscan/shodan scans. Practical deployments include Archime/Zeek plugins, eBPF/XDP blocking or allowlisting, and enrichment-to-block workflows that proved effective at stopping fast scanners.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker background
- 3:34What is network fingerprinting
- 8:10TLS handshake fingerprinting basics
- 16:44TCP/IP fingerprinting overview
- 28:57Network reconnaissance kill chain
- 33:11Blocking malicious traffic with fingerprints
- 36:00Practical uses of fingerprints in security
- 39:12Q&A and closing remarks
related talks
48mNothing but Net: Leveraging macOS's Networking Frameworks to Heuristically Detect Malware
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
26mInternet Scanning - Current State and Lessons Learned
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
32mActive Fault Finding in Networks
41mInternet Spelunking: IPv6 Scanning and Device Fingerprinting
43mPassive Fingerprinting of HTTP/2 Clients.
43ma journey...