# OS Fingerprinting with Ruby

**URL:** <https://www.ruby-forum.com/t/os-fingerprinting-with-ruby/175629>\
**Category:** Ruby\
**Created:** [September 16, 2009, 9:00pm UTC](https://www.ruby-forum.com/t/os-fingerprinting-with-ruby/175629 "2009-09-16T21:00:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![joemanfoo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/4bbf92/32.png) [@joemanfoo](https://www.ruby-forum.com/u/joemanfoo)\
**Post date:** [September 16, 2009, 9:00pm UTC](https://www.ruby-forum.com/t/os-fingerprinting-with-ruby/175629/1 "2009-09-16T21:00:13Z")

</div>

I’m working my way into learning some basic socket programming. I would  
like to incorporate some sort of nmap-like functionality, namely, OS  
fingerprinting. Is this possible to do without relying on the actual  
nmap program? Is there a way to read TCP/IP stack fingerprints and  
determine OS information in Ruby?

Thanks!

---

<div class="post-metadata">

**Author:** ![joemanfoo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/4bbf92/32.png) [@joemanfoo](https://www.ruby-forum.com/u/joemanfoo)\
**Post date:** [September 16, 2009, 10:25pm UTC](https://www.ruby-forum.com/t/os-fingerprinting-with-ruby/175629/2 "2009-09-16T22:25:51Z")

</div>

On Wed, Sep 16, 2009 at 12:00 PM, Joe M.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I’m working my way into learning some basic socket programming. I would  
> like to incorporate some sort of nmap-like functionality, namely, OS  
> fingerprinting. Is this possible to do without relying on the actual  
> nmap program? Is there a way to read TCP/IP stack fingerprints and  
> determine OS information in Ruby?

I’m not sure I would categorize OS fingerprinting as “basic socket  
programming”. For that you need raw socket access (PF\_PACKET under  
Linux or BPF under OSX/\*BSD). And to make it work you need to create  
a database of tests and how different OS’s respond. It’s a _lot_ of  
work.

Anyways, yes it could be done in Ruby… although I don’t recall off  
the top of my head if Ruby supports PF\_PACKET/BPF, but you could  
always use the Ruby/C bindings for libpcap for raw frame injection &  
reading responses.

---

<div class="post-metadata">

**Author:** ![joemanfoo](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/4bbf92/32.png) [@joemanfoo](https://www.ruby-forum.com/u/joemanfoo)\
**Post date:** [September 17, 2009, 1:00am UTC](https://www.ruby-forum.com/t/os-fingerprinting-with-ruby/175629/3 "2009-09-17T01:00:58Z")

</div>

Aaron T. wrote:

> Linux or BPF under OSX/\*BSD). And to make it work you need to create  
> a database of tests and how different OS’s respond. It’s a _lot_ of  
> work.
> 
> Anyways, yes it could be done in Ruby… although I don’t recall off  
> the top of my head if Ruby supports PF\_PACKET/BPF, but you could  
> always use the Ruby/C bindings for libpcap for raw frame injection &  
> reading responses.

I don’t know about PF\_PACKET in ruby either, but you can use raw sockets  
in ruby with PF\_INET to get to the level of IP headers, at least.

There’s an example of this in the examples/raw.rb in the bit-struct gem.  
Maybe it can be adapted for PF\_PACKET?