Os Fingerprinting - McAfee M-1250 - Network Security Platform Configuration Manual

McAfee® Network Security Platform 5.1
9
10
11

OS Fingerprinting

Network Security Platform provides the capability to perform Operating System (OS)
fingerprinting. OS fingerprinting is the process of determining the operating system used
by hosts connected to your network. Many vulnerabilities are OS dependant, and
ascertaining the OS on a host helps Network Security Platform identify the severity of an
attack on the target host and take appropriate actions.
Network Security Platform supports OS fingerprinting using two methods namely,
•
•
Figure 185: Enabling OS Finger Printing
When the Sensor detects attacks to and from these hosts, the alerts displayed in the
Threat Analyzer includes the OS information of the source and destination hosts. If health-
based NAC as well as passive OS fingerprinting are enabled, Network Security Platform
displays the OS information as sent by the McAfee NAC server.
The OS information displayed in the Threat Analyzer can be an exact match or the closest
match of the OS version installed on the host.
Log up to Packets per Flow
n
within a flow. The logged packets begin with the attack packet(s). Default is 1000
packets.
Log Whole Flow
Note: Even if you select
logging if it fails.
Yes Enable Packet Log Channel Encryption
Select at "Enabled" to
Update
Click . The alerts for exceeding this threshold are called Throttle alerts. You will
Alert Details
see this name in the
information , see Viewing Alerts details,
Download these changes to your Sensor by performing the steps in Updating the
configuration of a Sensor.
Fingerprinting with McAfee NAC: When a host plugs into the network, the Network
Security Sensor works with McAfee NAC to ascertain the operating system on the
machine. This is available only if System Health-based NAC is enabled on the
Sensor.
Passive OS fingerprinting: Network Security Platform performs passive OS
fingerprinting on the TCP connections. The information exchanged during the TCP
connection establishment phase (in the SYN and SYN+ACK packets) is used to
identify the host operating system.
Passive OS fingerprinting is disabled by default. You can enable this option under
IPS Settings > sensor_name > Advanced Scanning > Alerting and Logging
: type the number of packets (from 1000 to 64000) to log
, the Sensor may not be able to continue
"Type" field of the Threat Analyzer (For more
System Status Monitoring Guide
178
The IPS Sensor_Name node
.
).
>
.