yaf dhcp fingerprinting
There are several ways to perform Operating System Identification. Many tools, based on the well-known p0f tool, look at characteristics in the TCP/IP packet headers. DHCP fingerprinting is a relatively new way of performing OS identification. By looking at the order of the DHCP options in the DHCP requests from the Operating System's DHCP client, it may be possible to identify the client's OS version. The yaf DHCP fingerprinting plugin does exactly that. For flows that yaf has labeled as DHCP, yaf will look at the DHCP options if available in the payload captured for that flow. yaf specifically looks at Option 55. Option 55 requests a list of parameters. The order in which they are requested can usually identify the OS of the requesting IP address.
yaf also exports the DHCP Vendor Class Identifier, if available. The Vendor Class ID is included in DHCP Option 60 and often provides specific information about the hardware of the sender. The Vendor ID can often assist in identifying an OS. yaf does not match an OS based on the vendor ID, it simply exports the information if it is available.
Fingerbank (www.fingerbank.org) is the official website for DHCP fingerprints. yaf includes and uses the dhcp_fingerprints.conf file found on this website. yaf will be able to parse any INI config file that follows the format of the dhcp_fingerprints.conf file.
This feature is presently experimental and the DHCP data is not collected by the SiLK tools. Use an IPFIX mediator, such as the one listed on the CERT NetSA Tools Wiki, to collect and view the DHCP fields exported by yaf. yaf must be configured for application labeling and plugin support to use this plugin.
yaf's output consists of an IPFIX message stream. yaf uses a variety of templates for IPFIX data records. yaf uses a subTemplateMultiList to export optional information elements, such as Deep Packet Inspection and p0f fields, related to the flow. Below is the format of the DHCP fingerprinting record that will be exported if yaf found a match from the DHCP options, or a vendor class ID was present in the packet.
The DHCP fingerprint as matched from the dhcp_fingerprint.conf file. This will be the description of the OS as found in the conf file.
The DHCP vendor class ID found in Option 60 of the DHCP packet. This field may help further identify the operating system of the sender.
The DHCP fingerprint for the reverse flow. This will only be exported if the reversePacketTotalCount field is greater than 0.
The DHCP vendor class ID for the reverse flow. This will only be exported if the reversePacketTotalCount field is greater than 0.
Running YAF with DHCP fingerprinting:
yaf --in eth0 --out /data/yaf/yaf --rotate 120 --plugin-name=/usr/local/lib/yaf/dhcp_fp_plugin.la --applabel --max-payload=500 --live pcap
Running YAF with DPI and DHCP fingerprinting:
yaf --in eth0 --out localhost --ipfix tcp --ipfix-port=18000 --plugin-name=/usr/local/lib/yaf/dpacketplugin.la,/usr/local/lib/yaf/dhcp_fp_plugin.la --applabel --max-payload=1024 --live pcap
CERT Network Situational Awareness Group Engineering Team, http://www.cert.org/netsa