module question

module question

[Shipman, Jeffrey E]

I have been assigned to a project where we are trying to fool
OS footprinters into thinking the machine is running another
OS. I was thinking I could write a module which registers
a packet handler to modify the TCP/IP headers as necessary.
I haven't really looked into this all much.

I would like to be able to have some sort of user-space
GUI that the root user could run to allow for dynamic
configuration of the module. My question is: what would be
the best way to go about this? Should I keep the current
config of the module inside /proc so that way both the
GUI has access to it and the module has instantaneous
access to it without having to be reloaded?

I would like to avoid patching the kernel and just keeping
it to a module. However, any tips or advice that anyone
can provide would be most helpful.

BTW, if you could CC any answers to me, I'd appreciate
it as I'm not subscribed to the list.

Thanks in advance for your wisdom,

Jeff Shipman - CCD
Sandia National Laboratories
(505) 844-1158 / MS-1372

Re: module question

[Andi Kleen]

"Shipman, Jeffrey E" <jeshipm@sandia.gov> writes:

> I have been assigned to a project where we are trying to fool
> OS footprinters into thinking the machine is running another
> OS. I was thinking I could write a module which registers
> a packet handler to modify the TCP/IP headers as necessary.
> I haven't really looked into this all much.

It's probably impossible to fool advanced tools like http://www.icir.org/tbit/
unless you change some fundamental algorithms in linux TCP  (like the 
retransmit state machine) or replace it with another TCP. 

-Andi

Re: module question

[Rainer Ellinger]

Shipman, Jeffrey E wrote:
> I have been assigned to a project where we are trying to fool
> OS footprinters into thinking the machine is running another
> OS. I was thinking I could write a module which registers

Some links that might be interesting for you:

http://ippersonality.sourceforge.net/
http://www.stearns.org/p0f/

-- 
rainer@ellinger.de