Which option enables remote OS detection using TCP/IP stack fingerprinting?

Which option enables remote OS detection using TCP/IP stack fingerprinting?

• A. -O
• B. -A
• C. -D
• D. -F

Answer: (A)

OS detection via TCP/IP stack fingerprinting is activated by using the dedicated switch that turns on Nmap’s OS fingerprinting feature. This option makes Nmap probe the target and study how its TCP/IP stack responds, then compares those responses to a database of known fingerprints to estimate the operating system. The fingerprinting approach relies on characteristics like TTL values, IP ID behavior, TCP window size, and option flags, which tend to vary between different OS implementations. The other options either broaden the scan or perform different tasks. For example, one choice triggers an aggressive scan that includes OS detection plus version detection, script scanning, and traceroute. Another option focuses on decoying or on scanning a smaller set of ports quickly, neither of which specifically enables the TCP/IP fingerprinting-based OS detection by itself.

OS detection via TCP/IP stack fingerprinting is activated by using the dedicated switch that turns on Nmap’s OS fingerprinting feature. This option makes Nmap probe the target and study how its TCP/IP stack responds, then compares those responses to a database of known fingerprints to estimate the operating system. The fingerprinting approach relies on characteristics like TTL values, IP ID behavior, TCP window size, and option flags, which tend to vary between different OS implementations.

The other options either broaden the scan or perform different tasks. For example, one choice triggers an aggressive scan that includes OS detection plus version detection, script scanning, and traceroute. Another option focuses on decoying or on scanning a smaller set of ports quickly, neither of which specifically enables the TCP/IP fingerprinting-based OS detection by itself.