So many easy ways to fingerprint it.

Nmap is infinitely more powerful than the example given.

Google is your best friend.

Yeah, exactly why I need to know the distro, cause it's a firewall that can block the type of ddos i'm dealing with

so.. if you want it like this, what distro would you suggest me to use on a firewall? as i said... i'm dealing with some sort of ddos

If it's the firewall in particular you're trying to ID, then run 'p0f -R' in one terminal and scan it with nmap in another terminal. Unless it's configured to drop packets, trust the p0f findings.

Note: If nmap reports the port as open, then you're ID'ing a server behind the firewall. Only RST packets sent by the firewall itself will give you an accurate ID.

Then again, an RST packet is pretty hard to screw up, so RST's sent by nearly any major OS out there will probably ID the same (I've seen Linux machines ID as FreeBSD before on ID attempts I've run on my own machines)...and it's likely that if this firewall is doing well against ddos attacks, it's probably dropping the packets and not wasting time responding.

Good luck ID'ing it...you'd be better off begging and pleading with the admin of the firewall =) Oh, and I'll chime it in again: Google is your best friend.

It would appear that "some 20MB firewall distro" would have already been id'd by this response...

Ehh, if all you want to do is stop a ddos, then roll your own firewall with OpenBSD's pf. Sick stability and speed. Or you could always run pf on FreeBSD with bruteforceblocker installed... =)

@Rocket357: does FreeBSD's pf offer any support against DDoS? If so.. I'll try to install it... firstly if you have access to a OpenBSD box mabe we'll make some tests.. since I know how they're ddos'ing .

well... needing the distro makes sense.
sorry i jumped at you like that

it's okay, i'm dld'ing FreeBSD right now.. if someone has any other suggestions, or even better if someone wants to try to help me stop this type of DDoS, it would be great..

Ehh, only OpenBSD box I have available at the moment is a client's firewall I set up a while back, and that's (for obvious reasons) not a very "ethical" thing to do. I'm a bit short on machines at the moment since my sr. project is taking up my usually free "playground" machine (my school is an M$ house, so I'm working in VS and SQL Server...doh?)

I haven't messed with FreeBSD pf much...but I know bruteforceblocker (in ports) can modify pf rules on the fly to drop packets from ip's that have too many open requests and the like.

I had started writing a similar script a while back, but mine is far from finished, and I don't plan on finishing it since bruteforceblocker is available (I started writing it before I learned of bruteforceblocker). I think bruteforceblocker is intended for sshd attacks, but I'm sure it can be modified to work with whatever you're trying to use it for.

Let me know if this helps any.

Nmap is good but old method, there are new tools now.

Either you find these tools, some are private, forget about finding them.
Or
Use your brains:

Install qemu or vmware or whatever and create an image for all the distros that look like a 20meg firewall.
Probe them and make tables with as input network unit tests, as output the result of these probes.
Connect to them and make the same.

When you find the least minimum network probes that can determine the machine, run them on the target.

I don't see what's illegal in this. Systems are opened and if they allow you to connect (I said connect, not send bad data..) to them, why would it be illegal to do this... It's the game.

My god you are still on this ddos problem... Good luck..