Hi!

Is it possible to mangle the TOS used by Linux for ICMP Destination Unreachable?

I tried both these commands on a Redhat 9 (with 2.4.20) & Mandrake 10.1 (with 2.6.8):
# iptables -t mangle -I OUTPUT -p icmp -j TOS --set-tos 00
# iptables -t mangle -I POSTROUTING -p icmp -j TOS --set-tos 00

I even tried all chains in the mangle table and "-p all", but the 0xc0 TOS in Mandrake wasn't changed nor the 0x00 used by the Redhat box (which is strange because I thought that every Linux uses 0xc0 -- hey, on Redhat I tried --set-tos 0x10)

I'm just trying to make OS fingerprinting harder

Is it possible with netfilter?

Is there another way?

Thanks in advance...

You'll have to do more than mangle icmp to defeat NMAP's fingerprinting as it uses a variety of techniques to fingerprint the OS. If you are running a 2.4 kernel the simplest way to do it is to compile with http://ippersonality.sourceforge.net/. If you are running bind you'll also want to make sure you change the banner that announces your OS. The same goes for some FTP daemons.

Well, I've done that nmap homework. It's no scare, the real thing:
http://gemal.dk/browserspy/

Maybe I create a special forum to discussing Anti OS Fingerprinting techniques

The easiest way to defeat browserspy is not clicking on the links. Seriously that link has nothing to do with OS fingerprinting.

Perhaps, a lkm which restricts the uname syscall to certain processes. I will try this one.

Well, there's TCP/IP OS fingerprinting (whether passive or active) and generic OS fingerprinting...

(call it OS obscurity, whatever...)

I started this thread for help in mangling the TOS for ICMP errors & replies...

Is it possible?