System fingerprinting and protocol analysis¶

System fingerprinting is the process of inferring software, hardware, and configuration details by analysing technical artefacts emitted during communication. Rather than relying on explicit identifiers, which can easily be altered, fingerprinting relies on probabilistic assessment across multiple network and application layers.

In Industrial Control Systems (ICS/OT), legacy protocols often expose granular device details by design. For instance, Modbus devices supporting Function Code 43 (Read Device Identification) explicitly return vendor, product code, and firmware revision, reflecting legacy trust assumptions.

Fingerprinting outputs a ranked hypothesis (such as nginx 1.24 running behind a web framework, or a Siemens S7-1200 on an unpatched firmware version) accompanied by a confidence score. While simple application banners are easily spoofed, low-level artefacts, such as TLS handshake parameters or specific protocol exception responses, are significantly harder to alter.

Key fingerprinting indicators¶

Systems generate consistent, predictable outputs based on underlying stack defaults and library implementations. Supported protocols reveal core function; for example, S7comm signals a Siemens ecosystem, IEC 60870-5-104 indicates electric grid telemetry, and specific TLS extension configurations isolate web server stacks.

Stack artefacts such as the order and letter casing of HTTP headers (Server, ETag, X-Powered-By) or TLS handshake characteristics (captured via JA3S or JA4S hashes) reflect underlying frameworks and libraries rather than administrator configuration. Furthermore, default HTTP 500 stack traces reveal directory structures, while specific protocol responses, such as Modbus Exception 01 (Illegal Function), map precise device profiles.

Latency curves and response times under varied request types can also help distinguish specific firmware variants and hardware specifications. Finally, residual artefacts provide clear indicators, including default assets like favicon hashes indexed in Shodan, template files, HTML comments, or extreme sensitivity where legacy PLCs crash during routine port sweeps.

A single indicator can provide a low-confidence lead, whereas multiple aligned indicators can give high-confidence attribution. Discrepancies between indicators often point to multi-tiered architectures, such as proxies, web application firewalls (WAFs), or protocol converters like Modbus TCP-to-RTU gateways.

Passive vs. active fingerprinting¶

Reconnaissance strategies split into two primary methodologies: passive and active fingerprinting.

Passive fingerprinting analyses existing network traffic without transmitting packets to the target. This includes observing ongoing SCADA master polling, extracting JA3S hashes from inline captures, analysing public certificate logs, or querying internet-wide scanning databases like Shodan and Censys. Passive analysis leaves nothing on the target and carries no risk of crashing a fragile system.

In contrast, active fingerprinting generates dedicated traffic to elicit specific system responses by running tools like nmap -sV, transmitting malformed HTTP requests, issuing PROFINET DCP Identify requests, or opening direct S7comm sessions to query module lists.

In IT environments, active fingerprinting primarily introduces detection risk. In OT/ICS environments, active probing poses significant operational risk, as legacy controllers with fragile network stacks may crash or trip industrial processes when subjected to unexpected packet structures or scan rates. Consequently, passive reconnaissance earns its place ahead of active engagement.

Deception and antifingerprinting techniques¶

Fingerprinting indicators can be manipulated or spoofed by defenders. Security teams often alter Server banners or modify HTTP header ordering to misdirect automated scanners. Defenders may also deploy deception systems such as Conpot to intentionally advertise plausible Modbus or S7comm capabilities, trapping attackers and collecting threat intelligence.

To counter deceptive artefacts, effective fingerprinting relies on multi-layered analysis rather than single-source data. Discrepancies, such as a modern web banner paired with a legacy TLS fingerprint, indicate the presence of proxies or honeypots. Low-level, stack-inherent behaviours that are difficult to forge carry more weight than easily edited, high-level application outputs.