Exam 312-50v11 topic 1 question 110 discussion

Passive OS fingerprinting involves sniffing network traffic at any given collection point and matching known patterns that pass to a table of pre-established OS identities. No traffic is sent with passive fingerprinting. Nmap does not use a passive style of fingerprinting. Instead it performs its Operating System Fingerprinting Scan (OSFS) via active methodologies.

The key here is the word 'passive.' NMAP is active and does the hard work for you. It's also noisy. TCPDUMP will capture the network traffic (ala WireShark) but it doesn't do any OS fingerprinting. It leaves that work up to you, analyzing the captured data.

Answer: B Tcpdump is a tool that can be used for passive OS fingerprinting. It is a packet sniffer that captures network traffic and allows analysts to examine the contents of individual packets. By observing specific characteristics of the packets, such as the Time To Live (TTL) value or specific flags, an analyst can infer information about the operating system of the device sending those packets. This process is passive because it doesn't require direct interaction with the target system, as the information is collected by simply monitoring the network traffic.

OS Discovery/Banner Grabbing Passive Banner Grabbing Sniffing the network traffic - Capturing and analyzing packets from the target. (P.337/321)

tcpdump is PASSIVE (Work like wireshark) nmap is ACTIVE (nmap -O) https://explainshell.com/explain?cmd=nmap+-O tracert (you cant do anything with it to determine the os)

Tcpdump is the correct answer. Nmap is incorrect as it's active not passive OS fingerprinting The two other responses are not OS fingerprinting tracers (traceroute) and ping commands can't OS fingerprinting

easy explanation - you can find fingerprints from file pcap or other. you do do not need to interact with victim right now....

The correct answer is TCPDUMP. Tcpdump's other interesting feature is passive operating system fingerprinting is built into pf and tcpdump (both ipv4 and ipv6 wise), you can now turn it on by using -o option in tcpdump. shell>tcpdump -o -nni em0

tcpdump is the correct answer

Tcpdump is the correct answer, judging from technical view. Nmap : will work with life system son ping too to know if the system is On, traceout to know different routes the system has passed while onli not offline

Correct answer is TCPDUMP. Packet capturing is passive while NMAP does use active methods for probing and scanning.

tcpdump is the correct answer.

The answer is incorrect, the correct answer is nmap. Tcpdump prints the contents of network packet, wherein, nmap is used for probing computer networks, including host discovery and service and operating system detection.

correct