RE: PIX and ttl

[Jacek Lipkowski <sq5bpf () acid ch pw edu pl>]

On Thu, 24 May 2001, Jason Lewis wrote:

> I am not sure how you identify the PIX. How do you fingerprint servers when

(this is just an example)
check for any open smtp ports, if they are behind a pix (any you have
'conduit smtp 25' or something like this in the config file, which most
people do), it will say:
220 SMAP (and some other crap)

> you don't know what the servers are or if they are behind a PIX?

usually you don't have to (if by fingerprinting you mean nmap -O), they
usually give out way too much information anyway. check the http server
banner for starters, see if there is any ssh installed, try to get some
mail relayed through their mailserver, like a mail delivery notofication,
preferably to postmaster or webmaster asking some stupid question. by now
you usually know if it is unix or nt. dig deeper... 

jacek