Passive OS Fingerprinting: Analyzing TTL Values from Captured Packets
Which of the following is an example of passive OS fingerprinting?
Quick Answer
The answer is analyzing TTL values from captured packets, as this is a textbook example of passive OS fingerprinting. This technique works because different operating systems set distinct default initial Time to Live values—Windows typically uses 128, Linux uses 64, and Cisco IOS uses 255—so by examining the TTL in a passively captured packet, you can infer the source OS without ever sending a probe to the target. On the Certified Ethical Hacker CEH exam, this concept tests your understanding of reconnaissance methods that avoid active detection; a common trap is confusing passive fingerprinting with active techniques like Nmap scans that send crafted packets. Remember that passive fingerprinting relies solely on sniffing existing traffic, making it stealthy. For a quick memory tip: think “TTL tells the OS tale”—if you see a TTL near 64, think Linux; near 128, think Windows; near 255, think Cisco.
⚠ Common exam trap
EC-Council often tests the distinction between active and passive techniques, and the trap here is that candidates confuse 'analyzing captured data' (passive) with 'sending probes and analyzing responses' (active), leading them to pick options like Nmap -O scan or TCP SYN scan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Analyzing TTL values from captured packets
Passive OS fingerprinting involves analyzing captured network traffic without sending any packets to the target. Examining TTL (Time to Live) values from captured packets is a classic passive technique because different operating systems use default initial TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), and by observing the TTL in a received packet, you can infer the OS without actively probing the host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Performing a TCP SYN scan
Why it's wrong here
SYN scan is active.
- ✗
Nmap -O scan
Why it's wrong here
-O sends probes, making it active.
- ✗
Sending ICMP echo requests
Why it's wrong here
ICMP echo requests are active probes.
- ✓
Analyzing TTL values from captured packets
Why this is correct
TTL can indicate OS type passively.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are examples of passive OS fingerprinting techniques? (Select 2)
medium- A.Performing a SYN scan on the target
- ✓ B.Analyzing the initial TTL value of received IP packets
- C.Sending a series of TCP packets with different flags and analyzing responses
- ✓ D.Inspecting the TCP window size in SYN packets
- E.Using the telnet command to connect to port 80
Why B: Passive OS fingerprinting involves observing network traffic without sending any packets to the target. Analyzing the initial TTL value of received IP packets (Option B) is a classic passive technique: different operating systems set specific default TTL values (e.g., Windows uses 128, Linux uses 64, Cisco IOS uses 255), allowing an attacker to infer the OS without direct interaction. Similarly, inspecting the TCP window size in SYN packets (Option D) is also a passive technique. Different operating systems advertise different default TCP window sizes when establishing connections, which can be observed by sniffing existing traffic without sending any new packets to the target. Options A, C, and E involve sending packets to the target, making them active fingerprinting techniques.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.