Custom fingerprinting

The system includes operating system fingerprints that the system uses to identify the operating system on each host it detects. However, sometimes the system cannot identify a host operating system or misidentifies it because no fingerprints exist that match the operating system. To correct this problem, you can create a custom fingerprint. This fingerprint provides a pattern of operating system characteristics unique to the unknown or misidentified operating system and supplies the name of the operating system for identification purposes

Operating system identification and vulnerability mapping

If the system cannot match the operating system of a host, it cannot identify the vulnerabilities for the host, because the system derives the list of vulnerabilities for each host from its operating system fingerprint. For example, if the system detects a host running Microsoft Windows, it adds a stored Microsoft Windows vulnerability list to the host’s profile based on the detected operating system.

As an example, if you have several devices on your network running a new beta version of Microsoft Windows, the system cannot identify that operating system or map vulnerabilities to the hosts. However, knowing that the system has a list of vulnerabilities for Microsoft Windows, you may want to create a custom fingerprint for one of the hosts to help identify the other hosts running the same operating system. You can include a mapping of the vulnerability list for Microsoft Windows in the fingerprint to associate it with each host that matches the fingerprint.

When you create a custom fingerprint, the Cloud-Delivered Firewall Management Center lists the set of vulnerabilities associated with that fingerprint for any hosts running the same operating system. If the custom fingerprint does not contain any vulnerability mappings, the system uses the fingerprint to assign the custom operating system information you provide. When the system sees new traffic from a previously detected host, it updates the host with the new fingerprint information. The system also uses the new fingerprint to identify any new hosts with that operating system the first time they are detected.

Before you create a custom fingerprint, determine why the host is not being identified correctly to decide whether custom fingerprinting is a viable solution.

You can create two types of fingerprints with the system:

Client fingerprints, which identify operating systems based on the SYN packet that the host sends when it connects to a TCP application running on another host on the network.
Server fingerprints, which identify operating systems based on the SYN-ACK packet that the host uses to respond to an incoming connection to a running TCP application.

Note	If both a client and server fingerprint match the same host, the client fingerprint is used.

After creating fingerprints, you must activate them before the system can associate them with hosts.