CAPEC-323
TCP (ISN) Counter Rate Probe
This OS detection probe measures the average rate of initial sequence number increments during a period of time. Sequence numbers are incremented using a time-based algorithm and are susceptible to a timing analysis that can determine the number of increments per unit time. The result of this analysis is then compared against a database of operating systems and versions to determine likely operation system matches.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-323: TCP (ISN) Counter Rate Probe: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/323.html and https://cve.bz/cve/capec/323?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The ability to monitor and interact with network communications.Access to at least one host, and the privileges to interface with the network interface card.
Resources required
Any type of active probing that involves non-standard packet headers requires the use of raw sockets, which is not available on particular operating systems (Microsoft Windows XP SP 2, for example). Raw socket manipulation on Unix/Linux requires root privileges.
A tool capable of sending and receiving packets from a remote system.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Read Data | Confidentiality | |
| Bypass Protection Mechanism, Hide Activities | Confidentiality, Access Control, Authorization |
Weaknesses it exploits
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Recent CVEs with these weaknesses
- 4.3CVE-2026-124944
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160.
- 4.3CVE-2026-124941
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- 4.3CVE-2026-124930
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- 4.3CVE-2026-124929
Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- 4.3CVE-2026-124925
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160.
- 4.3CVE-2026-124909
Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- 5.3CVE-2026-96769
The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unaut…
- 7.5CVE-2026-63644
bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. Th…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-312 Active OS Fingerprinting
MITRE's words, unchanged: CAPEC-323 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.