Layer 7 Device/OS Fingerprinting Device Specific Behavior

Version 8

    Layer 7 Device/OS Fingerprinting, released with vWLAN version 2.6, is a feature used to provide statistics and vWLAN role placement based on Device OS and corporate ownership. This feature relies on examining the data included in option #55 presented by a specific device in it's DHCP Discover sent to the BSAPs when a device attempts to connect to a network with a captive portal configured. In some cases, certain devices present vague or misleading information, and in rarer cases, no information at all. This document serves to provide specifics on devices that fit this criteria as to alert customer's of the expectation of that specific device's behavior in conjunction with Layer 7 Device/OS Fingerprinting. For more information on this feature, please see Configuring Layer 7 Device Fingerprinting in vWLAN.

     

    Windows Devices

    Android Devices

    Apple Devices

    Other Devices and Devices that report no information

    Unknown Manufacturer Information

    Dashboard Statistics

    Useful Links


    Windows Devices


    While Windows XP and Windows 8 and 8.1 will report specific version and build information, it was observed that other versions of Windows will generally report "Windows Vista/7 or Server 2008 (6.0)".


    Windows Server 2003, now End of Life and unsupported, was not tested.


    Android Devices


    Android Devices cover an extremely wide array of manufactures and therefore have extremely inconsistent results. In some cases, Android devices report their specific device hardware as well as the build and version information in DHCP option #55. However, in many cases the defacto standard has been to report "Generic Android" in DHCP #55 resulting in those devices being categorized as the same. This is the reasoning behind using "Android" as a specific device type.


    The following devices are known to report "Generic Android" as their device type and OS:


    • Barnes and Noble Nook Devices
    • Motorola Xoom
    • Samsung Galaxy Tab 3
    • Samsung Galaxy S3 and S4
    • Sony Xperia
    • HTC One X
    • Kindle Fire Tablet


    Apple Devices

     

    While MAC OS devices generally give more information regarding build and version number, as well as the OS title, IOS devices almost unanimously report generic information in the form of "Generic Ipad/Ipod/Iphone". Due to this, at this time it is not possible to tell the difference between different types of IOS handheld devices.


    2.6.0-24 Bugs

     

    MAC-OS X Yosemite is fingerprinted as Lion. (Fixed in 2.6.1-06)


    Other Devices and Devices that report no information



    Devices that report an operating system and device type that is not recognized by vWLAN will show as "Other". Devices that report no information will also report in this manner. A list of devices will be maintained below that report as "Other" in this manner:

     

    Devices:

     

    - none currently known


    Unknown Manufacturer Information

     

    vWLAN now possesses a database of MAC Address OUI owners (the first 6 digits of a MAC address are assigned to specific companies) cross-referenced with the official IEEE database. While this will identify the majority of devices by manufacturer, the database is static and will only be upgraded with new versions of vWLAN. Keeping vWLAN up to date will ensure the system has the most recent information.

     

    In certain cases, it is possible that the MAC address of the device will reference an OUI pertaining to a specific chip-set manufacturer (or NIC), but not the device hardware itself. This is most common in custom built PCs and devices. It is important to remember that all manufacturer information is shown based on the reported MAC address only.

     

    Known Version 2.6.0-24 MAC additions not included:

     

    Apple (10:41:7F)

     

    Dashboard Statistics

     

    While Layer 7 device/OS fingerprinting introduces many new graphs, it is important to remember that these graphs are a complete representation of the information provided by the devices themselves in their entirety. Some graphs, depending on the devices present, may provide a large amount of non-granular information (such as "other) in certain circumstances.

     

    Useful Links