Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I hide version of Linux I am running when I scan server ports?

When I nmap'ed (nmap -A -T4 the server's ip from the outside, this is the result:

Starting Nmap 4.62 ( ) at 2009-11-07 11:27 IRST
LUA INTERPRETER in /usr/share/nmap/scripts/robots.nse:4: module 'http' not found:
 no field package.preload['http']
 no file '/usr/share/nmap/nselib/http.lua'
 no file './http.lua'
 no file '/usr/local/share/lua/5.1/http.lua'
 no file '/usr/local/share/lua/5.1/http/init.lua'
 no file '/usr/local/lib/lua/5.1/http.lua'
 no file '/usr/local/lib/lua/5.1/http/init.lua'
 no file '/usr/lib/nmap/nselib-bin/'
 no file './'
 no file '/usr/local/lib/lua/5.1/'
 no file '/usr/local/lib/lua/5.1/'
SCRIPT ENGINE: Aborting script scan.
Interesting ports on
Not shown: 1710 closed ports
22/tcp   open  ssh     OpenSSH 3.9p1 (protocol 1.99)
53/tcp   open  domain  dnsmasq 2.47
80/tcp   open  http    Apache httpd
222/tcp  open  ssh     OpenSSH 3.9p1 (protocol 1.99)
8081/tcp open  http    CherryPy httpd 2.3.0
MAC Address: 00:10:F3:0F:59:B7 (Nexcom International Co.)
Device type: firewall
Running: IPCop Linux 2.4.X
OS details: IPCop firewall 1.4.10 - 1.4.15 (Linux 2.4.31 - 2.4.34)
Network Distance: 1 hop

OS and Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 8.180 seconds

I do not want the OS details to be shown. I am using an IPCop firewall.


share|improve this question

nmap guesses the OS running on the target host by using (among other things) the characteristics of the TCP/IP stack. You can not prevent that except you change the way the TCP/IP stack of Linux works.

Details to nmap's OS detection:

Additionally the README file of the passive OS fingerprinting tool (p0f) could also give you a clue on how this works.

share|improve this answer
I did add one line in sysctl.conf (/etc/sysctl.conf). net.ipv4.ip_default_ttl = 199. When i nmap'ed (nmap -A -T4 the server's ip from the outside, in result not show linux version. – M.Rezaei Dec 13 '09 at 8:09
up vote 1 down vote accepted

I modify /etc/sysctl.conf

and add the following line:

net.ipv4.ip_default_ttl = 199


share|improve this answer
This is classical "Security through obscurity" – Anonymous Dec 22 '09 at 13:27
@Anon - Exactly. @M.Rezaei -- this gains you nothing if your intent is to secure this host. It doesn't address any vulnerability of the system, and further, gives you a false sense of security. – romandas Apr 9 '10 at 16:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.