ICMP OS Fingerprinting & NIDS Evasion: Traffic Mimicry via Linux/Windows Payload Signatures in x64 Assembly
Linux and Windows ICMP Echo Requests differ in payload size (64B vs 40B), default content (timestamp vs alphabetical), and TTL values — forming OS-specific network fingerprints that NIDS use for traffic classification. Traffic mimicry replicates these signatures at the assembly level: 8-byte RDTSC timestamp emulation, sequential byte padding (0x10–0x1F), and strict 64-byte structural alignment bypass DPI anomaly detection without triggering empty-payload or entropy signatures.
