In
information technology
Information technology (IT) is the use of computers to create, process, store, retrieve, and exchange all kinds of data . and information. IT forms part of information and communications technology (ICT). An information technology system ...
, a Christmas tree packet is a
packet with every single option set for whatever protocol is in use.
Background
The term derives from a fanciful image of each little option bit in a header being represented by a different-colored light bulb, all turned on, as in "the packet was lit up like a
Christmas tree
A Christmas tree is a decorated tree, usually an evergreen conifer, such as a spruce, pine or fir, or an artificial tree of similar appearance, associated with the celebration of Christmas. The custom was further developed in early modern G ...
". It can also be known as a ''kamikaze packet'', ''nastygram'', or ''lamp test segment''.
Christmas tree packets can be used as a method of
TCP/IP stack fingerprinting, exposing the underlying nature of a
TCP/IP
The Internet protocol suite, commonly known as TCP/IP, is a framework for organizing the set of communication protocols used in the Internet and similar computer networks according to functional criteria. The foundational protocols in the suit ...
stack by sending the packets and then awaiting and analyzing the responses. When used as part of scanning a system, the
TCP header of a Christmas tree packet has the flags FIN, URG and PSH set. Many operating systems implement their compliance with the
Internet Protocol
The Internet Protocol (IP) is the network layer communications protocol in the Internet protocol suite for relaying datagrams across network boundaries. Its routing function enables internetworking, and essentially establishes the Internet.
...
standards in varying or incomplete ways. By observing how a host responds to an odd packet, such as a Christmas tree packet, inferences can be made regarding the host's operating system. Versions of
Microsoft Windows,
BSD/OS,
HP-UX
HP-UX (from "Hewlett Packard Unix") is Hewlett Packard Enterprise's proprietary implementation of the Unix operating system, based on Unix System V (initially System III) and first released in 1984. Current versions support HPE Integrit ...
,
Cisco IOS
The Internetworking Operating System (IOS) is a family of proprietary network operating systems used on several router and network switch models manufactured by Cisco Systems. The system is a package of routing, switching, internetworking, an ...
,
MVS, and
IRIX
IRIX ( ) is a discontinued operating system developed by Silicon Graphics (SGI) to run on the company's proprietary MIPS workstations and servers. It is based on UNIX System V with BSD extensions. In IRIX, SGI originated the XFS file system ...
display behaviors that differ from the
RFC standard when queried with said packets.
A large number of Christmas tree packets can also be used to conduct a
DoS attack by exploiting the fact that Christmas tree packets require much more processing by routers and end-hosts than the "usual" packets do.
Christmas tree packets can be easily detected by
intrusion-detection systems or more advanced
firewall
Firewall may refer to:
* Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts
* Firewall (construction), a barrier inside a building, designed to limit the spre ...
s. From a
network security
Network security consists of the policies, processes and practices adopted to prevent, detect and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources. Network security involves th ...
point of view, Christmas tree packets are always suspicious and indicate a high probability of network
reconnaissance
In military operations, reconnaissance or scouting is the exploration of an area by military forces to obtain information about enemy forces, terrain, and other activities.
Examples of reconnaissance include patrolling by troops ( skirmishe ...
activities.
See also
*
Martian packet
References
External links
Nmap documentation
{{DEFAULTSORT:Christmas Tree Packet
Computer jargon
Packets (information technology)
Denial-of-service attacks