Can signature analysis of DHCP client behaviour identify WinXP clients?

[Jean-Francois.TremblayING at videotron.com]

> I'm trying to chase down the residual WinXP boxes on our campus,
> and wonder whether signature analysis of DHCP requests can help.

DHCP fingerprinting based on DHCPv4 options, both their presence 
and their order, proved to be surprinsingly effective and much 
less intrusive than scanning. 

For example, XP SP3 seems to always request these options, in 
exactly this order: 1,15,3,6,44,46,47,31,33,249,43

Your mileage may vary, but it's worth trying. 

/JF

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/dhcp-users/attachments/20131111/c672f54f/attachment.html>