using fingerprinting techniques are not within illegal.
it depends on the purpose of gathering this type of information, its like a moral and ethical and desicional issue. its like questioning whats next?
if this dont cause monetary damage, like performance etc etc and its not made with the info-gathering----attack approach, its not a problem legally speaking.
we got to consider here an important point...
if we talk about this new pasive fingerprinting remotely and non authorized against some machine itself means that we already compromised some machine and from there we are listening for getting info...so here there is already a crime committed.
the qeustioning types are local passive and remote and local aggresive with the help of IDS that get the "stealth ones" like generated with nmap.
if local authorized inside worker do it on his lan with this tool he wont get noticed so nothing happens... with the aggresives ones are the problem...written permision must asked to corresponding authorities...in both cases its better this cause you could get caugh in action, at the monitor...
the main problem here its the ignorance of footprinting like a natural protocol interaction that happends often in internet... and other things mentioned before...
excuse me for not organizing my ideas.

and excuse me for my engliss too.. :)


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/57/10407#10407