So many people here will go though great lengths to protect themselves from fingerprinting and snooping. However, one thing tends to get overlooked is DHCP and other layer 3 holes. When your device requests an IP it sends over a significant amount of data. DHCP fingerprinting is very similar to browser fingerprinting but unlike the browser there does not seem to be a lot of resources to defend against it. You would need to make changes to the underlying OS components to spoof it.
What are everyone’s thoughts on this? Did we miss the obvious?
They are watching DHCP Discover option 55. The device tells the server what options it expects to receive, and different vendors and device ask for different options or ask for them in a different order, and they are fingerprinting that.
Cisco also describes the tactic: https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116235-configure-ise-00.html
The fingerprints are viewable at https://github.com/karottc/fingerbank/blob/master/dhcp_fingerprints.conf - it is more specific than a mac vendor but not extremely anti-privacy, anybody watching firewall logs will know an iPhone connected pretty easily too.
Okay, I do recall that our software had a feature that could classify on "DHCP requested options’, but it was low-fidelity, unreliable. Ultimately, the software works best with known devices, and isn’t very good at reliably classing unknowns.
As you say, just the first few seconds of actual traffic from a device is so rich in terms of ID characteristics compared to DHCP.