██████╗  ██████╗ ██╗  ██╗ █████╗ 
╚════██╗██╔═══██╗██║  ██║██╔══██╗
 █████╔╝██║   ██║███████║███████║
 ╚═══██╗██║   ██║██╔══██║██╔══██║
██████╔╝╚██████╔╝██║  ██║██║  ██║
╚═════╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝

Welcome to 3OHA, a place for random notes, thoughts, and factoids that I want to share or remember

12 February 2026

This post is co-authored with Daniel Canencia, who built tuxid for his M.Sc. thesis under my supervision.

Fingerprinting Linux boxes

Device fingerprinting is a technique for building a unique identifier of a system from signals that describe various aspects of its state, such as software and hardware features. These signals can be universal (such as the device manufacturer, model, serial number, or software version) or specific to certain devices, such as screen resolution. Even when individual signals might not be enough to distinguish a device from any other in the world, they can provide a unique value when combined. A perfect fingerprint makes the device distinguishable, serving as a universally unique identifier that can be used to re-identify it within a larger population. Fingerprints are, therefore, a threat to anonymity.

Research in this area has largely focused on characterizing web-based (or browser) fingerprinting techniques, as they play a key role in cookieless user tracking. Browser fingerprinting is based on signals that can be collected from scripts loaded in web pages, including characteristics of the browser (version, configuration, canvas features) and the underlying computer system (screen resolution, installed fonts, and even hardware features). The browser fingerprint is used to re-identify a user when browsing the web without relying on explicit IDs set by the website through cookies.

Fingerprinting techniques

There are four main types of fingerprinting techniques, depending on the vantage point and capabilities of the party performing the fingerprinting:

• Local fingerprinting requires the ability to run code on the device. Available capabilities depend on the privilege level of the code execution. A general assumption of local fingerprinting is that access to persistent storage is unavailable; otherwise, fingerprinting may be trivially implemented by generating, and later retrieving, a universally unique identifier for the device.
• Remote fingerprinting is based on signals obtained by interacting with the target device through the network. It generally involves sending carefully crafted probes (e.g., network packets) and analyzing the responses.
• Passive fingerprinting does not require direct interaction with the target device. Identifying signals are obtained indirectly, for example, via traffic analysis.
• Active fingerprinting involves direct interaction with the target device, either by locally running code on it or remotely sending inputs. Active fingerprinting typically offers more control than passive fingerprinting.

Signals

Signals used to build a fingerprint have several key properties that affect their collection, reliability, and permanence (see Table 1).

Linux fingerprinting signal catalog

We studied the properties of 20 software, hardware, and network signals available in Linux boxes to be used as fingerprints (Table 2). Most of these signals are permanent, can be read by non-privileged processes, and require elevated privileges to modify them (in some cases by forcing a system reboot). All of them can be easily accessed programmatically or from the command line through an environment variable or a procfs object. We provide one method to collect each signal, though other (even simpler) alternatives are possible.

Evaluation

We conducted a limited evaluation to gain practical insights into the properties of these signals. We collected the signals listed in Table 2 from 20 different Linux or Linux-based systems (see Table 3) and evaluated two metrics for each signal:

• Entropy: A signal with high Shannon entropy indicates that it has different values for each evaluated device and, therefore, is high quality for fingerprinting. Entropy estimations can be extended to combinations of two or more signals.
• Stability: We measured signal changes over time without deliberate user intervention (i.e., we did not intentionally change modifiable signals). We performed several system reboots to account for changes in signals that are modified during the boot process. During our evaluation, we did not consider hardware changes or software updates. We measured stability by (i) computing the frequency of signal changes during the observation period, averaged over the number of devices, and (ii) subtracting this value from 100 so that a higher value indicates a more stable signal.

Figure 1 shows the entropy and stability values obtained. Even though the size and coverage of the device set is limited, the results allow us to draw some broad conclusions:

1. The perfect ID: Some signals, notably those associated with hardware serials (Storage Devices UUIDs, Main Board Product Serial, Main Board Product UUID, Hostname, and Machine ID), have significant fingerprinting potential. They are highly unique and stable. If you want to recognize a device indefinitely, use these. Conversely, if you want a device to be untrackable, these must be hidden.
2. The temporary fingerprint: A second group of signals related to boot data (Random Boot UUID and Last Boot Time) provides highly entropic but temporary fingerprints. These signals are unique but reset as soon as the device is restarted. They are excellent for identifying devices that do not reboot frequently.
3. The stable but ordinary: A third group consists of signals containing mostly static information that is stable but not very unique. This group includes Device Model, Device Vendor, OS Locale, and Kernel version. Their fingerprinting potential is limited alone but effective when combined with more entropic signals.
4. The entropic but unstable: Some network signals (MAC and IP addresses, Kernel version) are highly unique but can change after a software update or network reconfiguration. Their value as a source of entropy depends strongly on the estimated frequency of such changes.

tuxid, a Linux fingerprinting tool

We wrote a tool named tuxid that collects as many signals as available from the catalog above and builds a system fingerprint. The collected signals depend on both their availability on the target system and the tool's execution privileges. tuxid returns a JSON object containing the value of each signal (either the raw value or its hash) and the system fingerprint, which is computed by hashing the concatenation of all signal values. For maximum portability, tuxid is implemented as a POSIX-compliant Bash script. The listing below shows an example of the output produced.

tuxid is available in this GitHub repository.

{
    "hardware_signals": {
        "Device Model": "f11c60414cc662a5f7d0b407dd29a0bf3d5f8921",
        "Device Vendor": "818ebe0169e57c3063ec51fb8f59d9975a830eb6",
        "Storage Devices UUIDs": "feaa9e56e555297bbcd3992700a70917d17e8d35",
        "Processor Model Name": "dea834292a062781b29035985070f06fd29e1b59",
        "Total Memory (RAM)": "3b8b0ad024a457334aa21a91ca346d7369513ec2",
        "Total Disk Space": "3002fad2041e803689a833c0aa7a398169591c96"
    },
    "software_signals": {
        "Machine ID": "8e08ef60699ae0817d435da246278926079967b0",
        "Device hostid": "33c2e0caab0ae39735231db1f650b9cd90f2846d",
        "Hostname": "3e3218ef3b6aa0f036c4f87cb845ee5c5b790e74",
        "Random Boot UUID": "5e6ed3ec6f3a9bb6a90f491abdaab3434bcbe561"
    },
    "network_signals": {
        "Private IP Address": "b9433b1915dc5ff9e97dec4be647fa77c6245e43",
        "Public IP Address": "fe08a4ade52de7da79ba26df9bc1ab15e35335b2",
        "MAC Address": "6fdb129968f7f653ea357ea194f6886197eb9194",
        "Main Network Interface": "94357751aa7cf66c9b939a4a6e7b63560bf0a7ce"
    },
    "os_signals": {
        "OS Locale Settings": "2f7b4e2832e68e1b002423d9459c63734eef3941",
        "Kernel Version": "4ec9d088b1f39928ceeb81cf28139ce6160dd056",
        "OS Version": "e1887bfd77d126e0f74b08598303e7e2ae1bfbd7",
        "Last Boot Time": "1eca1470a2fc8c3189cee8c2df705f64bca39b2e"
    },
    "fingerprint_hash": {
        "hash_digest": "3f5cf58f9a47e285a6573f59a154c18aee8b49cf",
        "hash_algorithm": "sha1sum"
    }
}