Passive OS Fingerprinting

The TTL value set in the IP header of the first packet from a host. Different operating systems use distinct default starting values.

• Linux/Android: Typically starts at 64
• Windows: Typically starts at 128
• Cisco/Solaris: Typically starts at 255

By observing the TTL of a received packet and accounting for the number of network hops, you can estimate the original OS. A packet arriving with a TTL of 52 likely originated from a Linux host roughly 12 hops away.

The TCP receive window advertised in the SYN or SYN-ACK packet indicates the buffer space the host is willing to accept. This value is highly OS-specific and often remains consistent across versions.

• Windows: Often uses a window size that is a multiple of MSS (Maximum Segment Size), or specific values like 65535
• Linux: Tends to use multiples like 29200 or 28960
• macOS/iOS: Commonly advertises 65535

This field is a cornerstone of passive fingerprinting because it is rarely modified by user applications.

The DF bit in the IP header controls whether a packet can be fragmented by routers along the path. The default setting of this flag is a strong OS indicator.

• Windows: Sets the DF flag to 1 (on) by default for outbound TCP SYN packets
• Linux: Typically sets the DF flag to 0 (off), allowing fragmentation
• Network Devices: Often mirror the behavior of their kernel (e.g., Juniper based on FreeBSD)

Combined with TTL and Window Size, the DF flag helps disambiguate signatures between Windows and Linux hosts.

The specific sequence, type, and values of TCP options negotiated in the SYN packet create a unique fingerprint.

• MSS (Maximum Segment Size): The value itself can indicate the underlying network interface MTU
• Window Scaling: The multiplier factor (e.g., 7 or 8) is OS-dependent
• SACK Permitted: Selective Acknowledgment support is standard on modern OSes
• NOP (No-Operation): The padding bytes used to align options vary in placement
• Timestamp: The format and frequency of TCP timestamps differ between kernels

The exact order—such as MSS, SACK, Timestamp, NOP, Window Scale—is a classic signature for specific Linux kernels.

The IP Identification field is a 16-bit value used to uniquely identify fragments of a datagram. The algorithm used to generate this ID differs by OS.

• Windows: Increments the ID by 1 for each packet, regardless of destination
• Linux: Tends to use a random or zero ID for non-fragmented traffic
• OpenBSD: Uses a randomized ID for security

A monotonically increasing ID pattern strongly suggests a Windows host, while random or zero IDs point toward Unix-like systems.

The total length of the initial TCP SYN packet is a quick heuristic for OS identification. Because TCP options vary in length and count, the overall packet size is a reliable aggregate metric.

• Windows: Often sends a SYN packet of 52 bytes (options like MSS, NOP, Window Scale, NOP, NOP, SACK)
• Linux: Often sends a SYN packet of 60 bytes (includes Timestamp option)
• macOS: Typically sends a SYN packet of 64 bytes

This simple size check can immediately narrow down the OS family before deeper inspection.

The starting TTL value set by the operating system's IP stack on outbound packets. This is a primary discriminant in passive fingerprinting.

• Linux/Unix: Typically starts at 64
• Windows: Typically starts at 128
• Cisco IOS: Typically starts at 255

By observing the TTL of a received packet and calculating the hops to the host, you can infer the originating OS.

The initial receive window size advertised in the TCP SYN or SYN-ACK packet. This value is highly OS-specific and often remains consistent across versions.

• Windows Server: Often 8192 or 65535
• Linux: Often 29200 or 28960 (multiples of MSS)
• macOS/iOS: Often 65535

This field is a critical component of the p0f fingerprinting signature.

A single bit in the IP header that prohibits routers from fragmenting the packet. The default setting of this flag is a strong OS indicator.

• Windows: Sets DF flag on all outbound packets by default
• Linux: Typically does not set DF flag by default
• Network Devices: Often set DF for Path MTU Discovery

Combined with TTL and MSS, the DF flag helps distinguish between Windows and Linux hosts with high confidence.

The largest amount of TCP data a host is willing to receive in a single segment, advertised during the TCP handshake. This value reflects the local MTU minus headers.

• Ethernet standard: 1460 bytes (1500 MTU - 40 bytes)
• PPPoE connections: Often 1452
• Tunneling/VPNs: Can be significantly lower

Anomalous MSS values can indicate a specific network configuration or a non-standard IP stack used by bots.

The specific sequence, type, and values of TCP options (e.g., MSS, Window Scale, SACK Permitted, Timestamp) in the SYN packet form a unique signature.

• Option Order: The exact sequence is a strong fingerprint (e.g., MSS, NOP, WS, NOP, NOP, TS)
• Timestamp Value: Some OSs initialize the timestamp to zero; others use a random value
• Window Scale Factor: The multiplier value varies by OS

Tools like p0f and Ettercap use these combined signatures to match against a database of known OS fingerprints.