TCP/IP Stack Fingerprinting

The TCP receive window size advertised in the initial SYN or SYN-ACK packet is a highly distinctive fingerprinting vector. Different operating systems use different default values:

• Linux (kernel 2.6+): 5840 bytes
• Windows 10/11: 65535 bytes (with scaling)
• macOS: 65535 bytes
• FreeBSD: 65535 bytes

This value is set by the kernel at compile time and is rarely modified by applications, making it a reliable passive signature even when other TCP options are normalized.

The IP TTL field reveals the initial hop limit set by the sending OS, which decrements by one per router hop. By measuring the TTL of received packets and estimating the hop distance, you can infer the original value:

• Linux/Unix: Initial TTL of 64
• Windows: Initial TTL of 128
• Cisco IOS: Initial TTL of 255
• Solaris: Initial TTL of 255

A packet arriving with TTL 52 likely originated from a Linux host ~12 hops away. This passive metric requires no interaction and works even through NAT gateways.

The sequence and presence of TCP options in SYN packets form a unique OS signature. Each operating system arranges options like Maximum Segment Size (MSS), Window Scaling, Selective Acknowledgments (SACK), and Timestamps in a specific order:

• Windows: MSS, NOP, Window Scale, NOP, NOP, SACK Permitted
• Linux: MSS, SACK Permitted, Timestamp, NOP, Window Scale
• macOS/iOS: MSS, SACK Permitted, Timestamp, Window Scale

Even when the same options are present, the ordering byte sequence acts as a passive fingerprint that firewalls rarely normalize.

The DF bit in the IP header indicates whether a packet may be fragmented in transit. Operating systems exhibit distinct default behaviors:

• Linux: Sets DF bit on most TCP packets by default (enables Path MTU Discovery)
• Windows: Sets DF bit on all outbound TCP segments
• Older Solaris: Often clears DF bit

Observing whether the DF flag is consistently set across a connection provides a passive signal. Combined with the Maximum Segment Size value, this forms part of the p0f fingerprinting signature database.

When a SYN packet is lost, the retransmission timeout (RTO) algorithm and backoff pattern differ by OS. By passively observing retransmitted SYN intervals, you can fingerprint the stack:

• Linux: Uses a fine-grained timer with exponential backoff starting at ~1 second
• Windows: Initial RTO of 3 seconds, then exponential backoff
• BSD variants: Typically start at 3 seconds with a different multiplier

This passive timing analysis requires no active probing and works against hosts that never complete the TCP handshake, making it valuable for identifying scanners and scrapers.

Several mature tools implement passive TCP/IP stack fingerprinting for network defense and bot detection:

• p0f: The de facto standard passive OS fingerprinting tool using SYN packet signatures; maintains a comprehensive fingerprint database
• Ettercap: Includes passive fingerprinting as part of its network analysis suite
• NetworkMiner: A network forensics tool that extracts OS metadata from captured PCAP files
• Zeek (formerly Bro): Network security monitor with passive fingerprinting plugins

These tools analyze the same TCP header fields—TTL, window size, option order, and flags—to identify connecting hosts without generating traffic.

A stateless identification method that combines unique device attributes to generate a stable, persistent identifier. Techniques include:

• Canvas fingerprinting: Rendering a hidden image to detect GPU/driver variations
• WebGL fingerprinting: Probing the graphics stack for vendor-specific quirks
• Font enumeration: Detecting the set of installed system fonts
• AudioContext fingerprinting: Analyzing subtle audio processing differences These signals are combined into a hash that persists across incognito modes and cookie clearing.

Identifies automated browsing environments like Puppeteer, Playwright, and Selenium by probing for missing browser features and automation artifacts. Detection methods include:

• Checking navigator.webdriver property (set to true in automated modes)
• Analyzing JavaScript engine inconsistencies in headless vs. headed modes
• Detecting missing plugin arrays or mime types
• Probing for rendering artifacts absent in user-driven browsers
• Monitoring for zero-millisecond interaction delays impossible for humans

Analyzes human interaction patterns to differentiate organic behavior from scripted automation. Key signals include:

• Mouse movement trajectories: Natural ballistic curves vs. linear paths
• Keystroke dynamics: Variable inter-key delays vs. uniform typing speed
• Touch pressure and gesture patterns: Inconsistent pressure vs. uniform taps
• Scroll behavior: Variable acceleration vs. programmatic instant scrolling These passive signals are collected client-side and analyzed by machine learning models to assign a human probability score to each session.

A defensive mechanism that embeds elements invisible to human users but discoverable by automated parsers. Common implementations include:

• Hidden links with display: none or visibility: hidden CSS
• Invisible form fields placed off-screen via absolute positioning
• Decoy pagination links that only bots follow
• Honeytoken data seeded in HTML comments Any client that interacts with these traps is programmatically flagged as a bot, as human users cannot see or click them.