# Nmap OS Fingerprint List. -*- mode: fundamental; -*-
# $Id: nmap-os-fingerprints 5480 2007-08-11 06:02:29Z fyodor $ 
#
# Contributions to this database are welcome.  If Nmap obtains a new
# fingerprint (and test conditions are favorable), it will print out a
# URL you can use to submit the fingerprint.  If Nmap guesses wrong,
# please send the full Nmap output and the exact destination host OS
# name and version to fyodor@insecure.org .  Thanks!
#
# By submitting fingerprints you are transfering any and all copyright
# interest in the data to Fyodor so that he can modify it, relicense it,
# incorporate it into programs, etc.
#
# This collection of fingerprint data is (C) 1998-2003 by
# Insecure.Com LLC.  This data is available for
# free use by open source software under the terms of the GNU General
# Public License.  We also license the data to selected
# commercial/proprietary vendors under less restrictive terms.
# Contact sales@insecure.com for more information.
#
# TEST DESCRIPTION:
# Tseq is the TCP sequenceability test
# T1 is a SYN packet with a bunch of TCP options to open port
# T2 is a NULL packet w/options to open port
# T3 is a SYN|FIN|URG|PSH packet w/options to open port
# T4 is an ACK to open port w/options
# T5 is a SYN to closed port w/options
# T6 is an ACK to closed port w/options
# T7 is a FIN|PSH|URG to a closed port w/options
# PU is a UDP packet to a closed port

Fingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0
Class 2Wire | embedded || WAP
TSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3Com Home Connect Cable Modem external with USB - Model 3CR29223
Fingerprint 3Com Home Connect Cable Modem
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# 3Com 812 OfficeConnect ADSL Router Firmware version: 2.0.0
Fingerprint 3Com OfficeConnect 812 ADSL router
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint 3Com OfficeConnect Remote 812 ADSL Router
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<C354%SI=<1E)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# 3Com Sharkfin/Tailfin Cable Modem boot code 01.00.003a main image 1.17 hardware 2.00 web 604
Fingerprint 3Com Sharkfin/Tailfin Cable Modem
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<D6DC%SI=<14%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com Sharkfin/Tailfin Cable Modem
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# US Robotics USR8000 Broadband router, firmware 1.27 patched
Fingerprint US Robotics USR8000 Broadband router
Class 3Com | embedded || broadband router
TSeq(Class=RI%gcd=<68%SI=<726%IPID=BI%TS=U)
T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800|C00|400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|400|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3Com NBX Superstack 3 IP PBX running firmware 4_1_11
# 3Com NBX-100 (version R4_1_4) Phone System Processor
Fingerprint 3Com NBX PBX
Class 3Com | embedded || PBX
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# 3Com AccessBuilder Remote Office 500 with firmware V05.T4N
Fingerprint 3Com AccessBuilder Remote Office 500 router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com NetBuilder & NetBuilder II OS v 9.3
Class 3Com | embedded || router
TSeq(Class=TD%gcd=3C%SI=<FF)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint 3Com Netbuilder & Netbuilder II router OS v8.1
Class 3Com | embedded || router
TSeq(Class=TD%gcd=32|64|96%SI=<FF)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint 3Com Netbuilder II Router Ver 11.4.0.51
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

# 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
Fingerprint 3Com Netbuilder Remote Office 222 router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint 3Com NetBuilder-II, OS version SW/NB2M-BR-5.1.0.27
Class 3Com | embedded || router
TSeq(Class=TD%gcd=32|64|96%SI=<F)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS|AP%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

# 3Com OfficeConnect Netbuilder router running 11.4.0.09
Fingerprint 3Com OfficeConnect Netbuilder router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3com OfficeConnect Remote 812 ADSL Router (Firmware V1.1.7)
Fingerprint 3com OfficeConnect Remote 812 ADSL Router
Class 3Com | embedded || router
TSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com / USR TotalSwitch Firmware: 02.02.00R
Class 3Com | embedded || switch
TSeq(Class=C|TD%gcd=3D090%SI=0)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3com Switch 7700 firmware v2.01
# Huawei S6506R routing switch VRP 3.10 release 1009
Fingerprint 3Com 7700/8800 Switch or Huawei S6506R routing switch VRP 3.10
Class 3Com | embedded || switch
Class Huawei | VRP || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1FC4%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint 3Com Access Builder 4000 Switch
Class 3Com | embedded || switch
T1(DF=N%W=0|800%ACK=S++%Flags=AR|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# 3Com LANplex 6004 Extended Switching Software 7.0
Fingerprint 3Com LANplex 6004 switch
Class 3Com | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Switch 1100, 3300
Fingerprint 3Com SuperStack II switch (OS v 2.0)
Class 3Com | embedded || switch
TSeq(Class=C)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com SuperStack II switch SW/NBSI-CF,11.1.0.00S38
Class 3Com | embedded || switch
TSeq(Class=TD%gcd=<68%SI=<3C)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3Com SuperStack II RAS 1500 software version 2.5.0, 159
Fingerprint 3Com SuperStack II RAS remote access server
Class 3Com | embedded || terminal server
TSeq(Class=TD%gcd=<320CC%SI=<14%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint 3Com terminal server ESPL CS2100
Class 3Com | embedded || terminal server
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06
# 3Com 11Mpbs Wireless LAN Access Point 8000
Fingerprint Datavoice 3Com WAP or TxPORT PRISM T1 CSU/DSU
Class 3Com | embedded || WAP
Class Datavoice | embedded || CSUDSU
TSeq(Class=RI%gcd=<6%SI=>18000)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Tested ACC Amazon 9.2.29, ACC Congo 9.2.35
Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator
Class ACC | embedded || router
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Acorn RISC OS 3.60 (Acorn TCP/IP Stack 4.07)
Class Acorn | RISC OS || general purpose
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd)
Class Acorn | RISC OS || general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Actiontec Wireless ready DSL Gateway - Model R1520SU
# Actiontec 1520 DSL gateway with GlobespanVirata chipset hardware version RD6700 BSP v1.1 (ISOS 8.2) / He100/2xx CSP v2.3, firmware version 8.2.0.16
Fingerprint Actiontec 1520 DSL gateway firmware 8.2.0.16
Class Actiontec | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U)
T1(DF=N%W=1194%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=1194%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=N%W=1194%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Adtran Atlas 890 digital cross-connect device
Class Adtran | embedded || telecom-misc
TSeq(Class=TD%gcd=<714%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Aethra Vega Star Gold (Videoconferencing appliance)
# Aethra Video Conference System Vega Pro S running pSOSystem
Fingerprint Aethra Vega Conference System
Class Aethra | embedded || webcam
TSeq(Class=RI%gcd=<6%SI=<2F97016&>79D33%IPID=I%TS=U)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge
Class Aironet | embedded || bridge
TSeq(Class=C%Val=0)
T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Aironet Wireless Bridge running firmware V5.0J
Class Aironet | embedded || bridge
TSeq(Class=C|TR)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=)
T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps Wireless access point
Class Aironet | embedded || WAP
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Alcatel 1000 ADSL (modem)
Class Alcatel | embedded || broadband router
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Alcatel 1000 DSL Router
Class Alcatel | embedded || broadband router
TSeq(Class=RI%gcd=<5%SI=>AAA&<AAAAA)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Alcatel SpeedTouch Home running GV8BAA3.235 (992640)
# Alcatel SpeedTouch Pro ADSL Router running NZ OS 3.281
#  Alcatel SpeedTouch Home ADSL Modem (POTS), Ver 3.2
Fingerprint Alcatel SpeedTouch ADSL modem
Class Alcatel | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E|F%ULEN=134%DAT=E)

# Alcatel SpeedTouch 510 *DSL router (uses THOMSON UNIX embedded Version 4.0.0.9.0)
Fingerprint Alcatel SpeedTouch 510 ADSL modem
Class Alcatel | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Alcatel SpeedTouch Pro ADSL modem
Class Alcatel | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Alcatel OmniStack switch version 4.3.3 GA
Class Alcatel | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Alcatel telephone system called OmniPcx 4400 Chorus MiX V.3.2 r4.1.5 COMP-386
Fingerprint Alcatel OmniPcx 4400 telephone system
Class Alcatel | embedded || telecom-misc
TSeq(Class=RI%gcd=<6%SI=<720CE&>AEE%IPID=I%TS=U)
T1(DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Advanced Reflexes IP Phone, Version: E/AT400/46.8
# IBM x450 remote management console (lets you switch machine on/off, check temp, etc)
Fingerprint Alcatel Advanced Reflexes IP Phone or IBM x450 remote management console
Class Alcatel | embedded || VoIP phone
Class IBM | embedded || remote management
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub
Class Allied Telesyn | embedded || hub
TSeq(Class=C)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA
Class Allied Telesyn | embedded || switch
TSeq(Class=TD%gcd=FA|1F4%SI=<FFF)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Allied Telesyn Layer 3 Switch AT-8748XL Version 2.6.1
# Allied Telesyn Rapier 24i
Fingerprint Allied Telesyn AT-8748XL or Rapier 24i Switch
Class Allied Telesyn | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1F40%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F40%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Allied Telesyn AT-RP24i Rapier 24i version 2.3.1-04
# Ericsson Home internet Solution ver. 2.0
Fingerprint Allied Telesyn AT-RP24i switch or Ericcson HiS V2.0
Class Allied Telesyn | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Amos 2.3A
Class Alpha Micro | AMOS || general purpose
TSeq(Class=i800%gcd=<6%SI=<14)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Alteon Networks ACEswitch 180e Software Version 8.0.62.7
Class Alteon | embedded || load balancer
TSeq(Class=RI%gcd=<14%SI=<D45BC&>85A%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Nortel/Alteon ACE Director 3 Hardware Revision: B Software Version 6.0.42
Fingerprint Nortel/Alteon ACE Director 3 Version 6.0.42-B
Class Alteon | embedded || load balancer
TSeq(Class=TR%gcd=<6%IPID=RD)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# Alteon AceSwitch 110 (software 4.0.37)
# Centillion C100 ATM Switch OS Version 2.0.2.
Fingerprint Alteon AceSwitch 110 or Cantillion C100 ATM Switch
Class Alteon | embedded || switch
Class Cantillion | embedded || switch
TSeq(Class=TD%gcd=<9C8%SI=<1E)
T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Alteon ACEswitch 184 Software Version 8.0.49
Fingerprint Alteon ACEswitch 184 V. 8.0.49
Class Alteon | embedded || switch
TSeq(Class=RI%gcd=<34%SI=<C698A&>215%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Amiga OS 3.5 (Miami TCP/IP Stack v3.1)
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS 2.1 running AmiTCP4.3
Class Amiga | AmigaOS || general purpose
TSeq(Class=64K%TS=U)
T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0c
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS AmiTCP/IP 4.3
Class Amiga | AmigaOS || general purpose
TSeq(Class=64K)
T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS AmiTCP/IP Genesis 4.6
Class Amiga | AmigaOS || general purpose
TSeq(Class=64K)
T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami 2.1-3.0
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami 3.0
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami 3.1-3.2
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B
Class Amiga | AmigaOS || general purpose
TSeq(Class=TR)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint APC MasterSwitch Network Power Controller
Class APC | embedded || power-device
TSeq(Class=TR)
T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint APC Network management Card AP9616
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ)
T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# APC AP9617  network management card inside Matrix 5000 UPS
Fingerprint APC network-enabled UPS
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ)
T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# APC UPS Network Management Card, Model AP9617
Fingerprint APC UPS Network Management Card
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ)
T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# SmartUPS 3000RM Firmware: 92.14.I
# APC PDU AOS v1.1.6
Fingerprint APC UPS system
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<F38C%SI=<DC%IPID=I)
T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# American Power Conversion / Network Management Card AOS v2.5.3 / Symmetra LX 16000 RM / This is a network management interface on a high end UPS
Fingerprint APC UPS System network management card (runs AOS v2.5.3)
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# American Power Conversion Smart-UPS 3000 RM firmware revision 666.5.I
# APC AOS 2.2.7 (on APC AP7901 network management card)
# APC UPS - Symmetra 16000 UPS_IDEN
# APC AP9617 SmartSlot UPS network management card
# APC Network Management Card EX 10/100BaseT (AP9617)
# APC Network Management Card AOS v2.2.7 (Rack PDU APP v2.2.0)
# APC network mgmt card AP9617
Fingerprint APC UPS System network management card (runs AOS)
Class APC | embedded || power-device
TSeq(Class=TD%gcd=<7A124%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=Y|N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint APC Web/SNMP UPS management card
Class APC | embedded || power-device
TSeq(Class=RI%gcd=<6%SI=<52FB700&>D46DF)
T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Apollo Domain/OS SR10.3.5
Class Apollo | Domain/OS || general purpose
TSeq(Class=RI|TD%gcd=<E%SI=<898%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Apollo Domain/OS SR10.4
Class Apollo | Domain/OS || general purpose
TSeq(Class=TD|RI%gcd=<6%SI=<FF)
T1(DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
T4(DF=N%W=239C%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple A/UX 3.1.1 SVR2 or OpenStep 4.2
Class Apple | A/UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Color LaserWriter 12/660 PS (Model No. M3036)
Class Apple | embedded || printer
T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=C00%ACK=O%Flags=R%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Actually it is not constant seq class -- it just seems that way
# because it takes so long to increment
Fingerprint Apple Color LaserWriter 600 Printer
Class Apple | embedded || printer
TSeq(Class=C)
T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Color LaserWriter 600 Printer
Class Apple | embedded || printer
TSeq(Class=C)
T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple LaserWriter 12/640 PS
Class Apple | embedded || printer
TSeq(Class=C%Val=85BD001%IPID=I%TS=U)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Apple LaserWriter 16/600 PS, HP 6P, or HP 5 Printer
Class Apple | embedded || printer
TSeq(Class=C)
T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

# The sequence prediction is never really true random, but sometimes it
# has two unique "tracks" which make it look random to nmap.  Here is a
# real example:  Sequence numbers: 5576001 25D001 5576001 25D001
Fingerprint Apple LaserWriter 8500 (PostScript version 3010.103)
Class Apple | embedded || printer
TSeq(Class=TR|C)
T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

# Apple AirPort Extreme Base Station Firmware 5.1.1
Fingerprint Apple Airport Extreme Base Station (WAP) or ARRIS Cadant C3 CMTS Cable Modem
Class Apple | embedded || WAP
Class ARRIS | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<94160&>15CB%IPID=I%TS=2HZ)
T1(DF=Y%W=2000|4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2000|4000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Apple Airport Express (Wireless Router/Bridge) (Firmware v6.1)
# Apple AirPort Express (Apple Base Station V6.0)
# OKI Phaser B6300N laser printer
# Netgear 7000 Series Managed Switch (GSM7324) (strang ops)
# Westell Versalink 327W, Wireless DSL Modem/Router
Fingerprint Embedded device (Apple WAP, Dell bridge, OKI printer, Westell Broadband router)
Class Apple | embedded || WAP
Class Dell | embedded || storage-misc
Class Okidata | embedded || printer
Class Westell | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<A9830&>1000%TS=2HZ)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Mac OS X 1.1-1.2
Fingerprint Apple Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3
Class Apple | Mac OS X | 10.0.X | general purpose
TSeq(Class=RI%gcd=<5)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Mac OS X Server 1.0 - 1.0-1 <-- should be 10.1.0?
Fingerprint Apple Mac OS X Server 1.0-1.0-1 (Rhapsody 5.3 - 5.4)
Class Apple | Mac OS X | 10.0.X | general purpose
TSeq(Class=RI%gcd=<5%SI=>BBB&<FFFF)
T1(W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(W=2000%ACK=O%Flags=R%Ops=)
T5(W=0%ACK=S++%Flags=AR%Ops=)
T6(W=0%ACK=O%Flags=R%Ops=)
T7(W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.1 - 10.1.4
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.1.4 (Darwin Kernel 5.4) on iMac
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.1.5
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Mac OS 10.2.6, Darwin kernel 6.6
Fingerprint Apple Mac OS X 10.1.5-10.2.8
Class Apple | Mac OS X | 10.1.X | general purpose
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y|N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Apple Mac OS X Server 1.2 (ppc) -- 1.2 == 10.1.2?
Fingerprint Apple Mac OS X Server 10.1.2 (ppc)
Class Apple | Mac OS X | 10.1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<199A9C&>4177)
T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.2.6
Class Apple | Mac OS X | 10.2.X | general purpose
T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.2.6 (Jaguar)
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.2.8 (Jaguar)
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Mac OS X Server 10.2.8 Darwin Kernel 6.8 Macintosh powerpc
Fingerprint Apple Mac OS X Server 10.2.8
Class Apple | Mac OS X | 10.2.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.3.3 (Panther)
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Apple Mac OS 10.3.5 (Darwin Kernel Version 7.5.0)
# Mac OS 10.3.7 Server, Darwain, PPC. Kernel version 7.70. All relevant updates as of 2/2/05
Fingerprint Apple Mac OS X 10.3.5 or 10.3.7
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Darwin 7.7.0 Power Macintosh powerpc, OS X, version 10.3.7
# Apple Mac OS X 10.3.6 (7R28) -  (Darwin 7.6.0)
Fingerprint Apple Mac OS X 10.3.6 or 10.3.7
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.3.9
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=E34E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS X 10.4.1 (Tiger)
Class Apple | Mac OS X | 10.3.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=A%Ops=NNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Apple Mac OS X 10.3.8 (Panther); Darwin Kernel Version 7.8.0
# Apple Mac OS X 10.4 (Build: 8A428); Kernel: Darwin 8.0.0
Fingerprint Apple Mac OS X 10.3.8 or 10.4
Class Apple | Mac OS X | 10.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Apple Mac OS X 10.4.0 (Tiger) - Darwin Kernel Version 8.0.0
# Apple Macintosh PowerBook G4 15" Titanium, Mac OS X 10.4.0 (Tiger) build 8A428
# Mac OS X 10.4 Darwin 8.0.0 Darwin Kernel Version 8.0.0: Sat Mar 26 14:15:22 PST 2005;
# Fingerprint Apple Mac OS X 10.4.0 Build 8a428 Darwin Kernel Version 8.0.0. Power Macintosh powerpc Hardware is PB G4
# Darwin 8.1.0 Kernel Version 8.1.0 (Apple Mac OS 10.4.1 Tiger)
Fingerprint Apple Mac OS X 10.4.0 - 10.4.4 (Tiger)
Class Apple | Mac OS X | 10.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6
Class Apple | Mac OS | 7.X | general purpose
TSeq(Class=C|TD)
T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Not really constant -- just slow incrementation
# This is an LCIII
Fingerprint Apple Mac OS 7.1
Class Apple | Mac OS | 7.X | general purpose
TSeq(Class=C)
T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 7.5.5 - 9
Class Apple | Mac OS | 7.X | general purpose
Class Apple | Mac OS | 8.X | general purpose
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8 running on an LC 475
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.0
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0)
T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.1 running on a PowerPC G3 (iMac)
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.5
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)

# on Macintosh GS server
Fingerprint Apple Mac OS 8.5.1 (Appleshare IP 6.0)
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Mac OS 8.6 running WebStar http server
Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Apple Mac OS 8.6
Class Apple | Mac OS | 8.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

#  Mac OS 9 on a Power Macintosh 7200/75
# iMac running Mac OS 9.1
Fingerprint Apple Mac OS 9 - 9.1
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# HP-UX B.11.00
Fingerprint Apple Mac OS 9.04 or HP-UX B.11.00
Class Apple | Mac OS | 9.X | general purpose
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<9%SI=>3FFF)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0|A0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Mac OS 9.2.2
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ)
T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple MacOS 9.2.2
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<32EA6&>111%IPID=I%TS=1000HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0|40%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Apple Newton MessagePad 2100, Newton OS 2.1
Class Apple | Newton OS || PDA
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=R%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=R%Ops=)
T7(DF=N%W=1000%ACK=S%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Arescom 800 series dsl router
Class Arescom | embedded || broadband router
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Arescom NetDSL 1000NDS series ADSL router
Class Arescom | embedded || broadband router
TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint ARLAN BR2000E V5.0E Wireless Radio Bridge
Class Arlan | embedded || bridge
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Asante FriendlyNet FR3004 Series Internet Hub
Class Asante | embedded || hub
TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint AsanteHub 2072 Ethernet hub
Class Asante | embedded || hub
TSeq(Class=C)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Asante 6524-2G GigE switch
Class Asante | embedded || switch
TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Asante IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 ))
Class Asante | embedded || switch
TSeq(Class=C%Val=4090000)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Asante IntraSwitch 5324
Class Asante | embedded || switch
TSeq(Class=C%Val=80000)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Asante IntraSwitch 62xx (6216M in this case) Firmware v2.05A (16-port managed switch)
Fingerprint Asante IntraSwitch 6216M firmware v2.05A
Class Asante | embedded || switch
TSeq(Class=TD%gcd=<C28C%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend DSLPipe DSL-50S-CELL DSL router
Class Ascend | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<671E2&>114%IPID=I%TS=U)
T1(DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Max 1800 50Ap8+ or 2024 router
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<F)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend P130 Router
Class Ascend | embedded || router
TSeq(Class=RI%gcd=<6%SI=>BBB&<BBBB)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Ascend P75 router
Class Ascend | embedded || router
TSeq(Class=RI%gcd=<6%SI=>500&<FFFF)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 400/T1 (Software V 4.5B)
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<FF)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 50
Class Ascend | embedded || router
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 50 rev 4.6C
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710%SI=<5)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline 50 running 5.1A Firmware
Class Ascend | embedded || router
TSeq(Class=64K)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Pipeline P130 or 50
Class Ascend | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<BB)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend GRF Router running Ascend Embedded/OS 2.1
Class Ascend | Embedded/OS || router
TSeq(Class=RI%gcd=<5%SI=>600)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash - I think meant TAOS
Fingerprint Ascend / Lucent MAX TNT terminal server
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=<14F46&>346)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Ascend Mac 6000 Terminal access server (dialup access server) Running TAOS 9.0.9
# Lucent (Acend) DSLMAX 20 revision 8.0.7
Fingerprint Ascend Mac 6000 Terminal access server
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=<919BA&>E5D%IPID=BI%TS=U)
T1(DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend Max terminal server firmware 7.0.4
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=<14&>1000)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend TNT OS +5.0Ap48+
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Ascend/Lucent Max (HP,4000-6000) version 6.1.3 - 7.0.2+
Class Ascend | TAOS || terminal server
TSeq(Class=RI%gcd=<6%SI=>1000)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MiNT with MiNTnet 1.03 running on Atari TT
Class Atari | Atari || game console
TSeq(Class=TD%gcd=3E7%SI=0)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(Resp=N)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Atari Mega STE running JIS-68k 3.0
Class Atari | Atari || general purpose
TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86)
T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint AtheOS ( www.atheos.cx )
Class AtheOS | AtheOS || general purpose
TSeq(Class=RI%gcd=<8%SI=<A78&>6)
T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AtheOS/Syllable 0.4.2
Class AtheOS | AtheOS || general purpose
TSeq(Class=RI%gcd=<A%SI=<1BDA%IPID=I%TS=U)
T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Audio Codes MP-104 - VoIP Gateway FXO (version 4.0.282.350)
Fingerprint AudioCodes MP-104 VoIP Gateway FXO
Class AudioCodes | embedded || VoIP gateway
TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=N%W=20F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=20F4%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AudioCodes MP-108 FXS (iptele gateway) version: 4.40.162.274
Fingerprint AudioCodes MP-108 VoIP Gateway FXS
Class AudioCodes | embedded || VoIP gateway
TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Auspex Fileserver (AuspexOS 1.9.1/SunOS 4.1.4)
Class Auspex | AuspexOS || fileserver
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Avaya G3 PBX version 8.3
Class Avaya | embedded || PBX
TSeq(Class=RI%gcd=<6%SI=<652372&>89CC%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Avaya IP Office 403 PBX
Class Avaya | embedded || PBX
TSeq(Class=RI%gcd=<6%SI=<2B46872&>6EC4D%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1111%ACK=S++%Flags=R%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
PU(Resp=N)

# Avaya TN2302 Prowler/Medpro H.323 gateway HW03/FW022
Fingerprint Avaya TN2302 Prowler/Medpro H.323 gateway
Class Avaya | embedded || telecom-misc
TSeq(Class=TD%gcd=<6%SI=<14%IPID=I)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Avocent net KVM switch
Class Avocent | embedded || specialized
TSeq(Class=TR|RI|i800%gcd=<2004%SI=<40D8%IPID=I%TS=1000HZ)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Avocent CPS 1610 serial port server
Class Avocent | embedded || terminal server
TSeq(Class=RI%gcd=<14004%SI=<10C2%IPID=I%TS=1000HZ)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Axent Raptor Firewall running on Windows NT
Class Axent | Windows | NT/2K/XP | firewall
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

# Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
Fingerprint AXIS or Meridian Data Network CD-ROM server
Class AXIS | embedded || fileserver
TSeq(Class=C)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS NetEye Camera Server V1.20
# AXIS NPS 53X Printer Server V4.26 Jul 01 1995
# AXIS StorPoint CD-ROM server V 4.20
# AXIS Camera 200pV1.41
Fingerprint AXIS Stack -- CD-ROM server or print server or camera server
Class AXIS | embedded || fileserver
Class AXIS | embedded || print server
Class AXIS | embedded || webcam
TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS StorPoint CD E100 CD-ROM Server V5.32 Jan 19 2001
Fingerprint AXIS StorPoint CD E100 CD-ROM Server
Class AXIS | embedded || fileserver
TSeq(Class=TD%gcd=<80004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS StorPoint CD E100 CD-ROM Server V5.20 Oct 27 1999
Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.20
Class AXIS | embedded || fileserver
TSeq(Class=C%Val=4B80000%IPID=I%TS=U)
T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS StorPoint CD E100 CD-ROM Server V5.38 Jan 12 2004
Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.38
Class AXIS | embedded || fileserver
TSeq(Class=C%Val=30D40000%IPID=I%TS=U)
T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS 540 Ethernet Print Server ver 5.48
Class AXIS | embedded || print server
TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS 540 Print Server
Class AXIS | embedded || print server
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS 540/542 print server v5.30 Jan 24 1997
Fingerprint AXIS 540/542 Print Server v5.30
Class AXIS | embedded || print server
TSeq(Class=C)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS Print Server firmware 7.0.2
Class AXIS | embedded || print server
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=)
T4(DF=N%W=100%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS 200+ Web Camera running OS v1.42
Class AXIS | embedded || webcam
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)

Fingerprint AXIS 2120 network camera
Class AXIS | embedded || webcam
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# AXIS 200+ Webcam running software version is 1.42
Fingerprint AXIS Neteye 200+ Webcam running software version 1.42
Class AXIS | embedded || webcam
TSeq(Class=TD|C%gcd=<80004%SI=<1E%Val=DFB80000%IPID=RD|I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint AXIS NetEye Camera Server V1.20
Class AXIS | embedded || webcam
TSeq(Class=C)
T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# AXIS 540+/542+
# AXIS 5400 print server
Fingerprint AXIS Network Print Server
Class AXIS | Linux || print server
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=)
T4(DF=N%W=100%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# The AXIS 2100 Network Camera Operating System, Linux/CRIS, is based on the Linux 2.0 kernel with non-MMU CPU patches from uClinux. The HTTP server used is based on Boa. The source code for the Linux/CRIS kernel, Boa and more is available at http://developer.axis.com/.
Fingerprint AXIS 2100 Network Camera running Linux/CRIS v2.32
Class AXIS | Linux || webcam
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Barix Exstreamer network MP3 player
Class Barix | embedded || media device
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99)
# Bay Networks ASN Processor revision 9, SE100NM and SFNM modules
Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9
Class Bay Networks | embedded || router
T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Bay Networks Instant Internet router
Class Bay Networks | embedded || router
TSeq(Class=TD%gcd=1000|2000|3000%SI=<BB)
T1(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Bay Networks Instant Internet router
Class Bay Networks | embedded || router
TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S%Flags=R%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Baystack Instant Internet 400 SoHo Router
Class Bay Networks | embedded || router
TSeq(Class=RI%gcd=<24%SI=<4D33C&>C46)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S%Flags=R%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Bay Networks BayStack 310T switch
Class Bay Networks | embedded || switch
TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=<F)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BayStack 28115/ADV Fast Ethernet Switch
Class Bay Networks | embedded || switch
TSeq(Class=TD%gcd=<6%SI=<FF)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Fingerprint BayStack 450-24T HW:RevL  FW:V1.47 SW:v3.1.0.22  ISVN:1
Fingerprint BayStack 450-24T switch
Class Bay Networks | embedded || switch
TSeq(Class=TD%gcd=<1F8%SI=<50%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# BayTech RPC4 with Network Module (Data Switch Series - F3.03 (C)2000 DS72C808 Bay Technical Associates DS72)
# BayTech rpc3-15NC Remote Power Control device
Fingerprint BayTech Remote Power Control RPC3-15NC or RPC4
Class BayTech | embedded || power-device
TSeq(Class=TD|RI%gcd=<C%SI=<4272&>95%IPID=I|RD%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=ARF%Ops=)
T3(Resp=N)
T4(DF=N%W=800|1000%ACK=S%Flags=ARF%Ops=)
T5(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BBIagent v1.8.1 software router
Class BBIagent | Linux | 2.4.X | software router
TSeq(Class=RI%gcd=<6%SI=<18C54&>3B8%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Running on a BeBox 66Mhz
Fingerprint BeOS 4 - 4.5
Class Be | BeOS | 4.X | general purpose
TSeq(Class=TD%gcd=1%SI=0)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS 5.0.4 (BeOS 5 Pro + BONE 7a)
Class Be | BeOS | 5.X | general purpose
TSeq(Class=TD%gcd=<6%SI=<C8%IPID=I%TS=U)
T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS 5.03 x86 with the BONE network stack
Class Be | BeOS | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<141E&>1F%IPID=I%TS=U)
T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS 5.1d0/DANO on x86
Class Be | BeOS | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U)
T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint BeOS R5.03 Personal Edition
Class Be | BeOS | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# IPC@CHIP (SC12) -@CHIP-RTOS version SC12 V1.10 Beta Test version MEDIUMBuild: Nov 26 2003
Fingerprint IPC@CHIP CHIP-RTOS version SC12
Class Beck-IPC | embedded || specialized
TSeq(Class=TD%gcd=<C354%SI=<28%IPID=I%TS=1000HZ)
T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Belkin DSL/Cable Router running firmware v1.03.08
Fingerprint Belkin DSL/Cable Router
Class Belkin | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Plan9 x86 (2004.11.06)
# Plan 9 4th edition on x86
Fingerprint Bell Labs Plan9 Fourth Edition
Class Bell Labs | Plan9 || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MWN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Bell Labs Plan9 Fourth Edition (x86)
Class Bell Labs | Plan9 || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Bell Labs Plan9 Second Edition
Class Bell Labs | Plan9 || general purpose
TSeq(Class=TR)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BenQ Wireless Lan Router AWL700
Class BenQ | embedded || WAP
TSeq(Class=TD%gcd=<34%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Billion ADSL Router BIPAC 711CE
Fingerprint Billion ADSL router
Class Billion | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<1315F78&>306D3%IPID=Z)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Billion BIPAC-741GE V2 ADSL Router/Modem - Firmware 4.55 (HW: Helium 210-80 ADSL GE-A v1.00)
Fingerprint Billion BIPAC-741GE V2 aDSL Router
Class Billion | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<DF2A&>137%IPID=I%TS=U)
T1(DF=Y%W=1194%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=Y%W=1194%ACK=O%Flags=R%Ops=)
T3(Resp=N)
T4(DF=Y%W=1194%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# BIANCA/BRICK-XS version V.6.2 Rev. 5 from 2003/05/26 00:00:00
Fingerprint BinTEC BIANCA/BRIK-XS Broadband router V. 6.X
Class BinTec | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<54E5C&>C09%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# BINTEC-X4000 version V.7.1 Rev. 4 (Patch 3) IPSec
# BinTec BingoDSL Router Firmware version 7.1 Rev.1 Patch 11
Fingerprint BinTec BingoDSL/X4000 Router Firmware V. 7.1
Class BinTec | embedded || broadband router
TSeq(Class=RI%gcd=<8%SI=<240E&>1A%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# XS SW Release 4.9.1 ISDN access router
# BinTec BIANCA XM OS version 4.93
Fingerprint BinTec XS/XM ISDN access router V. 4.9.1-4.9.3
Class BinTec | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=>FF&<FFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=0%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# VPN Access 25 version V.7.1 Rev. 12
Fingerprint VPN Access 25 version V. 7.1
Class BinTec | embedded || broadband router
TSeq(Class=TD%gcd=<6%SI=<1E%TS=U)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Blue Coat Security Proxy Appliance
Class Blue Coat | embedded || web proxy
TSeq(Class=RI%gcd=<6%SI=<A4704&>780%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Blue Coat SG6000 Series - SGOS 3.2.2.1
Fingerprint Blue Coat ProxySG (SGOS 3.2.2.1)
Class Blue Coat | SGOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<43F10C&>4CBD%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Blue Coat SGOS 2.0.09 (Release ID: 20047)
# Blue Coat SGOS 3.0.1.0 (Release ID: 20069)
Fingerprint Blue Coat Secure Gateway
Class Blue Coat | SGOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<15654E&>1CC9%IPID=I%TS=2HZ)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint BlueCoat SG4
Class Blue Coat | SGOS || web proxy
T1(DF=N%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MENWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Borderware 5.0 Firewall
Class Borderware | embedded || firewall
TSeq(Class=TR|RI%gcd=<204%SI=<14)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Borderware 5.2 firewall
Class Borderware | embedded || firewall
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(Resp=N)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Borderware 6.0.2 firewall
Class Borderware | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Bosch Security Systems's Divar Digital Video Recorder Version 2.00
Class Bosch | embedded || webcam
TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint BreezeCOM BreezeACCESS Wireless bridge
Class BreezeCOM | embedded || bridge
TSeq(Class=RI%gcd=<6%SI=<988&>4%IPID=I%TS=U)
T1(DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# http://www.brixnetworks.com/products/brix1000.html
Fingerprint Brix 1000 Verifier
Class Brix Networks | embedded || specialized
TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Brother Laser Printer HL 1230
Fingerprint Brother HL-1230 Printer
Class Brother | embedded || printer
TSeq(Class=TD%gcd=<DC004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Brother HL-2070N Printer Firmware Ver.1.03 (04.11.18)
Fingerprint Brother HL-2070N printer
Class Brother | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<1C67888&>48B5D%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 2.0 - 2.1
Class BSDI | BSD/OS | 2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD)
Class BSDI | BSD/OS | 3.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 4.0-4.0.1
Class BSDI | BSD/OS | 4.X | general purpose
TSeq(Class=RI%gcd=<A%SI=<1974A&>16F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 4.0.1
Class BSDI | BSD/OS | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<F85E8&>27A9)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint BSDI BSD/OS 4.2
Class BSDI | BSD/OS | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<F3E94&>1A4F%IPID=I%TS=2HZ)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cabletron Smart Switch Router 8600
Class Cabletron | embedded || router
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Cabletron Systems SSR 8000 smart switch router System Software, Version 3.1.B.16
Class Cabletron | embedded || router
TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Cabletron SmartSwitch, Hardware Revision: 00R, Firmware Revision: 05.00.48, BOOTPROM Revision: 02.02.00
Fingerprint Cabletron SmartSwitch
Class Cabletron | embedded || switch
TSeq(Class=TD%gcd=<180004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Cabletron Switch model 6H202-24 Module Hardware Revision: 00A Module Firmware Revision: 05.05.11 Module BootPROM Revision: +03.06.04
Fingerprint Cabletron switch
Class Cabletron | embedded || switch
TSeq(Class=RI|TD%gcd=<404%SI=<263E%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint CacheFlow 6000 web proxy cache running CacheOS 4.1.05
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

# (rel. ID: 17908)
Fingerprint CacheFlow 6000 web proxy running Security Gateway 2.1.0
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<CB91C&>15C0%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cacheflow 6x5 web proxy cache running CacheOS 3.1.19-4.1.05
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<CF3F0&>16F5%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# CacheFlow CacheOS (CacheFlow 500-5000 web cache) CFOS 2.1.08 - 2.2.1
Fingerprint CacheFlow CacheOS (web proxy cache) CFOS 2.1.08 - 2.2.1
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<5%SI=>BBBB&<FFFFF)
T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint CacheFlow CacheOS 3.1 on a model 6000 web proxy cache
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<6%SI=<6DE6416&>1C6E5%IPID=RPI%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint CacheOS (CacheFlow 2000 proxy cache)
Class CacheFlow | CacheOS || web proxy
TSeq(Class=RI%gcd=<5%SI=>1111)
T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon GP 160 PF printer
Class Canon | embedded || printer
TSeq(Class=TD%gcd=<C04%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Canon iR 2200 printer
Class Canon | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Canon Image Runner C3200
Fingerprint Canon iR C3200 printer
Class Canon | embedded || printer
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Canon imageRunner iR2270 printer
Fingerprint Canon iR2270 printer
Class Canon | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<977D4&>5EC%IPID=I%TS=2HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon iR6000 printer
Class Canon | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon iR7200 Printer
Class Canon | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Canon photocopier/fax/scanner/printer GP30F
Class Canon | embedded || printer
TSeq(Class=TD%gcd=600%SI=0)
T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Canon inkjet printer iP4000R with Wireless interface
Fingerprint Canon Pixmar IP4000R printer
Class Canon | embedded || printer
TSeq(Class=TD%gcd=<20004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++|O%Flags=AS|A%Ops=M|)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Capellix 3000 Modular SAN Switch
Class Capellix | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint CastleNet AR502/GlobespanVirata GS8100 (same thing) DSL router
Class CastleNet | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# http://www.cayman.com/
Fingerprint Cayman 2E DSL/CABLE router
Class Cayman | embedded || broadband router
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cayman 3000 DSL Router
Class Cayman | embedded || broadband router
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Netopia Cayman 3346 DSL router
Class Cayman | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Chase/Perle IOLAN terminal server
Class Chase | embedded || terminal server
T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(Resp=N)

#  Chase/Perle IOLAN Terminal Server v3.5.02 CDi
Fingerprint Chase/Perle IOLAN terminal server
Class Chase | embedded || terminal server
TSeq(Class=TD%gcd=<84%SI=<1E)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# These boxes give goofy PU RIPTL results (like 3549 and 4801) so I removed
# that test
Fingerprint Chase/Perle IOLAN terminal server
Class Chase | embedded || terminal server
TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Nokia IPSO 3.2 Running Check Point Firewall-1
# IPSO 3.5-FCS8 releng 1020  Running Check Point FW-1 NG FP2
Fingerprint Nokia IPSO 3.2-3.5 Running Check Point Firewall-1 or NG FP2
Class Check Point | IPSO || firewall
TSeq(Class=RI%gcd=<6%SI=<E4656&>2476)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)

# Nokia IPSO 3.2-3.2.1 releng 783-849
# IPSO 3.4-FCS4A releng 767  Running CheckPoint 4.1 SP6
# Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based)
# Nokia IPSO 4.3.1-FCS5
Fingerprint Nokia IPSO 3.2-4.3.1-FCS5 Running checkpoint FW1
Class Check Point | IPSO || firewall
TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Nokia IPSO 3.6 FCS 6 releng 1061  01.21.2003-230310 i386 w/ CheckPoint FW-1 NG FP 2, SSL & DNS hotfix and SmartDefense Supplemental
Fingerprint Nokia IPSO 3.6 running Check Point FW-1 NG FP2
Class Check Point | IPSO || firewall
TSeq(Class=RI%gcd=<6%SI=<7A148&>A01%IPID=I%TS=2HZ)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Check Point Firewall-1 NG on Sun Solaris 8
Class Check Point | Solaris | 8 | firewall
TSeq(Class=RI%gcd=<6%SI=<6C82C&>E51%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build)
Class Check Point | Windows | NT/2K/XP | firewall
TSeq(Class=RI%gcd=<6%SI=<18358&>3CB)
T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Check Point Firewall-1 on Windows NT 4.0 Server SP4-SP5
Class Check Point | Windows | NT/2K/XP | firewall
TSeq(Class=TD%gcd=<8%SI=<154)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Check Point Firewall-1/VPN-1 SecurePlatform NG, running FeaturePack 3
Fingerprint Check Point SecurePlatform NG FP3
Class Check Point | Windows | NT/2K/XP | firewall
TSeq(Class=RI%gcd=<6%SI=<1C6F042&>48C8B%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco CacheOS (1.1.0)
Class Cisco | CacheOS || web proxy
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco 675 DSL router -- cbos 2.1
Class Cisco | CBOS || broadband router
T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M)
T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco ACNS 5.1 Content Engine
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<BFC80E&>1EAE1%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Content Engine 505 Software V. 4.2.1
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<2D75904&>5AE06%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0|CC%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# running Application and Content Networking System Software 4.2.3
# Fingerprint Cisco Content Engine 560 Software V. 4.2.3
Fingerprint Cisco Content Engine 560 running Content Networking System V. 4.2.3
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<19440B6&>40ACE%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Application and Content Networking System Software Release 5.3.1 (build b5 Mar 17 2005)
Fingerprint Cisco Content Engine ACNSS V5.2.1 or V5.3.1
Class Cisco | Content Networking System || web proxy
TSeq(Class=RI%gcd=<6%SI=<1A91BDA&>44018%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Accesspoint 1200
Class Cisco | embedded || bridge
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco AIR-WGB340 V8.38 Workgroup Bridge 340
Fingerprint Cisco AIR-WGB340 V8.38 Wireless workgroup bridge 340
Class Cisco | embedded || bridge
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1F4|1000%ACK=S++%Flags=AR|AS%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco WGB350 Wireless WorkGroup Bridge
Class Cisco | embedded || bridge
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=5C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 760 Series ISDN router (non IOS) or IBM Stackable Hub
Class Cisco | embedded || broadband router
Class IBM | embedded || hub
TSeq(Class=TD|i800%gcd=<14004%SI=<14)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1)
Class Cisco | embedded || broadband router
TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router
Class Cisco | embedded || broadband router
TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=<F)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 766 non-IOS software 4.2(3.5)
Class Cisco | embedded || broadband router
TSeq(Class=TD%gcd=82000%SI=<F)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Soho 97 router running IOS 12.3(8)
Class Cisco | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR|BAR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 3000 Series VPN Concentrator
Class Cisco | embedded || encryption accelerator
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Cisco VPN 3005 running 4.1.2   
# Cisco VPN Series 3000 Concentrator running OS version 4.1.2
# Cisco VPN Concentrator running IOS 4.1.7
Fingerprint Cisco 3000 Series VPN concentrator (OS ver 4.1.x)
Class Cisco | embedded || encryption accelerator
TSeq(Class=RI%gcd=<6%SI=<306F34E&>29F4D%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 3Com 4924 gigabit switch ver 2.04
# Cisco VPN 3000 3.5
Fingerprint Cisco VPN 3000 or 3Com 4924 GigE Switch
Class Cisco | embedded || encryption accelerator
Class 3Com | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco CSS 11501 Content Services Switch
Class Cisco | embedded || load balancer
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco CSS 11501 Content Services Switch
Class Cisco | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<159FA&>235%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco Local Director 420 version 2.1.1
Class Cisco | embedded || load balancer
TSeq(Class=C)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

# The "True Random" is bogus, it is because of sequences
# from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869
# Cisco Localdirector 430, running OS 2.1
Fingerprint Cisco LocalDirector load balancer
Class Cisco | embedded || load balancer
TSeq(Class=TR|C)
T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# LocalDirector 430 Version 4.2.4
Fingerprint Cisco LocalDirector load balancer
Class Cisco | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<2F240C&>789A%IPID=BI%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco Router C2600 running IOS 12.2(2)T
Class Cisco | embedded || router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|800|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4)
Class Cisco | embedded || router
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 1548M 10/100 Managed Switch (Firmware Version: v1.03.02)
Fingerprint Cisco 1548M managed switch
Class Cisco | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 1900 switch, Bay networks 350-450 switch,  or Netopia DSL/ISDN router
Class Cisco | embedded || switch
Class Bay Networks | embedded || switch
Class Netopia | embedded || broadband router
TSeq(Class=TD%gcd=<6000%SI=<1E)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 2820 switch Management Console
Class Cisco | embedded || switch
TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N|Y)

# Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5)
# Cisco Catalyst 5500 with OS Version 6.3(5)
# Alcatel OmniSwitch/Router! Version 4.3.1 GA
Fingerprint Cisco Catalyst 5500/6500 or Alcatel OmniSwitch/Router
Class Cisco | embedded || switch
Class Alcatel | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Cisco 6509 Cisco Internetwork Operating System Software IOS Version 12.1(23)E
Fingerprint Cisco Catalyst 6509 switch running IOS Version 12.1(23)E
Class Cisco | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL|MENN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MNW|MW|ML)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco Catalyst switch
Class Cisco | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or
# Trancell WebRamp router or Xylan OmniSwitch 3.2.X.X - 3.4.X.X
# Epson Stylus Color 1520C with 100BTX-NIC from Epson
# Cisco 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX
# SonicWALL firewall appliance 10meg firmware 3.3.1
Fingerprint Router/Switch/Printer/Firewall (LanPlex 2500/Cisco Catalyst 5505/Cisco 6509/Trancell Webramp/Xylan OmniSwitch)/Epson Stylus (100BTX-NIC HP Secure Web Console, SonicWALL firewall appliance 3.3.1)
Class Cisco | embedded || switch
Class Xylan | embedded || switch
Class Epson | embedded || printer
Class SonicWALL | SonicOS || firewall
Class Trancell | embedded || router
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco AS5200 terminal server
Class Cisco | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# A Cisco ATA 186 is a little box that allows a standard POTS
# telephone to be used as a voice-over-IP phone.  There is a
# variation, the ATA 188 that has a pass-through port, much like the
# Cisco 7960 phone.
Fingerprint Cisco ATA 186 POTS<->VoIP phone gateway device
Class Cisco | embedded || VoIP adapter
TSeq(Class=TD%gcd=<A0000%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=ARF%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint Cisco ATA 186 POTS<->VoIP phone gateway device
Class Cisco | embedded || VoIP adapter
T1(Resp=N)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 7960 SIP Phone running OS 4.2
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<2A004%SI=<28%IPID=I%TS=U)
T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco IP phone (POS3-04-3-00, PC030301)
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<C004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco IP Phone 7910 or 7940 Firmware 3.1
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<1E004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco IP Phone - Model NumberCP-7940G
# Cisco IP Phone 7940 Series CP-7940G
Fingerprint Cisco IP Phone 7940
Class Cisco | embedded || VoIP phone
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IP Phone 7960
Class Cisco | embedded || VoIP phone
TSeq(Class=TD%gcd=<2A004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=578%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=578%ACK=S%Flags=R%Ops=)
T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco IP Phone CP-7970G
# Cisco IP Phone 7970G running firmware 6.0.3sr1
Fingerprint Cisco IP Phone 7970G
Class Cisco | embedded || VoIP phone
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=2000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco ATA 186 (analog telephone adaptor (VoIP)) firmware Rev. B0
# Cisco (Komodo) ATA-186 Version: v2.16 ata18x (Build 030401a)
# Cisco ATA 186 or 7905 VoIP Phone
# Cisco IP Phone 7905 Software Version 1.02.00
# Cisco IP Phone 7912 - Software Version 1.02.02(031217B) - Product ID CP-7912G
# Cisco VoIP Phone (commonly used by Vonage)
# Cisco CP-7912G IP Phone
Fingerprint Cisco VoIP Phone 7905/7912 or ATA 186 Analog Telephone Adapter
Class Cisco | embedded || VoIP phone
Class Cisco | embedded || VoIP adapter
TSeq(Class=TD%gcd=<28004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=578|3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=578|3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Cache Engine Web Proxy
Class Cisco | ACNS || web proxy
TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Cisco 2501, 2504, 4500
Fingerprint Cisco 2501/2504/4500 router with IOS Version 10.3(15) - 11.1(20)
Class Cisco | IOS | 10.X | router
Class Cisco | IOS | 11.X | router
TSeq(Class=RI|TD%gcd=<6%SI=<2000)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1600/3640/7513 Router (IOS 11.2(14)P)
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<6%SI=<11170)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DECBrouter90T1 Runs Cisco IOS 10.2(5)
# Cisco 1601, IOS 11.0
Fingerprint Cisco 1601 (IOS 11.0) or DECbrouter90T1 (Runs Cisco IOS 10.2(5))
Class Cisco | IOS | 11.X | router
Class DEC | IOS | 10.X | router
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 4500 router running IOS 11.2(2)
Class Cisco | IOS | 11.X | router
T1(DF=N%W=860%ACK=S++|O%Flags=AS|A%Ops=M|)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Cisco 4500-M router running IOS 11.3(6) IP Plus
Class Cisco | IOS | 11.X | router
TSeq(Class=RI|TD%gcd=1%SI=<FFF)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 7206 router (IOS 11.1(17)
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<6%SI=>666)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 7206 running IOS 11.1(24)
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<5%SI=<CCCC&>CC)
T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS 11.3 - 12.0(11)
Class Cisco | IOS | 11.X | router
Class Cisco | IOS | 12.X | router
TSeq(Class=TD|RI%gcd=<6)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T
Class Cisco | IOS | 11.X | router
TSeq(Class=RI%gcd=<4%SI=<999&>CC)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# 25XX/45XX router, 29XX switch, RSP2 processor
Fingerprint Cisco Router/Switch with IOS 11.2
Class Cisco | IOS | 11.X | router
Class Cisco | IOS | 11.X | switch
TSeq(Class=RI%gcd=<6%SI=<18000)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 3640 router IOS 11.1(7)AX [KUONG(7)AX]
# Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6
Fingerprint Cisco switch/router with IOS 11.1(7)-11.2(8.10)
Class Cisco | IOS | 11.X | router
Class Cisco | IOS | 11.X | switch
TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
T1(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1)
Class Cisco | IOS | 11.X | terminal server
TSeq(Class=RI%gcd=<6%SI=>BBB)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 827 ADSL router running IOS 112.2(11)
Class Cisco | IOS | 12.X | broadband router
TSeq(Class=RI%gcd=<6%SI=<1B1F2&>24E%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Cisco 827 ADSL router running IOS 12.1(1)XB1
Class Cisco | IOS | 12.X | broadband router
TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 1601 router running IOS 12.0(8)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<B4DC&>8A%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1601R router running IOS 12.1(5)
Class Cisco | IOS | 12.X | router
TSeq(Class=TD%gcd=<6%SI=<32%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 1721 Router running IOS 12.3(10)
Fingerprint Cisco 1721 router running IOS 12.3(10)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=O|S++%Flags=A|AS%Ops=|ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 2514 router running IOS 12.0(21)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# CISCO 2600 router running IOS 12.2(3)
Fingerprint Cisco 2600 router running IOS 12.2(3)
Class Cisco | IOS | 12.X | router
TSeq(Class=TD|RI%gcd=<8%SI=<F302&>249%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# CISCO 2610 router running IOS 12.2(21a)
Fingerprint Cisco 2610 router running IOS 12.2(21a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Cisco 2611 router running IOS 12.0(7)T
Fingerprint Cisco 2611 router running IOS 12.0(7)T
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<C8546&>49%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# Cisco 2611 router running IOS 12.2(7a)
Fingerprint Cisco 2611 router running IOS 12.2(7a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IOS (tm) 1600 Software (C1600-K8OSY-M), Version 12.2(15)T9
# Cisco 2620 Router /w IOS 12.2(15)T14
Fingerprint Cisco 2620 router running IOS 12.2(15)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<1938568&>4088D%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 2620 router running IK903S3-M ios ver 12.3(5)
Fingerprint Cisco 2620 router running IOS 12.3(5)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 2620 running IOS 12.2(19a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 3660, IOS 12.0(6r)T
Fingerprint Cisco 3660 running IOS 12.0(6r)T
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# cisco 3725 IOS (tm) 3700 Software (C3725-IS-M), Version 12.3(6c), RELEASE SOFTWARE (fc1)
Fingerprint Cisco 3725 router running IOS 12.3(6c)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 3745 Router running IOS version 12.2(15)T13
Fingerprint Cisco 3745 Router running IOS 12.2(15)T13
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Cisco 4000 series, IOS 4500 Software (C4500-P-m), Version 12.0(10.3)S
Fingerprint Cisco 4000 Series running IOS 12.0(10.3)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI|TD%gcd=<6%SI=<F50%IPID=Z%TS=U)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco 7200 router running IOS 12.1(14)E6
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 7200 running IOS 12.4(1a)
Fingerprint Cisco 7200 router running IOS 12.4(1a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=B8%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 7204 IOS (tm) 7200 Software (C7200-IS-M), Version 12.1(19), RELEASE SOFTWARE (fc1)
Fingerprint Cisco 7204 router running IOS 12.1(19)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 7206 router running IOS Version 12.2(13)T8
Fingerprint Cisco 7206 router running IOS 12.2(13)T8
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IOS (tm) C800 Software (C800-Y6-MW), Version 12.0(7)T,  RELEASE SOFTWARE (fc2)
Fingerprint Cisco 800 Series Broadband Routers running IOS 12.0(7)T
Class Cisco | IOS | 12.X | router
TSeq(Class=TD|RI%gcd=<8%SI=<1399EE&>3219%IPID=Z%TS=U)
T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 837 router running IOS 12.3(11)T
# Cisco 2811 router running IOS 12.3(8r)T7
Fingerprint Cisco 837 router running IOS 12.3(11)T or Cisco 2811 router running IOS 12.3(8r)T7
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R|BR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 837 Router IOS version 12.3T(8)
Fingerprint Cisco 837 router running IOS 12.3(8)T
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco AS5350, IOS 12.2(2)XB6
Fingerprint Cisco AS5350 running IOS 12.2(2)XB6
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MEML|MEMWL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MML|MMWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco IOS 12.0(3.3)S (perhaps a 7200 router)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco IOS 12.0(16a) Service Provider feature set
# Cisco WS-C3508G-XL running 12.0(5)WC3
Fingerprint Cisco IOS 12.0(5)WC3 - 12.0(16a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 1700 running IOS 12.0(7)T
Fingerprint Cisco IOS 12.0(7)T (on a 1700 router)
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<7A6C&>D%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS 12.1(4) on a 2600 router
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<A%SI=<9772&>3A%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 7507 running 12.2(8)T5
Fingerprint Cisco IOS 12.2(8)T5 on a 7507 router
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 1720 router running 12.2.8T4 with IP/FW/PLUS/3DES feature set
# Cisco 801 router running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1)
# Cisco Aironet 1100/1200/1400 access point running IOS 12.2.15
Fingerprint Cisco router or WAP running IOS 12.2
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 12008 running IOS 12.0(18.6)S1
# Cisco 7206VXR running IOS 12.0(18)S
Fingerprint Cisco router running IOS 12.0(18)S or 12.0(18)S1
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 800 running 12.1(5)
# Cisco 2620 router running IOS 12.1(6)
Fingerprint Cisco router running IOS 12.1
Class Cisco | IOS | 12.X | router
TSeq(Class=RI%gcd=<6%SI=<ABC2&>78%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Cisco 3620 running IOS 12.2.1
# IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1)
Fingerprint Cisco router running IOS 12.1(5)-12.2(7a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco 2620, IOS 12.2(6r)
# Found on Cisco 1720/1750/2611/3640/AS5300 routers
Fingerprint Cisco router running IOS 12.1.5-12.2.13a
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco WS-C4006
# Cisco 7120-4T1 ISO 12.2
# CISCO 2950C
# Cisco 3600
Fingerprint Cisco router running IOS 12.2
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 2621 running IOS 12.2.8T
# Cisco SOHO 77 running IOS 12.2(8)T
Fingerprint Cisco router running IOS 12.2(8)T
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco IOS Software, C1700 Software (C1700-ADVSECURITYK9-M), Version 12.3(11)T3, RELEASE SOFTWARE (fc4)
Fingerprint Cisco router running IOS 12.3(11)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Cisco Router (1760) - IOS (tm) C1700 Software, Version 12.3(6)
# IOS (tm) 3700 Software (C3745-IS-M), Version 12.3(6), RELEASE SOFTWARE (fc3) 
# Cisco 837 router running IOS 12.3.8T3
# CISCO C827 (MPC855T) processor (revision 0x501) with 23552K/1024K bytes of memory.
# Cisco 2611XM router running IOS 12.3(10)
# Cisco 2921XM router running IOS 12.3(6a)
# Cisco 7206VXR running IOS 12.3(6b)
# Cisco 831 running IOS Version 12.3(8)T3
# Cisco 3825 Router, IOS 12.3(11)T3 (C3825-ADVSECURITYK9-M, Version 12.3(11)T3, RELEASE SOFTWARE+(fc4))
Fingerprint Cisco router running IOS 12.3(6) - 12.3(11)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R|BR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco 5200 router IOS v12.0(15)
# Cisco 2924C
Fingerprint Cisco router running IOS v12.0(15)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IOS (tm) SOHO91 Software (SOHO91-K9OY6-M), Version 12.3(2)XC, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) (Cisco SOHO 91 Secure router)
Fingerprint Cisco SOHO 91 secure router running IOS 12.3
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco Lightstream 1010 ATM Switch running IOS (tm) LS1010 WA4-5 Software (LS1010-WP-M), Version 12.1(23)E, RELEASE SOFTWARE (fc2)
# Cisco 6500 switch running IOS 12.1(23)E
Fingerprint Cisco switch running IOS 12.1(23)E
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ML)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# router Cisco 3640, IOS 12.2(23a)
Fingerprint router Cisco 3640 running IOS 12.2(23a)
Class Cisco | IOS | 12.X | router
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco catalyst 2924 running IOS 12.0(5)WC5
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# Cisco Catalyst 2924XL-EN running IOS 12.0(5)WC8
Fingerprint Cisco Catalyst 2924XL switch running IOS 12.0(5)
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco Catalyst 2950 switch running IOS 12.0(5.3)WC(1)
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Cisco Catalyst 2950 switch,  IOS 12.1(9)EA1
Fingerprint Cisco Catalyst 2950 switch running IOS 12.1(9)EA1 or IOS 12.1(22)EA2
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MEM)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MM)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco IOS 12.0(5)WC5a on a catalyst 2900XL switch
Class Cisco | IOS | 12.X | switch
TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco 1200 access point (WAP) running IOS 12.2(8)
Class Cisco | IOS | 12.X | WAP
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cisco AP1220 IOS 12.2(11)JA1
Fingerprint Cisco AP1220 WAP running IOS 12.2(11)
Class Cisco | IOS | 12.X | WAP
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cisco CPA2500 (68030) or 2511 router
Class Cisco | IOS || router
TSeq(Class=RI%gcd=<6%SI=>FFF)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco uBR 7223 router
Class Cisco | IOS || router
TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cisco Catalyst 4006 Switch running NmpSW 7.4(2)
Class Cisco | NmpSW || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cisco PIX 4.2(2) Internal Interface
Class Cisco | PIX | 4.X | firewall
TSeq(Class=C)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 515 firewall running software 4.4(5)
Class Cisco | PIX | 4.X | firewall
TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall running PIX 4.1(5)
Class Cisco | PIX | 4.X | firewall
TSeq(Class=C%Val=211E005F)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco Pix Firewall running PIX 4.1.6
Class Cisco | PIX | 4.X | firewall
TSeq(Class=C%Val=71F60191%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800|1000%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|400%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX v4.2 Firewall
Class Cisco | PIX | 4.X | firewall
TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL)
T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL)
PU(Resp=N)

# Cisco PIX running IOS 6.1(1) - Internal interface
# Cisco PIX 520 firewall running PixOS 6.1(3)
# Secure PIX Firewall Version 5.2(2)
Fingerprint Cisco PIX Firewall (PixOS 5.2 - 6.1)
Class Cisco | PIX | 5.X | firewall
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR|AS%Ops=WNMETL|M)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco Secure PIX Firewall Version 5.0(2)
Class Cisco | PIX | 5.X | firewall
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

# Cisco 535 IOS 6.2 PIX running in failover mode... ie.. idle
# PIX 506 running PIX IOS 6.2
Fingerprint Cisco Firewall (PIX 6.1.4 - 6.2.2)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 501 firewall running PIX 6.1(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%IPID=I%TS=U)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 515 or 525 Firewall running 6.1(4) - 6.2(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

# Cisco PIX 501 Firewall running IOS 6.3(1)
# Cisco PIX Firewall IOS version 6.22
# Cisco PIX 515 version 6.3(1)
# Cisco PIX 501 Firewall running PIXOS 6.3.3
Fingerprint Cisco PIX Firewall running PIX 6.2 - 6.3.3
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=400||800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall Version 6.1(2)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX Firewall Version 6.2(1)
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Cisco PIX Firewall Version 6.2(2) - 6.3
Class Cisco | PIX | 6.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Cisco PIX 506 Firewall
Class Cisco | PIX || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
PU(Resp=N)

# Sun Remote System Console version 1.12
# Brocade Fibre Switch, Firmware 2.6.0
# Cisco Aironet 340 WAP running v 12.03T of the firmware (and VxWorks OS)
Fingerprint Cisco Aironet WAP, Brocade Fibre Switch, or Sun Remote System Console
Class Cisco | VxWorks || WAP
Class Brocade | embedded || switch
Class Sun | embedded || remote management
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Clipcomm CP-100 v1.1.39 (040820)
Fingerprint Clipcomm CP-100 VoIP phone
Class Clipcomm | embedded || VoIP phone
TSeq(Class=TD%gcd=<9B4%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM)
T2(Resp=N)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cnet CNIG904B Internet Broadband Gateway firmware version 1.11
Class Cnet | embedded || broadband router
TSeq(Class=TD%gcd=<F4%SI=<1D6%IPID=Z%TS=U)
T1(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# CNT UltraNet EDGE (SAN Router) softwareversion 1.4.1.2
Fingerprint CNT UltraNet EDGE (SAN Router) V. 1.4.1.2
Class CNT | embedded || storage-misc
TSeq(Class=TD%gcd=<61AC%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Cobalt Linux 4.0 (Fargo) Kernel 2.0.34C52_SK on MIPS or TEAMInternet Series 100 WebSense
Class Cobalt | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Commodore 64 with TFE Ethernet Card (Contiki)
Class Commodore | embedded || game console
TSeq(Class=TD%gcd=<18%SI=<1E%IPID=RD|I%TS=U)
T1(DF=N%W=F4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Commodore 64 with TFE Ethernet Card (uIP TCP/IP stack)
Class Commodore | embedded || game console
TSeq(Class=C%Val=FFFFFFFF%IPID=RD%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=APF%Ops=)
T3(Resp=Y%DF=N%W=16D0|1CA%ACK=O%Flags=APF%Ops=)
T4(DF=N%W=16D0|5B4%ACK=O%Flags=APF%Ops=)
T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Compaq Inside Management Board
Class Compaq | embedded || remote management
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq Integrated Lights Out remote configuration Board
Class Compaq | embedded || remote management
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=O%Flags=R%Ops=)
T2(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ProLiant DL580 Integrated Lights-Out remote configuration board V1.06 14.5.2002
Fingerprint Compaq ProLiant DL580 Integrated Lights-Out remote configuration board V1.06
Class Compaq | embedded || remote management
TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U)
T1(DF=N%W=400%ACK=O%Flags=R%Ops=)
T2(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Compaq iPAQ Connection Point (WAP) model CP-2W Rev1.00
# NetGear MR814 WAP
Fingerprint WAP: Compaq iPAQ Connection Point or Netgear MR814
Class Compaq | embedded || WAP
Class Netgear | embedded || WAP
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Compaq Tru64 UNIX (formerly Digital UNIX) 4.0e
Class Compaq | Tru64 UNIX | 4.X | general purpose
TSeq(Class=C)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX 4.0e
Class Compaq | Tru64 UNIX | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<7BE80&>DAF%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# OSF1 V4.0 1530 alpha
# Tru64 4.0F (Alpha), Patch Kit 8, Kernel Build 1229
Fingerprint Tru64 UNIX 4.0f - 4.0g
Class Compaq | Tru64 UNIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Compaq Tru64 UNIX 5.0 on AlphaServer
# DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A on a DEC 4000 Model 610 running OpenVMS V7.2
Fingerprint Compaq Tru64 UNIX 5.0 or DEC OpenVMS 7.2
Class Compaq | Tru64 UNIX | 5.X | general purpose
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Compaq Tru64 UNIX V5.1B (Rev. 2650)
Fingerprint Compaq Tru64 UNIX V5.1B
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP Tru64 UNIX v5.1B: OSF1 V5.1 2650 alpha
Fingerprint HP Tru64 UNIX v5.1B
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint OSF1 5.0 Rev. 910 (AKA Compaq/DIGITAL Tru64 UNIX)
Class Compaq | Tru64 UNIX | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<E88&>11)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Compaq T1010 Thin Client Windows CE 2.12
Class Compaq | Windows | PocketPC/CE | terminal
TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Compatible Systems ISDN/leased-line/dialup Microrouter 2220R w/ firmware v4.5
Class Compatible Systems | embedded || broadband router
TSeq(Class=TD%gcd=388|710|A98%SI=<14)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Compatible Systems ISDN/leased-line/dialup MicroRouter 900i v3.0.9
Class Compatible Systems | embedded || broadband router
TSeq(Class=TD%gcd=388|710|A98%SI=<F)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Tested against: 3 RISC Routers (2600i, 2800, and 3500R) all running
# firmware 4.5 and two IntraPorts running 4.4.02.  I'm told this also
# applies to firmware 4.2 on RISC routers, but I have not checked.
Fingerprint Compatible Systems (RISC Router, IntraPort)
Class Compatible Systems | embedded || router
TSeq(Class=TD%gcd=388|710|A98%SI=<6)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Compex CGX3224 Switch, Firmware version CGX1.53
Fingerprint Compex CGX3224 Switch
Class Compex | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint CompUSA Broadband Router
Class CompUSA | embedded || broadband router
TSeq(Class=RI|TR%gcd=<6%SI=<7FCAA42%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=101F%ACK=O%Flags=R%Ops=)
T5(DF=N%W=101F%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=101F%ACK=O%Flags=R%Ops=)
T7(DF=N%W=101F%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Computone Power Rack IntelliServer terminal server Release 1.5.4d
Class Computone | embedded || terminal server
TSeq(Class=TD%gcd=40%SI=0)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Conexant ADSL Router Firmware 2.33a (FreeBSD)
Fingerprint Conexant ADSL Router
Class Conexant | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<1B50D00&>45EAE%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B) with Conexant-Hasbani CX82xxx_4.1.0.9 firmware running on VxWorks 5.4.2 OS
Fingerprint Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B)
Class Conexant | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Contiki 1.2-devel0 on Ethernut (Atmel AVR ATmega128 with RTL8019as Ethernet chip)
# uIP 0.9 running on a Atmel ATmega16 using a Packet Whacker for ethernet connectivity
Fingerprint Contiki 1.2-devel0 embedded OS on Ethernut card or uIP 0.9 TCP/IP stack
Class Contiki | Contiki || specialized
Class uIP | uIP || specialized
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Convex OS Release 10.1
Class Convex | ConvexOS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Convex SPP-UX 5.2.1
Class Convex | SPP-UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=)
T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint SPP-UX 5.x on a Convex SPP-1600
Class Convex | SPP-UX || general purpose
TSeq(Class=C)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=R%Ops=)
T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP j4813A ProCurve Switch 2524
# Copper Mountain Networks DSL Concentrator
# Compaq Remote Insight Lights-Out remote console card
# 3Com Home Wireless Gateway 3CRWE50194-E1, firmware 1.14
# TrueTime NTS-200 GPS Network Time Server
# Compaq Lights Out Edition firmware v2.41
# 3Com NBX 25 (Phone System) Version: R1_0_3
Fingerprint Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com NBX 25 phone system or Home Wireless Gateway, or TrueTime NTP clock
Class Copper Mountain | embedded || terminal server
Class 3Com | embedded || WAP
Class 3Com | embedded || telecom-misc
Class TrueTime | embedded || specialized
Class Compaq | embedded || remote management
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Corega BAR SW-4P  [Part number:CG-BARSW4P]
Fingerprint Corega BAR SW-4P Broadband Access Router
Class Corega | embedded || broadband router
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint UNICOS 10.0.0 on Cray 90
Class Cray | UNICOS | 10.X | general purpose
TSeq(Class=RI%gcd=<F%SI=<22222&>2222)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cray UNICOS/mk 8.6
Class Cray | UNICOS | 8.X | general purpose
TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1
Class Cray | UNICOS || general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2
Class Cray | UNICOS || general purpose
TSeq(Class=RI%gcd=<6%SI=>F)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Unisys LX/NX MCP 46.1/HMP 5.0 on an Unisys LX5120
Fingerprint Cray Unisys LX/NX MCP 46.1/HMP 5.0 on LX5120
Class Cray | Unisys || general purpose
TSeq(Class=RI%gcd=<6%SI=<7868FCE&>CF0B8%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyberguard 4.0 firewall
Class Cyberguard | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=>FFFF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Cyberguard Firewall 5.2 on Firestar 500 (proprietary Unixware version)
Fingerprint Cyberguard Firewall 5.2
Class Cyberguard | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<5FE3BC&>A86A%IPID=RD%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O|S++%Flags=R|AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint Cyclades PathRouter
Class Cyclades | Cyras || router
TSeq(Class=TD|RI%gcd=<618708%SI=<EEE47C)
T1(DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRouter/PC
Class Cyclades | Cyras || router
TSeq(Class=RI|TD%gcd=<618708%SI=<1F343)
T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Cyclades PathRAS Remote Access Server v1.1.7
Class Cyclades | Cyras || terminal server
TSeq(Class=RI%gcd=<6%SI=>BBBBB)
T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRouter V 1.2.4
Class Cyclades | Cyros || router
TSeq(Class=RI%gcd=<6%SI=>BBBBB)
T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12
Class Cyclades | Cyros || terminal server
TSeq(Class=TD%gcd=30C382%SI=<BB)
T1(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=218|0%ACK=S|S++%Flags=AR%Ops=|M)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# D-Link Internetwork Operating System Software 2630 Series Software, Version 1.3.1J (FULL), RELEASE SOFTWARE
Fingerprint D-Link 2630 Broadband router
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<2DC04%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-713P Wireless router (firmware 2.60 build 6a)
# 704P Ethernet Broadband Gateway
Fingerprint D-Link 704P Broadband Gateway or DI-713P WAP
Class D-Link | embedded || broadband router
TSeq(Class=RI|TD%gcd=<68%SI=<3A2%IPID=I|BI%TS=U)
T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-604 Broadband router
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<68%SI=<13A6&>16%IPID=BI%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-604 Ethernet Broadband Router with firmware V3.01
# D-link 4 port Ethernet Broadband Router DI-604 H/W Ver.:D1 F/W Ver.:3.01
Fingerprint D-Link DI-604 Ethernet Broadband Router
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-604 Ethernet router
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<2C0%SI=<14%IPID=BI%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-701, Version 2.22
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=N)
T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U)
T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-704P Cable/DSL Residential Gateway firmware version 2.57 build 3
Fingerprint D-Link DI-704P Cable/DSL Residential Gateway
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<68%SI=<1338&>13%IPID=I%TS=U)
T1(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-804 Cable/DSL Residential Gateway (with firmware v2.00B7)
# DI-804 Broadband Router with Firmware 2.01
Fingerprint D-Link DI-804 Cable/DSL Residential Gateway
Class D-Link | embedded || broadband router
TSeq(Class=TD|TR%gcd=<10%SI=<3C%IPID=I%TS=U)
T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-804HV 4-Port Broadband VPN Router
# US-Robotics Wireless Router : Revision Number : Model#8022, Version V4.2, CheckSum# B719
Fingerprint D-Link DI-804HV VPN Router or US-Robotics 8022 WAP or DI-714P+ Wireless router
Class D-Link | embedded || broadband router
Class US Robotics | embedded || WAP
TSeq(Class=TD%gcd=<3EC%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DSL-300G+ version 7.1.0.30 AnnexA  (Oct 18 2002) R2.05.b4t9uk
Fingerprint D-Link DSL-300G+ DSL modem
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<1731C%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint D-Link DSL-500 DSL modem
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<1FBD4%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DSL-500 DSL modem
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<EA64%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# D-Link Systems DI-713P Wireless Gateway with firmware 2.60 build 6a
Fingerprint D-Link Systems DI-713P Wireless Gateway
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<CC%SI=<9EC&>2%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-714P+, Firmware V1.33
# D-Link 4-port Broadband VPN Router DI-804HV
Fingerprint D-Link VPN Router DI-714P+/DI-804HV
Class D-Link | embedded || broadband router
TSeq(Class=TD%gcd=<3EC%SI=<6E%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DI-701 Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30
Fingerprint DI-701 Residential Gateway or KA9Q NOS - KO4KS-TNOS v. 2.30
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=N)
T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled
# Date: Oct 14 1997, Time: 09:35:04  (claims software version 2.04B3,
# boot PROM version 2.21)
Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21
Class D-Link | embedded || hub
TSeq(Class=TD%gcd=1388%SI=0)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link Print Server Model DP-101P+
Fingerprint D-Link Print Server
Class D-Link | embedded || print server
TSeq(Class=TD%gcd=<374%SI=<1E)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint D-Link VoIP Gateway GS-104SH
Class D-Link | embedded || telecom-misc
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

# D-Link DI-604 Ethernet router using firmware 1.62 build 2
# DI-707P router
# Sitecom - Broadband Home Station - Firmware R1.96c
# SMC Barricade Broadband Router with firmware R1.96h2 - internal interface
Fingerprint Broadband router or WAP: D-Link DI-series, Sitecom BHS WAP, or SMC Barricade
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-713P - Firmware version 2.60 build 2
Fingerprint D-Link DI-713P WAP
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DI-713P Wireless Gateway (2.57 build 3a)
Class D-Link | embedded || WAP
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link DI-774 - Firmware Version: 2.27
Fingerprint D-Link DI-774 WAP
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint D-Link DWL-5000AP WAP/BSP 1.3
Class D-Link | embedded || WAP
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# SMC Barricade Wireless Broadband Router (firmware R1.93e)
# D-Link DL-707 Cable/DSL Router
# USR8022 Wireless Cable/DSL Router with firmware V3.1
# Tonze IP-W314E  22 Mbps Wireless All-In-One Broadband Router
Fingerprint D-Link, SMC, Tonze, or US Robotics Wireless Broadband router
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<130%SI=<1E%IPID=RD|I%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# D-Link Wireless Access Point (WAP) DRC-1000AP - v3.2.28
# 3Com 11Mpbs Wireless LAN Access Point 2000 (Firmware 1.2)
Fingerprint Wireless access point (WAP): D-Link DRC-1000AP or 3Com Access Point 2000
Class D-Link | embedded || WAP
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint D-Link DCS-1000 webcam with firmware 1.06
Class D-Link | embedded || webcam
TSeq(Class=TD%gcd=<E0%SI=<14%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=ASF%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint D-Link dcs-5300w Wireless WebCam
Class D-Link | embedded || webcam
TSeq(Class=TD%gcd=<18%SI=<64%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=)
T4(Resp=N)
T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Dlink DVC-1100 Wireless Broadband VideoPhone (Application Version 4.0.0.155, Boot Loader Version 2.0.0.2, App Loader Version 1.0.300.102)
Fingerprint D-Link DVC-1000 Wireless Broadband VideoPhone
Class D-Link | embedded || webcam
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint AOS/VS on a Data General mainframe
Class Data General | AOS/VS || general purpose
TSeq(Class=TD%gcd=32|64|96%SI=1)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint AOS/VS or VSII
Class Data General | AOS/VS || general purpose
TSeq(Class=TD%gcd=40|80|C0%SI=0)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Data General DG/UX Release R4.11MU02
Class Data General | DG/UX || general purpose
TSeq(Class=TD%gcd=10000|20000|30000%SI=<F)
T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Data General DG/UX Release R4.20MU02
Class Data General | DG/UX || general purpose
TSeq(Class=TD%gcd=<20004%SI=<1E)
T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# DG/UX DataGeneral_Server R4.20MU04 generic AViiON Pentium Pro
Fingerprint Data General DG/UX Release R4.20MU04
Class Data General | DG/UX || general purpose
TSeq(Class=RI%gcd=<6%SI=<32CBC&>281)
T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Data General DG/UX Release R4.20MU06
Class Data General | DG/UX || general purpose
TSeq(Class=RI%gcd=<6%SI=<E21EE&>779%IPID=I%TS=U)
T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=)
T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint 4.3BSD-tahoe on a MicroVax III
Class DEC | BSD-misc || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OSF/1 V1.3A - 2.0
Class DEC | Digital UNIX | 1.X | general purpose
Class DEC | Digital UNIX | 2.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Digital UNIX OSF1 V 3.0,3.2,3.2C
Class DEC | Digital UNIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC Digital UNIX OSF1 V 4.0-4.0F
Class DEC | Digital UNIX | 4.X | general purpose
TSeq(Class=C|RI%gcd=<6)
T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint Digital UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F
Class DEC | Digital UNIX | 4.X | general purpose
TSeq(Class=RI|TD|64K%gcd=<6)  # Boy, OSF1 comes in all colors!
T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OSF1 (AKA Compaq/DIGITAL Tru64 UNIX) Version 5.0.0
Class DEC | Digital UNIX | 5.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint OSF/1 (AKA Compaq/DIGITAL Tru64 UNIX) 5.60
Class DEC | Digital UNIX | 5.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint DECNIS 600 V4.1.3B multiprotocol bridge/router
Class DEC | embedded || router
TSeq(Class=TD%gcd=30D4|C35%SI=<F)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# DECserver 700-16, Network Access SW V2.2
Fingerprint DECserver 700-16 terminal server, Network Access SW V2.2
Class DEC | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=600%ACK=S++|O%Flags=AR|A%Ops=)
T4(DF=N%W=600%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.1
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<4D8%IPID=BI%TS=U)
T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=AS%Ops=MWL)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DIGITAL TCP/IP Services for OpenVMS Alpha Version V4.2 - ECO 4 on a AlphaServer 8400 5/625 running OpenVMS V6.2-1H3
Fingerprint DEC OpenVMS 6.2
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2 - 7.2-1 on VAX or AXP
Class DEC | OpenVMS | 6.X | general purpose
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 6.2/Alpha
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS Alpha 6.2 running DIGITAL TCP/IP Services (UCX) v4.0
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS AXP 6.2 running Attachmate Pathway 3.1 TCP stack
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=i800|64K)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS V6.1 on VAX 4000-105A
Class DEC | OpenVMS | 6.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1 ALPHA
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8A840&>1009%IPID=I%TS=U)
T1(DF=N%W=7E4A%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7E4A%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7E00%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1 Alpha running DIGITAL's UCX v4.1ECO2 TCP/IP package
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI|TD%gcd=<6%SI=<BBBB)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MWL)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A - ECO 1 on a AlphaServer DS20 500 MHz running OpenVMS V7.2-1
Fingerprint DEC OpenVMS 7.2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<527E2&>543%IPID=I%TS=U)
T1(DF=N%W=C3A5%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C3A5%ACK=O%Flags=A%Ops=)
T4(DF=N%W=C350%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<44%SI=<2670&>3B%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Digital OpenVMS Alpha 7.2
Fingerprint DEC OpenVMS 7.2 Alpha
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# The OS was running on a GS1280 Alpha server
Fingerprint DEC OpenVMS 7.3
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OpenVMS 7.3 with TCP/IP 5.3
Fingerprint DEC OpenVMS 7.3 (Alpha) TCP/IP 5.3
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.3 (Compaq TCP/IP 5.3)
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.3-1
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<56E82&>B37%IPID=I%TS=U)
T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS Alpha 7.2-3
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=C6C%ACK=S++|O%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS V7.1 on VAX 6000-530
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package
Class DEC | OpenVMS | 7.X | general purpose
T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# DEC VAXVMS TCPIP V5.1-15  Full LP Installed
Fingerprint DEC OpenVMS v7.3 on VAXStation 4000/60
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U)
T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS VAX V7.3, Process Software MultiNet V5.0
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U)
T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL)
T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL)
T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint DEC VMS MultiNet V4.2(16)/ OpenVMS V7.1-2
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC VMS MultiNet V4.4 / OpenVMS V7.1
Class DEC | OpenVMS | 7.X | general purpose
TSeq(Class=TR%gcd=<6%TS=2HZ)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC TOPS-20 Monitor 7(102540)-1,TD-1
Class DEC | TOPS-20 || general purpose
TSeq(Class=TD%gcd=30000|60000|90000%SI=<BB)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC TOPS-20 Monitor 7(21733),KL-10 (DEC 2065)
Class DEC | TOPS-20 || general purpose
TSeq(Class=TD%gcd=<60004%SI=<1E%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint DEC Ultrix 4.1
Class DEC | Ultrix || general purpose
TSeq(Class=64K)
T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC Ultrix 4.2 - 4.5
Class DEC | Ultrix || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC OpenVMS 7.3-1 w/Multinet 4.4
Class DEC | VMS || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC VAX 7000-610 or 4200/SPX OR 6000-430
Class DEC | VMS || general purpose
TSeq(Class=64K)
T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1800%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint DEC VAX/VMS 5.3 on a MicroVAX II
Class DEC | VMS || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# VMS 5.5-2 on VAX (VaxStation 4)
Fingerprint DEC VAX/VMS 5.5-2
Class DEC | VMS || general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint DEC VAX/VMS v5.5, CMU-TEK TCP/IP stack
Class DEC | VMS || general purpose
TSeq(Class=RI%gcd=<6%SI=>BBBBB)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=64%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=64%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint DEC VMS MultiNet V4.1(16)
Class DEC | VMS || general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# dell 5100 printer
# Dell 3100cn printer, OEM of Xerox DocuPrint C525A
Fingerprint Dell 3100cn/5100cn printer
Class Dell | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3000%ACK=S++|O%Flags=AR|A%Ops=)
T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=4E4%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# Dell Remote Access Card III/XT
# Dell Remote Access Card 4/I (DRAC4)
# Drac III/XT Administation Card for Dell PowerEdge
# Dell Remote Access Controller 4/I (DRAC 4/I) Version 1.20 (Build 03.15)
Fingerprint Dell Remote Access Controller III/XT or 4/I
Class Dell | embedded || remote management
TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Dell Powervault 132T Automated Tape Library
Class Dell | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Dell PowerVault 132T Library (Firmware 103D.GY001)
Fingerprint Dell Powervault 132T Automated Tape Library
Class Dell | embedded || storage-misc
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=578%ACK=O%Flags=A%Ops=)
T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Dell Tape Library MSL6030
Class Dell | embedded || storage-misc
TSeq(Class=TD%gcd=<2004%SI=<1D6%IPID=I%TS=1000HZ)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Dell PowerConnect 3324 Switch
# Dell PowerConnect 3348 Switch, Software Version 1.2.0.6 Boot Version 1.0.0.13
# Dell 3324 PowerConnect Switch with firmware version 1.1.0.42
Fingerprint Dell PowerConnect Switch 3324 or 3348
Class Dell | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=200|800%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200|800%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Dell PowerConnect 5324 24 Port Gigabit Switch
Fingerprint Dell PowerConnect Switch 5324
Class Dell | embedded || switch
TSeq(Class=TD%gcd=<2C%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Dell PowerConnect Switch running SW V.1.0.0.52
Fingerprint Dell PowerConnect Switch running SW V.1.0.0.52
Class Dell | embedded || switch
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Digital Link DL2001 CSU/DSU Management Access Processor
Class Digital Link | embedded || CSUDSU
TSeq(Class=TD%gcd=<2780%SI=<14)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Digital Networks VNswitch 900
Class Digital Networks | embedded || switch
TSeq(Class=TD%gcd=<4%SI=<4)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Digitel NetRouter NR3000
Class Digitel | embedded || router
TSeq(Class=RI%gcd=<2004%SI=<10CC&>16)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Digitel NetRouter NR3100
Class Digitel | embedded || router
TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Draytek Vigor 2000 ISDN router
Class Draytek | embedded || broadband router
T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Draytek Vigor 2200e DSL router v2.1a
Class Draytek | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Draytek Vigor 2200e DSL router v2.1b
Class Draytek | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<2D38FC2&>72E8A%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Software version VIK-1.35.020320j -- www.easytel.fi
Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router
Class Easytel | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Edimax BR-6004 Broadband router
Class Edimax | embedded || broadband router
TSeq(Class=i800%IPID=I%TS=2HZ)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)

Fingerprint Edimax PS-1001 Print Server model
Class Edimax | embedded || print server
TSeq(Class=TD%gcd=<1C004%SI=<244%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Edimax PS-901 Print Server model 1P/13E-9.5.12
Class Edimax | embedded || print server
TSeq(Class=RI%gcd=<2004%SI=<12D4&>1C%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint Efficient Networks/SpeedStream DSL router
Class Efficient Networks | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Eicon Diva1830 ISDN router running 1.5 firmware
Class Eicon | embedded || broadband router
TSeq(Class=TD%gcd=<20004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
T2(Resp=Y%DF=N%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1%ACK=O%Flags=R%Ops=)
T7(DF=N%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM 1100 Office, Firmware 2.50.0005 / 15.11.2001
Fingerprint ELSA LANCOM 1100 office router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint ELSA LANCOM DSL I-10 Office router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=WNMETL)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM Wireless L-11 3.42.0021 / 24.06.2004
# Lancom (Elsa) DSL I-10 Office Firmware 3.2
Fingerprint ELSA LANCOM DSL I-10 Office router or Wireless L-11
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# LANCOM DSL/10 Office DSL router with firmware v3.22
Fingerprint ELSA LANCOM DSL/10 Office DSL router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM DSL/10 Office router 2.62.0002
Fingerprint ELSA LANCOM DSL/10 office router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint ELSA LANCOM DSL/10 office router
Class Elsa | embedded || broadband router
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# ELSA LANCOM DSL/I-1611 Office 2.70.0025 / 06.08.2002 http://www.lancom-systems.de/
# ELSA LANCOM DSL/I-1611 Office 2.50.0005 / 15.11.2001
Fingerprint ELSA LANCOM DSL/I-1611 Office router
Class Elsa | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

Fingerprint EMC DART running on a Data Mover fileserver. Version T4.1.8.1
Class EMC | DART || fileserver
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint EMC IP4700 Filer
Class EMC | DART || fileserver
TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Enterasys XSR-1805 Software Version 6.0.0.0, Built Sep 14 2003, 11:09:28
Fingerprint Enterasys XSR-1805 Security Route
Class Enterasys | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<55280&>B75%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Enterasys XP-2400 switch running Enterasys E9.0.0.0
# Cabletron Smartswitch 6000 running Enterasys E8.2.0.0
Fingerprint Enterasys/Cabletron switch running Enterasys E8.2.0.0 - E9.0.0.0
Class Enterasys | embedded || switch
TSeq(Class=RI%gcd=<6%SI=<7A31E&>10AD%IPID=I%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98
Class Epson | embedded || printer
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=)
T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20
Class Epson | embedded || printer
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Ericsson Congo router running software version 9.9.34
Fingerprint Ericsson Congo router
Class Ericsson | embedded || broadband router
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Ericsson HM220dp ADSL modem/router
Class Ericsson | embedded || broadband router
TSeq(Class=TD%gcd=<50000%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Ericsson Tigris Access Server V. 12.1.15 with 10.2 ISDN code
# Integrated Access Platform, Software Version  = 12.1.1.22 (ISDN Software Version 10.1)
Fingerprint Ericsson Tigris Access Server Software V. 12.1.*
Class Ericsson | embedded || terminal server
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Exabyte X80 tape backup robot
Class Exabyte | embedded || storage-misc
TSeq(Class=TD%gcd=<6004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0|0%ACK=S++|O%Flags=AS|AR%Ops=M|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Extreme Gigabit switch (unknown version)
Class Extreme Networks | embedded || switch
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Extreme Networks Black Diamond switch
Class Extreme Networks | embedded || switch
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Extreme Networks Alpine 3804 Switch running Extremeware 6.2.1
Class Extreme Networks | Extremeware || switch
TSeq(Class=RI%gcd=<6%SI=<1598C&>223)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Extremeware Version 6.2.2 (Build 68) by Release_Master 01/15/03 16:58:48
Fingerprint Extremeware 6.2.2
Class Extreme Networks | Extremeware || switch
TSeq(Class=RI%gcd=<6%SI=<2F062&>36C%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint F5 Labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86)
Class F5 Labs | BSDI || load balancer
TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# F5 labs BIG-IP Load balancer.  BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386
# F5 BIG-IP 540 loadbalancer.
Fingerprint F5 Labs BIG-IP Load balancer Kernel 4.1.1PTF-03 (x86)
Class F5 Labs | embedded || load balancer
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint F5 Labs BIG-IP load balancer kernel 4.2PTF-05a (x86)
Class F5 Labs | embedded || load balancer
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint FastComm FRAD (Frame Relay Access Device) F9200-DS-DNI -- Ver. 4.2.3A
Class FastComm | embedded || specialized
TSeq(Class=TD|RI%gcd=<8%SI=<1E)
T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Fiber Line Wireless Broadband DSL Router, type: 802.11g, hardware release: R1.03SRM firmware version: V1.96.1g
Fingerprint FiberLine Wireless DSL router
Class FiberLine | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<23C9F22&>5B99B%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint FiberLine WL-1200R1 (also known as InterEpoch IWE-1200A-1) Wireless Broadband Router (WAP)
Class FiberLine | embedded || WAP
TSeq(Class=TD%gcd=<8%SI=<14%IPID=I%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# FlowPoint 144 or 22XX DSL Router v3.0.8
# SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready
Fingerprint DSL Router: FlowPoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1
Class FlowPoint | embedded || broadband router
Class SpeedStream | embedded || broadband router
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E)

Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router
Class FlowPoint | embedded || broadband router
Class ASCOM | embedded || broadband router
TSeq(Class=TD%gcd=<6%SI=<FF)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Fore ForeThought 7.1.0 ATM switch
Class Fore | embedded || switch
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Fore ATM BX200 (S_ForeThought_ATM_8.3.0.N) GA-Update (1.133285)
Fingerprint Fore ForeThought 8.3.0.N ATM BX200 switch
Class Fore | embedded || switch
TSeq(Class=RI%gcd=<3EC%SI=<2F9B8&>5BD%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Fortigate-50A running FortiOS V2.80,build393,050405
Fingerprint Fortinet firewall Fortigate 50A (FortiOS V2.80)
Class Fortinet | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(DF=Y%W=16D0%ACK=O%Flags=AS%Ops=M)
PU(Resp=N)

# Fortinet Fortigate-60 firewall version 2.80,build430,050609
Fingerprint Fortinet firewall Fortigate 60
Class Fortinet | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry FastIron Edge Switch (load balancer) 2402
Class Foundry | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<3E418&>988%IPID=RD%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Foundry 1500 OS Ver 7.2.06T51
# Foundry ServerIron XL 16 Port 7.3.06T12
Fingerprint Foundry Load Balancer OS Ver 7.2.X - 7.3.X
Class Foundry | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint Foundry Networks Biglron 8000 load balancer
Class Foundry | embedded || load balancer
TSeq(Class=RI%gcd=<6%SI=<4C464&>294%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry FastIronII 4000 load balancer running 06.6.34T43
Class Foundry | IronWare || load balancer
TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry NetIron load balancer OS Ver. 7.1.23T13
Class Foundry | IronWare || load balancer
TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry Networks, Inc. Router/Load balancer, IronWare Version 06.5.12T43
Class Foundry | IronWare || load balancer
TSeq(Class=C)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Foundry ServerIron XL load balancing IP Switch Version 06.0.00T12
Class Foundry | IronWare || load balancer
TSeq(Class=C)
T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint FreeBSD 2.1.0 - 2.1.5
Class FreeBSD | FreeBSD | 2.X | general purpose
TSeq(Class=64K)
T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 2.2.1 - 4.1
Class FreeBSD | FreeBSD | 2.X | general purpose
Class FreeBSD | FreeBSD | 3.X | general purpose
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<38E50&>906)
T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M)
T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E)

Fingerprint FreeBSD 2.2.1-STABLE
Class FreeBSD | FreeBSD | 2.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<74A54&>1295)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 3.2-4.0
Class FreeBSD | FreeBSD | 3.X | general purpose
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<92D42&>1769)
T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint FreeBSD 3.4-RELEASE
Class FreeBSD | FreeBSD | 3.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<58AD4&>3BB)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# DragonFly 1.1-Stable #0: Sun Nov 14 17:22:45 CET 2004
# DragonFly 1.1-CURRENT (i386) build on 2004/12/03
Fingerprint DragonFly 1.1-Stable (FreeBSD-4 fork)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.0-20000208-CURRENT
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<63074&>FC4)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.1.1 - 4.3 (x86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.10-STABLE  i386
Fingerprint FreeBSD 4.10-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.3-RC
# FreeBSD 4.2-RELEASE i386
Fingerprint FreeBSD 4.2 - 4.3-RC (x86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<B23B8&>CD3%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.3 - 4.4-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.3 - 4.4PRERELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.4 for i386 (IA-32)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.4-5 or Apple Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13)
Class FreeBSD | FreeBSD | 4.X | general purpose
Class Apple | Mac OS X | 10.0.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ)
T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002
Fingerprint FreeBSD 4.4-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.5-RELEASE (or -STABLE) (x86)
# FreeBSD 4.6-RC
Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) through 4.6-RC (x86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.6-RELEASE FreeBSD 4.6-RELEASE #0 i386
Fingerprint FreeBSD 4.6
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8AAA2&>96A%IPID=I%TS=U)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# 4.6-RELEASE
# 4.6-STABLE
# 4.6.2-RELEASE-p6
Fingerprint FreeBSD 4.6 through 4.6.2 (July 2002) (x86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%IPID=I%TS=100HZ)
T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6-RC on Alpha
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.6.2-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.8-RELEASE
# 4.7-STABLE FreeBSD 4.7-STABLE #0: Tue Nov 19 16:13:55 2002
Fingerprint FreeBSD 4.6.2-RELEASE - 4.8-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-RELEASE
# FreeBSD 4.8-RELEASE-p13
Fingerprint FreeBSD 4.7 - 4.8-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-RELEASE-p3 FreeBSD 4.7-RELEASE-p3 #0: Wed Jan 8 21:31:21 CET 2003 i386
Fingerprint FreeBSD 4.7-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.7-RELEASE through 4.8-RELEASE (x86)
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-RELEASE-p3 on i386
Fingerprint FreeBSD 4.7-RELEASE-p3
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.7-STABLE (Jan 2003)
Fingerprint FreeBSD 4.7-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.9-PRERELEASE alpha
# FreeBSD 4.8-RELEASE on DEC Alpha
# FreeBSD 4.9-STABLE (platform unspecified)
Fingerprint FreeBSD 4.8-RELEASE through 4.9-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.8-STABLE (June 2003)
Fingerprint FreeBSD 4.8-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|1000HZ)
T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.8-STABLE (June 2003)
Fingerprint FreeBSD 4.8-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.8-STABLE - 4.9-PRERELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.0-RELEASE x86
# sparc64 running FreeBSD 5.1-RELEASE
# FreeBSD 4.9-STABLE FreeBSD 4.9-STABLE  i386
Fingerprint FreeBSD 4.9 - 5.1
Class FreeBSD | FreeBSD | 4.X | general purpose
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
T1(DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 4.9-RELEASE-p1 #0 i386
Fingerprint FreeBSD 4.9-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# 4.9-RELEASE FreeBSD 4.9-RELEASE #0
Fingerprint FreeBSD 4.9-RELEASE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 4.9-STABLE
Class FreeBSD | FreeBSD | 4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

#  FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002
Fingerprint FreeBSD 5.0-CURRENT (Apr 2002)
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.0-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.0-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD somehost.someplace 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Jan 29 12:31:51 CST 2003 i386
# FreeBSD 5.0-RELEASE Alpha
Fingerprint FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003)
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.1-CURRENT (June 2003) on Sparc64
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.1-RELEASE (x86)
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.2
Class FreeBSD | FreeBSD | 5.X | general purpose
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|84%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.2-CURRENT (Jan 2004) on x86
# FreeBSD 5.2.1-RELEASE i386
# FreeBSD 5.3-RELEASE #0
Fingerprint FreeBSD 5.2 - 5.3
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3-RELEASE
# FreeBSD 5.2-CURRENT i386
# FreeBSD 5.4-RELEASE #4
# FreeBSD 5.4-Stable
# FreeBSD 5.4-STABLE #0
# BummiOS 5.4-CURRENT i386 (based on FreeBSD 5.4-STABLE)
Fingerprint FreeBSD 5.2 - 5.4
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|U)
T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.2-CURRENT (Jun 25, 2004) on x86 running pf as firewall with "scrub in all"
# FreeBSD 5.3-Beta2 (x86)
# FreeBSD 5.3-RELEASE (x86) Generic kernel
Fingerprint FreeBSD 5.2-CURRENT - 5.3 (x86) with pf scrub all
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.2.1 running on Ultra5 spac64
Fingerprint FreeBSD 5.2.1 (SPARC)
Class FreeBSD | FreeBSD | 5.X | general purpose
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3-STABLE (x86) as of 2004.11.14
# FreeBSD 5.3-RELEASE
Fingerprint FreeBSD 5.3
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3rc3 with pf scrub all
Fingerprint FreeBSD 5.3
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# FreeBSD 5.3-RELEASE i386
Fingerprint FreeBSD 5.3-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint FreeBSD 5.3-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3-STABLE #7 Tue Feb 8 17:55:23 WET 2005 i386
Fingerprint FreeBSD 5.3-STABLE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.3-STABLE as of 2004-11-14, pf scrib in all random-id
Fingerprint FreeBSD 5.3-STABLE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# FreeBSD 5.4-RC2 FreeBSD 5.4-RC2 #2 i386
# FreeBSD 5.4-STABLE FreeBSD 5.4-STABLE #7 i386
Fingerprint FreeBSD 5.4
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=O|S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 5.4-RELEASE-p2 i386
Fingerprint FreeBSD 5.4-RELEASE
Class FreeBSD | FreeBSD | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# FreeBSD 6.0-CURRENT #1 i386
# FreeBSD 5.2.1-RELEASE
Fingerprint FreeBSD 5.2.1-RELEASE or 6.0-CURRENT
Class FreeBSD | FreeBSD | 6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint FreeSCO 0.27 (Linux 2.0.38)
Class FreeSCO | Linux | 2.0.X | router
TSeq(Class=RI%gcd=<6%SI=<1F22A6E&>4E0A2%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint FreeSCO 0.27 (Linux 2.0.38)
Class FreeSCO | Linux | 2.0.X | router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Galacticomm WorldGroup BBS (MajorBBS) w/TCP/IP
Class Galacticomm | WorldGroup || BBS
TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&<BBBBBB)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Galacticomm WorldGroup BBS / Vircom TCP/IP stack
Class Galacticomm | WorldGroup || BBS
TSeq(Class=C)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Gandalf LanLine Router
Class Gandalf | embedded || router
TSeq(Class=TD%gcd=<714%SI=<14)
T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Gauntlet 4.0a firewall on Solaris 2.5.1
Class Gauntlet | Solaris | 2.5.X | firewall
TSeq(Class=RI%gcd=<6%SI=<10540A&>89C%IPID=I%TS=U)
T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Genius Print Server
Class Genius | embedded || print server
T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Gnat Box Light firewall v3.0.3 (from the inside interface)
Class Global Technology Associates | embedded || firewall
TSeq(Class=RI%gcd=<6%SI=<F708&>264)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=N)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# GNet BB0040 DSL router
# SAR-703 Combined ADSL Modem/Router
Fingerprint GNet BB0040 or SAR 703 DSL modem + router
Class GNet | embedded || broadband router
Class SAR | embedded || broadband router
TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint GNU Hurd 0.2 (GNUmach-1.2/Hurd-0.2) x86
Class GNU | Hurd || general purpose
TSeq(Class=TD|i800%gcd=<3000%SI=<1E%IPID=I%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# GrandStream 486 Voice over IP adapter
Fingerprint Grandstream 486 VoIP adapter
Class Grandstream | embedded || VoIP adapter
TSeq(Class=C%Val=3883537A%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Grandstream HT-286 POTS<->VoIP phone gateway device
Class Grandstream | embedded || VoIP adapter
TSeq(Class=C%Val=66559055%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Grandstream BT-100 IP Phone
Class Grandstream | embedded || VoIP phone
TSeq(Class=C%Val=FBD5528A%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=400%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Grandstream BT-100 IP Phone
Class Grandstream | embedded || VoIP phone
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=800|C00|400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Grandstream BudgeTone101 VoIP phone, firmware 1.0.4.50
Fingerprint Grandstream BT-101 IP phone
Class Grandstream | embedded || VoIP phone
TSeq(Class=C%Val=75DFD55D%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=C00|800|400%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1000|C00|800%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# GrandStream BT-101 with firmware 1.0.5.22
Fingerprint Grandstream BT-101 IP phone
Class Grandstream | embedded || VoIP phone
TSeq(Class=C%Val=5CE04AC5%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=1000|800|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Grandstream BudgeTone 101 IP Phone
Class Grandstream | embedded || VoIP phone
TSeq(Class=C%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=C00|800|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Grandstream IP Phone
Class Grandstream | embedded || VoIP phone
TSeq(Class=C%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# GrandStream BudgeTone-100 VoIP phone
# GrandStream BudgeTone-100 1.0.5.16
Fingerprint Grandstream VoIP Phone (BudgeTone-100)
Class Grandstream | embedded || VoIP phone
TSeq(Class=C%Val=4D86DFEA|F66461C1%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|1000%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=400|800|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=800|C00|1000%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=400|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Grandstream Budge Tone 101 VoIP phone, firmware 1.0.5.16
Fingerprint Grandstream VoIP Phone (BudgeTone-101)
Class Grandstream | embedded || VoIP phone
TSeq(Class=C%Val=4F4264AA%IPID=I%TS=U)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint PalmOS 5.2.1 on Handspring Treo
Class Handspring | PalmOS | 5.X | PDA
TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Hawking PS12U Embedded Print Server  (Firmware Version :    6.09.17H (2003/04/18 16:55:07)
Fingerprint Hawking PS12U Embedded Print Server
Class Hawking | embedded || print server
TSeq(Class=TD%gcd=78000|F0000%SI=<14%IPID=I%TS=U)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Zero One Tech. Print Server 3000
# Hawking Print Server PN7117
# Zero One Tech Printserver ZOT-PS-11 (firmware 5.4.2049)
# EUSSO Technologies UPS1211-B print server
Fingerprint Print server: Zero One Tech 3000, Hawking PN7117, or EUSSO UPS1211-B
Class Hawking | embedded || print server
Class Zero One | embedded || print server
Class EUSSO | embedded || print server
TSeq(Class=TD%gcd=<C004%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Hitachi HI-UX/MPP
Class Hitachi | HI-UX || general purpose
TSeq(Class=64K)
T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=MNNTWL)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FF5E%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Don't ask me what this is :)  David says
# it is "a Utah port of BSD to HP machines"
Fingerprint HP-BSD 2.0
Class HP | BSD-misc || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP Procurve Routing Switch 9304M
Class HP | embedded || load balancer
TSeq(Class=C)
T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP J4899A ProCurve Switch 2650, H.08.53, ROM H.08.02 - 24 port HP Switch with 2 Uplinks
# HP ProCurve Switch 2626 - Firmware revision  : H.08.67
# HP Procurve Switch 5304XL - Image stamp: /sw/code/build/alpmo(dex_v09_2)
Fingerprint HP Procurve Switch 2600 series or 5304XL
Class HP | embedded || load balancer
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# HP LaserJet 1300N with JetDirect 200m LIO card
Fingerprint HP printer w/JetDirect card
Class HP | embedded || print server
TSeq(Class=RI%gcd=<6%SI=<8C9B0&>1295%IPID=I%TS=2HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# HP Buisiness InkJet 1200 internal print server
# HP Deskjet 6127, firmware FD4R019A
Fingerprint HP Deskjet 6127 printer or InkJet 1200 printer server
Class HP | embedded || printer
Class HP | embedded || print server
TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ)
T1(DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550
# HP LaserJet 2200 with JetDirect (J6057A)
# HP Wireless JetDirect EIO card - 680n
Fingerprint HP JetDirect Card in a LaserJet printer
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=)
T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0|F%UCK=0%ULEN=134%DAT=E)

# HP Laserjet 4250, HP JetDirect J7949E
# hp LaserJet 2420
# hp LaserJet 4250 w/ embedded HP JetDirect J7949E; firmware V.28.43.FF w/ datecode 20040902 08.007.0
# HP LaserJet 2420dn printer, JetDirect J7949E, firmware V.28.43
# hp LaserJet 4250 with embedded HP JetDirect J7949E
# HP LaserJet 2420 printer
Fingerprint HP LaserJet 2420 or 4250 printer
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP LaserJet 4000N Printer
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP LaserJet 4100N printer
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP LaserJet 5
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<FF)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# 2100 Series, 4000 TN, 4000 PS, 8000 DN
# Hewlett-Packard Digital Sender 9100C (http://h10010.www1.hp.com/wwpc/us/en/sm/WF05a/15179-64175-64404-12126-64404-428008.html)
Fingerprint HP LaserJet printer/print server
Class HP | embedded || printer
Class HP | embedded || print server
Class HP | embedded || scanner
TSeq(Class=TD%gcd=<6%SI=<100)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Jet Direct Model J3113A, Firmware Rev G.07.20
# HP Color LaserJet 4500N, Jet Direct J3113A/2100
Fingerprint HP printer w/Jet Direct
Class HP | embedded || printer
T1(DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=M|)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP JetDirect printer/print server
# HP JetDirect J3111A, firmware G.05.35
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=N%W=16D0|C90%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=|M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E%ULEN=134%DAT=E)

Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<10%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# HP printer w/JetDirect card (Firmware Rev. H.06.00)
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=TD%gcd=<8%SI=<14)
T1(DF=N%W=860|16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# JetDirect J6057A, firmware R.24.06, connected to an HP 2200 printer
# JetDirect 610n (Model J4169A) firmware L.24.06
# HP Color LaserJet 4600 Model Number: J6057A Firmware Rev: R.25.09
# HP Laserjet 4200 Network Printer
# HP JetDirect J6057A, firmware R.24.08 (internal print server in a LaserJet 4050n)
# HP Color Laserjet 4650 printer
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<AF762&>9E9%IPID=I%TS=2HZ)
T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# HP JetDirect J6057A Firmware Version R.22.09 in 4100mpf printer
Fingerprint HP printer w/JetDirect card
Class HP | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# This is a HP 5si printer with a JetDirect Ethernet card model# J2556b Firmware A.05.32
Fingerprint HP printer w/JetDirect J2556b card (firmware A.05.32)
Class HP | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP printer w/JetDirect J2556b card firmware A.05.32
Class HP | embedded || printer
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# HP iLO (Integrated Lights Out) Firmware Version 1.20 (12/04/2002)
# HP Integrated Lights Out (iLO) with firmware 1.41 08/19/2003
Fingerprint HP Integrated Lights Out remote configuration Board
Class HP | embedded || remote management
TSeq(Class=TD%gcd=<194%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP Router 210 with OS 9.72
# Netgear RP114 DSL-Router with 4-Port Switch
Fingerprint HP Advancestack Etherswitch 224T or 210 or Netgear RP114 DSL-Router w/Switch
Class HP | embedded || switch
Class Netgear | embedded || broadband router
TSeq(Class=TD%SI=<20)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400%ACK=O%Flags=R%Ops=)
T6(DF=N%W=400%ACK=O%Flags=R%Ops=)
T7(DF=N%W=400%ACK=O%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP Entria II with Kernel B.09.11 and Boot Block B.08.02
Fingerprint HP Entria II X station
Class HP | embedded || X terminal
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18000)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 10.20 A 9000/715 or 9000/899
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# XXX: It crashed the machine again, but I got a full
# scan this time.
Fingerprint HP-UX B.10.01 A 9000/715
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K|TR)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.10.20 9000/897
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=N)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18000)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.10.20 A 9000/750
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

# HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0
Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=64K)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX release B.10.20 version A
Class HP | HP-UX | 10.X | general purpose
TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP9000 Model 804 K450 running HP-UX 11.00
# Mac OS9
Fingerprint Apple Mac OS 9, or HP-UX 11.00
Class HP | HP-UX | 11.X | general purpose
Class Apple | Mac OS | 9.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<4F254&>C95)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP-UX B.11.00
# HP-UX B.11.11
Fingerprint HP-UX 11
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<A7B0C&>C6E%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 11 w/tcp_isn_passphrase
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# This is a weird one
Fingerprint HP-UX 11.00
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=TD%gcd=>20000%SI=<3)
T1(Resp=N)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP-UX test01 B.11.11 U 9000/800 1277844053 unlimited-user license
Fingerprint HP-UX 11.11
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<C7A6A&>ABA%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 11.11
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=R%Ops=WNMETL)
T4(DF=N%W=800|1000|C00%ACK=S%Flags=R%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
T7(DF=N%W=1000|800|C00%ACK=S%Flags=R%Ops=WNMETL)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.11.00 A 9000/785
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<B108A&>630%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX B.11.00 A 9000/800
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<8E148&>846%IPID=I%TS=100HZ)
T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint HP-UX B11.00 U 9000/839
Class HP | HP-UX | 11.X | general purpose
TSeq(Class=RI%gcd=<10%SI=<2114C&>536)
T1(Resp=N)
T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# HP-UX 7.0 B 9000/375
Fingerprint HP-UX 7.0
Class HP | HP-UX | 7.X | general purpose
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX 9.01 - 9.07
Class HP | HP-UX | 9.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777
Class HP | HP-UX | 9.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint HP MPE/iX 5.5
Class HP | MPE/iX || general purpose
TSeq(Class=TD%gcd=<6%SI=<14)
T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint HP MPE/iX 5.5 on HP 3000
Class HP | MPE/iX || general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%TS=U)
T1(DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint HP Entria X station (running Netstation 7.x)
Class HP | Netstation || X terminal
TSeq(Class=64K)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

#  HPJ2600A Ethernet hub or HP ProCurve Switch 4000M
# Bay Networks MicroAnnex XL running firmware 10.0B
Fingerprint VxWorks 5.3.x bases system (usually an Ethernet hub or switch such as HP ProCurve) or Bay Networks MicroAnnex XL terminal server
Class HP | VxWorks || switch
Class Bay Networks | embedded || terminal server
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Huawei Quidway R2621 router running VRP 1.5.6(1)
Class Huawei | VRP || router
TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ)
T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Huawei Quidway Router R2621E VRP 1.5.6
Class Huawei | VRP || router
TSeq(Class=TD%gcd=<1E806%SI=<14%IPID=I%TS=2HZ)
T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint Hydra HydraWEB 5000
Class Hydra | embedded || load balancer
TSeq(Class=RI%gcd=1|2|3|4%SI=<FFFF&>1111)
T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2 running on RS/6000
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2.3 running on RS6000 model 560
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 3.2.5 (Bull HardWare)
Class IBM | AIX | 3.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX v3.2.5 running on 8xPower-2 wide nodes
# Fingerprint IBM AIX Version 4
Fingerprint IBM AIX v3.2.5 - 4
Class IBM | AIX | 3.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.0 - 4.2
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.02.0001.0000
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.1
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K%gcd=<6%SI=<14)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.1-4.1.5
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K)
T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.2
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=FFAF|FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.2-4.3.3
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.2.X-4.3.3.0
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%IPID=I%TS=U)
T1(DF=N|Y%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.3
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=5B4|F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=1000|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 4.3.1 on a IBM RS/6000 R40
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM AIX 4.3.3 on an RS/6000 H50
# Fingerprint IBM AIX 4.3.3 on a p660-6M1
# IBM AIX 4.3.3 ML10
Fingerprint IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/*
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0|F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM-RS/6000 7017-S80, AIX Version 4.3.3.0
Fingerprint IBM AIX 4.3.3.0 on an IBM RS/*
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6%TS=U)
T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX v4.1 running on a C10
Class IBM | AIX | 4.X | general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AIX v4.2
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E)

Fingerprint IBM AIX Version 4.3
Class IBM | AIX | 4.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM AIX 5.1.0.0 maintenance level 3
Fingerprint IBM AIX 5.1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0|4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5L 5.1
# IBM AIX 5.1 ML00
# AIX 5.1.4
# IBM AIX 5L Version 5.2
Fingerprint IBM AIX 5.1 - 5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1 - 5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5.1 on pSeries LPAR
# AIX 2 5 000B8CDC4C00 IBM AIX 5.2L Update 2
Fingerprint IBM AIX 5.1 - 5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# aix 5.1 Maintenance Level 6
Fingerprint IBM AIX 5.1 on a p610-6C1
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.1-5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5.103 on
Fingerprint IBM AIX 5.103
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
T1(DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5.2 on pSeries (Power4)
Fingerprint IBM AIX 5.2
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# IBM AIX 5.2 (Maintenance Level 1) on RS/6000
Fingerprint IBM AIX 5.2 (on RS/6000)
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=2HZ)
T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# AIX 5.2-003
Fingerprint IBM AIX 5.2.3
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%TS=2HZ)
T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Fingerprint IBM AIX 5L V5.3 5765-G03 (2005/02) on IBM p5 (Power5 processor)
# Fingerprint IBM AIX 5.3 ML 01 on RS/6000 43P150
Fingerprint IBM AIX 5.3
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM AIX 5.3 ML01
Class IBM | AIX | 5.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM 8222 hub
Class IBM | embedded || hub
TSeq(Class=TD%gcd=<6%SI=<1A4%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM 8239 Token-Ring Stackable Hub
Class IBM | embedded || hub
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Microplex M205 Pocket Print Server v5.7
# IBM 6400 Printer - Network Printer Server Version 7.0.9.6 [ network card ]
Fingerprint IBM 6400 printer or Microplex Pocket Print Server
Class IBM | embedded || printer
Class Microplex | embedded || print server
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint IBM Infoprint 12 Net-Printer
Class IBM | embedded || printer
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint IBM BladeCenter Remote Management Module
Class IBM | embedded || remote management
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM Remote Supervisor Adapter II
Class IBM | embedded || remote management
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
PU(Resp=N)

Fingerprint IBM 2210 router
Class IBM | embedded || router
TSeq(Class=TD%gcd=<6%SI=<F)
T1(DF=N%W=0|200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S|O|S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM 2210 Router MRS 2.x on Token Ring interface
Class IBM | embedded || router
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR|R%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IBM 8210 Multiprotocol Switching Server for ATM networks, Model 3 (p/n 31L3  340),
Fingerprint IBM 8210 Multiprotocol Switching Server/router for ATM networks
Class IBM | embedded || router
TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Proteon OpenRoute 2.1 on a RBX200 Router or IBM 2210 Router
Class IBM | embedded || router
Class Proteon | OpenRoute || router
TSeq(Class=TD%gcd=<6%SI=<BB)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM 3494 Magnetic Tape Library
Class IBM | embedded || storage-misc
TSeq(Class=RI%gcd=<6%SI=<A5B22&>1A6E%IPID=I%TS=U)
T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT
Class IBM | embedded || switch
Class Xylan | embedded || switch
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# AGE Logic, Inc. IBM X-Station
Fingerprint AGE Logic, Inc. IBM XStation
Class IBM | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM MVS
Class IBM | MVS || general purpose
TSeq(Class=RI%gcd=64|C8|12C|190)
T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2
Class IBM | MVS || general purpose
TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200)
T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)

Fingerprint IBM MVS TCP/IP TCPMVS 3.2
Class IBM | MVS || general purpose
TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E)
T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM MVS TCP/IP TCPOE 3.3
Class IBM | MVS || general purpose
TSeq(Class=RI%gcd=<6%SI=<BB0)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/2 V 2.1
Class IBM | OS/2 || general purpose
TSeq(Class=64K)
T1(DF=N%W=6FCC%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=6FCC%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 V.3
Class IBM | OS/2 || general purpose
TSeq(Class=i800)
T1(DF=N%W=7000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 Warp 4.0
Class IBM | OS/2 || general purpose
TSeq(Class=i800)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
Class IBM | OS/2 || general purpose
TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
Class IBM | OS/2 || general purpose
TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint OS/2 Warp Server for eBusiness 4.52
Class IBM | OS/2 || general purpose
TSeq(Class=RI%gcd=<8%SI=<5A9A6&>633%IPID=I%TS=U)
T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM OS/390 V2R10
Class IBM | OS/390 | V2 | general purpose
TSeq(Class=RI%gcd=<6%SI=<17C1E&>128%IPID=I%TS=1000HZ)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint IBM OS/390 V5R0M0
Class IBM | OS/390 | V5 | general purpose
TSeq(Class=RI%gcd=<5%SI=>F&<BBBB)
T1(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# added by Beat Rubischon <beat@rubis.ch>
Fingerprint IBM AS/400 V3 and V4
Class IBM | OS/400 | V3 | general purpose
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V3
Class IBM | OS/400 | V3 | general purpose
TSeq(Class=RI%gcd=<8%SI=<3411C4&>5977%TS=1000HZ)
T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AS/400 running OS/400 R4.4
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=TD%gcd=<6%SI=<1E)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4 r4-5
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=RI%gcd=<C%SI=<C1C&>3%IPID=I%TS=1000HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4R2M0
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4R5
Class IBM | OS/400 | V4 | general purpose
TSeq(Class=C%IPID=I%TS=1000HZ)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V4R5M0
Class IBM | OS/400 | V4 | general purpose
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM AS/400 running OS/400 5.1
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=TD%gcd=<6000%SI=<14%IPID=I)
T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IBM proprietary operating system for AS/400 systems (now known as "iSeries")
# Fingerprint OS/400 V5R2
# IBM OS/400 V5R1M0
Fingerprint IBM OS/400 V5R1 - V5R2
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<24%SI=<19DCD2&>6D3%IPID=I)
T1(DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# OS/400 V5R1M0 w/ C2134 + Autumn '02 Hiper, DB & Java
Fingerprint IBM OS/400 V5R1M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=TD%gcd=<22222%SI=<14%IPID=I%TS=1000HZ)
T1(DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IBM OS/400 V5.2
Fingerprint IBM OS/400 V5R2M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<24%SI=<41D304&>7BC%IPID=I)
T1(DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM OS/400 V5R2M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<8%SI=<2871A2&>276C%IPID=I%TS=1000HZ)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# IBM iSeries OS/400 V5R2M0 L000
# IBM AS/400 - Operating System: OS/400 V5R2M0 (Version 5, Revision 2)
# IBM OS/400 V5R3M0 on iSeries
# OS/400 V5R3
Fingerprint OS/400 V5R2M0 or V5R3 or V5R3M0
Class IBM | OS/400 | V5 | general purpose
TSeq(Class=RI%gcd=<14%SI=<2EB440&>EF0%IPID=I%TS=1000HZ)
T1(DF=Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint IBM VM/CMS (mainframe)
Class IBM | VM/CMS || general purpose
TSeq(Class=RI%gcd=64|C8%SI=>CC&<CCC)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint IBM VM/ESA 2.2.0 CMS Mainframe System
Class IBM | VM/CMS || general purpose
TSeq(Class=RI|TD%gcd=64|C8|12C|1F4|190%SI=<FFF)
T1(DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Infortrend EonStor A16U-G1410, firmware 3.42D.03
Fingerprint Infortrend EonStor A16U-G1410
Class Infortrend | embedded || storage-misc
TSeq(Class=RI|TD%gcd=<6%SI=<17CA%IPID=RD|RPI%TS=U)
T1(DF=N%W=5C8%ACK=S++%Flags=AS%Ops=MNNL)
T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
PU(Resp=N)

# innovaphone 200 V4.00 sr4 IP200[02-4283], Bootcode[205], HW[202] 2048/8192
# innovaphone IP400 V4.00 hotfix IP400[02-4253], Bootcode[315], HW[102] 2048/4096
Fingerprint innovaphone IP200/IP400 VoIP phone/gateway
Class innovaphone | embedded || telecom-misc
TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
T1(DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Intel NetStructure 3110 VPN Gateway V6.90p7
Fingerprint Intel NetStructure 3110 VPN Gateway
Class Intel | embedded || firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Intel InBusiness Print Station
Class Intel | embedded || print server
TSeq(Class=64K)
T1(DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Intel NetportExpress 10 3-port Print Server
Class Intel | embedded || print server
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Intel NetportExpress(tm) 10/100 3-port ROM: V05.10a
Fingerprint Intel NetportExpress 10/100 3-port Print Server
Class Intel | embedded || print server
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
T4(Resp=Y%DF=N%W=16D0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=R%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Intel NetportExpress PRO Print Server V04.33a
Class Intel | embedded || print server
TSeq(Class=TD%gcd=1%SI=0)
T1(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Intel NetportExpress XL Print Server
Class Intel | embedded || print server
TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Fingerprint Intel ER8100ST Express 8100 Router running firmware 3.20n
Fingerprint Intel ER8100ST Express Router 8100
Class Intel | embedded || router
TSeq(Class=TD%gcd=<E4%SI=<14%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Intel Corporation, ER9100 Express Router 9100
# Fingerprint by Ron van Daal (ronvdaal@syntonic.net)
Fingerprint Intel ER9100 Express Router 9100
Class Intel | embedded || router
TSeq(Class=TD%gcd=10|20|30%SI=1)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intel Express 510T switch
Class Intel | embedded || switch
TSeq(Class=TD%gcd=10|20|30%SI=<BB)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intel Express 510T switch
Class Intel | embedded || switch
TSeq(Class=i800%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intel NetStructure 470T Switch
Class Intel | embedded || switch
TSeq(Class=TD%gcd=<7534%SI=<64%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Intergraph CLiX R3.1 Vr.7.6.20 6480
Class Intergraph | CLiX || general purpose
TSeq(Class=TD%gcd=<416%SI=<1E)
T1(DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Intergraph Workstation (2000 Series) running CLiX R3.1
Class Intergraph | CLiX || general purpose
TSeq(Class=TD%gcd=209|1048|E3F%SI=<5)
T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

Fingerprint Intergraph jetSpeed 520 ADSL Router
Class Intracom | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=18%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IPCop 1.20 dedicated firewall Linux distro old Pentium 1 hardware + 3C509B cards http://ipcop.org/
Fingerprint IPCop 1.20 Linux 2.2.2X-based firewall
Class IPCop | Linux | 2.2.X | firewall
TSeq(Class=RI%gcd=<6%SI=<95DBC&>116E%IPID=I%TS=100HZ)
T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux kernel 2.4.27 (x86) ipcop 1.40
# Linux ipcop 2.4.27 #1 Thu Sep 30 02:57:11 GMT 2004 i586 AuthenticAMD unknown GNU/Linux
# IPcop v1.4.2 Linux 2.4.27
# Linux fw.ioes.org 2.4.27 #1 Wed Sep 29 12:48:42 GMT 2004 i686 GenuineIntel unknown GNU/Linux (IPCOP+1.4)
# Linux 2.4.27-29 (IPCop 1.4.2)
# IPCop 1.4.2 (Kernel: 2.4.27) i486
# Linux 2.4.27 i686 GNU/Linux IPCop 1.4.2 (Green Interface)
# Linux 2.4.29 #1 i686 GenuineIntel+unknown GNU/Linux / IPCop 1.4.5
# IPCop Linux  1.4.5  (Linux xxx 2.4.29 #1) Pentuim II
# IPCOP 1.4.6 based on Debian/Linux 2.4.29
Fingerprint IPCop 1.4 - 1.4.6 Linux 2.4.2x-based firewall
Class IPCop | Linux | 2.4.X | firewall
TSeq(Class=RI%gcd=<6%SI=<24E74F4&>49DD3%IPID=Z%TS=U)
T1(DF=Y%W=16D0|400C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IPRoute V1.18, compiled at 08:26:02 on Jun 23 1998
Fingerprint IPRoute (DOS based software router)
Class IPRoute | DOS || software router
TSeq(Class=TD%gcd=<6%SI=<82%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=E0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# IQinVison IQeye3 Version V2.1/1(030123)
Fingerprint IQinVison IQeye3 webcam
Class IQinVision | embedded || webcam
TSeq(Class=RI%gcd=<6%SI=<5168&>B3%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# IronPort AsyncOS 3.7.1-001 running on C60 platform
Fingerprint IronPort C60 email security appliance
Class IronPort | AsyncOS || specialized
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Isolation Systems Infocrypt Enterprise
Class Isolation | embedded || encryption accelerator
TSeq(Class=C)
T1(Resp=N)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL traffic generation and analysis server
Class Ixia | embedded || specialized
TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Juniper Networks JUNOS 5.3 on an Olive router
Class Juniper | JUNOS || router
TSeq(Class=RI%gcd=<6%SI=<ABEB4&>661%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# JUNOS <hostname> 5.6R1.3 JUNOS 5.6R1.3 #0: 2003-01-02 20:38:33 UTC -- This one was no Juniper Hardware Router but a JunOS installed on a simple i386 box.
Fingerprint Juniper Networks JUNOS 5.6R1.3 routing software on x86 box
Class Juniper | JUNOS || router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Juniper Networks JUNOS 5.5R1.2 built 2002-09-28
Fingerprint Juniper Networks router JUNOS 5.5R1.2
Class Juniper | JUNOS || router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Juniper router M10i JUNOS ROUTER 7.2R1.7 #0 i386
Fingerprint Juniper Networks router M10i running JUNOS 7.2R1.7
Class Juniper | JUNOS || router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Juniper Router running JUNOS
Class Juniper | JUNOS || router
TSeq(Class=RI%gcd=<5%SI=>FFF)
T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# KA9Q is a networking OS used mostly by amateur radio operators for radio to
# internet gateways.
Fingerprint KA9Q amateur radio OS
Class KA9Q | KA9Q || specialized
TSeq(Class=TD%gcd=37000%SI=<1E)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# 3Com OfficeConnect 812 ADSL router firmware 2.0.0
# Kentrox DataSMART 656 CSU/DSU or USR NETServer/16
Fingerprint Kentrox DataSMART 656 CSU/DSU, USR NETserver/16, or 3Com OfficeConnect ADSL router
Class Kentrox | embedded || CSUDSU
Class US Robotics | embedded || switch
Class 3Com | embedded || broadband router
TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=<A)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint KIRK Wireless Server 600
Class KIRK | embedded || VoIP gateway
TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
T1(DF=N%W=2800%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2800%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Konica-Minolta magicolor2300DL printer controller f/w 02.83S engine f/w 4131.50G1.0900
Fingerprint Konica-Minolta magicolor2300DL printer controller
Class Konica Minolta | embedded || printer
TSeq(Class=64K%IPID=I%TS=2HZ)
T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1%ACK=O%Flags=A%Ops=NNT)
T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Kronos Time clock
Class Kronos | embedded || specialized
TSeq(Class=TD%gcd=<7C%SI=<32%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Kyocera FS-1700+ printer
Class Kyocera | embedded || printer
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AF|AR%Ops=)
T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Kyocera IB-21 Printer NIC
Class Kyocera | embedded || printer
TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U)
T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=100%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=100%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Kyocera FS-9100 DN printer, network firmware IB-21E 1.3.1
# Kyocera FS-6020 laser printer, system firmware 90.06, engine firmware A005, network firmware IB-21E 1.3.1
# Kyocera FS-5016N IB-21E Version 1.3.0
# Kyocera-Mita 2050 printer/copier/scanner
# Kyocera Printer FS-1900 (network firmware IB-21E 1.3.0)
# Kyocera IB-21E network module version 1.3.1
# KYOCERA Printer I/F IB-21E Ver 1.3.0
# Kyocera-Mita IB-21E
Fingerprint Kyocera Printer (network module IB-21E 1.3.x)
Class Kyocera | embedded || printer
TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U)
T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=5B4%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=5B4%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=5B4%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Kyocera SB-4e Printer-Interface in an Kyocera FS-800 laser printer
Fingerprint Kyocera SB-4e printer NIC
Class Kyocera | embedded || printer
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint Labtam MT300, X-Terminal Kernel
Class Labtam | embedded || X terminal
TSeq(Class=64K)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix LSB4 Ethernet Switch
Class Lantronix | embedded || switch
TSeq(Class=RI%gcd=<6%SI=>CCC&<FFFF)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Radionics Ram IV Alarm System
# Lantronix CoBox DR1-IAP serial device server
Fingerprint Lantronix CoBox serial device server or Radionics RAM IV Alarm
Class Lantronix | embedded || terminal server
Class Radionics | embedded || specialized
TSeq(Class=TD%gcd=<404%SI=<6E%IPID=I%TS=U)
T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Lantronix Consoleserver 800 (Technically, it is a Lightwave Consoleserver 800 prior to Lantronix purchase of the company.)
Fingerprint Lantronix Consoleserver 800
Class Lantronix | embedded || terminal server
TSeq(Class=TD%gcd=<6%SI=<14%IPID=I%TS=100HZ)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Lantronix ETS16 terminal server Version V3.4/5(961028)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=<9D1C&>91%IPID=BI%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix ETS16P terminal server Version V3.5/2(970721)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=<404C&>90)
T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<6%SI=<9318E&>1688%IPID=BI%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
Class Lantronix | embedded || terminal server
TSeq(Class=RI%gcd=<8%SI=<404C&>8C%IPID=BI%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix EPS1 Print Server version V3.5/1(970325)
Class Lantronix | Punix || print server
TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
T1(DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Lantronix EPS1 Printer Server running Punix version  2.9/342(930813)
Fingerprint Lantronix EPS1 Printer Server
Class Lantronix | Punix || print server
TSeq(Class=RI%gcd=<6%SI=<10018&>8F%IPID=BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Lantronix EPS2 Print Server Version V3.5/2(970721)
Class Lantronix | Punix || print server
TSeq(Class=RI|TD%gcd=<6)
T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# Lantronix ETS16 Version V3.1/2(940207) / [Punix version 2.9/379(940207)]
Fingerprint Lantronix ETS16 terminal server
Class Lantronix | Punix || terminal server
TSeq(Class=RI%gcd=<6%SI=<41E9C&>AD%IPID=RPI|BI%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Leunig ePower Switch b723 v5.2
Class Leunig | embedded || power-device
TSeq(Class=TR)
T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=)
T5(Resp=N)
T6(Resp=N)
T7(Resp=N)
PU(Resp=N)

Fingerprint Fingerprint LevelOne WBR-3406TX Wireless Broadband router
Class Level One | embedded || broadband router
TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
T1(DF=N%W=1540|1638%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# LevelOne Wireless router WBR-3403TX
Fingerprint LevelOne WBR-3403TX Wireless Broadband router
Class Level One | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<102C870&>295B1%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(Resp=N)

Fingerprint Lexmark M412n network printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ)
T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Lexmark Marknet X2031e printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<AFDAC&>16E0%IPID=I%TS=2HZ)
T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Lexmark Optra N Laser Printer
Fingerprint Lexmark Optra N Laser Printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=1C%RIPTL=0%RID=0%RIPCK=0%UCK=F%ULEN=134%DAT=E)

# Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1
# Lexmark Optra Lx+ Network Printer, firmware
Fingerprint Lexmark Optra network printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=388|1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20)
T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Lexmark Optra T612 (printer) running firmware 3.11.17
# Lexmark Optra S 2420
Fingerprint Lexmark Optra printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
T1(DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)

# Lexmark MarkNet XL Internal Printer Network Adapter on a Lexmark Optra LaserPrinter
Fingerprint Lexmark Optra printer w/MarkNet XL Network Adapter
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

#  Lexmark Optra S 1659 (MarkNetS)
#  Lexmark Optra S 2455 and SC 1275
# Lexmark S 1855 Firmware 1.9.14 Bootcode revision 7.3
Fingerprint Lexmark Optra S Printer
Class Lexmark | embedded || printer
TSeq(Class=TD%gcd=>1000%SI=<30)
T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N|Y)

# Lexmark T520 printer, firmware 54.30.39
Fingerprint Lexmark T520 printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<3651E88&>8AEFD%IPID=Z%TS=100HZ)
T1(DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Lexmark T522 printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<6%SI=<24E3426&>5E5DB%IPID=Z%TS=100HZ)
T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Lexmark T522/T622 printer
Class Lexmark | embedded || printer
TSeq(Class=RI%gcd=<8%SI=<2C2D254&>387BA%IPID=Z%TS=100HZ)
T1(DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint LG Goldstream LR3001f router, software version 4.0
Class LG GoldStream | embedded || router
TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

Fingerprint LG Goldstream LR3100p router, software version 1.0-1.5
Class LG GoldStream | embedded || router
TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Liebert Intellislot SNMP/Web Card (power devices, air conditioning, etc.)
Class Liebert | embedded || specialized
TSeq(Class=TD%gcd=<32DC4%SI=<14%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# "This device listens on all TCP and all UDP ports, so OS
#  fingerprints are not that excellent. Actually there's not even an OS
#  running on it, it simply translates monitoring data into SNMP OIDs. It
#  can also be used to control the unit by setting specific OIDs."
Fingerprint Liebert-Hiross HiSNMP A/C controlling unit
Class Liebert-Hiross | embedded || specialized
T1(DF=Y%W=2000%ACK=S++%Flags=BAS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=UAPSF%Ops=M)
T4(Resp=N)
T5(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
T6(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
T7(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
PU(Resp=N)

# Linksys WET-11 Wireless Ethernet bridge running firmware rev. 1.43
Fingerprint Linksys WET-11 Wireless Ethernet bridge
Class Linksys | embedded || bridge
TSeq(Class=RI%gcd=<6%SI=<2C30D0&>52F7%IPID=I%TS=U)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linksys WGA54G Wireless Game Adapter (bridge)
Class Linksys | embedded || bridge
TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MM)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# Linksys EtherFast Cable/DSL Router with 4-port switch BEFSR41 ver. 3; firmware: 1.44.3, FEB 13 2003
Fingerprint Linksys BEFSR41 Broadband router
Class Linksys | embedded || broadband router
TSeq(Class=TD%gcd=<18%SI=<1E%IPID=Z%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys BEFSR41 Broadband router and 4-port hub
Fingerprint Linksys BEFSR41 Broadband router
Class Linksys | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<2FF88AC&>7ACA0%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linksys/Cisco BEFSR41 V3 Etherfast Cable/DSL Router (Firmware 1.04.17)
Fingerprint Linksys BEFSR41 V3 Etherfast cable/DSL router
Class Linksys | embedded || broadband router
T1(Resp=N)
T2(Resp=N)
T3(Resp=Y%DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
T4(Resp=N)
T5(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys BEFVP41 VPN Router - Firmware Version 1.41.1, Sep 04 2003
Fingerprint Linksys BEFVP41 VPN Router
Class Linksys | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys BEFW11S4 DSL/Cable Router with Firmware 1.45z
Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router
Class Linksys | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=4009%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linksys BEFW11S4 firmware revision 1.45.10
Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router
Class Linksys | embedded || broadband router
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# LinkSys WRT-54G running the SVEASOFT code
# Linksys BEFW11S4 802.11B WAP
# Linksys BEFSR41 firmware ver. 1.40.2
# Linksys Router: BEFW11S4 v2/v3
Fingerprint Linksys BEFW11S4/WRT-54G Wireless Broadband router or BEFSR41 Cable/DSL router
Class Linksys | embedded || broadband router
TSeq(Class=TD|RI%gcd=<400%SI=<62C%IPID=Z|RD%TS=U)
T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys WAG54G Wireless Broadband Router
Fingerprint Linksys WAG54G Wireless Broadband Router
Class Linksys | embedded || broadband router
TSeq(Class=TD%gcd=<E0%SI=<1E%IPID=Z%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=800|1000|400%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linksys WAG54G Wireless Gateway
Class Linksys | embedded || broadband router
TSeq(Class=RI%gcd=<8%SI=<1CE6872&>24FCE%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linux kernel 2.4.20 (mips) on Linksys WRT54G Wireless Broadband Router with firmware Sveasoft +Alchemy-pre7a beta build version v3.37.6.8sv
Fingerprint Linksys WRT54G Wireless Broadband Router (Linux kernel 2.4.20)
Class Linksys | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<17B7D1A&>3BAFF%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linksys EtherFast Print Server
Class Linksys | embedded || print server
T1(DF=N%W=0|C80%ACK=S++%Flags=AR|APS%Ops=|M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linksys EtherFast Print Server
Class Linksys | embedded || print server
TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linksys PSUS4 USB Print Server and switch
Class Linksys | embedded || print server
TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linksys WPS54GU2 Wireless Print Server
Class Linksys | embedded || print server
TSeq(Class=TD%gcd=<1A866%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=111C%ACK=S++%Flags=APS|A%Ops=M|)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=111C|0%ACK=S++|O%Flags=APS|AR%Ops=M|)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linksys WRK54G Firmware Version: 1.56.01
# Linksys Wireless-B router/switch/802.11b access point (device model BEFW11S4 V4)
# Linksys BEFW11S4 firmware 1.50.14
# Linksys BEFSR41 v2 Firmware Version:  1.46.02, Aug 03 2004
# Linksys BEFSR81v2 Router with firmware 2.45.10
# Linksys EtherFast Cable/DSL Router (Model: BEFSR41 Ver 2)(Updated Firmware ver. 1.46.02, Aug 03+2004)
# Linksys Wireless-B Broadband Router BEFW11S4 Firmware v.1.50.14
# Linksys RT31P2  VoIP router (Vonage; firmware version 1.28.00; internal interface)
Fingerprint Linksys BEFW11S4/BEFSR41/BEFSR81/WRK54G Broadband router or RT31P2 VoIP router
Class Linksys | embedded || WAP
TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linksys WAP11 v2.6 firmware 1.06
Fingerprint Linksys WAP11 Wireless AP
Class Linksys | embedded || WAP
TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Planet embedded WAP-1965
# Linksys WAP11 Wireless AP v2.2 firmware 1.06
# D-Link DWL-900+ with Firmware Version 2.57, Wed, 30 Apr 2003
# D-Link DWL - 2000 AP (WAP) firmware 2.04
Fingerprint Linksys, D-Link, or Planet WAP
Class Linksys | embedded || WAP
Class D-Link | embedded || WAP
TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# fingerprint!
Fingerprint Linux 1.0.9
Class Linux | Linux | 1.X | general purpose
TSeq(Class=TD%gcd=30|60%SI=<F)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=ASF%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 1.2.13
Class Linux | Linux | 1.X | general purpose
TSeq(Class=TD%gcd=1%SI=1C)
T1(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 1.2.8 - 1.2.13
Class Linux | Linux | 1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<BBBB)
T1(DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 1.3.20 (x86)
Class Linux | Linux | 1.X | general purpose
T1(DF=N%W=77FF|0%ACK=S++%Flags=AS|BAR%Ops=ME|)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.0
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=RI%gcd=<6)
T1(DF=N%W=7C00%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=6%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.27 - 2.0.30
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7C00|3C00%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7C00|3C00%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.32-34
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# On very rare cases, I get a T2 response back -- weird
Fingerprint Linux 2.0.32-34
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.34-38
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR)
T1(DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=AS%Ops=ME|M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FDF|7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=ASF%Ops=|ME|M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0|20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.0.35 (S.u.S.E. Linux 5.3 (i386)
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=ASF%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.0.39
Class Linux | Linux | 2.0.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3FE0|0%ACK=S++%Flags=ARSF|AR%Ops=ME|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.19 - 2.2.25
Class Linux | Linux | 2.1.X | general purpose
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<8%SI=>10000%IPID=I%TS=100HZ)
T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=28|C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.1.24 PowerPC
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=TR)
T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.76
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=TR)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.88
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7)
T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.1.91 - 2.1.103
Class Linux | Linux | 2.1.X | general purpose
TSeq(Class=RI%gcd=<6%SI=>7A000)
T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.12 - 2.2.25
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0|60|A0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.13
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<E5F68C&>24CA0)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# SuSE Linux 6.3 (i386) - Kernel 2.2.13
Fingerprint Linux 2.2.13 (SuSE; x86)
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<21DE76C&>2B4E4%IPID=I%TS=100HZ)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.14
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7)
T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)

Fingerprint Linux 2.2.16C37_III on Sun Cobalt
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2021DA2&>3CBCC%IPID=I%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.2.19-6.2.1ensim-3.1.5-2 (RedHat 7.2)
Fingerprint Linux 2.2.19
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<242483C&>5C202%IPID=I%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.19 (Alpha)
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1409420&>3348D%IPID=I%TS=1000HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.19 - 2.2.20
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U)
T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.2.19 on a DEC Alpha 233mhz Multia
Fingerprint Linux 2.2.19 on a DEC Alpha
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.20 SMP
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<277C73C&>6371B%IPID=I%TS=100HZ)
T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.2.21 SMP (x86)
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1921FE8&>404B1%IPID=I%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.22
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<22AB988&>58BFF%IPID=I%TS=U)
T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.2.5 - 2.2.13 SMP
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<D49FAE&>2203C)
T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)

# Linux kernel 2.4.4-4GB (x86) from Red hat
Fingerprint Linux 2.4.4
Class Linux | Linux | 2.2.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<FC5E4&>19E%IPID=Z%TS=U)
T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linux 2.3.12
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<20%SI=>DDDD)
T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.28-33
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3)
T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA)
T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.3.49 x86
Class Linux | Linux | 2.3.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E)
T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Astaro Security Linux 4 (Kernel 2.4.19)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

# I don't put "Gentoo" as the vendor for the classification because it
# makes output ugly when there are a bunch of Linux matches due to
# firewalling or similar problems.
Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Cobalt Linux 6.0 Kernel 2.2.16c32_III on an i586
Fingerprint Linux 2.2.16
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<23D760E&>5BBDD%IPID=Z)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.0 - 2.5.20
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U)
T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y|N%TOS=0|8|14|20|28|38|40|C0|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.0 - 2.5.20 w/o tcp_timestamps
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U)
T1(DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.0-test5
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8)
T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)

# Linux 2.4.18
# SuSE Linux 7.3 linux-2.4.10-4GB, running on amd k6-2
Fingerprint Linux 2.4.10 - 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<21BFEA2&>46B9B%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D0|D8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Strangely enough, I have received several prints like this that claim a T2:
Fingerprint Linux 2.4.16 - 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.17 on HP 9000 s700
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<1C15A06&>23F17%IPID=Z)
T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Debian/Gnu Linux 3.0 (Woody) Kernel 2.4.18-bf2.4
Fingerprint Linux 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<293EE44&>69651%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18 (PPC)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<36CB986&>488A7%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<5BA02C&>EA7B%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2774D66&>2F583%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.18-custom
# Linux 2.4.19 w/o tcp_timestamps
Fingerprint Linux 2.4.18 - 2.4.19 w/o tcp_timestamps
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1720870&>361B9%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.18 - 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<14B7282&>11A94%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=30|60|D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20 (Gentoo 1.2; x86)
# Linux 2.4.18-14
Fingerprint Linux 2.4.18 - 2.4.20 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B9C772&>6FA19%IPID=Z%TS=100HZ)
T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# linux 2.4.20 (i586) Preemptible
# Linux 2.4.18
# 2.4.21-20.ELsmp SMP RedHat AS3, REL3
Fingerprint Linux 2.4.18 - 2.4.21 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<25C5808&>30578%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.4.21-4.0.1.ELsmp x86 Dual Xeon RedHat EL3 AS3 (Red Hat Linux 3.2.3-20)
# Linux Kernel 2.4.21-4.0.1 Red Hat Enterprise Linux ES release 3 (Taroon)
# Linux sun 2.4.27 #3 SMP Mon Nov 1 21:24:45 GMT 2004 sparc unknown unknown GNU/Linux
# Linux AthenA-server 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i586 unknown
Fingerprint Linux 2.4.18 - 2.4.27
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR|RI%gcd=<6%SI=<2CA3968&>49B3D%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux live cd knoppix 2.4.27 (knoppix 2.6)
Fingerprint Linux 2.4.18 - 2.4.27
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<3859E24&>47DBA%IPID=Z%TS=100HZ)
T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Linux 4.19-4GB #1 Tue Sep 30 19:01:07 UTC 2003 i686 unknown / SuSe Linux OpenExchange Server
Fingerprint Linux 2.4.19
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<13A36B6&>3244E%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux kernel 2.4.19C13_V (x86) Sun Cobalt RaQ550
Fingerprint Linux 2.4.19
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<20DD6C4&>54211%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Mandrake 9.1 SMP 2.4.19-16mdksmp #1 SMP Fri Sep 20 16:08:37 CEST 2002 i686 unknown unknown GNU/Linux
Fingerprint Linux 2.4.19 (Mandrake, x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<263CFAC&>55266%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.19 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<25CEE8A&>341B8%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++|O%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-4GB-athlon i686
# SuSE Linux 8.2 2.4.20-64GB-SMP
# linux 2.4.19-4GB
Fingerprint Linux 2.4.19 - 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<22D7C86&>2AE00%IPID=I%TS=100HZ)
T1(DF=Y%W=16A0|1680|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.19 w/grsecurity patch
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2A492C6&>6C3F2%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.4.20-4GB (x86)
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<1540758&>1B32B%IPID=I%TS=100HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-wolk4.16s
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=7D74%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18D4252&>3F8B9%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20; Sysctl goodness below. Changed default TTL, syncookies, not sure what else. Scanned from localhost.
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2C88A&>1E5%IPID=RD)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-xfs-rmap15d-ptrace #1 Debian GNU/Linux
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<15580A6&>30FB7%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.4.20 from ALT Linux Master 2.2 (uname -r = 2.4.20-alt16-smp)
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<25A8F50&>60659%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-8 #1 i686 i686 i386 GNU/Linux
Fingerprint Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1A82ACC&>43DBE%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Red Hat Linux release 9 (Shrike) Kernel 2.4.20-8 on an i686
Fingerprint Linux 2.4.20 (Red Hat)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1B9DCC2&>469F7%IPID=Z%TS=100HZ)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux localhost 2.4.20-30.9 #1 Wed Feb 4 20:44:26 EST 2004 i686 i686 i386 GNU/Linux
Fingerprint Linux 2.4.20 (x86, Redhat 7.3)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<3A23C96&>949CB%IPID=Z%TS=100HZ)
T1(DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Red Hat Linux release 9 (Shrike), Kernel Version 2.4.20-31.9.progeny.5
# Linux 2.4.21-27.0.2.EL i686 i386 (Red Hat Enterprise Linux ES release 3 (Taroon Update 4)) + APF 0.9.3
# Linux 2.4.21-15.0.4.ELsmp #1 SMP i686 i686 i386 GNU/Linux
# Linux 2.4.22-1.2115.nptlsmp
# Linux 2.4.22-1.2199.nptlsmp #1 SMP i686 i686 +i386 GNU/Linux
Fingerprint Linux 2.4.20 - 2.4.22
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<3089154&>7C37E%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(Resp=N)

# Linux 2.4.20-gentoo-r5 w/grsecurity
Fingerprint Linux 2.4.20 - 2.4.22 w/grsecurity.org patch
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Linux kernel 2.4.20-wolk4.17s (x86)
# Linux demeter 2.4.20-wolk4.17s #1 i686 unknown
# "Devil Linux 1.2.2" 2.4.27-grsec #1 SMP i686 AuthenticAMD unknown+GNU/Linux
# Gentoo 2.4.28-hardened-r5 (Up to date with Gentoo Hardened Patches) on a Proliant 1600R
Fingerprint Linux 2.4.20 - 2.4.28
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=1690|16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.20 or 2.6.0-test5-love3 (x86)
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<DDDFF6&>23458%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.4.20 x86
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<1DB22CE&>1862A%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.20-ac2
Fingerprint Linux 2.4.20-ac2
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2A812D4&>2F29E%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.21-32.0.1.ELsmp #1 i686 i686 i386 GNU/Linux
Fingerprint Linux 2.4.21
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<31EB9A2&>7FCA1%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# RedHat Linux Enterprise 3 2.4.21-27.0.2.EL #1
Fingerprint Linux 2.4.21 (RedHat)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux Boobie 2.4.21-9.EL #1 RedHat
Fingerprint Linux 2.4.21 (RedHat)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2E5DABA&>58D55%IPID=Z%TS=100HZ)
T1(DF=Y%W=564%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=C00|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(Resp=N)

# base on msg 1058, 1776
# Linux kernel 2.4.21-243(athlon) from SuSE 9.0
# SuSE 9.0 with updates, kernel 2.4.21-280-default
Fingerprint Linux 2.4.21 (Suse)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<243DCC4&>17466%IPID=I%TS=U)
T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# SuSE Linux 8.1 (i386) 2.4.21 #4 SMP
Fingerprint Linux 2.4.21 (Suse, x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2634758&>55644%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# SuSE Linux 9.0 2.4.21-215-athlon
# Linux 2.4.21-121-athlon; SuSE, x86
# Linux 2.4.21-231-athlon from SuSE 9.0
Fingerprint Linux 2.4.21 (x86 SuSE)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1C5FBC4&>48A1C%IPID=I%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Linux 2.4.21-0.25mdk x86
Fingerprint Linux 2.4.21 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2A2786A&>6BE77%IPID=I%TS=100HZ)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux mail2 2.4.21-4.ELsmp #1 SMP Fri Oct 3 17:52:56 EDT 2003 i686 i686 i386 GNU/Linux (Redhat Enterprise Linux AS 3)
Fingerprint Linux 2.4.21 (x86, RedHat)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<26BFF42&>63303%IPID=Z%TS=100HZ)
T1(DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.21-166-default (Suse 9)
# Linux 2.4.23-pre6aa3 #2 Wed Mar 10 23:27:52 BRT 2004 i686 GNU/Linux
Fingerprint Linux 2.4.21 - 2.4.23
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<139B84E&>3230A%IPID=I%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Debian Linux feeshus 2.4.22-1-ipvs-686 #1
Fingerprint Linux 2.4.22
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<180F182&>3D924%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.22 (SPARC)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<256B646&>5FC9A%IPID=Z%TS=100HZ)
T1(DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.22 (x86) without timestamps, grsecurity 1.9 (rand_isns, rand_ip_ids)
Fingerprint Linux 2.4.22 (x86) w/grsecurity patch and with timestamps disabled
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR|RI%gcd=<6%IPID=RD|Z%TS=U)
T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.22 (x86, Gentoo)
# Linux server 2.6.7-ck5 (x86)
# Linux lamaquina 2.6.8.1-10mdk #1 Wed Sep 8 17:00:52 CEST 2004 i686 AMD Athlon(tm) 64 Processor 3200+
Fingerprint Linux 2.4.22 - 2.6.8
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<132F658&>188E0%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux Kernel 2.6.10-ck (x86) Gentoo system
Fingerprint Linux 2.4.22 or 2.6.10
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<29CB48E&>6AF95%IPID=Z%TS=U)
T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.22 (x86, Gentoo)
# Linux 2.6.7-hardened-r16 #1 x86_64 AMD Athlon(tm) 64 Processor 3000+ AuthenticAMD GNU/Linux
# Slackware 10 kernel 2.6.7
# Fedora Core 2 With Kernel 2.6.8-1
# Kernel 2.6.3 (x86); Gentoo Distro
# Gentoo Base System version 1.4.16 Linux linuxbox 2.6.9 #2 SMP+Pentium III (Coppermine) GenuineIntel GNU/Linux
# Linux kernel 2.6.10-1.760_FC3 from Fedora Core 3
Fingerprint Linux 2.4.22 or 2.6.3 - 2.6.10
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<11A9004&>2D341%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.22-gentoo-r7 (x86)
# Linux 2.6.4-gentoo-grsec (x86) - manual patch on gentoo's kernel (gentoo-dev-sources) with grsecurity-2.0-test2-2.6.4.patch
# Linux 2.6.10 with grsecurity 2.6.10 i686
Fingerprint Linux 2.4.22 or 2.6.4 - 2.6.10
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.22-ck2 (x86)   w/grsecurity.org and HZ=1000 patches
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.22-gentoo-r2 i686
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux gateway 2.4.22-gentoo-r5 #1 ven feb 6 05:25:25 CET 2004 i686 Celeron (Mendocino) GenuineIntel GNU/Linux - grsecurity patch + iptables
Fingerprint Linux 2.4.22-gentoo-r5 (x86) w/grsecurity
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.22-gentoo-rc
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<22F8152&>2CC16%IPID=RD%TS=1000HZ)
T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.23 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B5505C&>6EEAA%IPID=I%TS=U)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.23-grsec w/o timestamps
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Adamantix GNU/Linux with Linux 2.4.25-grsec (x86)
Fingerprint Linux 2.4.25 w/grsec (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26-gentoo-r6 #1 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
Fingerprint Linux 2.4.26
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<298F858&>6A637%IPID=I%TS=U)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26  from slackware linux 10
Fingerprint Linux 2.4.26
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2961188&>6375E%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux kernel 2.4.26 from Slackware 10.0
Fingerprint Linux 2.4.26
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<3230066&>338AC%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26 i686 GNU/Linux
Fingerprint Linux 2.4.26
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2049F82&>52A3D%IPID=Z%TS=100HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26-gentoo-r12 #5 i686 Pentium II
# Linux 2.4.26-gentoo-r9 #14 i686 Celeron (Mendocino) GenuineIntel GNU/Linux
Fingerprint Linux 2.4.26 (gentoo)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<2E22EC4&>27AD8%IPID=I|RD%TS=100HZ)
T1(DF=N|Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.26-gentoo-r6 w/grsec
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.27-1-586tsc #1 Wed Dec 1 19:25:25 JST 2004 i586 GNU/Linux (Debian Sid)
Fingerprint Linux 2.4.27 or D-Link DSL-500T (running linux 2.4)
Class Linux | Linux | 2.4.X | general purpose
Class D-Link | embedded || broadband router
TSeq(Class=RI%gcd=<6%SI=<2031130&>5267C%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.27-grsec #1 SMP i686
# Linux 2.4.27-grsec (x86) (grsecurity 2.0.1) w/ net.ipv4.tcp_timestamps = 0
Fingerprint Linux 2.4.27 with grsec
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.27 with grsec
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.4.29 from Slackware 10.1.0
Fingerprint Linux 2.4.29
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2209F48&>571E7%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux kernel 2.4.30 (vanilla)
Fingerprint Linux 2.4.30
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<293A11E&>6963B%IPID=Z%TS=100HZ)
T1(DF=Y%W=1578%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1578%ACK=S++|O%Flags=AS|A%Ops=MNNTNW|NNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.4-4GB #1 Wed May 16 00:37:55 GMT 2001 i586 unknown
Fingerprint Linux 2.4.4
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<10F070C&>15ACF%IPID=Z%TS=100HZ)
T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.26 #6 i686 unknown unknown GNU/Linux
# Linux kernel 2.6.9-1.681_FC3 from Fedora Core 3
Fingerprint Linux 2.4.6 - 2.4.26 or 2.6.9
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1E74A9A&>4DF5C%IPID=Z%TS=100HZ)
T1(DF=Y%W=1680|16A0|4000|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.4.7 (x86)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U)
T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.7 (zLinux on OS/390)
Fingerprint Linux 2.4.7 (zLinux on OS/390)
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<152381A&>3616E%IPID=Z%TS=100HZ)
T1(DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.4.18 on Alpha EV4
# Linux 2.5.70 (x86)
# Linux 2.6.4 i686
# Linux gentoo 2.6.7-gentoo-r11 i686
# Linux gentoo 2.6.11-gentoo-r9
Fingerprint Linux 2.4.7 - 2.6.11
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<20DBA72&>5419C%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux Athena 2.6.3-1-686 #2 Tue Feb 24 20:24:38 EST 2004 i686 GNU/Linux
# Linux 2.4.7 (RedHat 7.3 on SPARC)  
Fingerprint Linux 2.4.7 - 2.6.11
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1682210&>399B1%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux RedHat 2.4.18-5 #1 Mon Jun 10 15:31:48 EDT 2002 i686 unknown
Fingerprint Linux 2.4.9 - 2.4.18
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1C3AE82&>46383%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=800|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Mandrake Communiry 10.1  (2.6.8.1-10mdk-i586-up-1GB)
# Linux matrix 2.6.3-gentoo-r2 x86
Fingerprint Linux 2.5.25 - 2.6.8 or Gentoo 1.2 Linux 2.4.19 rc1-rc7
Class Linux | Linux | 2.4.X | general purpose
Class Linux | Linux | 2.5.X | general purpose
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Xbox running Debian Linux 2.4.20
Class Linux | Linux | 2.4.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<FB5982&>2833E%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Linux 2.5.5 (Gentoo)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<306B8C0&>6ABCE%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<269E81A&>62D97%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<34CD71A&>861AC%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.10 #1 Wed Jan 5 12:36:35 CET 2005 i686 unknown  Debian 3.0r2
# linux gentoo kernel 2.6.10
# Linux kernel 2.6.10-custom (x86) from Debian GNU/Linux 3.1
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1A5ABDA&>43761%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=38|A0|B8|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.3-gentoo-r1 #5 Wed Apr 7 13:48:31 EDT 2004 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
# Gentoo 1.4.16; Kernel 2.6.7
# Linux sarge 2.6.8-2-386 #1 Thu May 19 17:40:50 JST 2005 i686 GNU/Linux
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<16883CC&>1CD61%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.8.1-12mdk #1 i686 Intel(R) Xeon(TM) CPU 2.80GHz unknown GNU/Linux
# Linux 2.6.8-1-k7 #1 i686 GNU/Linux
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<18C0F36&>3F49D%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=14|30%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.8-1-k7-smp (x86) Debian GNU/Linux 3.1 (Sarge - testing)
# Linux 2.6.11-gentoo-r2-ck1
# Linux 2.6.11-gentoo-r4 #1 i686 P4CPU+2.40GHz GenuineIntel GNU/Linux Gentoo Base System version 1.4.16
# Linux 2.6.11-gentoo-r9-nymph #1i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.9 #1 i686
# Linux kernel 2.6.9 (PIII-80Mhz)
Fingerprint Linux 2.6.0 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2AB93AA&>6D5A3%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=28|40%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0-test10 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<226FBCC&>58267%IPID=Z%TS=1000HZ)
T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.0-test5 x86
Fingerprint Linux 2.6.0-test5 x86
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2D3CFA0&>73C6B%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0-test7 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1488090&>34896%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.0-test9 - 2.6.0 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<263F536&>61B8F%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Gentoo Linux running on a UML client, Linux 2.6.10-linode12 #1 i686 UML User Mode
Fingerprint Linux 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2CE05FC&>72AE6%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.10 i686 on IBM Thinkpad T30
# Linux barton 2.6.10-gentoo-r6 Gentoo
# Linux 2.6.10-grsec #1 Fri Jan 28 00:37:15 CET 2005 i686 GNU/Linux
Fingerprint Linux 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR|RI%gcd=<6%SI=<321C62E&>8044F%IPID=I|RD%TS=1000HZ)
T1(DF=Y|N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.10 x86 Slackware 10.0
Fingerprint Linux 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1FB5BDE&>51299%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Ubuntu Hoary Hedgehog - Linux ubuntu 2.6.10-5-386 #1 Tue Apr 5 12:12:40 UTC 2005 i686 GNU/Linux
Fingerprint Linux 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<15962A2&>3740B%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux runerm 2.6.10-kanotix-8 #1 Wed Feb 2 16:49:31 GMT 2005 i686 GNU/Linux
# Linux Kernel 2.6.11 With some Fixes from debian/kanotix
# debian 3.1 kernel : 2.6.11-rc7
Fingerprint Linux 2.6.10 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<249F172&>5DBEE%IPID=Z%TS=U)
T1(DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux linux 2.6.11.9 #1 Sat May 14 00:49:06 CEST 2005 i686 unknown unknown GNU/Linux
Fingerprint Linux 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T4(DF=N%W=800|400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.11 (gentoo-dev-sources)
Fingerprint Linux 2.6.11 (gentoo)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linux 2.6.10-1.741_FC3 i686 athlon i386 GNU/Linux
Fingerprint Linux 2.6.3 - 2.6.10
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<3552DC&>8860%IPID=Z%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux Kernel 2.6.3 (x86)
# Linux 2.6.7 #3 Sat Jul 17 13:25:29 EEST 2004 i486
Fingerprint Linux 2.6.3 - 2.6.7 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<205C682&>528B7%IPID=Z%TS=1000HZ)
T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.3-6mdksecure #1 SMP x86_64 from Mandrake 10
# Linux 2.6.8-p4 #1 SMP i686 GNU/Linux
Fingerprint Linux 2.6.3 or 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<24F1576&>1E7BD%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# LINUX Suse 9.1 Professional Kernel 2.6.4 i686
Fingerprint Linux 2.6.4 (Suse)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1B18996&>45556%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Slackware current kernel 2.6.9
# Fedora Core 3 Linux Kernel 2.6.9 x86 (i386)
# Linux kernel 2.6.4-52 from (x86) SuSE Linux 9.1
# Debian Sarge Linux 2.6.6-1, i686 (x86)
Fingerprint Linux 2.6.4 - 2.6.9
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<28A04EC&>2F60A%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=1000|800|C00|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|1000|400|800%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux
Fingerprint Linux 2.6.5
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<265B754&>6225F%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Linux 2.6.7-gentoo-r11 #2 Wed Jul 28 23:25:03 PDT 2004 i686 Pentium II (Deschutes)
# Linux  2.6.8-rc3 #1 Sat Aug 7 07:19:34 EDT 2004 i686 GNU/Linux
# Debian Sarge GNU/Linux kernel 2.6.8-1 (i386)
# Linux 2.6.7-hardened-r17 Gentoo
# Linux 2.6.9-1.681_FC3smp #1 SMP i586 i586 i386 GNU/Linux (Fedora Core 3+kernel as supplied)
# Linux 2.6.8-1-686 from Debian sid
# SuSE Linux Prefessional 9.1, with kernel 2.6.10
# Linux 2.6.8, PLD distribution, SMP
# Linux 2.6.11.4-20a-default #1 i686 i686 i386 GNU/Linux from+Suse 9.3
# Linux 2.6.8-24.11-default #1 Fri Jan 14 13:01:26 UTC 2005 i686 i686 i386 GNU/Linux
# Linux 2.6.5-7.155.29-default #1 Thu Jun 2 12:07:05 UTC 2005 i686 i686 i386 GNU/Linux (SuSE+9.2 )
# Linux Debian Sarge 2.6.11.7
# Linux kernel 2.6.10-4GB (x86) with Debian GNU/Linux 3.1
# Linux Kernel 2.6.7-1-686-smp from backports.org Debian Woody
Fingerprint Linux 2.6.5 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2BF6254&>70895%IPID=Z%TS=1000HZ)
T1(DF=Y%W=15E0|16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Linux 2.6.9 #1 i686 Intel(R) Pentium(R) 4 CPU 3.06GHz+GenuineIntel GNU/Linux
# Linux kernel 2.6.10-rc3 from Gentoo on an Ultra 1 (sparc)
# Linux 2.6.5 i686 P42.00GHz, Gentoo Base System version 1.6.6, Portage+2.0.51-r3
# Gentoo Linux 2004.1 PPC (old blue and white G3)  Kernel 2.6.11.7
Fingerprint Linux 2.6.5 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<360764E&>48D40%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.6-rc2-bk3
Fingerprint Linux 2.6.6
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2E04BFE&>4ADED%IPID=Z%TS=1000HZ)
T1(DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.6-1-k7 (x86) from Debian Testing
Fingerprint Linux 2.6.6-1-k7 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<235C288&>5A817%IPID=Z%TS=1000HZ)
T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.7-tp #5 i686 GNU/Linux
Fingerprint Linux 2.6.7
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<8%SI=<13C059A&>1B365%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.7 with grsecurity patches
Fingerprint Linux 2.6.7
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.7-hardened-r16 (Gentoo hardened-dev-sources) x86
# Linux 2.6.7-hardened-r16 #3 SMP i686  GNU/Linux (grsec+pax, gentoo hardened-dev-sources))
Fingerprint Linux 2.6.7
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.7 (x86) from Mepis
Fingerprint Linux 2.6.7 (x86)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<14E7284&>35813%IPID=Z%TS=U)
T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux kernel 2.6.8 on PLD Linux
# Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 Community
# Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 community
# Linux kernel 2.6.7-SMP from Knoppix 3.6
# Linux 2.6.8.1-4-k7 i686 GNU/Linux
Fingerprint Linux 2.6.7 - 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1D19DA8&>4A672%IPID=Z%TS=1000HZ)
T1(DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Linux 2.6.7 w/grsecurity.org patch
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.8-24.14-smp GNU/Linux Suse Linux 9.2 Professional
Fingerprint Linux 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<C0DF46&>1ED0B%IPID=Z%TS=1000HZ)
T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux Mandrake 10.1, i586, kernel 2.6.8.1-12mdk
# Linux 2.6.8.1-12mdk #1 Fri Oct 1 12:53:41 CEST 2004 i686 AMD Athlon(tm) XP 3000+ unknown GNU/Linux
Fingerprint Linux 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1E91DE8&>4E3D1%IPID=Z%TS=1000HZ)
T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.8-1.521 #1 i686 athlon i386 GNU/Linux
Fingerprint Linux 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<C88D22&>20154%IPID=I%TS=1000HZ)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.8-2-k7 #1 Thu May 19 18:03:29 JST 2005 i686 GNU/Linux
# Linux 2.6.8-2-386 #1 Mon Jan 24 03:01:58 EST 2005 i686 GNU/Linux, from Debian testing
Fingerprint Linux 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<32035F2&>2A223%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Debian Sarge Kernel 2.6.8
Fingerprint Linux 2.6.8 (Debian)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<2C96D4E&>34B7A%IPID=Z%TS=100HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux ubuntu 2.6.8.1-5-386 #1 Sat Feb 12 00:19:31 UTC 2005 i686 GNU/Linux
Fingerprint Linux 2.6.8 (Ubuntu)
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<10F66C0&>2B6A6%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)

# Linux kernel 2.6.8.1 from Debian sarge netinst
# Linux kernel 2.6.11-1.27 from Fedora Core 3
Fingerprint Linux 2.6.8 - 2.6.11
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<23C986A&>4BB91%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.9-gentoo-r13Hipcia #3 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
# Linux 2.6.8-1-686-smp #1 SMP i686 GNU/Linux from Debian 3.1
Fingerprint Linux 2.6.8 - 2.6.9
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<11DFD8E&>15CCF%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T4(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Linux 2.6.9-1.649 FC Rawhide
# Linux kernel 2.6.9 (x86_64) from kernel.org
Fingerprint Linux 2.6.9
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<13935EA&>32119%IPID=Z%TS=1000HZ)
T1(DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.9-1.681_FC3 #1 i686 i686 i386 GNU/Linux Fedora Core 3
Fingerprint Linux 2.6.9
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<1BA9D60&>26DF4%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Linux 2.6.5 (Gentoo)
# Linux 2.6.8 (Fedora Core 2)
# Fingerprint Linux kernel 2.6.8-1.521 Fedora 2
Fingerprint Linux kernel 2.6.5 - 2.6.8
Class Linux | Linux | 2.6.X | general purpose
TSeq(Class=RI%gcd=<6%SI=<17F9116&>3D580%IPID=Z%TS=1000HZ)
T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint ComOS based terminal server - Livingston PortMaster or U.S. Robotics/3Com Total Control
Class Livingston | ComOS || terminal server
Class 3Com | ComOS || terminal server
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)

Fingerprint ATT UNIX SVR4.2 on a Lucent Definity voicemail system
Class Lucent | BSD-misc || general purpose
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2
Class Lucent | ComOS || terminal server
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# http://www.sics.se/~adam/lwip/
Fingerprint lwIP (Lightweight TCP/IP stack) version lwip-0.5.3-win32
Class lwIP | lwIP || general purpose
TSeq(Class=TD%gcd=<6%SI=<3C%IPID=I%TS=U)
T1(DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# M0n0wall 1.2b2 - Firewall based on FreeBSD 4.1
# M0n0wall 1.2b2 FreeBSD-based firewall running on PC Engines WRAP board (Geode x86 architecture)
# m0n0wall FreeBSD based firewall (http://m0n0.ch/wall/) version 1.2b3 (version 1.2 beta 3) generic PC
# m0n0wall Router/Captive portal version 1.2b8 running on stripped down version of FreeBSD
Fingerprint M0n0wall 1.2b2 - 1.2b8 FreeBSD 4.1 based firewall
Class m0n0wall | FreeBSD | 4.X | firewall
TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

# m0n0wall or pfsense firewall distro based on FreeBSD 5.3
# M0n0wall (FreeBSD 5.3 based) with firmware beta version 1.2b7
Fingerprint M0n0wall 1.2b7 FreeBSD 5.3 based firewall
Class m0n0wall | FreeBSD | 5.X | firewall
TSeq(Class=TR%gcd=<6%TS=1000HZ)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(Resp=N)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=N)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Madge Smart Ringswitch
Class Madge | embedded || switch
T1(DF=N%W=1F4%ACK=S++%Flags=AS%Ops=)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AS%Ops=)
T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Magna SG10 intranet router
Class Magna | embedded || router
TSeq(Class=RI%gcd=<6%SI=<31AD68E&>5F62F%TS=100HZ)
T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Maxim-IC TiniOS DS80c400
Class Maxim-IC | TiniOS || general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Maxim/Dallas TINI embedded Java v1.02b
Class Maxim-IC | TiniOS || general purpose
TSeq(Class=TD%gcd=<1F408%SI=<28%IPID=Z%TS=U)
T1(DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|)
T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|)
T4(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)

# Maxim/Dallas TINI embedded Java v1.11
# Dallas Semiconductor TINI OS 1.02d
Fingerprint Maxim/Dallas TINI embedded Java v1.02d
Class Maxim-IC | TiniOS || general purpose
TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint MegaBit Gear TE4111C modem
Class Megabit | embedded || terminal server
TSeq(Class=64K%IPID=I%TS=U)
T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=N)
T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)

Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
Class Meridian | embedded || storage-misc
TSeq(Class=TD%gcd=40000%SI=<A)
T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Microbase VirtuOS v3.00b R.09
Class Microbase | VirtuOS || general purpose
TSeq(Class=TD%gcd=<2120004%SI=<14%IPID=I%TS=U)
T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T7(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microplex Print Server
Class Microplex | embedded || print server
TSeq(Class=C)
T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Bart's Network Boot Disk 2.7 http://www.nu2.nu/bootdisk/network/ i386
Fingerprint Bart's Network Boot Disk 2.7 (x86) MS-DOS
Class Microsoft | DOS || general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
T1(DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=E%ULEN=134%DAT=E)

Fingerprint NCSA Telnet (dos)
Class Microsoft | DOS || general purpose
TSeq(Class=C)
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# I'm not 100% sure this version is for DOS, just a guess
Fingerprint NCSA Telnet 2.3.08 for the PC (DOS)
Class Microsoft | DOS || general purpose
TSeq(Class=C)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
T7(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Watt-32 DOS tcp/ip stack
Class Microsoft | DOS || general purpose
TSeq(Class=C%IPID=I%TS=1000HZ)
T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint WNOS 5.0 on Microsoft DOS 6.22
Class Microsoft | DOS || general purpose
TSeq(Class=TD%gcd=1000|2000|3000%SI=<7F)
T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(DF=N%W=400%ACK=O%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft xbox with hacked bios and xbmc running
# Evolution-X 2.X (unsure which evolution-x version is running, one from the 2.X series though...) on mod-chipped XBOX
# XBOX running Xbox Media center v1.0.0
# Microsoft XBOX 1.0.5101.1, mod chip ALX2+, running Avalaunch v0.49.3 Xmas edition
# XBox hardware version 1.5 running XBox Media Centre version 1.1.0
Fingerprint Microsoft Xbox (modified)
Class Microsoft | embedded || game console
TSeq(Class=RI%gcd=<6%SI=<5C26%IPID=RPI|I%TS=U)
T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# xbox v1.1 running EvoX bios
# v1.5 XBOX running Evolution build 3935, fresh default install.
# Microsoft XBOX with SmartXX modchip - running XBOX Media Center v1.0
# Microsoft Xbox v1.6
Fingerprint Microsoft Xbox (modified)
Class Microsoft | embedded || game console
TSeq(Class=RI%gcd=<6%SI=<AD02&>20%TS=U)
T1(DF=N%W=4238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4238%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Microsoft Xbox Console running Xbox Media Centre version 1.1.01
# Microsoft Xbox (modified) running EvolutionX
Fingerprint Microsoft Xbox (modified)
Class Microsoft | embedded || game console
TSeq(Class=TD%gcd=<6%SI=<2E4%IPID=I%TS=U)
T1(DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Xbox V1.1 Running Evolution-X Dashboard v1.8.3752
Fingerprint Microsoft Xbox (modified) running evolutionX
Class Microsoft | embedded || game console
TSeq(Class=RI%gcd=<6%SI=<5A14&>20%IPID=I%TS=U)
T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Microsoft Xbox (modified) running UnleashX 0.26
Class Microsoft | embedded || game console
TSeq(Class=RI%gcd=<6%SI=<A79E&>99%IPID=I%TS=U)
T1(DF=N%W=8470%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=8470%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

# Microsoft Windows Longhorn Preview, Version 6.0 Build 4051.idx 02.031001-1340
Fingerprint Microsoft Windows Longhorn Preview
Class Microsoft | Windows Longhorn || general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=N)
T3(Resp=N)
T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003, Enterprise Edition, Build 3790
# Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947)
# Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947)
# Windows Server 2003 Standard Edition. no SP, all current hotfixes
Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows 2003 Server Edition, no service packs
Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL)
T3(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL)
T4(DF=N%W=C00|400%ACK=S%Flags=R%Ops=WNMETL)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL)
T7(DF=N%W=C00|1000|400%ACK=S%Flags=R%Ops=WNMETL)
PU(Resp=N)

Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=80%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows 2003 Server (Version 5.2 build 3790.srv03_rtm.030324-2048)
Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003 Enterprise Edition (English) with latest Windows Update patches as of September 2, 2004
Fingerprint Microsoft Windows 2003 Server Enterprise Edition
Class Microsoft | Windows | 2003/.NET | general purpose
T1(DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server Enterprise Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)

# Microsoft Windows Server 2003, Enterprise Edition, no service packs, (build 3790.srv03_rtm.030324-2048)
# Microsoft Windows XP Professional (English) SP2 with latest updates through Nov. 24, 2004
Fingerprint Microsoft Windows 2003 Server Enterprise Edition or XP Pro SP2
Class Microsoft | Windows | 2003/.NET | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows.NET Enterprise Server (build 3615 beta)
# Windows .NET Standard Server build 3604
# Microsoft Windows 2003 Standard Build V5.2.3790 build 3790
# Microsoft Windows 2003 Server - Web edition - all available critical fixes as of 15th feb 2004
# Windows 2003 Standard Edition RTM
# Window Server 2003 Enterprise Edition Swedish
# Microsoft Windows XP Professional (English) w/ SP2 RC1 build 2600.xpsp_sp2_rc1.040311-2315 - WINDOWS FIREWALL DISABLED
# Microsoft Windows 5.2 Build 3790.srv03_rtm.030324-2048
# Microsoft Windows Version 5.1 (Build 2600.spdp_sp2_rtm.040803-2158 : Services Pack 2)
Fingerprint Microsoft Windows 2003 Server or XP SP2
Class Microsoft | Windows | 2003/.NET | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows XP Pro (French) version:2002 SP2
# Microsoft Windows Server 2003 version 5.2 (Build 3790.srv03_gdr.040410-1234)
# Microsoft Windows Server 2003 Enterprise Edition (Trial Version downloaded from Microsoft as at 06/03
# Microsoft Windows 2003 Server Enterprise Edition (German) build 3790.srv03_rtm.030324-2048
# Microsoft Windows .NET Standard Server RC#2 (build 3718)
# Microsoft Windows XP Professional version 2002 service pack 2
# Microsoft Windows XP Home Edition (English) SP2 Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
# Microsoft Windows XP Home /SP2 Polish Edition
Fingerprint Microsoft Windows 2003 Server or XP SP2
Class Microsoft | Windows | 2003/.NET | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y|N%W=2017|402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=N)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=N)
PU(DF=N%TOS=0|20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)

# Windows Server 2003, build 3790
# Microsoft Windows XP Media Center Edition
Fingerprint Microsoft Windows 2003 Server or XP SP2
Class Microsoft | Windows | 2003/.NET | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)

# Microsoft Windows 2003 Server with SP1 and latest Windows Update patches as of May, 2005
# Windows Server 2003 w/ SP1, build 3790.srv03_sp1
# Microsoft Windows 2003 Server, version SBS 2003 Premium, just after Windows Server SP1 installed
# Windows Server 2003 Version 5.2 (Build 3790.srv03_sp1_rtm.050324-1447: Service Pack 1
# Windows Server 2003 w/ SP1, build 3790.srv03_sp1
Fingerprint Microsoft Windows 2003 Server SP1
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003 SP1 [Version 5.2.3790]
# Windows 2003 Service Pack 1 32 Bit Running on Abit Mobo AMD64
Fingerprint Microsoft Windows 2003 Server SP1
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 5.2 (Build 3790.srv03_sp1_rtm.050324-1447 : Service Pack 1)
# Windows Server 2003 SP1 all patches as of June-23-05
Fingerprint Microsoft Windows 2003 Server SP1
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server Standard Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=20%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 2003 Server Standard Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
T7(DF=N%W=400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 2003 Server Standard Edition (Build 3790.srv03_gdr.040410-1234)
Fingerprint Microsoft Windows 2003 Server Standard Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N)

Fingerprint Microsoft Windows 2003 Server Standart Edition SP1
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=5C%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 2003 standard edition version 5.2 build 3790.srv03_rtm.030324-2048 and lastest windows updates patches as november 9, 2004
Fingerprint Microsoft Windows 2003 standard edition
Class Microsoft | Windows | 2003/.NET | general purpose
T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Server 2003, No Service Packs build 3790.srv03_gdr.040410-1234
Fingerprint Microsoft Windows Server 2003
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows Server 2003 Enterprise Edition Version 5.2.3790
Fingerprint Microsoft Windows Server 2003 Enterprise Edition
Class Microsoft | Windows | 2003/.NET | general purpose
TSeq(Class=TR%gcd=<6%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=10%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 3.1 with Trumpet Winsock 2.0 revision B
Class Microsoft | Windows | 3.X | general purpose
TSeq(Class=TD%gcd=10000%SI=<FF)
T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows for Workgroups 3.11 / TCP/IP-32 3.11b stack or Windows 98
Class Microsoft | Windows | 3.X | general purpose
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<F%SI=<F)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 95 Version 4.00.950 OEM HP Pavilion 5010
Fingerprint Microsoft Windows 95 4.00.950
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<E4%SI=<14%IPID=BI)
T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Win95 4.00.950B  -  IE 5 5.50.4807.2300
Fingerprint Microsoft Windows 95 4.00.950B
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<3C%IPID=BI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 95 4.00.950B (IE 5 5.00 2314.1003)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<14%SI=<32%IPID=BI)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 95/98/NT 4.0 or PocketPC
Class Microsoft | Windows | 95/98/ME | general purpose
Class Microsoft | Windows | PocketPC/CE | PDA
TSeq(Class=TD|RI%gcd=1|2|3|4|5|8|A|14|1E|28|5A|17C%SI=<1F4)
T1(DF=Y%W=2017|16D0|860|8000|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y|N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<FFF)
T1(DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U)
T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)

# Microsoft Windows 98 x86 No Service Pack
# Microsoft Windows 98 4.10.1998
Fingerprint Microsoft Windows 98 4.10.1998
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<142%SI=<186%IPID=BI%TS=U)
T1(DF=Y%W=2024|7D78%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2024|7D78%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98 4.10.1998
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<78%IPID=BI%TS=U)
T1(DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S|O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98SE 4.10.2222A
# Windows 98 4.10.1998
Fingerprint Microsoft Windows 98 or 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98 SP1
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<5%SI=<20)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98 SP2
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U)
T1(DF=Y%W=270F|5FA0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=270F|5FA0%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98SE, no service packs, on AMD Sempron 2.4 GHz
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<1AA4&>D%IPID=RPI%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 98 4.10.2222.A
# "Windows 98SE, patched up to date" (1/25/03)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<A%SI=<46%IPID=RPI|RD|BI%TS=U)
T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98 4.10.2222 A (1/27/04)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<F4%SI=<14%IPID=RPI%TS=U)
T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98SE (build 2222)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<46%IPID=RPI|RD|BI%TS=U)
T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 98SE, no service packs
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<FF%SI=<32%IPID=BI%TS=U)
T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows 98SE + unoffical service pack 1.6.1 (includes all cumulative patches and hotfixes)
#                (http://exuberant.ms11.net/98sesp.html)
Fingerprint Microsoft Windows 98SE
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<E2%SI=<1E%IPID=RPI%TS=U)
T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98SE + IE5.5sp1
Class Microsoft | Windows | 95/98/ME | general purpose
T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=N)
T4(DF=N%W=2DA0|0%ACK=S++|O%Flags=AS|R%Ops=M|)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=N|Y)

# Win 98SE, 4.10.2222 A (fully WindowsUpdated)
# Windows 98SE build 4.10.2222 A
# Microsoft Windows 98SE, Version 4.10.2222
# Windows 98SE 4.10.2222 A  Compaq OEM version Patched as of 1/2005
Fingerprint Microsoft Windows 98SE 4.10.2222
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<E4%SI=<14%IPID=BI|RPI%TS=U)
T1(DF=Y%W=2017|2058|FAF0|FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2017|2058|FAF0|FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows 98SE, service pack 1 installed, litepc installed (www.litepc.com)
Fingerprint Microsoft Windows 98SE SP1
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U)
T1(DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Fingerprint Microsoft Windows 98SE with security patch A
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=TD%gcd=<6%SI=<AA%IPID=BI%TS=U)
T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Millenium Edition - no service packs
Fingerprint Microsoft Windows Millennium Edition (Me)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<2B05C&>2D1%IPID=I)
T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows ME + all updates as of 1/1/03
Fingerprint Microsoft Windows Millennium Edition (Me)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<8%SI=<1DA74&>117%IPID=I)
T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Microsoft Windows Millennium (German) 4.90.3000
Fingerprint Microsoft Windows Millennium Edition (Me)
Class Microsoft | Windows | 95/98/ME | general purpose
TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I)
T1(DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

# Windows Millenium Edition v4.90.300
# Windows Me or Windows 2000 RC1 through final release
# Microsoft Windows 2000 Advanced Server
# Windows 2000 with SP2 and long fat pipe (RFC 1323)
# Windows 2000 Professional Service Pack 3
# Windows 2000 5.00.2195 Service Pack 2 and latest hotfixes
# Windows 2000 Professional (x86)
# Compaq ProLiant DL-380G2 running Windows 2000 with SP3 and all the current patch sets (2/3/03)
# Windows XP Professional version 2002 on PC Intel processor
# Windows XP Build 2600
# XP Professional 5.1 (build 2600).. all patches up to June 20, 2002
# Fingerprint Microsoft Windows XP Professional with all current updates to May 2002
# Windows 2000 Version 5.0 Build (2195: Service Pack 3)
#  Windows 2000 Advanced Server SP3
Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP
Class Microsoft | Windows | 95/98/ME | general purpose
Class Microsoft | Windows | NT/2K/XP | general purpose
TSeq(Class=RI%gcd=<6%SI=<FFFFF&>49C%IPID=I%TS=0)
T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|4470|8052|B5C9|B580|C000|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT)
T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|4470|8052|B5C9|B580|C000|402E|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
PU(DF=N%TOS=0|20%I