# Nmap OS Fingerprint List. -*- mode: fundamental; -*- # $Id: nmap-os-fingerprints 5480 2007-08-11 06:02:29Z fyodor $ # # Contributions to this database are welcome. If Nmap obtains a new # fingerprint (and test conditions are favorable), it will print out a # URL you can use to submit the fingerprint. If Nmap guesses wrong, # please send the full Nmap output and the exact destination host OS # name and version to fyodor@insecure.org . Thanks! # # By submitting fingerprints you are transfering any and all copyright # interest in the data to Fyodor so that he can modify it, relicense it, # incorporate it into programs, etc. # # This collection of fingerprint data is (C) 1998-2003 by # Insecure.Com LLC. This data is available for # free use by open source software under the terms of the GNU General # Public License. We also license the data to selected # commercial/proprietary vendors under less restrictive terms. # Contact sales@insecure.com for more information. # # TEST DESCRIPTION: # Tseq is the TCP sequenceability test # T1 is a SYN packet with a bunch of TCP options to open port # T2 is a NULL packet w/options to open port # T3 is a SYN|FIN|URG|PSH packet w/options to open port # T4 is an ACK to open port w/options # T5 is a SYN to closed port w/options # T6 is an ACK to closed port w/options # T7 is a FIN|PSH|URG to a closed port w/options # PU is a UDP packet to a closed port Fingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0 Class 2Wire | embedded || WAP TSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # 3Com Home Connect Cable Modem external with USB - Model 3CR29223 Fingerprint 3Com Home Connect Cable Modem Class 3Com | embedded || broadband router TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # 3Com 812 OfficeConnect ADSL Router Firmware version: 2.0.0 Fingerprint 3Com OfficeConnect 812 ADSL router Class 3Com | embedded || broadband router TSeq(Class=TD%gcd=18000) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Tested ACC Amazon 9.2.29, ACC Congo 9.2.35 Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator Class ACC | embedded || router TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Acorn RISC OS 3.60 (Acorn TCP/IP Stack 4.07) Class Acorn | RISC OS || general purpose TSeq(Class=TR) T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd) Class Acorn | RISC OS || general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Actiontec Wireless ready DSL Gateway - Model R1520SU # Actiontec 1520 DSL gateway with GlobespanVirata chipset hardware version RD6700 BSP v1.1 (ISOS 8.2) / He100/2xx CSP v2.3, firmware version 8.2.0.16 Fingerprint Actiontec 1520 DSL gateway firmware 8.2.0.16 Class Actiontec | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=8E%IPID=I%TS=U) T1(DF=N%W=1194%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=1194%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=1194%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Adtran Atlas 890 digital cross-connect device Class Adtran | embedded || telecom-misc TSeq(Class=TD%gcd=<714%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Aethra Vega Star Gold (Videoconferencing appliance) # Aethra Video Conference System Vega Pro S running pSOSystem Fingerprint Aethra Vega Conference System Class Aethra | embedded || webcam TSeq(Class=RI%gcd=<6%SI=<2F97016&>79D33%IPID=I%TS=U) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge Class Aironet | embedded || bridge TSeq(Class=C%Val=0) T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Aironet Wireless Bridge running firmware V5.0J Class Aironet | embedded || bridge TSeq(Class=C|TR) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=) T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps Wireless access point Class Aironet | embedded || WAP TSeq(Class=TR%gcd=<6) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Alcatel 1000 ADSL (modem) Class Alcatel | embedded || broadband router TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Alcatel 1000 DSL Router Class Alcatel | embedded || broadband router TSeq(Class=RI%gcd=<5%SI=>AAA&AEE%IPID=I%TS=U) T1(DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Advanced Reflexes IP Phone, Version: E/AT400/46.8 # IBM x450 remote management console (lets you switch machine on/off, check temp, etc) Fingerprint Alcatel Advanced Reflexes IP Phone or IBM x450 remote management console Class Alcatel | embedded || VoIP phone Class IBM | embedded || remote management TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub Class Allied Telesyn | embedded || hub TSeq(Class=C) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA Class Allied Telesyn | embedded || switch TSeq(Class=TD%gcd=FA|1F4%SI=85A%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Nortel/Alteon ACE Director 3 Hardware Revision: B Software Version 6.0.42 Fingerprint Nortel/Alteon ACE Director 3 Version 6.0.42-B Class Alteon | embedded || load balancer TSeq(Class=TR%gcd=<6%IPID=RD) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) # Alteon AceSwitch 110 (software 4.0.37) # Centillion C100 ATM Switch OS Version 2.0.2. Fingerprint Alteon AceSwitch 110 or Cantillion C100 ATM Switch Class Alteon | embedded || switch Class Cantillion | embedded || switch TSeq(Class=TD%gcd=<9C8%SI=<1E) T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Alteon ACEswitch 184 Software Version 8.0.49 Fingerprint Alteon ACEswitch 184 V. 8.0.49 Class Alteon | embedded || switch TSeq(Class=RI%gcd=<34%SI=215%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Amiga OS 3.5 (Miami TCP/IP Stack v3.1) Class Amiga | AmigaOS || general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS 2.1 running AmiTCP4.3 Class Amiga | AmigaOS || general purpose TSeq(Class=64K%TS=U) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m Class Amiga | AmigaOS || general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0c Class Amiga | AmigaOS || general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS AmiTCP/IP 4.3 Class Amiga | AmigaOS || general purpose TSeq(Class=64K) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS AmiTCP/IP Genesis 4.6 Class Amiga | AmigaOS || general purpose TSeq(Class=64K) T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami 2.1-3.0 Class Amiga | AmigaOS || general purpose TSeq(Class=TR) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami 3.0 Class Amiga | AmigaOS || general purpose TSeq(Class=TR) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami 3.1-3.2 Class Amiga | AmigaOS || general purpose TSeq(Class=TR) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B Class Amiga | AmigaOS || general purpose TSeq(Class=TR) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint APC MasterSwitch Network Power Controller Class APC | embedded || power-device TSeq(Class=TR) T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint APC Network management Card AP9616 Class APC | embedded || power-device TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ) T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # APC AP9617 network management card inside Matrix 5000 UPS Fingerprint APC network-enabled UPS Class APC | embedded || power-device TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ) T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # APC UPS Network Management Card, Model AP9617 Fingerprint APC UPS Network Management Card Class APC | embedded || power-device TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ) T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # SmartUPS 3000RM Firmware: 92.14.I # APC PDU AOS v1.1.6 Fingerprint APC UPS system Class APC | embedded || power-device TSeq(Class=TD%gcd=D46DF) T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Apollo Domain/OS SR10.3.5 Class Apollo | Domain/OS || general purpose TSeq(Class=RI|TD%gcd=15CB%IPID=I%TS=2HZ) T1(DF=Y%W=2000|4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2000|4000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000|4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Apple Airport Express (Wireless Router/Bridge) (Firmware v6.1) # Apple AirPort Express (Apple Base Station V6.0) # OKI Phaser B6300N laser printer # Netgear 7000 Series Managed Switch (GSM7324) (strang ops) # Westell Versalink 327W, Wireless DSL Modem/Router Fingerprint Embedded device (Apple WAP, Dell bridge, OKI printer, Westell Broadband router) Class Apple | embedded || WAP Class Dell | embedded || storage-misc Class Okidata | embedded || printer Class Westell | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=1000%TS=2HZ) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=AS%Ops=MNWNNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Mac OS X 1.1-1.2 Fingerprint Apple Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3 Class Apple | Mac OS X | 10.0.X | general purpose TSeq(Class=RI%gcd=<5) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Mac OS X Server 1.0 - 1.0-1 <-- should be 10.1.0? Fingerprint Apple Mac OS X Server 1.0-1.0-1 (Rhapsody 5.3 - 5.4) Class Apple | Mac OS X | 10.0.X | general purpose TSeq(Class=RI%gcd=<5%SI=>BBB&4177) T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.2.6 Class Apple | Mac OS X | 10.2.X | general purpose T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.2.6 (Jaguar) Class Apple | Mac OS X | 10.2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.2.8 (Jaguar) Class Apple | Mac OS X | 10.2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Mac OS X Server 10.2.8 Darwin Kernel 6.8 Macintosh powerpc Fingerprint Apple Mac OS X Server 10.2.8 Class Apple | Mac OS X | 10.2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.3.3 (Panther) Class Apple | Mac OS X | 10.3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Apple Mac OS 10.3.5 (Darwin Kernel Version 7.5.0) # Mac OS 10.3.7 Server, Darwain, PPC. Kernel version 7.70. All relevant updates as of 2/2/05 Fingerprint Apple Mac OS X 10.3.5 or 10.3.7 Class Apple | Mac OS X | 10.3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Darwin 7.7.0 Power Macintosh powerpc, OS X, version 10.3.7 # Apple Mac OS X 10.3.6 (7R28) - (Darwin 7.6.0) Fingerprint Apple Mac OS X 10.3.6 or 10.3.7 Class Apple | Mac OS X | 10.3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.3.9 Class Apple | Mac OS X | 10.3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=E34E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.4.1 (Tiger) Class Apple | Mac OS X | 10.3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=A%Ops=NNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Apple Mac OS X 10.3.8 (Panther); Darwin Kernel Version 7.8.0 # Apple Mac OS X 10.4 (Build: 8A428); Kernel: Darwin 8.0.0 Fingerprint Apple Mac OS X 10.3.8 or 10.4 Class Apple | Mac OS X | 10.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Apple Mac OS X 10.4.0 (Tiger) - Darwin Kernel Version 8.0.0 # Apple Macintosh PowerBook G4 15" Titanium, Mac OS X 10.4.0 (Tiger) build 8A428 # Mac OS X 10.4 Darwin 8.0.0 Darwin Kernel Version 8.0.0: Sat Mar 26 14:15:22 PST 2005; # Fingerprint Apple Mac OS X 10.4.0 Build 8a428 Darwin Kernel Version 8.0.0. Power Macintosh powerpc Hardware is PB G4 # Darwin 8.1.0 Kernel Version 8.1.0 (Apple Mac OS 10.4.1 Tiger) Fingerprint Apple Mac OS X 10.4.0 - 10.4.4 (Tiger) Class Apple | Mac OS X | 10.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6 Class Apple | Mac OS | 7.X | general purpose TSeq(Class=C|TD) T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Not really constant -- just slow incrementation # This is an LCIII Fingerprint Apple Mac OS 7.1 Class Apple | Mac OS | 7.X | general purpose TSeq(Class=C) T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 7.5.5 - 9 Class Apple | Mac OS | 7.X | general purpose Class Apple | Mac OS | 8.X | general purpose Class Apple | Mac OS | 9.X | general purpose TSeq(Class=64K) T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8 running on an LC 475 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=TR) T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.0 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0) T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 running on a PowerPC G3 (iMac) Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.5 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) # on Macintosh GS server Fingerprint Apple Mac OS 8.5.1 (Appleshare IP 6.0) Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.6 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Mac OS 8.6 running WebStar http server Fingerprint Apple Mac OS 8.6 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.6 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Apple Mac OS 8.6 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Mac OS 9 on a Power Macintosh 7200/75 # iMac running Mac OS 9.1 Fingerprint Apple Mac OS 9 - 9.1 Class Apple | Mac OS | 9.X | general purpose TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # HP-UX B.11.00 Fingerprint Apple Mac OS 9.04 or HP-UX B.11.00 Class Apple | Mac OS | 9.X | general purpose Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<9%SI=>3FFF) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0|A0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 9.2.2 Class Apple | Mac OS | 9.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ) T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple MacOS 9.2.2 Class Apple | Mac OS | 9.X | general purpose TSeq(Class=RI%gcd=<6%SI=<32EA6&>111%IPID=I%TS=1000HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0|40%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Newton MessagePad 2100, Newton OS 2.1 Class Apple | Newton OS || PDA T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=R%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=R%Ops=) T7(DF=N%W=1000%ACK=S%Flags=R%Ops=) PU(Resp=N) Fingerprint Arescom 800 series dsl router Class Arescom | embedded || broadband router T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint Arescom NetDSL 1000NDS series ADSL router Class Arescom | embedded || broadband router TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint ARLAN BR2000E V5.0E Wireless Radio Bridge Class Arlan | embedded || bridge TSeq(Class=TR%gcd=<6) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Asante FriendlyNet FR3004 Series Internet Hub Class Asante | embedded || hub TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AsanteHub 2072 Ethernet hub Class Asante | embedded || hub TSeq(Class=C) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Asante 6524-2G GigE switch Class Asante | embedded || switch TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Asante IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 )) Class Asante | embedded || switch TSeq(Class=C%Val=4090000) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Asante IntraSwitch 5324 Class Asante | embedded || switch TSeq(Class=C%Val=80000) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Asante IntraSwitch 62xx (6216M in this case) Firmware v2.05A (16-port managed switch) Fingerprint Asante IntraSwitch 6216M firmware v2.05A Class Asante | embedded || switch TSeq(Class=TD%gcd=114%IPID=I%TS=U) T1(DF=Y%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Max 1800 50Ap8+ or 2024 router Class Ascend | embedded || router TSeq(Class=TD%gcd=388|710|A98%SI=BBB&500&600) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash - I think meant TAOS Fingerprint Ascend / Lucent MAX TNT terminal server Class Ascend | TAOS || terminal server TSeq(Class=RI%gcd=<6%SI=<14F46&>346) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Ascend Mac 6000 Terminal access server (dialup access server) Running TAOS 9.0.9 # Lucent (Acend) DSLMAX 20 revision 8.0.7 Fingerprint Ascend Mac 6000 Terminal access server Class Ascend | TAOS || terminal server TSeq(Class=RI%gcd=<6%SI=<919BA&>E5D%IPID=BI%TS=U) T1(DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Max terminal server firmware 7.0.4 Class Ascend | TAOS || terminal server TSeq(Class=RI%gcd=<6%SI=<14&>1000) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend TNT OS +5.0Ap48+ Class Ascend | TAOS || terminal server TSeq(Class=RI%gcd=<6%SI=>BBB&1000) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MiNT with MiNTnet 1.03 running on Atari TT Class Atari | Atari || game console TSeq(Class=TD%gcd=3E7%SI=0) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=N) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Atari Mega STE running JIS-68k 3.0 Class Atari | Atari || general purpose TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86) T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AtheOS ( www.atheos.cx ) Class AtheOS | AtheOS || general purpose TSeq(Class=RI%gcd=<8%SI=6) T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint AtheOS/Syllable 0.4.2 Class AtheOS | AtheOS || general purpose TSeq(Class=RI%gcd=89CC%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Avaya IP Office 403 PBX Class Avaya | embedded || PBX TSeq(Class=RI%gcd=<6%SI=<2B46872&>6EC4D%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=1111%ACK=S++%Flags=R%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=1111%ACK=S++%Flags=R%Ops=) T6(DF=N%W=1111%ACK=S++%Flags=R%Ops=) T7(DF=N%W=1111%ACK=S++%Flags=R%Ops=) PU(Resp=N) # Avaya TN2302 Prowler/Medpro H.323 gateway HW03/FW022 Fingerprint Avaya TN2302 Prowler/Medpro H.323 gateway Class Avaya | embedded || telecom-misc TSeq(Class=TD%gcd=<6%SI=<14%IPID=I) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Avocent net KVM switch Class Avocent | embedded || specialized TSeq(Class=TR|RI|i800%gcd=<2004%SI=<40D8%IPID=I%TS=1000HZ) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Avocent CPS 1610 serial port server Class Avocent | embedded || terminal server TSeq(Class=RI%gcd=<14004%SI=<10C2%IPID=I%TS=1000HZ) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Axent Raptor Firewall running on Windows NT Class Axent | Windows | NT/2K/XP | firewall TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) # Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) Fingerprint AXIS or Meridian Data Network CD-ROM server Class AXIS | embedded || fileserver TSeq(Class=C) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=) T4(DF=N%W=200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS NetEye Camera Server V1.20 # AXIS NPS 53X Printer Server V4.26 Jul 01 1995 # AXIS StorPoint CD-ROM server V 4.20 # AXIS Camera 200pV1.41 Fingerprint AXIS Stack -- CD-ROM server or print server or camera server Class AXIS | embedded || fileserver Class AXIS | embedded || print server Class AXIS | embedded || webcam TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS StorPoint CD E100 CD-ROM Server V5.32 Jan 19 2001 Fingerprint AXIS StorPoint CD E100 CD-ROM Server Class AXIS | embedded || fileserver TSeq(Class=TD%gcd=<80004%SI=<14%IPID=I%TS=U) T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=) T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS StorPoint CD E100 CD-ROM Server V5.20 Oct 27 1999 Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.20 Class AXIS | embedded || fileserver TSeq(Class=C%Val=4B80000%IPID=I%TS=U) T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=) T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS StorPoint CD E100 CD-ROM Server V5.38 Jan 12 2004 Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.38 Class AXIS | embedded || fileserver TSeq(Class=C%Val=30D40000%IPID=I%TS=U) T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=) T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint AXIS 540 Ethernet Print Server ver 5.48 Class AXIS | embedded || print server TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint AXIS 540 Print Server Class AXIS | embedded || print server T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS 540/542 print server v5.30 Jan 24 1997 Fingerprint AXIS 540/542 Print Server v5.30 Class AXIS | embedded || print server TSeq(Class=C) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint AXIS Print Server firmware 7.0.2 Class AXIS | embedded || print server TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=) T4(DF=N%W=100%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint AXIS 200+ Web Camera running OS v1.42 Class AXIS | embedded || webcam T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) Fingerprint AXIS 2120 network camera Class AXIS | embedded || webcam TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # AXIS 200+ Webcam running software version is 1.42 Fingerprint AXIS Neteye 200+ Webcam running software version 1.42 Class AXIS | embedded || webcam TSeq(Class=TD|C%gcd=<80004%SI=<1E%Val=DFB80000%IPID=RD|I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=) T4(DF=N%W=200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint AXIS NetEye Camera Server V1.20 Class AXIS | embedded || webcam TSeq(Class=C) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS 540+/542+ # AXIS 5400 print server Fingerprint AXIS Network Print Server Class AXIS | Linux || print server T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=) T4(DF=N%W=100%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # The AXIS 2100 Network Camera Operating System, Linux/CRIS, is based on the Linux 2.0 kernel with non-MMU CPU patches from uClinux. The HTTP server used is based on Boa. The source code for the Linux/CRIS kernel, Boa and more is available at http://developer.axis.com/. Fingerprint AXIS 2100 Network Camera running Linux/CRIS v2.32 Class AXIS | Linux || webcam TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=) T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Barix Exstreamer network MP3 player Class Barix | embedded || media device TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99) # Bay Networks ASN Processor revision 9, SE100NM and SFNM modules Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9 Class Bay Networks | embedded || router T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Bay Networks Instant Internet router Class Bay Networks | embedded || router TSeq(Class=TD%gcd=1000|2000|3000%SI=C46) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S%Flags=R%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Bay Networks BayStack 310T switch Class Bay Networks | embedded || switch TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=95%IPID=I|RD%TS=U) T1(Resp=N) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=ARF%Ops=) T3(Resp=N) T4(DF=N%W=800|1000%ACK=S%Flags=ARF%Ops=) T5(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint BBIagent v1.8.1 software router Class BBIagent | Linux | 2.4.X | software router TSeq(Class=RI%gcd=<6%SI=<18C54&>3B8%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Running on a BeBox 66Mhz Fingerprint BeOS 4 - 4.5 Class Be | BeOS | 4.X | general purpose TSeq(Class=TD%gcd=1%SI=0) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint BeOS 5.0.4 (BeOS 5 Pro + BONE 7a) Class Be | BeOS | 5.X | general purpose TSeq(Class=TD%gcd=<6%SI=1F%IPID=I%TS=U) T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint BeOS 5.1d0/DANO on x86 Class Be | BeOS | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U) T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint BeOS R5.03 Personal Edition Class Be | BeOS | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # IPC@CHIP (SC12) -@CHIP-RTOS version SC12 V1.10 Beta Test version MEDIUMBuild: Nov 26 2003 Fingerprint IPC@CHIP CHIP-RTOS version SC12 Class Beck-IPC | embedded || specialized TSeq(Class=TD%gcd=306D3%IPID=Z) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Billion BIPAC-741GE V2 ADSL Router/Modem - Firmware 4.55 (HW: Helium 210-80 ADSL GE-A v1.00) Fingerprint Billion BIPAC-741GE V2 aDSL Router Class Billion | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=137%IPID=I%TS=U) T1(DF=Y%W=1194%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=Y%W=1194%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=Y%W=1194%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # BIANCA/BRICK-XS version V.6.2 Rev. 5 from 2003/05/26 00:00:00 Fingerprint BinTEC BIANCA/BRIK-XS Broadband router V. 6.X Class BinTec | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<54E5C&>C09%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E) # BINTEC-X4000 version V.7.1 Rev. 4 (Patch 3) IPSec # BinTec BingoDSL Router Firmware version 7.1 Rev.1 Patch 11 Fingerprint BinTec BingoDSL/X4000 Router Firmware V. 7.1 Class BinTec | embedded || broadband router TSeq(Class=RI%gcd=<8%SI=<240E&>1A%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E) # XS SW Release 4.9.1 ISDN access router # BinTec BIANCA XM OS version 4.93 Fingerprint BinTec XS/XM ISDN access router V. 4.9.1-4.9.3 Class BinTec | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=>FF&780%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Blue Coat SG6000 Series - SGOS 3.2.2.1 Fingerprint Blue Coat ProxySG (SGOS 3.2.2.1) Class Blue Coat | SGOS || web proxy TSeq(Class=RI%gcd=<6%SI=<43F10C&>4CBD%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Blue Coat SGOS 2.0.09 (Release ID: 20047) # Blue Coat SGOS 3.0.1.0 (Release ID: 20069) Fingerprint Blue Coat Secure Gateway Class Blue Coat | SGOS || web proxy TSeq(Class=RI%gcd=<6%SI=<15654E&>1CC9%IPID=I%TS=2HZ) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint BlueCoat SG4 Class Blue Coat | SGOS || web proxy T1(DF=N%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MENWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Borderware 5.0 Firewall Class Borderware | embedded || firewall TSeq(Class=TR|RI%gcd=<204%SI=<14) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Borderware 5.2 firewall Class Borderware | embedded || firewall TSeq(Class=TR%gcd=<6) T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=N) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Borderware 6.0.2 firewall Class Borderware | embedded || firewall TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Bosch Security Systems's Divar Digital Video Recorder Version 2.00 Class Bosch | embedded || webcam TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ) T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint BreezeCOM BreezeACCESS Wireless bridge Class BreezeCOM | embedded || bridge TSeq(Class=RI%gcd=<6%SI=<988&>4%IPID=I%TS=U) T1(DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # http://www.brixnetworks.com/products/brix1000.html Fingerprint Brix 1000 Verifier Class Brix Networks | embedded || specialized TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Brother Laser Printer HL 1230 Fingerprint Brother HL-1230 Printer Class Brother | embedded || printer TSeq(Class=TD%gcd=48B5D%IPID=I%TS=U) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 2.0 - 2.1 Class BSDI | BSD/OS | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD) Class BSDI | BSD/OS | 3.X | general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 4.0-4.0.1 Class BSDI | BSD/OS | 4.X | general purpose TSeq(Class=RI%gcd=16F) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 4.0.1 Class BSDI | BSD/OS | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=27A9) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 4.2 Class BSDI | BSD/OS | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=1A4F%IPID=I%TS=2HZ) T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cabletron Smart Switch Router 8600 Class Cabletron | embedded || router T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Cabletron Systems SSR 8000 smart switch router System Software, Version 3.1.B.16 Class Cabletron | embedded || router TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Cabletron SmartSwitch, Hardware Revision: 00R, Firmware Revision: 05.00.48, BOOTPROM Revision: 02.02.00 Fingerprint Cabletron SmartSwitch Class Cabletron | embedded || switch TSeq(Class=TD%gcd=<180004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Cabletron Switch model 6H202-24 Module Hardware Revision: 00A Module Firmware Revision: 05.05.11 Module BootPROM Revision: +03.06.04 Fingerprint Cabletron switch Class Cabletron | embedded || switch TSeq(Class=RI|TD%gcd=<404%SI=<263E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint CacheFlow 6000 web proxy cache running CacheOS 4.1.05 Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) # (rel. ID: 17908) Fingerprint CacheFlow 6000 web proxy running Security Gateway 2.1.0 Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<6%SI=15C0%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cacheflow 6x5 web proxy cache running CacheOS 3.1.19-4.1.05 Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<6%SI=16F5%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # CacheFlow CacheOS (CacheFlow 500-5000 web cache) CFOS 2.1.08 - 2.2.1 Fingerprint CacheFlow CacheOS (web proxy cache) CFOS 2.1.08 - 2.2.1 Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<5%SI=>BBBB&1C6E5%IPID=RPI%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint CacheOS (CacheFlow 2000 proxy cache) Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<5%SI=>1111) T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Canon GP 160 PF printer Class Canon | embedded || printer TSeq(Class=TD%gcd=5EC%IPID=I%TS=2HZ) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Canon iR6000 printer Class Canon | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Canon iR7200 Printer Class Canon | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Canon photocopier/fax/scanner/printer GP30F Class Canon | embedded || printer TSeq(Class=TD%gcd=600%SI=0) T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Canon inkjet printer iP4000R with Wireless interface Fingerprint Canon Pixmar IP4000R printer Class Canon | embedded || printer TSeq(Class=TD%gcd=<20004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++|O%Flags=AS|A%Ops=M|) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Capellix 3000 Modular SAN Switch Class Capellix | embedded || storage-misc TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint CastleNet AR502/GlobespanVirata GS8100 (same thing) DSL router Class CastleNet | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # http://www.cayman.com/ Fingerprint Cayman 2E DSL/CABLE router Class Cayman | embedded || broadband router TSeq(Class=TR%gcd=<6) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cayman 3000 DSL Router Class Cayman | embedded || broadband router T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Netopia Cayman 3346 DSL router Class Cayman | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Chase/Perle IOLAN terminal server Class Chase | embedded || terminal server T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(Resp=N) # Chase/Perle IOLAN Terminal Server v3.5.02 CDi Fingerprint Chase/Perle IOLAN terminal server Class Chase | embedded || terminal server TSeq(Class=TD%gcd=<84%SI=<1E) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # These boxes give goofy PU RIPTL results (like 3549 and 4801) so I removed # that test Fingerprint Chase/Perle IOLAN terminal server Class Chase | embedded || terminal server TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Nokia IPSO 3.2 Running Check Point Firewall-1 # IPSO 3.5-FCS8 releng 1020 Running Check Point FW-1 NG FP2 Fingerprint Nokia IPSO 3.2-3.5 Running Check Point Firewall-1 or NG FP2 Class Check Point | IPSO || firewall TSeq(Class=RI%gcd=<6%SI=2476) T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E) # Nokia IPSO 3.2-3.2.1 releng 783-849 # IPSO 3.4-FCS4A releng 767 Running CheckPoint 4.1 SP6 # Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based) # Nokia IPSO 4.3.1-FCS5 Fingerprint Nokia IPSO 3.2-4.3.1-FCS5 Running checkpoint FW1 Class Check Point | IPSO || firewall TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319) T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Nokia IPSO 3.6 FCS 6 releng 1061 01.21.2003-230310 i386 w/ CheckPoint FW-1 NG FP 2, SSL & DNS hotfix and SmartDefense Supplemental Fingerprint Nokia IPSO 3.6 running Check Point FW-1 NG FP2 Class Check Point | IPSO || firewall TSeq(Class=RI%gcd=<6%SI=<7A148&>A01%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Check Point Firewall-1 NG on Sun Solaris 8 Class Check Point | Solaris | 8 | firewall TSeq(Class=RI%gcd=<6%SI=<6C82C&>E51%IPID=I%TS=100HZ) T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build) Class Check Point | Windows | NT/2K/XP | firewall TSeq(Class=RI%gcd=<6%SI=<18358&>3CB) T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Check Point Firewall-1 on Windows NT 4.0 Server SP4-SP5 Class Check Point | Windows | NT/2K/XP | firewall TSeq(Class=TD%gcd=<8%SI=<154) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Check Point Firewall-1/VPN-1 SecurePlatform NG, running FeaturePack 3 Fingerprint Check Point SecurePlatform NG FP3 Class Check Point | Windows | NT/2K/XP | firewall TSeq(Class=RI%gcd=<6%SI=<1C6F042&>48C8B%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco CacheOS (1.1.0) Class Cisco | CacheOS || web proxy TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco 675 DSL router -- cbos 2.1 Class Cisco | CBOS || broadband router T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M) T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco ACNS 5.1 Content Engine Class Cisco | Content Networking System || web proxy TSeq(Class=RI%gcd=<6%SI=1EAE1%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Content Engine 505 Software V. 4.2.1 Class Cisco | Content Networking System || web proxy TSeq(Class=RI%gcd=<6%SI=<2D75904&>5AE06%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0|CC%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # running Application and Content Networking System Software 4.2.3 # Fingerprint Cisco Content Engine 560 Software V. 4.2.3 Fingerprint Cisco Content Engine 560 running Content Networking System V. 4.2.3 Class Cisco | Content Networking System || web proxy TSeq(Class=RI%gcd=<6%SI=<19440B6&>40ACE%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Application and Content Networking System Software Release 5.3.1 (build b5 Mar 17 2005) Fingerprint Cisco Content Engine ACNSS V5.2.1 or V5.3.1 Class Cisco | Content Networking System || web proxy TSeq(Class=RI%gcd=<6%SI=<1A91BDA&>44018%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Accesspoint 1200 Class Cisco | embedded || bridge TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco AIR-WGB340 V8.38 Workgroup Bridge 340 Fingerprint Cisco AIR-WGB340 V8.38 Wireless workgroup bridge 340 Class Cisco | embedded || bridge TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1F4|1000%ACK=S++%Flags=AR|AS%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco WGB350 Wireless WorkGroup Bridge Class Cisco | embedded || bridge TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=5C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 760 Series ISDN router (non IOS) or IBM Stackable Hub Class Cisco | embedded || broadband router Class IBM | embedded || hub TSeq(Class=TD|i800%gcd=<14004%SI=<14) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1) Class Cisco | embedded || broadband router TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router Class Cisco | embedded || broadband router TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=29F4D%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # 3Com 4924 gigabit switch ver 2.04 # Cisco VPN 3000 3.5 Fingerprint Cisco VPN 3000 or 3Com 4924 GigE Switch Class Cisco | embedded || encryption accelerator Class 3Com | embedded || switch TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco CSS 11501 Content Services Switch Class Cisco | embedded || load balancer TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco CSS 11501 Content Services Switch Class Cisco | embedded || load balancer TSeq(Class=RI%gcd=<6%SI=<159FA&>235%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco Local Director 420 version 2.1.1 Class Cisco | embedded || load balancer TSeq(Class=C) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) # The "True Random" is bogus, it is because of sequences # from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869 # Cisco Localdirector 430, running OS 2.1 Fingerprint Cisco LocalDirector load balancer Class Cisco | embedded || load balancer TSeq(Class=TR|C) T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL) T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL) T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # LocalDirector 430 Version 4.2.4 Fingerprint Cisco LocalDirector load balancer Class Cisco | embedded || load balancer TSeq(Class=RI%gcd=<6%SI=<2F240C&>789A%IPID=BI%TS=U) T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco Router C2600 running IOS 12.2(2)T Class Cisco | embedded || router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|800|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4) Class Cisco | embedded || router T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 1548M 10/100 Managed Switch (Firmware Version: v1.03.02) Fingerprint Cisco 1548M managed switch Class Cisco | embedded || switch TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 1900 switch, Bay networks 350-450 switch, or Netopia DSL/ISDN router Class Cisco | embedded || switch Class Bay Networks | embedded || switch Class Netopia | embedded || broadband router TSeq(Class=TD%gcd=<6000%SI=<1E) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 2820 switch Management Console Class Cisco | embedded || switch TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N|Y) # Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5) # Cisco Catalyst 5500 with OS Version 6.3(5) # Alcatel OmniSwitch/Router! Version 4.3.1 GA Fingerprint Cisco Catalyst 5500/6500 or Alcatel OmniSwitch/Router Class Cisco | embedded || switch Class Alcatel | embedded || switch TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Cisco 6509 Cisco Internetwork Operating System Software IOS Version 12.1(23)E Fingerprint Cisco Catalyst 6509 switch running IOS Version 12.1(23)E Class Cisco | embedded || switch TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL|MENN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MNW|MW|ML) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco Catalyst switch Class Cisco | embedded || switch TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or # Trancell WebRamp router or Xylan OmniSwitch 3.2.X.X - 3.4.X.X # Epson Stylus Color 1520C with 100BTX-NIC from Epson # Cisco 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX # SonicWALL firewall appliance 10meg firmware 3.3.1 Fingerprint Router/Switch/Printer/Firewall (LanPlex 2500/Cisco Catalyst 5505/Cisco 6509/Trancell Webramp/Xylan OmniSwitch)/Epson Stylus (100BTX-NIC HP Secure Web Console, SonicWALL firewall appliance 3.3.1) Class Cisco | embedded || switch Class Xylan | embedded || switch Class Epson | embedded || printer Class SonicWALL | SonicOS || firewall Class Trancell | embedded || router TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco AS5200 terminal server Class Cisco | embedded || terminal server TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # A Cisco ATA 186 is a little box that allows a standard POTS # telephone to be used as a voice-over-IP phone. There is a # variation, the ATA 188 that has a pass-through port, much like the # Cisco 7960 phone. Fingerprint Cisco ATA 186 POTS<->VoIP phone gateway device Class Cisco | embedded || VoIP adapter TSeq(Class=TD%gcd=VoIP phone gateway device Class Cisco | embedded || VoIP adapter T1(Resp=N) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 7960 SIP Phone running OS 4.2 Class Cisco | embedded || VoIP phone TSeq(Class=TD%gcd=<2A004%SI=<28%IPID=I%TS=U) T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco IP phone (POS3-04-3-00, PC030301) Class Cisco | embedded || VoIP phone TSeq(Class=TD%gcd=FF&666) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 7206 running IOS 11.1(24) Class Cisco | IOS | 11.X | router TSeq(Class=RI%gcd=<5%SI=CC) T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS 11.3 - 12.0(11) Class Cisco | IOS | 11.X | router Class Cisco | IOS | 12.X | router TSeq(Class=TD|RI%gcd=<6) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T Class Cisco | IOS | 11.X | router TSeq(Class=RI%gcd=<4%SI=<999&>CC) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # 25XX/45XX router, 29XX switch, RSP2 processor Fingerprint Cisco Router/Switch with IOS 11.2 Class Cisco | IOS | 11.X | router Class Cisco | IOS | 11.X | switch TSeq(Class=RI%gcd=<6%SI=<18000) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 3640 router IOS 11.1(7)AX [KUONG(7)AX] # Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6 Fingerprint Cisco switch/router with IOS 11.1(7)-11.2(8.10) Class Cisco | IOS | 11.X | router Class Cisco | IOS | 11.X | switch TSeq(Class=RI%gcd=<6%SI=>BBB&BBB) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 827 ADSL router running IOS 112.2(11) Class Cisco | IOS | 12.X | broadband router TSeq(Class=RI%gcd=<6%SI=<1B1F2&>24E%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Cisco 827 ADSL router running IOS 12.1(1)XB1 Class Cisco | IOS | 12.X | broadband router TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 1601 router running IOS 12.0(8) Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=<6%SI=8A%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1601R router running IOS 12.1(5) Class Cisco | IOS | 12.X | router TSeq(Class=TD%gcd=<6%SI=<32%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 1721 Router running IOS 12.3(10) Fingerprint Cisco 1721 router running IOS 12.3(10) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=O|S++%Flags=A|AS%Ops=|ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 2514 router running IOS 12.0(21) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # CISCO 2600 router running IOS 12.2(3) Fingerprint Cisco 2600 router running IOS 12.2(3) Class Cisco | IOS | 12.X | router TSeq(Class=TD|RI%gcd=<8%SI=249%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # CISCO 2610 router running IOS 12.2(21a) Fingerprint Cisco 2610 router running IOS 12.2(21a) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Cisco 2611 router running IOS 12.0(7)T Fingerprint Cisco 2611 router running IOS 12.0(7)T Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=<6%SI=49%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=WNMETL) PU(Resp=N) # Cisco 2611 router running IOS 12.2(7a) Fingerprint Cisco 2611 router running IOS 12.2(7a) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IOS (tm) 1600 Software (C1600-K8OSY-M), Version 12.2(15)T9 # Cisco 2620 Router /w IOS 12.2(15)T14 Fingerprint Cisco 2620 router running IOS 12.2(15) Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=<6%SI=<1938568&>4088D%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 2620 router running IK903S3-M ios ver 12.3(5) Fingerprint Cisco 2620 router running IOS 12.3(5) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 2620 running IOS 12.2(19a) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 3660, IOS 12.0(6r)T Fingerprint Cisco 3660 running IOS 12.0(6r)T Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # cisco 3725 IOS (tm) 3700 Software (C3725-IS-M), Version 12.3(6c), RELEASE SOFTWARE (fc1) Fingerprint Cisco 3725 router running IOS 12.3(6c) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=109%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 3745 Router running IOS version 12.2(15)T13 Fingerprint Cisco 3745 Router running IOS 12.2(15)T13 Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Cisco 4000 series, IOS 4500 Software (C4500-P-m), Version 12.0(10.3)S Fingerprint Cisco 4000 Series running IOS 12.0(10.3) Class Cisco | IOS | 12.X | router TSeq(Class=RI|TD%gcd=<6%SI=3219%IPID=Z%TS=U) T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 837 router running IOS 12.3(11)T # Cisco 2811 router running IOS 12.3(8r)T7 Fingerprint Cisco 837 router running IOS 12.3(11)T or Cisco 2811 router running IOS 12.3(8r)T7 Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R|BR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 837 Router IOS version 12.3T(8) Fingerprint Cisco 837 router running IOS 12.3(8)T Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco AS5350, IOS 12.2(2)XB6 Fingerprint Cisco AS5350 running IOS 12.2(2)XB6 Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MEML|MEMWL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MML|MMWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco IOS 12.0(3.3)S (perhaps a 7200 router) Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=<6%SI=>FF&D%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS 12.1(4) on a 2600 router Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=3A%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 7507 running 12.2(8)T5 Fingerprint Cisco IOS 12.2(8)T5 on a 7507 router Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 1720 router running 12.2.8T4 with IP/FW/PLUS/3DES feature set # Cisco 801 router running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1) # Cisco Aironet 1100/1200/1400 access point running IOS 12.2.15 Fingerprint Cisco router or WAP running IOS 12.2 Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 12008 running IOS 12.0(18.6)S1 # Cisco 7206VXR running IOS 12.0(18)S Fingerprint Cisco router running IOS 12.0(18)S or 12.0(18)S1 Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 800 running 12.1(5) # Cisco 2620 router running IOS 12.1(6) Fingerprint Cisco router running IOS 12.1 Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=<6%SI=78%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Cisco 3620 running IOS 12.2.1 # IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1) Fingerprint Cisco router running IOS 12.1(5)-12.2(7a) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 2620, IOS 12.2(6r) # Found on Cisco 1720/1750/2611/3640/AS5300 routers Fingerprint Cisco router running IOS 12.1.5-12.2.13a Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=20|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco WS-C4006 # Cisco 7120-4T1 ISO 12.2 # CISCO 2950C # Cisco 3600 Fingerprint Cisco router running IOS 12.2 Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 2621 running IOS 12.2.8T # Cisco SOHO 77 running IOS 12.2(8)T Fingerprint Cisco router running IOS 12.2(8)T Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco IOS Software, C1700 Software (C1700-ADVSECURITYK9-M), Version 12.3(11)T3, RELEASE SOFTWARE (fc4) Fingerprint Cisco router running IOS 12.3(11) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Cisco Router (1760) - IOS (tm) C1700 Software, Version 12.3(6) # IOS (tm) 3700 Software (C3745-IS-M), Version 12.3(6), RELEASE SOFTWARE (fc3) # Cisco 837 router running IOS 12.3.8T3 # CISCO C827 (MPC855T) processor (revision 0x501) with 23552K/1024K bytes of memory. # Cisco 2611XM router running IOS 12.3(10) # Cisco 2921XM router running IOS 12.3(6a) # Cisco 7206VXR running IOS 12.3(6b) # Cisco 831 running IOS Version 12.3(8)T3 # Cisco 3825 Router, IOS 12.3(11)T3 (C3825-ADVSECURITYK9-M, Version 12.3(11)T3, RELEASE SOFTWARE+(fc4)) Fingerprint Cisco router running IOS 12.3(6) - 12.3(11) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R|BR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 5200 router IOS v12.0(15) # Cisco 2924C Fingerprint Cisco router running IOS v12.0(15) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IOS (tm) SOHO91 Software (SOHO91-K9OY6-M), Version 12.3(2)XC, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) (Cisco SOHO 91 Secure router) Fingerprint Cisco SOHO 91 secure router running IOS 12.3 Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco Lightstream 1010 ATM Switch running IOS (tm) LS1010 WA4-5 Software (LS1010-WP-M), Version 12.1(23)E, RELEASE SOFTWARE (fc2) # Cisco 6500 switch running IOS 12.1(23)E Fingerprint Cisco switch running IOS 12.1(23)E Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ML) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # router Cisco 3640, IOS 12.2(23a) Fingerprint router Cisco 3640 running IOS 12.2(23a) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco catalyst 2924 running IOS 12.0(5)WC5 Class Cisco | IOS | 12.X | switch TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) # Cisco Catalyst 2924XL-EN running IOS 12.0(5)WC8 Fingerprint Cisco Catalyst 2924XL switch running IOS 12.0(5) Class Cisco | IOS | 12.X | switch TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 2950 switch running IOS 12.0(5.3)WC(1) Class Cisco | IOS | 12.X | switch TSeq(Class=TR%gcd=<6%IPID=C%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco Catalyst 2950 switch, IOS 12.1(9)EA1 Fingerprint Cisco Catalyst 2950 switch running IOS 12.1(9)EA1 or IOS 12.1(22)EA2 Class Cisco | IOS | 12.X | switch TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MEM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MM) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS 12.0(5)WC5a on a catalyst 2900XL switch Class Cisco | IOS | 12.X | switch TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1200 access point (WAP) running IOS 12.2(8) Class Cisco | IOS | 12.X | WAP TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco AP1220 IOS 12.2(11)JA1 Fingerprint Cisco AP1220 WAP running IOS 12.2(11) Class Cisco | IOS | 12.X | WAP TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco CPA2500 (68030) or 2511 router Class Cisco | IOS || router TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco uBR 7223 router Class Cisco | IOS || router TSeq(Class=TR%gcd=<6%IPID=C%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco Catalyst 4006 Switch running NmpSW 7.4(2) Class Cisco | NmpSW || switch TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco PIX 4.2(2) Internal Interface Class Cisco | PIX | 4.X | firewall TSeq(Class=C) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 515 firewall running software 4.4(5) Class Cisco | PIX | 4.X | firewall TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall running PIX 4.1(5) Class Cisco | PIX | 4.X | firewall TSeq(Class=C%Val=211E005F) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco Pix Firewall running PIX 4.1.6 Class Cisco | PIX | 4.X | firewall TSeq(Class=C%Val=71F60191%IPID=BI%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800|1000%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00|400%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX v4.2 Firewall Class Cisco | PIX | 4.X | firewall TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) # Cisco PIX running IOS 6.1(1) - Internal interface # Cisco PIX 520 firewall running PixOS 6.1(3) # Secure PIX Firewall Version 5.2(2) Fingerprint Cisco PIX Firewall (PixOS 5.2 - 6.1) Class Cisco | PIX | 5.X | firewall Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR|AS%Ops=WNMETL|M) T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco Secure PIX Firewall Version 5.0(2) Class Cisco | PIX | 5.X | firewall T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) # Cisco 535 IOS 6.2 PIX running in failover mode... ie.. idle # PIX 506 running PIX IOS 6.2 Fingerprint Cisco Firewall (PIX 6.1.4 - 6.2.2) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 501 firewall running PIX 6.1(1) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%IPID=I%TS=U) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T6(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 515 or 525 Firewall running 6.1(4) - 6.2(1) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) # Cisco PIX 501 Firewall running IOS 6.3(1) # Cisco PIX Firewall IOS version 6.22 # Cisco PIX 515 version 6.3(1) # Cisco PIX 501 Firewall running PIXOS 6.3.3 Fingerprint Cisco PIX Firewall running PIX 6.2 - 6.3.3 Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=400||800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall Version 6.1(2) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall Version 6.2(1) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Cisco PIX Firewall Version 6.2(2) - 6.3 Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 506 Firewall Class Cisco | PIX || firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) # Sun Remote System Console version 1.12 # Brocade Fibre Switch, Firmware 2.6.0 # Cisco Aironet 340 WAP running v 12.03T of the firmware (and VxWorks OS) Fingerprint Cisco Aironet WAP, Brocade Fibre Switch, or Sun Remote System Console Class Cisco | VxWorks || WAP Class Brocade | embedded || switch Class Sun | embedded || remote management TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Clipcomm CP-100 v1.1.39 (040820) Fingerprint Clipcomm CP-100 VoIP phone Class Clipcomm | embedded || VoIP phone TSeq(Class=TD%gcd=<9B4%SI=<1E%IPID=I%TS=U) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM) T2(Resp=N) T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cnet CNIG904B Internet Broadband Gateway firmware version 1.11 Class Cnet | embedded || broadband router TSeq(Class=TD%gcd=DAF%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # OSF1 V4.0 1530 alpha # Tru64 4.0F (Alpha), Patch Kit 8, Kernel Build 1229 Fingerprint Tru64 UNIX 4.0f - 4.0g Class Compaq | Tru64 UNIX | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Compaq Tru64 UNIX 5.0 on AlphaServer # DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A on a DEC 4000 Model 610 running OpenVMS V7.2 Fingerprint Compaq Tru64 UNIX 5.0 or DEC OpenVMS 7.2 Class Compaq | Tru64 UNIX | 5.X | general purpose Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732) Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732) Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885) Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885) Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Compaq Tru64 UNIX V5.1B (Rev. 2650) Fingerprint Compaq Tru64 UNIX V5.1B Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP Tru64 UNIX v5.1B: OSF1 V5.1 2650 alpha Fingerprint HP Tru64 UNIX v5.1B Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OSF1 5.0 Rev. 910 (AKA Compaq/DIGITAL Tru64 UNIX) Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=11) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Compaq T1010 Thin Client Windows CE 2.12 Class Compaq | Windows | PocketPC/CE | terminal TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compatible Systems ISDN/leased-line/dialup Microrouter 2220R w/ firmware v4.5 Class Compatible Systems | embedded || broadband router TSeq(Class=TD%gcd=388|710|A98%SI=<14) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Compatible Systems ISDN/leased-line/dialup MicroRouter 900i v3.0.9 Class Compatible Systems | embedded || broadband router TSeq(Class=TD%gcd=388|710|A98%SI=45EAE%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B) with Conexant-Hasbani CX82xxx_4.1.0.9 firmware running on VxWorks 5.4.2 OS Fingerprint Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B) Class Conexant | embedded || broadband router TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Contiki 1.2-devel0 on Ethernut (Atmel AVR ATmega128 with RTL8019as Ethernet chip) # uIP 0.9 running on a Atmel ATmega16 using a Packet Whacker for ethernet connectivity Fingerprint Contiki 1.2-devel0 embedded OS on Ethernut card or uIP 0.9 TCP/IP stack Class Contiki | Contiki || specialized Class uIP | uIP || specialized T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Convex OS Release 10.1 Class Convex | ConvexOS || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Convex SPP-UX 5.2.1 Class Convex | SPP-UX || general purpose TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=) T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SPP-UX 5.x on a Convex SPP-1600 Class Convex | SPP-UX || general purpose TSeq(Class=C) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=R%Ops=) T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP j4813A ProCurve Switch 2524 # Copper Mountain Networks DSL Concentrator # Compaq Remote Insight Lights-Out remote console card # 3Com Home Wireless Gateway 3CRWE50194-E1, firmware 1.14 # TrueTime NTS-200 GPS Network Time Server # Compaq Lights Out Edition firmware v2.41 # 3Com NBX 25 (Phone System) Version: R1_0_3 Fingerprint Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com NBX 25 phone system or Home Wireless Gateway, or TrueTime NTP clock Class Copper Mountain | embedded || terminal server Class 3Com | embedded || WAP Class 3Com | embedded || telecom-misc Class TrueTime | embedded || specialized Class Compaq | embedded || remote management TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Corega BAR SW-4P [Part number:CG-BARSW4P] Fingerprint Corega BAR SW-4P Broadband Access Router Class Corega | embedded || broadband router T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint UNICOS 10.0.0 on Cray 90 Class Cray | UNICOS | 10.X | general purpose TSeq(Class=RI%gcd=2222) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL) T2(Resp=N) T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cray UNICOS/mk 8.6 Class Cray | UNICOS | 8.X | general purpose TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1 Class Cray | UNICOS || general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL) T2(Resp=N) T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2 Class Cray | UNICOS || general purpose TSeq(Class=RI%gcd=<6%SI=>F) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL) T2(Resp=N) T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Unisys LX/NX MCP 46.1/HMP 5.0 on an Unisys LX5120 Fingerprint Cray Unisys LX/NX MCP 46.1/HMP 5.0 on LX5120 Class Cray | Unisys || general purpose TSeq(Class=RI%gcd=<6%SI=<7868FCE&>CF0B8%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyberguard 4.0 firewall Class Cyberguard | embedded || firewall TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Cyberguard Firewall 5.2 on Firestar 500 (proprietary Unixware version) Fingerprint Cyberguard Firewall 5.2 Class Cyberguard | embedded || firewall TSeq(Class=RI%gcd=<6%SI=<5FE3BC&>A86A%IPID=RD%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O|S++%Flags=R|AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(Resp=N) Fingerprint Cyclades PathRouter Class Cyclades | Cyras || router TSeq(Class=TD|RI%gcd=<618708%SI=BBBBB) T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRouter V 1.2.4 Class Cyclades | Cyros || router TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12 Class Cyclades | Cyros || terminal server TSeq(Class=TD%gcd=30C382%SI=16%IPID=BI%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # D-Link DI-604 Ethernet Broadband Router with firmware V3.01 # D-link 4 port Ethernet Broadband Router DI-604 H/W Ver.:D1 F/W Ver.:3.01 Fingerprint D-Link DI-604 Ethernet Broadband Router Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link DI-604 Ethernet router Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<2C0%SI=<14%IPID=BI%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link DI-701, Version 2.22 Class D-Link | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=N) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9 Class D-Link | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # D-Link DI-704P Cable/DSL Residential Gateway firmware version 2.57 build 3 Fingerprint D-Link DI-704P Cable/DSL Residential Gateway Class D-Link | embedded || broadband router TSeq(Class=RI%gcd=<68%SI=<1338&>13%IPID=I%TS=U) T1(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # D-Link DI-804 Cable/DSL Residential Gateway (with firmware v2.00B7) # DI-804 Broadband Router with Firmware 2.01 Fingerprint D-Link DI-804 Cable/DSL Residential Gateway Class D-Link | embedded || broadband router TSeq(Class=TD|TR%gcd=<10%SI=<3C%IPID=I%TS=U) T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # D-Link DI-804HV 4-Port Broadband VPN Router # US-Robotics Wireless Router : Revision Number : Model#8022, Version V4.2, CheckSum# B719 Fingerprint D-Link DI-804HV VPN Router or US-Robotics 8022 WAP or DI-714P+ Wireless router Class D-Link | embedded || broadband router Class US Robotics | embedded || WAP TSeq(Class=TD%gcd=<3EC%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # D-Link DSL-300G+ version 7.1.0.30 AnnexA (Oct 18 2002) R2.05.b4t9uk Fingerprint D-Link DSL-300G+ DSL modem Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<1731C%SI=<14%IPID=I%TS=U) T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint D-Link DSL-500 DSL modem Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<1FBD4%SI=<14%IPID=I%TS=U) T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link DSL-500 DSL modem Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=2%IPID=BI%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # D-Link DI-714P+, Firmware V1.33 # D-Link 4-port Broadband VPN Router DI-804HV Fingerprint D-Link VPN Router DI-714P+/DI-804HV Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<3EC%SI=<6E%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # DI-701 Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30 Fingerprint DI-701 Residential Gateway or KA9Q NOS - KO4KS-TNOS v. 2.30 Class D-Link | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=N) T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) # D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled # Date: Oct 14 1997, Time: 09:35:04 (claims software version 2.04B3, # boot PROM version 2.21) Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21 Class D-Link | embedded || hub TSeq(Class=TD%gcd=1388%SI=0) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # D-Link Print Server Model DP-101P+ Fingerprint D-Link Print Server Class D-Link | embedded || print server TSeq(Class=TD%gcd=<374%SI=<1E) T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint D-Link VoIP Gateway GS-104SH Class D-Link | embedded || telecom-misc TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) # D-Link DI-604 Ethernet router using firmware 1.62 build 2 # DI-707P router # Sitecom - Broadband Home Station - Firmware R1.96c # SMC Barricade Broadband Router with firmware R1.96h2 - internal interface Fingerprint Broadband router or WAP: D-Link DI-series, Sitecom BHS WAP, or SMC Barricade Class D-Link | embedded || WAP TSeq(Class=TD%gcd=281) T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Data General DG/UX Release R4.20MU06 Class Data General | DG/UX || general purpose TSeq(Class=RI%gcd=<6%SI=779%IPID=I%TS=U) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint 4.3BSD-tahoe on a MicroVax III Class DEC | BSD-misc || general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OSF/1 V1.3A - 2.0 Class DEC | Digital UNIX | 1.X | general purpose Class DEC | Digital UNIX | 2.X | general purpose TSeq(Class=64K) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Digital UNIX OSF1 V 3.0,3.2,3.2C Class DEC | Digital UNIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC Digital UNIX OSF1 V 4.0-4.0F Class DEC | Digital UNIX | 4.X | general purpose TSeq(Class=C|RI%gcd=<6) T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint Digital UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F Class DEC | Digital UNIX | 4.X | general purpose TSeq(Class=RI|TD|64K%gcd=<6) # Boy, OSF1 comes in all colors! T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OSF1 (AKA Compaq/DIGITAL Tru64 UNIX) Version 5.0.0 Class DEC | Digital UNIX | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint OSF/1 (AKA Compaq/DIGITAL Tru64 UNIX) 5.60 Class DEC | Digital UNIX | 5.X | general purpose TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint DECNIS 600 V4.1.3B multiprotocol bridge/router Class DEC | embedded || router TSeq(Class=TD%gcd=30D4|C35%SI=1009%IPID=I%TS=U) T1(DF=N%W=7E4A%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=7E4A%ACK=O%Flags=A%Ops=) T4(DF=N%W=7E00%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.1 Alpha running DIGITAL's UCX v4.1ECO2 TCP/IP package Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=64K) T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=) T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI|TD%gcd=<6%SI=543%IPID=I%TS=U) T1(DF=N%W=C3A5%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=C3A5%ACK=O%Flags=A%Ops=) T4(DF=N%W=C350%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.2 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<44%SI=<2670&>3B%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Digital OpenVMS Alpha 7.2 Fingerprint DEC OpenVMS 7.2 Alpha Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=) T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # The OS was running on a GS1280 Alpha server Fingerprint DEC OpenVMS 7.3 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # OpenVMS 7.3 with TCP/IP 5.3 Fingerprint DEC OpenVMS 7.3 (Alpha) TCP/IP 5.3 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.3 (Compaq TCP/IP 5.3) Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.3-1 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<6%SI=<56E82&>B37%IPID=I%TS=U) T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS Alpha 7.2-3 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=C6C%ACK=S++|O%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS V7.1 on VAX 6000-530 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package Class DEC | OpenVMS | 7.X | general purpose T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # DEC VAXVMS TCPIP V5.1-15 Full LP Installed Fingerprint DEC OpenVMS v7.3 on VAXStation 4000/60 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS VAX V7.3, Process Software MultiNet V5.0 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U) T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint DEC VMS MultiNet V4.2(16)/ OpenVMS V7.1-2 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC VMS MultiNet V4.4 / OpenVMS V7.1 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6%TS=2HZ) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC TOPS-20 Monitor 7(102540)-1,TD-1 Class DEC | TOPS-20 || general purpose TSeq(Class=TD%gcd=30000|60000|90000%SI=BBBBB) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=64%ACK=O%Flags=AR%Ops=) T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=64%ACK=O%Flags=AR%Ops=) T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint DEC VMS MultiNet V4.1(16) Class DEC | VMS || general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # dell 5100 printer # Dell 3100cn printer, OEM of Xerox DocuPrint C525A Fingerprint Dell 3100cn/5100cn printer Class Dell | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++|O%Flags=AR|A%Ops=) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=4E4%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Dell Remote Access Card III/XT # Dell Remote Access Card 4/I (DRAC4) # Drac III/XT Administation Card for Dell PowerEdge # Dell Remote Access Controller 4/I (DRAC 4/I) Version 1.20 (Build 03.15) Fingerprint Dell Remote Access Controller III/XT or 4/I Class Dell | embedded || remote management TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Dell Powervault 132T Automated Tape Library Class Dell | embedded || storage-misc TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Dell PowerVault 132T Library (Firmware 103D.GY001) Fingerprint Dell Powervault 132T Automated Tape Library Class Dell | embedded || storage-misc TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=578%ACK=O%Flags=A%Ops=) T4(DF=N%W=578%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Dell Tape Library MSL6030 Class Dell | embedded || storage-misc TSeq(Class=TD%gcd=<2004%SI=<1D6%IPID=I%TS=1000HZ) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Dell PowerConnect 3324 Switch # Dell PowerConnect 3348 Switch, Software Version 1.2.0.6 Boot Version 1.0.0.13 # Dell 3324 PowerConnect Switch with firmware version 1.1.0.42 Fingerprint Dell PowerConnect Switch 3324 or 3348 Class Dell | embedded || switch TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=200|800%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200|800%ACK=S++%Flags=AS%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Dell PowerConnect 5324 24 Port Gigabit Switch Fingerprint Dell PowerConnect Switch 5324 Class Dell | embedded || switch TSeq(Class=TD%gcd=<2C%SI=<1E%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Dell PowerConnect Switch running SW V.1.0.0.52 Fingerprint Dell PowerConnect Switch running SW V.1.0.0.52 Class Dell | embedded || switch TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Digital Link DL2001 CSU/DSU Management Access Processor Class Digital Link | embedded || CSUDSU TSeq(Class=TD%gcd=<2780%SI=<14) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Digital Networks VNswitch 900 Class Digital Networks | embedded || switch TSeq(Class=TD%gcd=<4%SI=<4) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Digitel NetRouter NR3000 Class Digitel | embedded || router TSeq(Class=RI%gcd=<2004%SI=<10CC&>16) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Digitel NetRouter NR3100 Class Digitel | embedded || router TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Draytek Vigor 2000 ISDN router Class Draytek | embedded || broadband router T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Draytek Vigor 2200e DSL router v2.1a Class Draytek | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Draytek Vigor 2200e DSL router v2.1b Class Draytek | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<2D38FC2&>72E8A%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Software version VIK-1.35.020320j -- www.easytel.fi Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router Class Easytel | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Edimax BR-6004 Broadband router Class Edimax | embedded || broadband router TSeq(Class=i800%IPID=I%TS=2HZ) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Edimax PS-1001 Print Server model Class Edimax | embedded || print server TSeq(Class=TD%gcd=<1C004%SI=<244%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Edimax PS-901 Print Server model 1P/13E-9.5.12 Class Edimax | embedded || print server TSeq(Class=RI%gcd=<2004%SI=<12D4&>1C%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Efficient Networks/SpeedStream DSL router Class Efficient Networks | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Eicon Diva1830 ISDN router running 1.5 firmware Class Eicon | embedded || broadband router TSeq(Class=TD%gcd=<20004%SI=<14%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M) T2(Resp=Y%DF=N%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M) T4(DF=N%W=1%ACK=O%Flags=R%Ops=) T5(DF=N%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1%ACK=O%Flags=R%Ops=) T7(DF=N%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # ELSA LANCOM 1100 Office, Firmware 2.50.0005 / 15.11.2001 Fingerprint ELSA LANCOM 1100 office router Class Elsa | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint ELSA LANCOM DSL I-10 Office router Class Elsa | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=WNMETL) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # ELSA LANCOM Wireless L-11 3.42.0021 / 24.06.2004 # Lancom (Elsa) DSL I-10 Office Firmware 3.2 Fingerprint ELSA LANCOM DSL I-10 Office router or Wireless L-11 Class Elsa | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # LANCOM DSL/10 Office DSL router with firmware v3.22 Fingerprint ELSA LANCOM DSL/10 Office DSL router Class Elsa | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # ELSA LANCOM DSL/10 Office router 2.62.0002 Fingerprint ELSA LANCOM DSL/10 office router Class Elsa | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint ELSA LANCOM DSL/10 office router Class Elsa | embedded || broadband router T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # ELSA LANCOM DSL/I-1611 Office 2.70.0025 / 06.08.2002 http://www.lancom-systems.de/ # ELSA LANCOM DSL/I-1611 Office 2.50.0005 / 15.11.2001 Fingerprint ELSA LANCOM DSL/I-1611 Office router Class Elsa | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint EMC DART running on a Data Mover fileserver. Version T4.1.8.1 Class EMC | DART || fileserver TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint EMC IP4700 Filer Class EMC | DART || fileserver TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Enterasys XSR-1805 Software Version 6.0.0.0, Built Sep 14 2003, 11:09:28 Fingerprint Enterasys XSR-1805 Security Route Class Enterasys | embedded || firewall TSeq(Class=RI%gcd=<6%SI=<55280&>B75%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Enterasys XP-2400 switch running Enterasys E9.0.0.0 # Cabletron Smartswitch 6000 running Enterasys E8.2.0.0 Fingerprint Enterasys/Cabletron switch running Enterasys E8.2.0.0 - E9.0.0.0 Class Enterasys | embedded || switch TSeq(Class=RI%gcd=<6%SI=<7A31E&>10AD%IPID=I%TS=2HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98 Class Epson | embedded || printer TSeq(Class=TR) T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=) T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20 Class Epson | embedded || printer T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=) T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Ericsson Congo router running software version 9.9.34 Fingerprint Ericsson Congo router Class Ericsson | embedded || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Ericsson HM220dp ADSL modem/router Class Ericsson | embedded || broadband router TSeq(Class=TD%gcd=<50000%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Ericsson Tigris Access Server V. 12.1.15 with 10.2 ISDN code # Integrated Access Platform, Software Version = 12.1.1.22 (ISDN Software Version 10.1) Fingerprint Ericsson Tigris Access Server Software V. 12.1.* Class Ericsson | embedded || terminal server TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Exabyte X80 tape backup robot Class Exabyte | embedded || storage-misc TSeq(Class=TD%gcd=<6004%SI=<14%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0|0%ACK=S++|O%Flags=AS|AR%Ops=M|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Extreme Gigabit switch (unknown version) Class Extreme Networks | embedded || switch TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Extreme Networks Black Diamond switch Class Extreme Networks | embedded || switch TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Extreme Networks Alpine 3804 Switch running Extremeware 6.2.1 Class Extreme Networks | Extremeware || switch TSeq(Class=RI%gcd=<6%SI=<1598C&>223) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Extremeware Version 6.2.2 (Build 68) by Release_Master 01/15/03 16:58:48 Fingerprint Extremeware 6.2.2 Class Extreme Networks | Extremeware || switch TSeq(Class=RI%gcd=<6%SI=<2F062&>36C%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint F5 Labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86) Class F5 Labs | BSDI || load balancer TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # F5 labs BIG-IP Load balancer. BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386 # F5 BIG-IP 540 loadbalancer. Fingerprint F5 Labs BIG-IP Load balancer Kernel 4.1.1PTF-03 (x86) Class F5 Labs | embedded || load balancer TSeq(Class=TR%gcd=<6) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint F5 Labs BIG-IP load balancer kernel 4.2PTF-05a (x86) Class F5 Labs | embedded || load balancer TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint FastComm FRAD (Frame Relay Access Device) F9200-DS-DNI -- Ver. 4.2.3A Class FastComm | embedded || specialized TSeq(Class=TD|RI%gcd=<8%SI=<1E) T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=) T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Fiber Line Wireless Broadband DSL Router, type: 802.11g, hardware release: R1.03SRM firmware version: V1.96.1g Fingerprint FiberLine Wireless DSL router Class FiberLine | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<23C9F22&>5B99B%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint FiberLine WL-1200R1 (also known as InterEpoch IWE-1200A-1) Wireless Broadband Router (WAP) Class FiberLine | embedded || WAP TSeq(Class=TD%gcd=<8%SI=<14%IPID=I%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # FlowPoint 144 or 22XX DSL Router v3.0.8 # SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready Fingerprint DSL Router: FlowPoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1 Class FlowPoint | embedded || broadband router Class SpeedStream | embedded || broadband router TSeq(Class=TR%gcd=<6) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E) Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router Class FlowPoint | embedded || broadband router Class ASCOM | embedded || broadband router TSeq(Class=TD%gcd=<6%SI=5BD%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Fortigate-50A running FortiOS V2.80,build393,050405 Fingerprint Fortinet firewall Fortigate 50A (FortiOS V2.80) Class Fortinet | embedded || firewall TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ) T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(DF=Y%W=16D0%ACK=O%Flags=AS%Ops=M) PU(Resp=N) # Fortinet Fortigate-60 firewall version 2.80,build430,050609 Fingerprint Fortinet firewall Fortigate 60 Class Fortinet | embedded || firewall TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ) T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry FastIron Edge Switch (load balancer) 2402 Class Foundry | embedded || load balancer TSeq(Class=RI%gcd=<6%SI=<3E418&>988%IPID=RD%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Foundry 1500 OS Ver 7.2.06T51 # Foundry ServerIron XL 16 Port 7.3.06T12 Fingerprint Foundry Load Balancer OS Ver 7.2.X - 7.3.X Class Foundry | embedded || load balancer TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Foundry Networks Biglron 8000 load balancer Class Foundry | embedded || load balancer TSeq(Class=RI%gcd=<6%SI=<4C464&>294%IPID=I%TS=U) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry FastIronII 4000 load balancer running 06.6.34T43 Class Foundry | IronWare || load balancer TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry NetIron load balancer OS Ver. 7.1.23T13 Class Foundry | IronWare || load balancer TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry Networks, Inc. Router/Load balancer, IronWare Version 06.5.12T43 Class Foundry | IronWare || load balancer TSeq(Class=C) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry ServerIron XL load balancing IP Switch Version 06.0.00T12 Class Foundry | IronWare || load balancer TSeq(Class=C) T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint FreeBSD 2.1.0 - 2.1.5 Class FreeBSD | FreeBSD | 2.X | general purpose TSeq(Class=64K) T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 2.2.1 - 4.1 Class FreeBSD | FreeBSD | 2.X | general purpose Class FreeBSD | FreeBSD | 3.X | general purpose Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<38E50&>906) T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M) T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E) Fingerprint FreeBSD 2.2.1-STABLE Class FreeBSD | FreeBSD | 2.X | general purpose TSeq(Class=RI%gcd=<8%SI=<74A54&>1295) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 3.2-4.0 Class FreeBSD | FreeBSD | 3.X | general purpose Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<92D42&>1769) T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint FreeBSD 3.4-RELEASE Class FreeBSD | FreeBSD | 3.X | general purpose TSeq(Class=RI%gcd=<6%SI=<58AD4&>3BB) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E) # DragonFly 1.1-Stable #0: Sun Nov 14 17:22:45 CET 2004 # DragonFly 1.1-CURRENT (i386) build on 2004/12/03 Fingerprint DragonFly 1.1-Stable (FreeBSD-4 fork) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.0-20000208-CURRENT Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<63074&>FC4) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.1.1 - 4.3 (x86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.10-STABLE i386 Fingerprint FreeBSD 4.10-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.3-RC # FreeBSD 4.2-RELEASE i386 Fingerprint FreeBSD 4.2 - 4.3-RC (x86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=CD3%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.3 - 4.4-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.3 - 4.4PRERELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.4 for i386 (IA-32) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.4-5 or Apple Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13) Class FreeBSD | FreeBSD | 4.X | general purpose Class Apple | Mac OS X | 10.0.X | general purpose TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ) T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002 Fingerprint FreeBSD 4.4-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.5-RELEASE (or -STABLE) (x86) # FreeBSD 4.6-RC Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) through 4.6-RC (x86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6 Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.6-RELEASE FreeBSD 4.6-RELEASE #0 i386 Fingerprint FreeBSD 4.6 Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6 Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8AAA2&>96A%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # 4.6-RELEASE # 4.6-STABLE # 4.6.2-RELEASE-p6 Fingerprint FreeBSD 4.6 through 4.6.2 (July 2002) (x86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%IPID=I%TS=100HZ) T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6-RC on Alpha Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6.2-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.8-RELEASE # 4.7-STABLE FreeBSD 4.7-STABLE #0: Tue Nov 19 16:13:55 2002 Fingerprint FreeBSD 4.6.2-RELEASE - 4.8-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.7-RELEASE # FreeBSD 4.8-RELEASE-p13 Fingerprint FreeBSD 4.7 - 4.8-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.7-RELEASE-p3 FreeBSD 4.7-RELEASE-p3 #0: Wed Jan 8 21:31:21 CET 2003 i386 Fingerprint FreeBSD 4.7-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.7-RELEASE through 4.8-RELEASE (x86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.7-RELEASE-p3 on i386 Fingerprint FreeBSD 4.7-RELEASE-p3 Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.7-STABLE (Jan 2003) Fingerprint FreeBSD 4.7-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.9-PRERELEASE alpha # FreeBSD 4.8-RELEASE on DEC Alpha # FreeBSD 4.9-STABLE (platform unspecified) Fingerprint FreeBSD 4.8-RELEASE through 4.9-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.8-STABLE (June 2003) Fingerprint FreeBSD 4.8-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|1000HZ) T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.8-STABLE (June 2003) Fingerprint FreeBSD 4.8-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.8-STABLE - 4.9-PRERELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.0-RELEASE x86 # sparc64 running FreeBSD 5.1-RELEASE # FreeBSD 4.9-STABLE FreeBSD 4.9-STABLE i386 Fingerprint FreeBSD 4.9 - 5.1 Class FreeBSD | FreeBSD | 4.X | general purpose Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ) T1(DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.9-RELEASE-p1 #0 i386 Fingerprint FreeBSD 4.9-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # 4.9-RELEASE FreeBSD 4.9-RELEASE #0 Fingerprint FreeBSD 4.9-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.9-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002 Fingerprint FreeBSD 5.0-CURRENT (Apr 2002) Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.0-RELEASE Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.0-RELEASE Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD somehost.someplace 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Jan 29 12:31:51 CST 2003 i386 # FreeBSD 5.0-RELEASE Alpha Fingerprint FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003) Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.1-CURRENT (June 2003) on Sparc64 Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.1-RELEASE (x86) Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.2 Class FreeBSD | FreeBSD | 5.X | general purpose T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|84%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.2-CURRENT (Jan 2004) on x86 # FreeBSD 5.2.1-RELEASE i386 # FreeBSD 5.3-RELEASE #0 Fingerprint FreeBSD 5.2 - 5.3 Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.3-RELEASE # FreeBSD 5.2-CURRENT i386 # FreeBSD 5.4-RELEASE #4 # FreeBSD 5.4-Stable # FreeBSD 5.4-STABLE #0 # BummiOS 5.4-CURRENT i386 (based on FreeBSD 5.4-STABLE) Fingerprint FreeBSD 5.2 - 5.4 Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|U) T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.2-CURRENT (Jun 25, 2004) on x86 running pf as firewall with "scrub in all" # FreeBSD 5.3-Beta2 (x86) # FreeBSD 5.3-RELEASE (x86) Generic kernel Fingerprint FreeBSD 5.2-CURRENT - 5.3 (x86) with pf scrub all Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.2.1 running on Ultra5 spac64 Fingerprint FreeBSD 5.2.1 (SPARC) Class FreeBSD | FreeBSD | 5.X | general purpose T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.3-STABLE (x86) as of 2004.11.14 # FreeBSD 5.3-RELEASE Fingerprint FreeBSD 5.3 Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=1000HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.3rc3 with pf scrub all Fingerprint FreeBSD 5.3 Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # FreeBSD 5.3-RELEASE i386 Fingerprint FreeBSD 5.3-RELEASE Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint FreeBSD 5.3-RELEASE Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.3-STABLE #7 Tue Feb 8 17:55:23 WET 2005 i386 Fingerprint FreeBSD 5.3-STABLE Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.3-STABLE as of 2004-11-14, pf scrib in all random-id Fingerprint FreeBSD 5.3-STABLE Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # FreeBSD 5.4-RC2 FreeBSD 5.4-RC2 #2 i386 # FreeBSD 5.4-STABLE FreeBSD 5.4-STABLE #7 i386 Fingerprint FreeBSD 5.4 Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=FFFF%ACK=O|S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.4-RELEASE-p2 i386 Fingerprint FreeBSD 5.4-RELEASE Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 6.0-CURRENT #1 i386 # FreeBSD 5.2.1-RELEASE Fingerprint FreeBSD 5.2.1-RELEASE or 6.0-CURRENT Class FreeBSD | FreeBSD | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeSCO 0.27 (Linux 2.0.38) Class FreeSCO | Linux | 2.0.X | router TSeq(Class=RI%gcd=<6%SI=<1F22A6E&>4E0A2%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint FreeSCO 0.27 (Linux 2.0.38) Class FreeSCO | Linux | 2.0.X | router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Galacticomm WorldGroup BBS (MajorBBS) w/TCP/IP Class Galacticomm | WorldGroup || BBS TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&89C%IPID=I%TS=U) T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Genius Print Server Class Genius | embedded || print server T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Gnat Box Light firewall v3.0.3 (from the inside interface) Class Global Technology Associates | embedded || firewall TSeq(Class=RI%gcd=<6%SI=264) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E) # GNet BB0040 DSL router # SAR-703 Combined ADSL Modem/Router Fingerprint GNet BB0040 or SAR 703 DSL modem + router Class GNet | embedded || broadband router Class SAR | embedded || broadband router TSeq(Class=TD%gcd=VoIP phone gateway device Class Grandstream | embedded || VoIP adapter TSeq(Class=C%Val=66559055%IPID=I%TS=U) T1(Resp=N) T2(Resp=Y%DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Grandstream BT-100 IP Phone Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=FBD5528A%IPID=I%TS=U) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=400%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Grandstream BT-100 IP Phone Class Grandstream | embedded || VoIP phone T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=1000|C00%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=800|C00|400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Grandstream BudgeTone101 VoIP phone, firmware 1.0.4.50 Fingerprint Grandstream BT-101 IP phone Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=75DFD55D%IPID=I%TS=U) T1(Resp=N) T2(Resp=Y%DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=C00|800|400%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1000|C00|800%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=800|400|C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # GrandStream BT-101 with firmware 1.0.5.22 Fingerprint Grandstream BT-101 IP phone Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=5CE04AC5%IPID=I%TS=U) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=1000|800|400%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Grandstream BudgeTone 101 IP Phone Class Grandstream | embedded || VoIP phone TSeq(Class=C%IPID=I%TS=U) T1(Resp=N) T2(Resp=Y%DF=Y%W=800|1000|C00%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=400|C00|800%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=C00|800|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Grandstream IP Phone Class Grandstream | embedded || VoIP phone TSeq(Class=C%IPID=I%TS=U) T1(Resp=N) T2(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # GrandStream BudgeTone-100 VoIP phone # GrandStream BudgeTone-100 1.0.5.16 Fingerprint Grandstream VoIP Phone (BudgeTone-100) Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=4D86DFEA|F66461C1%IPID=I%TS=U) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=800|1000%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=400|800|1000%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=800|C00|1000%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=400|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Grandstream Budge Tone 101 VoIP phone, firmware 1.0.5.16 Fingerprint Grandstream VoIP Phone (BudgeTone-101) Class Grandstream | embedded || VoIP phone TSeq(Class=C%Val=4F4264AA%IPID=I%TS=U) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint PalmOS 5.2.1 on Handspring Treo Class Handspring | PalmOS | 5.X | PDA TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Hawking PS12U Embedded Print Server (Firmware Version : 6.09.17H (2003/04/18 16:55:07) Fingerprint Hawking PS12U Embedded Print Server Class Hawking | embedded || print server TSeq(Class=TD%gcd=78000|F0000%SI=<14%IPID=I%TS=U) T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Zero One Tech. Print Server 3000 # Hawking Print Server PN7117 # Zero One Tech Printserver ZOT-PS-11 (firmware 5.4.2049) # EUSSO Technologies UPS1211-B print server Fingerprint Print server: Zero One Tech 3000, Hawking PN7117, or EUSSO UPS1211-B Class Hawking | embedded || print server Class Zero One | embedded || print server Class EUSSO | embedded || print server TSeq(Class=TD%gcd=1295%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HP Buisiness InkJet 1200 internal print server # HP Deskjet 6127, firmware FD4R019A Fingerprint HP Deskjet 6127 printer or InkJet 1200 printer server Class HP | embedded || printer Class HP | embedded || print server TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ) T1(DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550 # HP LaserJet 2200 with JetDirect (J6057A) # HP Wireless JetDirect EIO card - 680n Fingerprint HP JetDirect Card in a LaserJet printer Class HP | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=) T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0|F%UCK=0%ULEN=134%DAT=E) # HP Laserjet 4250, HP JetDirect J7949E # hp LaserJet 2420 # hp LaserJet 4250 w/ embedded HP JetDirect J7949E; firmware V.28.43.FF w/ datecode 20040902 08.007.0 # HP LaserJet 2420dn printer, JetDirect J7949E, firmware V.28.43 # hp LaserJet 4250 with embedded HP JetDirect J7949E # HP LaserJet 2420 printer Fingerprint HP LaserJet 2420 or 4250 printer Class HP | embedded || printer TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint HP LaserJet 4000N Printer Class HP | embedded || printer TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP LaserJet 4100N printer Class HP | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=A%Ops=) T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint HP LaserJet 5 Class HP | embedded || printer TSeq(Class=TD%gcd=<6%SI=9E9%IPID=I%TS=2HZ) T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HP JetDirect J6057A Firmware Version R.22.09 in 4100mpf printer Fingerprint HP printer w/JetDirect card Class HP | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=O%Flags=A%Ops=) T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # This is a HP 5si printer with a JetDirect Ethernet card model# J2556b Firmware A.05.32 Fingerprint HP printer w/JetDirect J2556b card (firmware A.05.32) Class HP | embedded || printer T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP printer w/JetDirect J2556b card firmware A.05.32 Class HP | embedded || printer T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # HP iLO (Integrated Lights Out) Firmware Version 1.20 (12/04/2002) # HP Integrated Lights Out (iLO) with firmware 1.41 08/19/2003 Fingerprint HP Integrated Lights Out remote configuration Board Class HP | embedded || remote management TSeq(Class=TD%gcd=<194%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP Router 210 with OS 9.72 # Netgear RP114 DSL-Router with 4-Port Switch Fingerprint HP Advancestack Etherswitch 224T or 210 or Netgear RP114 DSL-Router w/Switch Class HP | embedded || switch Class Netgear | embedded || broadband router TSeq(Class=TD%SI=<20) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=400%ACK=O%Flags=R%Ops=) T5(DF=N%W=400%ACK=O%Flags=R%Ops=) T6(DF=N%W=400%ACK=O%Flags=R%Ops=) T7(DF=N%W=400%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP Entria II with Kernel B.09.11 and Boot Block B.08.02 Fingerprint HP Entria II X station Class HP | embedded || X terminal TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2 Class HP | HP-UX | 10.X | general purpose TSeq(Class=RI%gcd=<6%SI=<18000) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 10.20 A 9000/715 or 9000/899 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # XXX: It crashed the machine again, but I got a full # scan this time. Fingerprint HP-UX B.10.01 A 9000/715 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K|TR) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.10.20 9000/897 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1 Class HP | HP-UX | 10.X | general purpose TSeq(Class=RI%gcd=<6%SI=<18000) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.10.20 A 9000/750 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0 Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX release B.10.20 version A Class HP | HP-UX | 10.X | general purpose TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP9000 Model 804 K450 running HP-UX 11.00 # Mac OS9 Fingerprint Apple Mac OS 9, or HP-UX 11.00 Class HP | HP-UX | 11.X | general purpose Class Apple | Mac OS | 9.X | general purpose TSeq(Class=RI%gcd=<6%SI=<4F254&>C95) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP-UX B.11.00 # HP-UX B.11.11 Fingerprint HP-UX 11 Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<6%SI=C6E%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 11 w/tcp_isn_passphrase Class HP | HP-UX | 11.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # This is a weird one Fingerprint HP-UX 11.00 Class HP | HP-UX | 11.X | general purpose TSeq(Class=TD%gcd=>20000%SI=<3) T1(Resp=N) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP-UX test01 B.11.11 U 9000/800 1277844053 unlimited-user license Fingerprint HP-UX 11.11 Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<6%SI=ABA%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 11.11 Class HP | HP-UX | 11.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=R%Ops=WNMETL) T4(DF=N%W=800|1000|C00%ACK=S%Flags=R%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) T7(DF=N%W=1000|800|C00%ACK=S%Flags=R%Ops=WNMETL) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.11.00 A 9000/785 Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<6%SI=630%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.11.00 A 9000/800 Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8E148&>846%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint HP-UX B11.00 U 9000/839 Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<10%SI=<2114C&>536) T1(Resp=N) T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP-UX 7.0 B 9000/375 Fingerprint HP-UX 7.0 Class HP | HP-UX | 7.X | general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 9.01 - 9.07 Class HP | HP-UX | 9.X | general purpose TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777 Class HP | HP-UX | 9.X | general purpose TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP MPE/iX 5.5 Class HP | MPE/iX || general purpose TSeq(Class=TD%gcd=<6%SI=<14) T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint HP MPE/iX 5.5 on HP 3000 Class HP | MPE/iX || general purpose TSeq(Class=TD%gcd=<6%SI=<1E%TS=U) T1(DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint HP Entria X station (running Netstation 7.x) Class HP | Netstation || X terminal TSeq(Class=64K) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HPJ2600A Ethernet hub or HP ProCurve Switch 4000M # Bay Networks MicroAnnex XL running firmware 10.0B Fingerprint VxWorks 5.3.x bases system (usually an Ethernet hub or switch such as HP ProCurve) or Bay Networks MicroAnnex XL terminal server Class HP | VxWorks || switch Class Bay Networks | embedded || terminal server TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Huawei Quidway R2621 router running VRP 1.5.6(1) Class Huawei | VRP || router TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ) T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Huawei Quidway Router R2621E VRP 1.5.6 Class Huawei | VRP || router TSeq(Class=TD%gcd=<1E806%SI=<14%IPID=I%TS=2HZ) T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Hydra HydraWEB 5000 Class Hydra | embedded || load balancer TSeq(Class=RI%gcd=1|2|3|4%SI=1111) T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2 Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2 Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2 running on RS/6000 Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2.3 running on RS6000 model 560 Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2.5 (Bull HardWare) Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # IBM AIX v3.2.5 running on 8xPower-2 wide nodes # Fingerprint IBM AIX Version 4 Fingerprint IBM AIX v3.2.5 - 4 Class IBM | AIX | 3.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.0 - 4.2 Class IBM | AIX | 4.X | general purpose TSeq(Class=64K) T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AIX 4.02.0001.0000 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AIX 4.1 Class IBM | AIX | 4.X | general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.1-4.1.5 Class IBM | AIX | 4.X | general purpose TSeq(Class=64K) T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.2 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR) T1(DF=N%W=FFAF|FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.2-4.3.3 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR) T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.2.X-4.3.3.0 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%IPID=I%TS=U) T1(DF=N|Y%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.3 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=5B4|F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=1000|4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.3.1 on a IBM RS/6000 R40 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Fingerprint IBM AIX 4.3.3 on an RS/6000 H50 # Fingerprint IBM AIX 4.3.3 on a p660-6M1 # IBM AIX 4.3.3 ML10 Fingerprint IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/* Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0|F%UCK=0%ULEN=134%DAT=E) # Fingerprint IBM-RS/6000 7017-S80, AIX Version 4.3.3.0 Fingerprint IBM AIX 4.3.3.0 on an IBM RS/* Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX v4.1 running on a C10 Class IBM | AIX | 4.X | general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AIX v4.2 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E) Fingerprint IBM AIX Version 4.3 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Fingerprint IBM AIX 5.1.0.0 maintenance level 3 Fingerprint IBM AIX 5.1 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0|4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # IBM AIX 5L 5.1 # IBM AIX 5.1 ML00 # AIX 5.1.4 # IBM AIX 5L Version 5.2 Fingerprint IBM AIX 5.1 - 5.2 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1 - 5.2 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # IBM AIX 5.1 on pSeries LPAR # AIX 2 5 000B8CDC4C00 IBM AIX 5.2L Update 2 Fingerprint IBM AIX 5.1 - 5.2 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # aix 5.1 Maintenance Level 6 Fingerprint IBM AIX 5.1 on a p610-6C1 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1-5.2 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # IBM AIX 5.103 on Fingerprint IBM AIX 5.103 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # IBM AIX 5.2 on pSeries (Power4) Fingerprint IBM AIX 5.2 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # IBM AIX 5.2 (Maintenance Level 1) on RS/6000 Fingerprint IBM AIX 5.2 (on RS/6000) Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=2HZ) T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # AIX 5.2-003 Fingerprint IBM AIX 5.2.3 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=2HZ) T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Fingerprint IBM AIX 5L V5.3 5765-G03 (2005/02) on IBM p5 (Power5 processor) # Fingerprint IBM AIX 5.3 ML 01 on RS/6000 43P150 Fingerprint IBM AIX 5.3 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.3 ML01 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM 8222 hub Class IBM | embedded || hub TSeq(Class=TD%gcd=<6%SI=<1A4%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM 8239 Token-Ring Stackable Hub Class IBM | embedded || hub TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Microplex M205 Pocket Print Server v5.7 # IBM 6400 Printer - Network Printer Server Version 7.0.9.6 [ network card ] Fingerprint IBM 6400 printer or Microplex Pocket Print Server Class IBM | embedded || printer Class Microplex | embedded || print server TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint IBM Infoprint 12 Net-Printer Class IBM | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint IBM BladeCenter Remote Management Module Class IBM | embedded || remote management TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM Remote Supervisor Adapter II Class IBM | embedded || remote management TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint IBM 2210 router Class IBM | embedded || router TSeq(Class=TD%gcd=<6%SI=1A6E%IPID=I%TS=U) T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT Class IBM | embedded || switch Class Xylan | embedded || switch TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # AGE Logic, Inc. IBM X-Station Fingerprint AGE Logic, Inc. IBM XStation Class IBM | embedded || X terminal TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint IBM MVS Class IBM | MVS || general purpose TSeq(Class=RI%gcd=64|C8|12C|190) T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2 Class IBM | MVS || general purpose TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200) T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) Fingerprint IBM MVS TCP/IP TCPMVS 3.2 Class IBM | MVS || general purpose TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM MVS TCP/IP TCPOE 3.3 Class IBM | MVS || general purpose TSeq(Class=RI%gcd=<6%SI=FF) T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta Class IBM | OS/2 || general purpose TSeq(Class=RI%gcd=<6%SI=FF) T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OS/2 Warp Server for eBusiness 4.52 Class IBM | OS/2 || general purpose TSeq(Class=RI%gcd=<8%SI=<5A9A6&>633%IPID=I%TS=U) T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/390 V2R10 Class IBM | OS/390 | V2 | general purpose TSeq(Class=RI%gcd=<6%SI=<17C1E&>128%IPID=I%TS=1000HZ) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint IBM OS/390 V5R0M0 Class IBM | OS/390 | V5 | general purpose TSeq(Class=RI%gcd=<5%SI=>F& Fingerprint IBM AS/400 V3 and V4 Class IBM | OS/400 | V3 | general purpose Class IBM | OS/400 | V4 | general purpose TSeq(Class=RI%gcd=<6) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V3 Class IBM | OS/400 | V3 | general purpose TSeq(Class=RI%gcd=<8%SI=<3411C4&>5977%TS=1000HZ) T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AS/400 running OS/400 R4.4 Class IBM | OS/400 | V4 | general purpose TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4 r4-5 Class IBM | OS/400 | V4 | general purpose TSeq(Class=RI%gcd=3%IPID=I%TS=1000HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4R2M0 Class IBM | OS/400 | V4 | general purpose TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4R5 Class IBM | OS/400 | V4 | general purpose TSeq(Class=C%IPID=I%TS=1000HZ) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4R5M0 Class IBM | OS/400 | V4 | general purpose T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AS/400 running OS/400 5.1 Class IBM | OS/400 | V5 | general purpose TSeq(Class=TD%gcd=<6000%SI=<14%IPID=I) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IBM proprietary operating system for AS/400 systems (now known as "iSeries") # Fingerprint OS/400 V5R2 # IBM OS/400 V5R1M0 Fingerprint IBM OS/400 V5R1 - V5R2 Class IBM | OS/400 | V5 | general purpose TSeq(Class=RI%gcd=<24%SI=<19DCD2&>6D3%IPID=I) T1(DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # OS/400 V5R1M0 w/ C2134 + Autumn '02 Hiper, DB & Java Fingerprint IBM OS/400 V5R1M0 Class IBM | OS/400 | V5 | general purpose TSeq(Class=TD%gcd=<22222%SI=<14%IPID=I%TS=1000HZ) T1(DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IBM OS/400 V5.2 Fingerprint IBM OS/400 V5R2M0 Class IBM | OS/400 | V5 | general purpose TSeq(Class=RI%gcd=<24%SI=<41D304&>7BC%IPID=I) T1(DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V5R2M0 Class IBM | OS/400 | V5 | general purpose TSeq(Class=RI%gcd=<8%SI=<2871A2&>276C%IPID=I%TS=1000HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # IBM iSeries OS/400 V5R2M0 L000 # IBM AS/400 - Operating System: OS/400 V5R2M0 (Version 5, Revision 2) # IBM OS/400 V5R3M0 on iSeries # OS/400 V5R3 Fingerprint OS/400 V5R2M0 or V5R3 or V5R3M0 Class IBM | OS/400 | V5 | general purpose TSeq(Class=RI%gcd=<14%SI=<2EB440&>EF0%IPID=I%TS=1000HZ) T1(DF=Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM VM/CMS (mainframe) Class IBM | VM/CMS || general purpose TSeq(Class=RI%gcd=64|C8%SI=>CC&116E%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Linux kernel 2.4.27 (x86) ipcop 1.40 # Linux ipcop 2.4.27 #1 Thu Sep 30 02:57:11 GMT 2004 i586 AuthenticAMD unknown GNU/Linux # IPcop v1.4.2 Linux 2.4.27 # Linux fw.ioes.org 2.4.27 #1 Wed Sep 29 12:48:42 GMT 2004 i686 GenuineIntel unknown GNU/Linux (IPCOP+1.4) # Linux 2.4.27-29 (IPCop 1.4.2) # IPCop 1.4.2 (Kernel: 2.4.27) i486 # Linux 2.4.27 i686 GNU/Linux IPCop 1.4.2 (Green Interface) # Linux 2.4.29 #1 i686 GenuineIntel+unknown GNU/Linux / IPCop 1.4.5 # IPCop Linux 1.4.5 (Linux xxx 2.4.29 #1) Pentuim II # IPCOP 1.4.6 based on Debian/Linux 2.4.29 Fingerprint IPCop 1.4 - 1.4.6 Linux 2.4.2x-based firewall Class IPCop | Linux | 2.4.X | firewall TSeq(Class=RI%gcd=<6%SI=<24E74F4&>49DD3%IPID=Z%TS=U) T1(DF=Y%W=16D0|400C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IPRoute V1.18, compiled at 08:26:02 on Jun 23 1998 Fingerprint IPRoute (DOS based software router) Class IPRoute | DOS || software router TSeq(Class=TD%gcd=<6%SI=<82%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=E0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IQinVison IQeye3 Version V2.1/1(030123) Fingerprint IQinVison IQeye3 webcam Class IQinVision | embedded || webcam TSeq(Class=RI%gcd=<6%SI=<5168&>B3%IPID=I%TS=U) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # IronPort AsyncOS 3.7.1-001 running on C60 platform Fingerprint IronPort C60 email security appliance Class IronPort | AsyncOS || specialized TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Isolation Systems Infocrypt Enterprise Class Isolation | embedded || encryption accelerator TSeq(Class=C) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL traffic generation and analysis server Class Ixia | embedded || specialized TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Juniper Networks JUNOS 5.3 on an Olive router Class Juniper | JUNOS || router TSeq(Class=RI%gcd=<6%SI=661%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # JUNOS 5.6R1.3 JUNOS 5.6R1.3 #0: 2003-01-02 20:38:33 UTC -- This one was no Juniper Hardware Router but a JunOS installed on a simple i386 box. Fingerprint Juniper Networks JUNOS 5.6R1.3 routing software on x86 box Class Juniper | JUNOS || router TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Juniper Networks JUNOS 5.5R1.2 built 2002-09-28 Fingerprint Juniper Networks router JUNOS 5.5R1.2 Class Juniper | JUNOS || router TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Juniper router M10i JUNOS ROUTER 7.2R1.7 #0 i386 Fingerprint Juniper Networks router M10i running JUNOS 7.2R1.7 Class Juniper | JUNOS || router TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Juniper Router running JUNOS Class Juniper | JUNOS || router TSeq(Class=RI%gcd=<5%SI=>FFF) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # KA9Q is a networking OS used mostly by amateur radio operators for radio to # internet gateways. Fingerprint KA9Q amateur radio OS Class KA9Q | KA9Q || specialized TSeq(Class=TD%gcd=37000%SI=<1E) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # 3Com OfficeConnect 812 ADSL router firmware 2.0.0 # Kentrox DataSMART 656 CSU/DSU or USR NETServer/16 Fingerprint Kentrox DataSMART 656 CSU/DSU, USR NETserver/16, or 3Com OfficeConnect ADSL router Class Kentrox | embedded || CSUDSU Class US Robotics | embedded || switch Class 3Com | embedded || broadband router TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=CCC&91%IPID=BI%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix ETS16P terminal server Version V3.5/2(970721) Class Lantronix | embedded || terminal server TSeq(Class=RI%gcd=<6%SI=<404C&>90) T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620) Class Lantronix | embedded || terminal server TSeq(Class=RI%gcd=<6%SI=<9318E&>1688%IPID=BI%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620) Class Lantronix | embedded || terminal server TSeq(Class=RI%gcd=<8%SI=<404C&>8C%IPID=BI%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix EPS1 Print Server version V3.5/1(970325) Class Lantronix | Punix || print server TSeq(Class=RI%gcd=<6%SI=>FF&8F%IPID=BI%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix EPS2 Print Server Version V3.5/2(970721) Class Lantronix | Punix || print server TSeq(Class=RI|TD%gcd=<6) T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Lantronix ETS16 Version V3.1/2(940207) / [Punix version 2.9/379(940207)] Fingerprint Lantronix ETS16 terminal server Class Lantronix | Punix || terminal server TSeq(Class=RI%gcd=<6%SI=<41E9C&>AD%IPID=RPI|BI%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Leunig ePower Switch b723 v5.2 Class Leunig | embedded || power-device TSeq(Class=TR) T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Fingerprint LevelOne WBR-3406TX Wireless Broadband router Class Level One | embedded || broadband router TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) T1(DF=N%W=1540|1638%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # LevelOne Wireless router WBR-3403TX Fingerprint LevelOne WBR-3403TX Wireless Broadband router Class Level One | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<102C870&>295B1%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) Fingerprint Lexmark M412n network printer Class Lexmark | embedded || printer TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ) T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Lexmark Marknet X2031e printer Class Lexmark | embedded || printer TSeq(Class=RI%gcd=<6%SI=16E0%IPID=I%TS=2HZ) T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Lexmark Optra N Laser Printer Fingerprint Lexmark Optra N Laser Printer Class Lexmark | embedded || printer TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=1C%RIPTL=0%RID=0%RIPCK=0%UCK=F%ULEN=134%DAT=E) # Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1 # Lexmark Optra Lx+ Network Printer, firmware Fingerprint Lexmark Optra network printer Class Lexmark | embedded || printer TSeq(Class=TD%gcd=388|1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Lexmark Optra T612 (printer) running firmware 3.11.17 # Lexmark Optra S 2420 Fingerprint Lexmark Optra printer Class Lexmark | embedded || printer TSeq(Class=TD%gcd=1000%SI=<30) T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N|Y) # Lexmark T520 printer, firmware 54.30.39 Fingerprint Lexmark T520 printer Class Lexmark | embedded || printer TSeq(Class=RI%gcd=<6%SI=<3651E88&>8AEFD%IPID=Z%TS=100HZ) T1(DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Lexmark T522 printer Class Lexmark | embedded || printer TSeq(Class=RI%gcd=<6%SI=<24E3426&>5E5DB%IPID=Z%TS=100HZ) T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Lexmark T522/T622 printer Class Lexmark | embedded || printer TSeq(Class=RI%gcd=<8%SI=<2C2D254&>387BA%IPID=Z%TS=100HZ) T1(DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint LG Goldstream LR3001f router, software version 4.0 Class LG GoldStream | embedded || router TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint LG Goldstream LR3100p router, software version 1.0-1.5 Class LG GoldStream | embedded || router TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Liebert Intellislot SNMP/Web Card (power devices, air conditioning, etc.) Class Liebert | embedded || specialized TSeq(Class=TD%gcd=<32DC4%SI=<14%IPID=I%TS=U) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # "This device listens on all TCP and all UDP ports, so OS # fingerprints are not that excellent. Actually there's not even an OS # running on it, it simply translates monitoring data into SNMP OIDs. It # can also be used to control the unit by setting specific OIDs." Fingerprint Liebert-Hiross HiSNMP A/C controlling unit Class Liebert-Hiross | embedded || specialized T1(DF=Y%W=2000%ACK=S++%Flags=BAS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=UAPSF%Ops=M) T4(Resp=N) T5(DF=Y%W=2000%ACK=S%Flags=R%Ops=) T6(DF=Y%W=2000%ACK=S%Flags=R%Ops=) T7(DF=Y%W=2000%ACK=S%Flags=R%Ops=) PU(Resp=N) # Linksys WET-11 Wireless Ethernet bridge running firmware rev. 1.43 Fingerprint Linksys WET-11 Wireless Ethernet bridge Class Linksys | embedded || bridge TSeq(Class=RI%gcd=<6%SI=<2C30D0&>52F7%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linksys WGA54G Wireless Game Adapter (bridge) Class Linksys | embedded || bridge TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MM) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Linksys EtherFast Cable/DSL Router with 4-port switch BEFSR41 ver. 3; firmware: 1.44.3, FEB 13 2003 Fingerprint Linksys BEFSR41 Broadband router Class Linksys | embedded || broadband router TSeq(Class=TD%gcd=<18%SI=<1E%IPID=Z%TS=U) T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T2(Resp=N) T3(Resp=N) T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linksys BEFSR41 Broadband router and 4-port hub Fingerprint Linksys BEFSR41 Broadband router Class Linksys | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<2FF88AC&>7ACA0%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Linksys/Cisco BEFSR41 V3 Etherfast Cable/DSL Router (Firmware 1.04.17) Fingerprint Linksys BEFSR41 V3 Etherfast cable/DSL router Class Linksys | embedded || broadband router T1(Resp=N) T2(Resp=N) T3(Resp=Y%DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=) T4(Resp=N) T5(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linksys BEFVP41 VPN Router - Firmware Version 1.41.1, Sep 04 2003 Fingerprint Linksys BEFVP41 VPN Router Class Linksys | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linksys BEFW11S4 DSL/Cable Router with Firmware 1.45z Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router Class Linksys | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=4009%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Linksys BEFW11S4 firmware revision 1.45.10 Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router Class Linksys | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # LinkSys WRT-54G running the SVEASOFT code # Linksys BEFW11S4 802.11B WAP # Linksys BEFSR41 firmware ver. 1.40.2 # Linksys Router: BEFW11S4 v2/v3 Fingerprint Linksys BEFW11S4/WRT-54G Wireless Broadband router or BEFSR41 Cable/DSL router Class Linksys | embedded || broadband router TSeq(Class=TD|RI%gcd=<400%SI=<62C%IPID=Z|RD%TS=U) T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linksys WAG54G Wireless Broadband Router Fingerprint Linksys WAG54G Wireless Broadband Router Class Linksys | embedded || broadband router TSeq(Class=TD%gcd=24FCE%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Linux kernel 2.4.20 (mips) on Linksys WRT54G Wireless Broadband Router with firmware Sveasoft +Alchemy-pre7a beta build version v3.37.6.8sv Fingerprint Linksys WRT54G Wireless Broadband Router (Linux kernel 2.4.20) Class Linksys | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<17B7D1A&>3BAFF%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linksys EtherFast Print Server Class Linksys | embedded || print server T1(DF=N%W=0|C80%ACK=S++%Flags=AR|APS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Linksys EtherFast Print Server Class Linksys | embedded || print server TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Linksys PSUS4 USB Print Server and switch Class Linksys | embedded || print server TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Linksys WPS54GU2 Wireless Print Server Class Linksys | embedded || print server TSeq(Class=TD%gcd=<1A866%SI=<1E%IPID=I%TS=U) T1(DF=N%W=111C%ACK=S++%Flags=APS|A%Ops=M|) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=111C|0%ACK=S++|O%Flags=APS|AR%Ops=M|) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Linksys WRK54G Firmware Version: 1.56.01 # Linksys Wireless-B router/switch/802.11b access point (device model BEFW11S4 V4) # Linksys BEFW11S4 firmware 1.50.14 # Linksys BEFSR41 v2 Firmware Version: 1.46.02, Aug 03 2004 # Linksys BEFSR81v2 Router with firmware 2.45.10 # Linksys EtherFast Cable/DSL Router (Model: BEFSR41 Ver 2)(Updated Firmware ver. 1.46.02, Aug 03+2004) # Linksys Wireless-B Broadband Router BEFW11S4 Firmware v.1.50.14 # Linksys RT31P2 VoIP router (Vonage; firmware version 1.28.00; internal interface) Fingerprint Linksys BEFW11S4/BEFSR41/BEFSR81/WRK54G Broadband router or RT31P2 VoIP router Class Linksys | embedded || WAP TSeq(Class=TD%gcd=10000%IPID=I%TS=100HZ) T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=28|C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Linux 2.1.24 PowerPC Class Linux | Linux | 2.1.X | general purpose TSeq(Class=TR) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.76 Class Linux | Linux | 2.1.X | general purpose TSeq(Class=TR) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.88 Class Linux | Linux | 2.1.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7) T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.91 - 2.1.103 Class Linux | Linux | 2.1.X | general purpose TSeq(Class=RI%gcd=<6%SI=>7A000) T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.2.12 - 2.2.25 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0|60|A0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.2.13 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=24CA0) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # SuSE Linux 6.3 (i386) - Kernel 2.2.13 Fingerprint Linux 2.2.13 (SuSE; x86) Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<21DE76C&>2B4E4%IPID=I%TS=100HZ) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.2.14 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7) T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E) Fingerprint Linux 2.2.16C37_III on Sun Cobalt Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2021DA2&>3CBCC%IPID=I%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.2.19-6.2.1ensim-3.1.5-2 (RedHat 7.2) Fingerprint Linux 2.2.19 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<242483C&>5C202%IPID=I%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.2.19 (Alpha) Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1409420&>3348D%IPID=I%TS=1000HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.2.19 - 2.2.20 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U) T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.2.19 on a DEC Alpha 233mhz Multia Fingerprint Linux 2.2.19 on a DEC Alpha Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E) Fingerprint Linux 2.2.20 SMP Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<277C73C&>6371B%IPID=I%TS=100HZ) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Linux 2.2.21 SMP (x86) Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1921FE8&>404B1%IPID=I%TS=U) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.2.22 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<22AB988&>58BFF%IPID=I%TS=U) T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.2.5 - 2.2.13 SMP Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=2203C) T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E) # Linux kernel 2.4.4-4GB (x86) from Red hat Fingerprint Linux 2.4.4 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=19E%IPID=Z%TS=U) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(Resp=N) Fingerprint Linux 2.3.12 Class Linux | Linux | 2.3.X | general purpose TSeq(Class=RI%gcd=<20%SI=>DDDD) T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.28-33 Class Linux | Linux | 2.3.X | general purpose TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3) T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86 Class Linux | Linux | 2.3.X | general purpose TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA) T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.49 x86 Class Linux | Linux | 2.3.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E) T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Astaro Security Linux 4 (Kernel 2.4.19) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # I don't put "Gentoo" as the vendor for the classification because it # makes output ugly when there are a bunch of Linux matches due to # firewalling or similar problems. Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cobalt Linux 6.0 Kernel 2.2.16c32_III on an i586 Fingerprint Linux 2.2.16 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<23D760E&>5BBDD%IPID=Z) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.0 - 2.5.20 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.5.X | general purpose TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U) T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y|N%TOS=0|8|14|20|28|38|40|C0|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Linux 2.4.0 - 2.5.20 w/o tcp_timestamps Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.5.X | general purpose TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U) T1(DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Linux 2.4.0-test5 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8) T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E) # Linux 2.4.18 # SuSE Linux 7.3 linux-2.4.10-4GB, running on amd k6-2 Fingerprint Linux 2.4.10 - 2.4.18 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<21BFEA2&>46B9B%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D0|D8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Strangely enough, I have received several prints like this that claim a T2: Fingerprint Linux 2.4.16 - 2.4.18 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.17 on HP 9000 s700 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.18 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<1C15A06&>23F17%IPID=Z) T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Debian/Gnu Linux 3.0 (Woody) Kernel 2.4.18-bf2.4 Fingerprint Linux 2.4.18 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<293EE44&>69651%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Linux 2.4.18 (PPC) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<36CB986&>488A7%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.18 (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<5BA02C&>EA7B%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.18 (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2774D66&>2F583%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.18-custom # Linux 2.4.19 w/o tcp_timestamps Fingerprint Linux 2.4.18 - 2.4.19 w/o tcp_timestamps Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1720870&>361B9%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.18 - 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<14B7282&>11A94%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=30|60|D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20 (Gentoo 1.2; x86) # Linux 2.4.18-14 Fingerprint Linux 2.4.18 - 2.4.20 (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2B9C772&>6FA19%IPID=Z%TS=100HZ) T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # linux 2.4.20 (i586) Preemptible # Linux 2.4.18 # 2.4.21-20.ELsmp SMP RedHat AS3, REL3 Fingerprint Linux 2.4.18 - 2.4.21 (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<25C5808&>30578%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.4.21-4.0.1.ELsmp x86 Dual Xeon RedHat EL3 AS3 (Red Hat Linux 3.2.3-20) # Linux Kernel 2.4.21-4.0.1 Red Hat Enterprise Linux ES release 3 (Taroon) # Linux sun 2.4.27 #3 SMP Mon Nov 1 21:24:45 GMT 2004 sparc unknown unknown GNU/Linux # Linux AthenA-server 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i586 unknown Fingerprint Linux 2.4.18 - 2.4.27 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR|RI%gcd=<6%SI=<2CA3968&>49B3D%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux live cd knoppix 2.4.27 (knoppix 2.6) Fingerprint Linux 2.4.18 - 2.4.27 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<3859E24&>47DBA%IPID=Z%TS=100HZ) T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Linux 4.19-4GB #1 Tue Sep 30 19:01:07 UTC 2003 i686 unknown / SuSe Linux OpenExchange Server Fingerprint Linux 2.4.19 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<13A36B6&>3244E%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Linux kernel 2.4.19C13_V (x86) Sun Cobalt RaQ550 Fingerprint Linux 2.4.19 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<20DD6C4&>54211%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Mandrake 9.1 SMP 2.4.19-16mdksmp #1 SMP Fri Sep 20 16:08:37 CEST 2002 i686 unknown unknown GNU/Linux Fingerprint Linux 2.4.19 (Mandrake, x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<263CFAC&>55266%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint Linux 2.4.19 (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<25CEE8A&>341B8%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++|O%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20-4GB-athlon i686 # SuSE Linux 8.2 2.4.20-64GB-SMP # linux 2.4.19-4GB Fingerprint Linux 2.4.19 - 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<22D7C86&>2AE00%IPID=I%TS=100HZ) T1(DF=Y%W=16A0|1680|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint Linux 2.4.19 w/grsecurity patch Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2A492C6&>6C3F2%IPID=RD%TS=1000HZ) T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.4.20-4GB (x86) Fingerprint Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<1540758&>1B32B%IPID=I%TS=100HZ) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20-wolk4.16s Fingerprint Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=7D74%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<18D4252&>3F8B9%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20; Sysctl goodness below. Changed default TTL, syncookies, not sure what else. Scanned from localhost. Fingerprint Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2C88A&>1E5%IPID=RD) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20-xfs-rmap15d-ptrace #1 Debian GNU/Linux Fingerprint Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<15580A6&>30FB7%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.4.20 from ALT Linux Master 2.2 (uname -r = 2.4.20-alt16-smp) Fingerprint Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<25A8F50&>60659%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20-8 #1 i686 i686 i386 GNU/Linux Fingerprint Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1A82ACC&>43DBE%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Red Hat Linux release 9 (Shrike) Kernel 2.4.20-8 on an i686 Fingerprint Linux 2.4.20 (Red Hat) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1B9DCC2&>469F7%IPID=Z%TS=100HZ) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux localhost 2.4.20-30.9 #1 Wed Feb 4 20:44:26 EST 2004 i686 i686 i386 GNU/Linux Fingerprint Linux 2.4.20 (x86, Redhat 7.3) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<3A23C96&>949CB%IPID=Z%TS=100HZ) T1(DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Red Hat Linux release 9 (Shrike), Kernel Version 2.4.20-31.9.progeny.5 # Linux 2.4.21-27.0.2.EL i686 i386 (Red Hat Enterprise Linux ES release 3 (Taroon Update 4)) + APF 0.9.3 # Linux 2.4.21-15.0.4.ELsmp #1 SMP i686 i686 i386 GNU/Linux # Linux 2.4.22-1.2115.nptlsmp # Linux 2.4.22-1.2199.nptlsmp #1 SMP i686 i686 +i386 GNU/Linux Fingerprint Linux 2.4.20 - 2.4.22 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<3089154&>7C37E%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(Resp=N) # Linux 2.4.20-gentoo-r5 w/grsecurity Fingerprint Linux 2.4.20 - 2.4.22 w/grsecurity.org patch Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Linux kernel 2.4.20-wolk4.17s (x86) # Linux demeter 2.4.20-wolk4.17s #1 i686 unknown # "Devil Linux 1.2.2" 2.4.27-grsec #1 SMP i686 AuthenticAMD unknown+GNU/Linux # Gentoo 2.4.28-hardened-r5 (Up to date with Gentoo Hardened Patches) on a Proliant 1600R Fingerprint Linux 2.4.20 - 2.4.28 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=1690|16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.20 or 2.6.0-test5-love3 (x86) Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=23458%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Linux 2.4.20 x86 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<1DB22CE&>1862A%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20-ac2 Fingerprint Linux 2.4.20-ac2 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2A812D4&>2F29E%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.21-32.0.1.ELsmp #1 i686 i686 i386 GNU/Linux Fingerprint Linux 2.4.21 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<31EB9A2&>7FCA1%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # RedHat Linux Enterprise 3 2.4.21-27.0.2.EL #1 Fingerprint Linux 2.4.21 (RedHat) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Linux Boobie 2.4.21-9.EL #1 RedHat Fingerprint Linux 2.4.21 (RedHat) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2E5DABA&>58D55%IPID=Z%TS=100HZ) T1(DF=Y%W=564%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=C00|800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) # base on msg 1058, 1776 # Linux kernel 2.4.21-243(athlon) from SuSE 9.0 # SuSE 9.0 with updates, kernel 2.4.21-280-default Fingerprint Linux 2.4.21 (Suse) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<243DCC4&>17466%IPID=I%TS=U) T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SuSE Linux 8.1 (i386) 2.4.21 #4 SMP Fingerprint Linux 2.4.21 (Suse, x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2634758&>55644%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # SuSE Linux 9.0 2.4.21-215-athlon # Linux 2.4.21-121-athlon; SuSE, x86 # Linux 2.4.21-231-athlon from SuSE 9.0 Fingerprint Linux 2.4.21 (x86 SuSE) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1C5FBC4&>48A1C%IPID=I%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Linux 2.4.21-0.25mdk x86 Fingerprint Linux 2.4.21 (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2A2786A&>6BE77%IPID=I%TS=100HZ) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux mail2 2.4.21-4.ELsmp #1 SMP Fri Oct 3 17:52:56 EDT 2003 i686 i686 i386 GNU/Linux (Redhat Enterprise Linux AS 3) Fingerprint Linux 2.4.21 (x86, RedHat) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<26BFF42&>63303%IPID=Z%TS=100HZ) T1(DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.21-166-default (Suse 9) # Linux 2.4.23-pre6aa3 #2 Wed Mar 10 23:27:52 BRT 2004 i686 GNU/Linux Fingerprint Linux 2.4.21 - 2.4.23 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<139B84E&>3230A%IPID=I%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Debian Linux feeshus 2.4.22-1-ipvs-686 #1 Fingerprint Linux 2.4.22 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<180F182&>3D924%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.22 (SPARC) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<256B646&>5FC9A%IPID=Z%TS=100HZ) T1(DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.22 (x86) without timestamps, grsecurity 1.9 (rand_isns, rand_ip_ids) Fingerprint Linux 2.4.22 (x86) w/grsecurity patch and with timestamps disabled Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR|RI%gcd=<6%IPID=RD|Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.22 (x86, Gentoo) # Linux server 2.6.7-ck5 (x86) # Linux lamaquina 2.6.8.1-10mdk #1 Wed Sep 8 17:00:52 CEST 2004 i686 AMD Athlon(tm) 64 Processor 3200+ Fingerprint Linux 2.4.22 - 2.6.8 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<8%SI=<132F658&>188E0%IPID=Z%TS=1000HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux Kernel 2.6.10-ck (x86) Gentoo system Fingerprint Linux 2.4.22 or 2.6.10 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<29CB48E&>6AF95%IPID=Z%TS=U) T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.22 (x86, Gentoo) # Linux 2.6.7-hardened-r16 #1 x86_64 AMD Athlon(tm) 64 Processor 3000+ AuthenticAMD GNU/Linux # Slackware 10 kernel 2.6.7 # Fedora Core 2 With Kernel 2.6.8-1 # Kernel 2.6.3 (x86); Gentoo Distro # Gentoo Base System version 1.4.16 Linux linuxbox 2.6.9 #2 SMP+Pentium III (Coppermine) GenuineIntel GNU/Linux # Linux kernel 2.6.10-1.760_FC3 from Fedora Core 3 Fingerprint Linux 2.4.22 or 2.6.3 - 2.6.10 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<11A9004&>2D341%IPID=Z%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.22-gentoo-r7 (x86) # Linux 2.6.4-gentoo-grsec (x86) - manual patch on gentoo's kernel (gentoo-dev-sources) with grsecurity-2.0-test2-2.6.4.patch # Linux 2.6.10 with grsecurity 2.6.10 i686 Fingerprint Linux 2.4.22 or 2.6.4 - 2.6.10 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.22-ck2 (x86) w/grsecurity.org and HZ=1000 patches Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.22-gentoo-r2 i686 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Linux gateway 2.4.22-gentoo-r5 #1 ven feb 6 05:25:25 CET 2004 i686 Celeron (Mendocino) GenuineIntel GNU/Linux - grsecurity patch + iptables Fingerprint Linux 2.4.22-gentoo-r5 (x86) w/grsecurity Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.22-gentoo-rc Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<22F8152&>2CC16%IPID=RD%TS=1000HZ) T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.23 (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2B5505C&>6EEAA%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.23-grsec w/o timestamps Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Adamantix GNU/Linux with Linux 2.4.25-grsec (x86) Fingerprint Linux 2.4.25 w/grsec (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.26-gentoo-r6 #1 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux Fingerprint Linux 2.4.26 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<298F858&>6A637%IPID=I%TS=U) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.26 from slackware linux 10 Fingerprint Linux 2.4.26 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2961188&>6375E%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Linux kernel 2.4.26 from Slackware 10.0 Fingerprint Linux 2.4.26 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<3230066&>338AC%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.26 i686 GNU/Linux Fingerprint Linux 2.4.26 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2049F82&>52A3D%IPID=Z%TS=100HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.26-gentoo-r12 #5 i686 Pentium II # Linux 2.4.26-gentoo-r9 #14 i686 Celeron (Mendocino) GenuineIntel GNU/Linux Fingerprint Linux 2.4.26 (gentoo) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<2E22EC4&>27AD8%IPID=I|RD%TS=100HZ) T1(DF=N|Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.26-gentoo-r6 w/grsec Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.27-1-586tsc #1 Wed Dec 1 19:25:25 JST 2004 i586 GNU/Linux (Debian Sid) Fingerprint Linux 2.4.27 or D-Link DSL-500T (running linux 2.4) Class Linux | Linux | 2.4.X | general purpose Class D-Link | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<2031130&>5267C%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.27-grsec #1 SMP i686 # Linux 2.4.27-grsec (x86) (grsecurity 2.0.1) w/ net.ipv4.tcp_timestamps = 0 Fingerprint Linux 2.4.27 with grsec Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.27 with grsec Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.4.29 from Slackware 10.1.0 Fingerprint Linux 2.4.29 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2209F48&>571E7%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Linux kernel 2.4.30 (vanilla) Fingerprint Linux 2.4.30 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<293A11E&>6963B%IPID=Z%TS=100HZ) T1(DF=Y%W=1578%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1578%ACK=S++|O%Flags=AS|A%Ops=MNNTNW|NNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.4-4GB #1 Wed May 16 00:37:55 GMT 2001 i586 unknown Fingerprint Linux 2.4.4 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<10F070C&>15ACF%IPID=Z%TS=100HZ) T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.26 #6 i686 unknown unknown GNU/Linux # Linux kernel 2.6.9-1.681_FC3 from Fedora Core 3 Fingerprint Linux 2.4.6 - 2.4.26 or 2.6.9 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1E74A9A&>4DF5C%IPID=Z%TS=100HZ) T1(DF=Y%W=1680|16A0|4000|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.7 (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U) T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.7 (zLinux on OS/390) Fingerprint Linux 2.4.7 (zLinux on OS/390) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<152381A&>3616E%IPID=Z%TS=100HZ) T1(DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.18 on Alpha EV4 # Linux 2.5.70 (x86) # Linux 2.6.4 i686 # Linux gentoo 2.6.7-gentoo-r11 i686 # Linux gentoo 2.6.11-gentoo-r9 Fingerprint Linux 2.4.7 - 2.6.11 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.5.X | general purpose Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<20DBA72&>5419C%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux Athena 2.6.3-1-686 #2 Tue Feb 24 20:24:38 EST 2004 i686 GNU/Linux # Linux 2.4.7 (RedHat 7.3 on SPARC) Fingerprint Linux 2.4.7 - 2.6.11 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1682210&>399B1%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Linux RedHat 2.4.18-5 #1 Mon Jun 10 15:31:48 EDT 2002 i686 unknown Fingerprint Linux 2.4.9 - 2.4.18 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1C3AE82&>46383%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Mandrake Communiry 10.1 (2.6.8.1-10mdk-i586-up-1GB) # Linux matrix 2.6.3-gentoo-r2 x86 Fingerprint Linux 2.5.25 - 2.6.8 or Gentoo 1.2 Linux 2.4.19 rc1-rc7 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.5.X | general purpose Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Xbox running Debian Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=2833E%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Linux 2.5.5 (Gentoo) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<306B8C0&>6ABCE%IPID=Z%TS=1000HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Linux 2.6.0 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<269E81A&>62D97%IPID=Z%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.6.0 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<34CD71A&>861AC%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.10 #1 Wed Jan 5 12:36:35 CET 2005 i686 unknown Debian 3.0r2 # linux gentoo kernel 2.6.10 # Linux kernel 2.6.10-custom (x86) from Debian GNU/Linux 3.1 Fingerprint Linux 2.6.0 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1A5ABDA&>43761%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=38|A0|B8|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.3-gentoo-r1 #5 Wed Apr 7 13:48:31 EDT 2004 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux # Gentoo 1.4.16; Kernel 2.6.7 # Linux sarge 2.6.8-2-386 #1 Thu May 19 17:40:50 JST 2005 i686 GNU/Linux Fingerprint Linux 2.6.0 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<16883CC&>1CD61%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Linux 2.6.8.1-12mdk #1 i686 Intel(R) Xeon(TM) CPU 2.80GHz unknown GNU/Linux # Linux 2.6.8-1-k7 #1 i686 GNU/Linux Fingerprint Linux 2.6.0 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<18C0F36&>3F49D%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=14|30%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.6.8-1-k7-smp (x86) Debian GNU/Linux 3.1 (Sarge - testing) # Linux 2.6.11-gentoo-r2-ck1 # Linux 2.6.11-gentoo-r4 #1 i686 P4CPU+2.40GHz GenuineIntel GNU/Linux Gentoo Base System version 1.4.16 # Linux 2.6.11-gentoo-r9-nymph #1i686 Pentium III (Coppermine) GenuineIntel GNU/Linux Fingerprint Linux 2.6.0 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.9 #1 i686 # Linux kernel 2.6.9 (PIII-80Mhz) Fingerprint Linux 2.6.0 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2AB93AA&>6D5A3%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=28|40%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.6.0-test10 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<226FBCC&>58267%IPID=Z%TS=1000HZ) T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.0-test5 x86 Fingerprint Linux 2.6.0-test5 x86 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2D3CFA0&>73C6B%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.6.0-test7 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1488090&>34896%IPID=Z%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.6.0-test9 - 2.6.0 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<263F536&>61B8F%IPID=Z%TS=1000HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Gentoo Linux running on a UML client, Linux 2.6.10-linode12 #1 i686 UML User Mode Fingerprint Linux 2.6.10 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2CE05FC&>72AE6%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Linux 2.6.10 i686 on IBM Thinkpad T30 # Linux barton 2.6.10-gentoo-r6 Gentoo # Linux 2.6.10-grsec #1 Fri Jan 28 00:37:15 CET 2005 i686 GNU/Linux Fingerprint Linux 2.6.10 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=TR|RI%gcd=<6%SI=<321C62E&>8044F%IPID=I|RD%TS=1000HZ) T1(DF=Y|N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.6.10 x86 Slackware 10.0 Fingerprint Linux 2.6.10 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1FB5BDE&>51299%IPID=Z%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Ubuntu Hoary Hedgehog - Linux ubuntu 2.6.10-5-386 #1 Tue Apr 5 12:12:40 UTC 2005 i686 GNU/Linux Fingerprint Linux 2.6.10 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<15962A2&>3740B%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Linux runerm 2.6.10-kanotix-8 #1 Wed Feb 2 16:49:31 GMT 2005 i686 GNU/Linux # Linux Kernel 2.6.11 With some Fixes from debian/kanotix # debian 3.1 kernel : 2.6.11-rc7 Fingerprint Linux 2.6.10 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<249F172&>5DBEE%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux linux 2.6.11.9 #1 Sat May 14 00:49:06 CEST 2005 i686 unknown unknown GNU/Linux Fingerprint Linux 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|400|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.11 (gentoo-dev-sources) Fingerprint Linux 2.6.11 (gentoo) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ) T1(DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Linux 2.6.10-1.741_FC3 i686 athlon i386 GNU/Linux Fingerprint Linux 2.6.3 - 2.6.10 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<3552DC&>8860%IPID=Z%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux Kernel 2.6.3 (x86) # Linux 2.6.7 #3 Sat Jul 17 13:25:29 EEST 2004 i486 Fingerprint Linux 2.6.3 - 2.6.7 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<205C682&>528B7%IPID=Z%TS=1000HZ) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.3-6mdksecure #1 SMP x86_64 from Mandrake 10 # Linux 2.6.8-p4 #1 SMP i686 GNU/Linux Fingerprint Linux 2.6.3 or 2.6.8 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<8%SI=<24F1576&>1E7BD%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # LINUX Suse 9.1 Professional Kernel 2.6.4 i686 Fingerprint Linux 2.6.4 (Suse) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1B18996&>45556%IPID=Z%TS=1000HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Slackware current kernel 2.6.9 # Fedora Core 3 Linux Kernel 2.6.9 x86 (i386) # Linux kernel 2.6.4-52 from (x86) SuSE Linux 9.1 # Debian Sarge Linux 2.6.6-1, i686 (x86) Fingerprint Linux 2.6.4 - 2.6.9 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<28A04EC&>2F60A%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=1000|800|C00|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|1000|400|800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Linux 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux Fingerprint Linux 2.6.5 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<265B754&>6225F%IPID=Z%TS=1000HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Linux 2.6.7-gentoo-r11 #2 Wed Jul 28 23:25:03 PDT 2004 i686 Pentium II (Deschutes) # Linux 2.6.8-rc3 #1 Sat Aug 7 07:19:34 EDT 2004 i686 GNU/Linux # Debian Sarge GNU/Linux kernel 2.6.8-1 (i386) # Linux 2.6.7-hardened-r17 Gentoo # Linux 2.6.9-1.681_FC3smp #1 SMP i586 i586 i386 GNU/Linux (Fedora Core 3+kernel as supplied) # Linux 2.6.8-1-686 from Debian sid # SuSE Linux Prefessional 9.1, with kernel 2.6.10 # Linux 2.6.8, PLD distribution, SMP # Linux 2.6.11.4-20a-default #1 i686 i686 i386 GNU/Linux from+Suse 9.3 # Linux 2.6.8-24.11-default #1 Fri Jan 14 13:01:26 UTC 2005 i686 i686 i386 GNU/Linux # Linux 2.6.5-7.155.29-default #1 Thu Jun 2 12:07:05 UTC 2005 i686 i686 i386 GNU/Linux (SuSE+9.2 ) # Linux Debian Sarge 2.6.11.7 # Linux kernel 2.6.10-4GB (x86) with Debian GNU/Linux 3.1 # Linux Kernel 2.6.7-1-686-smp from backports.org Debian Woody Fingerprint Linux 2.6.5 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2BF6254&>70895%IPID=Z%TS=1000HZ) T1(DF=Y%W=15E0|16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Linux 2.6.9 #1 i686 Intel(R) Pentium(R) 4 CPU 3.06GHz+GenuineIntel GNU/Linux # Linux kernel 2.6.10-rc3 from Gentoo on an Ultra 1 (sparc) # Linux 2.6.5 i686 P42.00GHz, Gentoo Base System version 1.6.6, Portage+2.0.51-r3 # Gentoo Linux 2004.1 PPC (old blue and white G3) Kernel 2.6.11.7 Fingerprint Linux 2.6.5 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<360764E&>48D40%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Linux 2.6.6-rc2-bk3 Fingerprint Linux 2.6.6 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2E04BFE&>4ADED%IPID=Z%TS=1000HZ) T1(DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.6.6-1-k7 (x86) from Debian Testing Fingerprint Linux 2.6.6-1-k7 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<235C288&>5A817%IPID=Z%TS=1000HZ) T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.7-tp #5 i686 GNU/Linux Fingerprint Linux 2.6.7 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<8%SI=<13C059A&>1B365%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.6.7 with grsecurity patches Fingerprint Linux 2.6.7 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.7-hardened-r16 (Gentoo hardened-dev-sources) x86 # Linux 2.6.7-hardened-r16 #3 SMP i686 GNU/Linux (grsec+pax, gentoo hardened-dev-sources)) Fingerprint Linux 2.6.7 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.6.7 (x86) from Mepis Fingerprint Linux 2.6.7 (x86) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<14E7284&>35813%IPID=Z%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.6.8 on PLD Linux # Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 Community # Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 community # Linux kernel 2.6.7-SMP from Knoppix 3.6 # Linux 2.6.8.1-4-k7 i686 GNU/Linux Fingerprint Linux 2.6.7 - 2.6.8 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1D19DA8&>4A672%IPID=Z%TS=1000HZ) T1(DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.6.7 w/grsecurity.org patch Class Linux | Linux | 2.6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.8-24.14-smp GNU/Linux Suse Linux 9.2 Professional Fingerprint Linux 2.6.8 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=1ED0B%IPID=Z%TS=1000HZ) T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux Mandrake 10.1, i586, kernel 2.6.8.1-12mdk # Linux 2.6.8.1-12mdk #1 Fri Oct 1 12:53:41 CEST 2004 i686 AMD Athlon(tm) XP 3000+ unknown GNU/Linux Fingerprint Linux 2.6.8 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1E91DE8&>4E3D1%IPID=Z%TS=1000HZ) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.8-1.521 #1 i686 athlon i386 GNU/Linux Fingerprint Linux 2.6.8 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=20154%IPID=I%TS=1000HZ) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.8-2-k7 #1 Thu May 19 18:03:29 JST 2005 i686 GNU/Linux # Linux 2.6.8-2-386 #1 Mon Jan 24 03:01:58 EST 2005 i686 GNU/Linux, from Debian testing Fingerprint Linux 2.6.8 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<32035F2&>2A223%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000|400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00|800|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Debian Sarge Kernel 2.6.8 Fingerprint Linux 2.6.8 (Debian) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2C96D4E&>34B7A%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux ubuntu 2.6.8.1-5-386 #1 Sat Feb 12 00:19:31 UTC 2005 i686 GNU/Linux Fingerprint Linux 2.6.8 (Ubuntu) Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<10F66C0&>2B6A6%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Linux kernel 2.6.8.1 from Debian sarge netinst # Linux kernel 2.6.11-1.27 from Fedora Core 3 Fingerprint Linux 2.6.8 - 2.6.11 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<23C986A&>4BB91%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.9-gentoo-r13Hipcia #3 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux # Linux 2.6.8-1-686-smp #1 SMP i686 GNU/Linux from Debian 3.1 Fingerprint Linux 2.6.8 - 2.6.9 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<11DFD8E&>15CCF%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Linux 2.6.9-1.649 FC Rawhide # Linux kernel 2.6.9 (x86_64) from kernel.org Fingerprint Linux 2.6.9 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<13935EA&>32119%IPID=Z%TS=1000HZ) T1(DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.9-1.681_FC3 #1 i686 i686 i386 GNU/Linux Fedora Core 3 Fingerprint Linux 2.6.9 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1BA9D60&>26DF4%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.6.5 (Gentoo) # Linux 2.6.8 (Fedora Core 2) # Fingerprint Linux kernel 2.6.8-1.521 Fedora 2 Fingerprint Linux kernel 2.6.5 - 2.6.8 Class Linux | Linux | 2.6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<17F9116&>3D580%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint ComOS based terminal server - Livingston PortMaster or U.S. Robotics/3Com Total Control Class Livingston | ComOS || terminal server Class 3Com | ComOS || terminal server T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint ATT UNIX SVR4.2 on a Lucent Definity voicemail system Class Lucent | BSD-misc || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2 Class Lucent | ComOS || terminal server T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # http://www.sics.se/~adam/lwip/ Fingerprint lwIP (Lightweight TCP/IP stack) version lwip-0.5.3-win32 Class lwIP | lwIP || general purpose TSeq(Class=TD%gcd=<6%SI=<3C%IPID=I%TS=U) T1(DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME) T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # M0n0wall 1.2b2 - Firewall based on FreeBSD 4.1 # M0n0wall 1.2b2 FreeBSD-based firewall running on PC Engines WRAP board (Geode x86 architecture) # m0n0wall FreeBSD based firewall (http://m0n0.ch/wall/) version 1.2b3 (version 1.2 beta 3) generic PC # m0n0wall Router/Captive portal version 1.2b8 running on stripped down version of FreeBSD Fingerprint M0n0wall 1.2b2 - 1.2b8 FreeBSD 4.1 based firewall Class m0n0wall | FreeBSD | 4.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # m0n0wall or pfsense firewall distro based on FreeBSD 5.3 # M0n0wall (FreeBSD 5.3 based) with firmware beta version 1.2b7 Fingerprint M0n0wall 1.2b7 FreeBSD 5.3 based firewall Class m0n0wall | FreeBSD | 5.X | firewall TSeq(Class=TR%gcd=<6%TS=1000HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Madge Smart Ringswitch Class Madge | embedded || switch T1(DF=N%W=1F4%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AS%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Magna SG10 intranet router Class Magna | embedded || router TSeq(Class=RI%gcd=<6%SI=<31AD68E&>5F62F%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Maxim-IC TiniOS DS80c400 Class Maxim-IC | TiniOS || general purpose TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Maxim/Dallas TINI embedded Java v1.02b Class Maxim-IC | TiniOS || general purpose TSeq(Class=TD%gcd=<1F408%SI=<28%IPID=Z%TS=U) T1(DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|) T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|) T4(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) # Maxim/Dallas TINI embedded Java v1.11 # Dallas Semiconductor TINI OS 1.02d Fingerprint Maxim/Dallas TINI embedded Java v1.02d Class Maxim-IC | TiniOS || general purpose TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MegaBit Gear TE4111C modem Class Megabit | embedded || terminal server TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) Class Meridian | embedded || storage-misc TSeq(Class=TD%gcd=40000%SI=20%TS=U) T1(DF=N%W=4238%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4238%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Microsoft Xbox Console running Xbox Media Centre version 1.1.01 # Microsoft Xbox (modified) running EvolutionX Fingerprint Microsoft Xbox (modified) Class Microsoft | embedded || game console TSeq(Class=TD%gcd=<6%SI=<2E4%IPID=I%TS=U) T1(DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Xbox V1.1 Running Evolution-X Dashboard v1.8.3752 Fingerprint Microsoft Xbox (modified) running evolutionX Class Microsoft | embedded || game console TSeq(Class=RI%gcd=<6%SI=<5A14&>20%IPID=I%TS=U) T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Microsoft Xbox (modified) running UnleashX 0.26 Class Microsoft | embedded || game console TSeq(Class=RI%gcd=<6%SI=99%IPID=I%TS=U) T1(DF=N%W=8470%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=8470%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Microsoft Windows Longhorn Preview, Version 6.0 Build 4051.idx 02.031001-1340 Fingerprint Microsoft Windows Longhorn Preview Class Microsoft | Windows Longhorn || general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Server 2003, Enterprise Edition, Build 3790 # Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947) # Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947) # Windows Server 2003 Standard Edition. no SP, all current hotfixes Fingerprint Microsoft Windows 2003 Server Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 2003 Server Edition, no service packs Fingerprint Microsoft Windows 2003 Server Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL) T4(DF=N%W=C00|400%ACK=S%Flags=R%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL) T7(DF=N%W=C00|1000|400%ACK=S%Flags=R%Ops=WNMETL) PU(Resp=N) Fingerprint Microsoft Windows 2003 Server Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=80%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Microsoft Windows 2003 Server (Version 5.2 build 3790.srv03_rtm.030324-2048) Fingerprint Microsoft Windows 2003 Server Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2003 Server Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=FB8B%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2003 Server Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Server 2003 Enterprise Edition (English) with latest Windows Update patches as of September 2, 2004 Fingerprint Microsoft Windows 2003 Server Enterprise Edition Class Microsoft | Windows | 2003/.NET | general purpose T1(DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2003 Server Enterprise Edition Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Microsoft Windows Server 2003, Enterprise Edition, no service packs, (build 3790.srv03_rtm.030324-2048) # Microsoft Windows XP Professional (English) SP2 with latest updates through Nov. 24, 2004 Fingerprint Microsoft Windows 2003 Server Enterprise Edition or XP Pro SP2 Class Microsoft | Windows | 2003/.NET | general purpose Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows.NET Enterprise Server (build 3615 beta) # Windows .NET Standard Server build 3604 # Microsoft Windows 2003 Standard Build V5.2.3790 build 3790 # Microsoft Windows 2003 Server - Web edition - all available critical fixes as of 15th feb 2004 # Windows 2003 Standard Edition RTM # Window Server 2003 Enterprise Edition Swedish # Microsoft Windows XP Professional (English) w/ SP2 RC1 build 2600.xpsp_sp2_rc1.040311-2315 - WINDOWS FIREWALL DISABLED # Microsoft Windows 5.2 Build 3790.srv03_rtm.030324-2048 # Microsoft Windows Version 5.1 (Build 2600.spdp_sp2_rtm.040803-2158 : Services Pack 2) Fingerprint Microsoft Windows 2003 Server or XP SP2 Class Microsoft | Windows | 2003/.NET | general purpose Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows XP Pro (French) version:2002 SP2 # Microsoft Windows Server 2003 version 5.2 (Build 3790.srv03_gdr.040410-1234) # Microsoft Windows Server 2003 Enterprise Edition (Trial Version downloaded from Microsoft as at 06/03 # Microsoft Windows 2003 Server Enterprise Edition (German) build 3790.srv03_rtm.030324-2048 # Microsoft Windows .NET Standard Server RC#2 (build 3718) # Microsoft Windows XP Professional version 2002 service pack 2 # Microsoft Windows XP Home Edition (English) SP2 Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) # Microsoft Windows XP Home /SP2 Polish Edition Fingerprint Microsoft Windows 2003 Server or XP SP2 Class Microsoft | Windows | 2003/.NET | general purpose Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y|N%W=2017|402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0|20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # Windows Server 2003, build 3790 # Microsoft Windows XP Media Center Edition Fingerprint Microsoft Windows 2003 Server or XP SP2 Class Microsoft | Windows | 2003/.NET | general purpose Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 2003 Server with SP1 and latest Windows Update patches as of May, 2005 # Windows Server 2003 w/ SP1, build 3790.srv03_sp1 # Microsoft Windows 2003 Server, version SBS 2003 Premium, just after Windows Server SP1 installed # Windows Server 2003 Version 5.2 (Build 3790.srv03_sp1_rtm.050324-1447: Service Pack 1 # Windows Server 2003 w/ SP1, build 3790.srv03_sp1 Fingerprint Microsoft Windows 2003 Server SP1 Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Server 2003 SP1 [Version 5.2.3790] # Windows 2003 Service Pack 1 32 Bit Running on Abit Mobo AMD64 Fingerprint Microsoft Windows 2003 Server SP1 Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 5.2 (Build 3790.srv03_sp1_rtm.050324-1447 : Service Pack 1) # Windows Server 2003 SP1 all patches as of June-23-05 Fingerprint Microsoft Windows 2003 Server SP1 Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2003 Server Standard Edition Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=20%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2003 Server Standard Edition Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2003 Server Standard Edition (Build 3790.srv03_gdr.040410-1234) Fingerprint Microsoft Windows 2003 Server Standard Edition Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Microsoft Windows 2003 Server Standart Edition SP1 Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=5C%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2003 standard edition version 5.2 build 3790.srv03_rtm.030324-2048 and lastest windows updates patches as november 9, 2004 Fingerprint Microsoft Windows 2003 standard edition Class Microsoft | Windows | 2003/.NET | general purpose T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Server 2003, No Service Packs build 3790.srv03_gdr.040410-1234 Fingerprint Microsoft Windows Server 2003 Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Microsoft Windows Server 2003 Enterprise Edition Version 5.2.3790 Fingerprint Microsoft Windows Server 2003 Enterprise Edition Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=10%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 3.1 with Trumpet Winsock 2.0 revision B Class Microsoft | Windows | 3.X | general purpose TSeq(Class=TD%gcd=10000%SI=D%IPID=RPI%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 98 4.10.2222.A # "Windows 98SE, patched up to date" (1/25/03) Fingerprint Microsoft Windows 98SE Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=2D1%IPID=I) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows ME + all updates as of 1/1/03 Fingerprint Microsoft Windows Millennium Edition (Me) Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=RI%gcd=<8%SI=<1DA74&>117%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Millennium (German) 4.90.3000 Fingerprint Microsoft Windows Millennium Edition (Me) Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I) T1(DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows Millenium Edition v4.90.300 # Windows Me or Windows 2000 RC1 through final release # Microsoft Windows 2000 Advanced Server # Windows 2000 with SP2 and long fat pipe (RFC 1323) # Windows 2000 Professional Service Pack 3 # Windows 2000 5.00.2195 Service Pack 2 and latest hotfixes # Windows 2000 Professional (x86) # Compaq ProLiant DL-380G2 running Windows 2000 with SP3 and all the current patch sets (2/3/03) # Windows XP Professional version 2002 on PC Intel processor # Windows XP Build 2600 # XP Professional 5.1 (build 2600).. all patches up to June 20, 2002 # Fingerprint Microsoft Windows XP Professional with all current updates to May 2002 # Windows 2000 Version 5.0 Build (2195: Service Pack 3) # Windows 2000 Advanced Server SP3 Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP Class Microsoft | Windows | 95/98/ME | general purpose Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=49C%IPID=I%TS=0) T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|4470|8052|B5C9|B580|C000|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT) T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|4470|8052|B5C9|B580|C000|402E|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # Windows NT 3.51 SP5 Fingerprint Microsoft Windows NT 3.51 SP5, NT 4.0 or 95/98/98SE Class Microsoft | Windows | 95/98/ME | general purpose Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4%IPID=BI|RPI|RD%TS=U|0) T1(DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=A|AS%Ops=|M|MNWNNT) T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=AS%Ops=M|MNWNNT) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows XP Professional (English) w/ SP2 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) # Widows XP Professional (English UK) SP2 - latest patches as of 20 Dec 2004 - build 2600.xpsp_sp2_rtm.040803-2158 # Microsoft Windows XP Home Edition (French) SP2 build 2600.xpsp_sp2_rtm.040803-2158 # Microsoft Windows XP Profesional (English) SP2 Ver 5.1 build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2 Fingerprint Microsoft Widows XP SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=805C|88A4|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=805C|88A4|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Advanced Server SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<22FBA&>28B%IPID=I) T1(DF=Y%W=7530%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7530%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Advanced Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<206B6&>2E7%IPID=I) T1(DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Advanced Server SP3, all available updates as of 11/13/02 Fingerprint Microsoft Windows 2000 Advanced Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<58066&>3E9%IPID=I) T1(DF=Y%W=402E|FFF0%ACK=S++%Flags=AS%Ops=MNNT|MNWNNT) T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Windows 2000 Advanced Server Service Pack 4 With ALL updates as of October 9th 2003 Winver: Version 5 build 2195 SP4 Fingerprint Microsoft Windows 2000 Advanced Server SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1FD06&>42A) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Advanced Server SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<7CE98&>6B7) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Windows 2000 Advanced Server Version 5.0 (Build 2195: Service Pack 4) Fingerprint Microsoft Windows 2000 Advanced Server SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Professional Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1C476&>472) T1(DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|20|80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 2000 Professional (Russian) SP2 with some antiworm patches (MS04-011 etc.), firewalled with wipfw (http://wipfw.sourceforge.net) dropping TCP_SYNFIN # Microsoft Windows 2000 Professional Rus with SP2 with only Sasser etc. patches Fingerprint Microsoft Windows 2000 Professional (Russian) SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<3073C&>393) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Professional RC1 or Windows 2000 Advanced Server Beta3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<27D922&>65EE) T1(DF=Y%W=402E|2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E|2017%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows NT 5 Beta2 or Beta3 # Microsoft Windows 2000 Professional Edition (English) Build 2195 with SP2 - x86 Fingerprint Microsoft Windows 2000 Professional SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD%gcd=<6%SI=<1000) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 Professional Build 2195 Service Pack 3 Fingerprint Microsoft Windows 2000 Professional SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1BB0C&>2DC%IPID=I%TS=U) T1(DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # base one msg 170, 666 # Windows 2000 Professional SP4 fully patched as of 10/20/04 # Microsoft Windows 2000 Professional SP4 and latest Windows Update as of December 8th, 2004 # Microsoft Windows 2000 Professional Version: 5.0.2195 Service Pack 4 Build 2195 # Microsoft 2000 Professional SP4 CPU AMD Fingerprint Microsoft Windows 2000 Professional SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR|RI%gcd=<6%SI=<2B0D4&>22E%IPID=I) T1(DF=Y%W=2238|7D78|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2238|7D78|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Professional SP4 build 2195 Fingerprint Microsoft Windows 2000 Professional SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<29B6C&>2EF%IPID=I%TS=U) T1(DF=Y%W=FB06|FF70%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FB06|FF70%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1B26A&>26A%IPID=I%TS=U) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<25224&>22C%IPID=I) T1(DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Server with Service Pack 3 and MS Exchange 2000 Server Fingerprint Microsoft Windows 2000 Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=186%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=A%Ops=NNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<255BC&>24F%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<230DC&>388%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Windows (XP Pro) version 5.1 (numero 260.xpsp2.030422-1633:Service Pack 1) Fingerprint Microsoft Windows 2000 Server SP3 or Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<24F5E&>47E%IPID=I%TS=U) T1(DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Server (Spanish) with SP4 build 2195 Fingerprint Microsoft Windows 2000 Server SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<67DF4&>2FB%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=A%Ops=NNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Server with SP4 and Windows Update patches as of January 14, 2005. # Microsoft Windows 2000 Server with SP4 and latest Update Patches as of January 10 2005 Fingerprint Microsoft Windows 2000 Server SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=110C) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=) PU(DF=N%TOS=C0|68%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Windows 2000 Server Edition Version 5.0 (Build 2195: Service Pack 4) Fingerprint Microsoft Windows 2000 Server SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<21E62&>256%IPID=I) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=6AA%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 Server SP4 with all current patches april 9th 2005 Fingerprint Microsoft Windows 2000 Server SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1C3B8&>157%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2003 Standard build 3790 # Microsoft Windows 2003/.NET Standard Edition # Windows 2000 Server with SP4 fully patched as of 10/8/04 Fingerprint Microsoft Windows 2000 Server SP4 or 2003 Server Standard Edition Class Microsoft | Windows | NT/2K/XP | general purpose Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNNT) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 2000 Server with SP4 and no other updates # Windows 2000 Server SP 4 + ALL patches at 25 Sep. 2003 # Windows XP Professional SP1 and latest Windows Update patches as of Oct 04, 2004 Fingerprint Microsoft Windows 2000 Server SP4 or XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2B430&>5AD%IPID=I) T1(DF=Y%W=FA00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1F216&>251%IPID=I) T1(DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Build 2195 Service Pack 1 Fingerprint Microsoft Windows 2000 SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<220164&>80000%TS=U) T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 version 5 build 2195 Service Pack 2 Fingerprint Microsoft Windows 2000 SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<270D8&>4BF%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1D362&>237%IPID=I) T1(DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2FE90&>6F9%IPID=I%TS=U) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2928E&>4B7%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Professional SP2 # Microsoft Windows XP Professional SP1 # Microsoft Windows XP Professional, ver. 5.1 Build 2600.xpclnt_qfe.010827-1803 Fingerprint Microsoft Windows 2000 SP2 or XP or XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<327F6C&>3E9%IPID=I) T1(DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # base on msg 1039 # Microsoft Windows 2000 SP2 with Hotfix Q300972, Q301625 Fingerprint Microsoft Windows 2000 SP2 with Hotfix (Pre-SP3) Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<1E08C&>15A%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|1000|800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Professional with SP3 and latest Windows Update # patches as of August 22, 2003 - Laptop using G-Trans PCMCIA CDMA # Wireless card. Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<39062&>5B5%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2382B18&>5AE4C%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1A748&>D9%IPID=I%TS=U) T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 SP3 Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2425C&>383%IPID=I) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<13EEB2&>2BD%IPID=I%TS=U) T1(DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 [Version 5.00.2195] SP3 Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<269EE&>2EC%IPID=I) T1(DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|D0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 SP3 Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<28B54&>31B%IPID=I) T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 5.00.2195 with SP 3 Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<876AE&>98E) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<15374&>110%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Microsoft Windows 2000: v5.00.2195: SP4 Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=400|1000|800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 with SP4 ( version 5.0 (build 2195: sp 4) ) Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<17D54&>2B4%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS|A%Ops=MNW|) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Windows 2000 Professional 5.00.2195 SP4 incl. latest Hotfixes till 30.12.2004 # Microsoft Windows 2000 build 2195 SP 4 Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<139354&>972%IPID=I%TS=U) T1(DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 build 2195 SP4 with update patches through 4/22/2004 Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1BFDA&>357%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=A06%IPID=I%TS=U) T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<51CB6&>2DF%IPID=I) T1(DF=Y%W=B547%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=B547%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Fingerprint Windows 2000 build 5.00.2195 SP4 Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<78816&>95%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 Version 5.0 Build 2195 SP 4 x86 Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=4204|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4204|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows Version 5.0 build 2195 SP 4 Fingerprint Microsoft Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=7FFF|832C|FA00%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7FFF|832C|FA00%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 SP4 and latest Windows Update patches as of Sept 26, 2003 running BlackICE # Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of September 01, 2003 Fingerprint Microsoft Windows 2000 SP4 or Windows XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1E58A2&>1517) T1(DF=Y%W=2238|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # base on msg 2213(-2210), 2378, 2473, 2476, 2174, 2153, 1942, 1955 # Microsoft Windows 2000 Professional (German) with SP4 build 2195 and latest Windows Update patches (2005.5.19) # Windows 2000 terminal version 5.0 build 2195 service pack 4 # Microsoft Windows 2000 Professional SP4 and latest Windows Update patches (2005.6.11) # Microsoft Windows 2000 Server with SP4 and latest Windows Update patches as of May 17, 2005 # Windows XP Professional Version 2002 Service Pack 1 # Microsoft Windows 2000 Advanced Server SP4 Fingerprint Microsoft Windows 2000 SP4 or XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=B547|FC00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=B547|FC00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Server 2003 Standard Edition # Microsoft Windows 2003 standard edition Version 5.2 (Build 3790.srv03_gdr.040410-1234) # Microsoft Windows 2003 Server with SP1 # Windows Server 2003 Enterprise SP1 + hotfixes (build 3790.srv30_sp1_rtm.050324-1447 : Service Pack 1) # Windows 2003 Enterprise SP1 Version 5.2 (Build 3790.srv03_sp1_rc1.041202-1618 : +Service Pack 1, v.1) # Microsoft Windows XP Professional /w SP2 build 2600.xpsp_sp2_rtm.040803-2158 # Microsoft Windows 2003 Standard Edition SP1 Updated through June 19th 2005 # Windows Server 2003 Enterprise Edition (Version 5.2 Build 3790.srv03_sp1_rtm.050324-1447 : +Service Pack 1) Fingerprint Microsoft Windows 2003 Server, 2003 Server SP1 or XP Pro SP2 Class Microsoft | Windows | NT/2K/XP | general purpose Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 with Service Pack 3 # Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of February 1st, 2003 Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000, or Windows XP Class Microsoft | Windows | NT/2K/XP | general purpose Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=RI%gcd=<20%SI=240) T1(DF=Y%W=40E8|5B8E|7FFF|FAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=40E8|5B8E|7FFFFAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 3.10 (Build 528) Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI|TD%gcd=<24%SI=<69A%IPID=I%TS=U) T1(DF=N%W=1400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 Server SP5-SP6 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<11784E&>2CA4) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP 6a + hotfixes Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<40132&>290%IPID=BI|RPI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) PU(Resp=N|Y) Fingerprint Microsoft Windows NT 4.0 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73) T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT) T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD%gcd=21A) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows NT 4.0 Service pack 6 w/exchange 5.5 # Microsoft Windows NT 4.0 service pack 6 (English) Fingerprint Microsoft Windows NT 4.0 SP6 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<1F9C8&>FA%IPID=BI|RPI|RD%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows NT4.0 Workstation SP6a # Windows NT4.0 with Service Pack 6 # Microsoft Windows NT4.0 Terminal Server Edition with Service Pack 6 and Citrix MetaFrame 1.8 with Service Pack 4 Fingerprint Microsoft Windows NT 4.0 SP6a Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=112%IPID=RPI|BI%TS=U) T1(DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP6a Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<8D3CE&>1017%IPID=RPI|RD%TS=U) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP6a with Kerio WinRoute Pro 4.27 Firewall Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD%gcd=<8%SI=<8C%IPID=BI|RPI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T5(DF=N%W=1000|400|800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 Terminal Server Edition Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=1D4%IPID=BI%TS=U) T1(DF=N|Y%W=0|2017%ACK=S++%Flags=AR|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=0|2017%ACK=O|S++%Flags=AR|AS%Ops=|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Windows NT Version 4.0 (Build 1381 - Service Pack 6), Revised Service Pack 6a Fingerprint Microsoft Windows NT 4.0 Workstation SP6a Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD%gcd=<8%SI=<46%IPID=RPI|RD|BI%TS=U) T1(DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 Workstation SP6a Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD%gcd=<6%SI=<46%IPID=BI%TS=U) T1(DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT Version 4 (Build 1381) Service Pack 6a Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<377BC&>3BB%IPID=RPI|BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP [Version 5.1.2600] Fingerprint Microsoft Windows XP Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2C09C&>2CB%IPID=I%TS=U) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Microsoft Windows XP Home Edition Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<23C4E&>330%IPID=I%TS=U) T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Home Edition (English) SP2 build 2600.xps_p2_gdr.050301:1519 Fingerprint Microsoft Windows XP Home Edition (English) SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Microsoft Windows XP Home Edition (German) SP1 # ver 5.1 build 2600.xpsp2.030422-1633 : SP 1; German version # Microsoft Windows XP Home Edition (German) SP1 Fingerprint Microsoft Windows XP Home Edition (German) SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<129062&>775%IPID=I) T1(DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows XP Version 5.1 Home German SP2 (Build 2600.xpsp_sp2_rtm.040803-2158 : SP2), latest Updates as of Oct 27, 2004 Fingerprint Microsoft Windows XP Home Edition (German) SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Home Edition (English) SP1 Version 5.1.2600.1106 build 2600 xpsp.1.020828-1-920 Fingerprint Microsoft Windows XP Home Edition SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<163E6&>31F%IPID=I) T1(DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Home Edition (Italian) SP1 build 2600.xpclnt_qfe.021108-2107 # Windows XP Home Edition SP2 Fingerprint Microsoft Windows XP Home Edition SP1 or SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2522E&>381%IPID=I%TS=U) T1(DF=Y%W=1FE0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows XP Professional WITHOUT ANY service packs # Windows XP SP1 Fingerprint Microsoft Windows XP Pro Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2EBEE&>45E%IPID=I%TS=U) T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # No service packs Fingerprint Microsoft Windows XP Pro (German) Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1074EE&>E48%TS=U) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Microsoft Windows XP Prof Corporate (German) SP1 + all Security Updates as of Febr. 10, 2004 Fingerprint Microsoft Windows XP Pro (German) SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<15BA8&>2DA%IPID=I%TS=U) T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Pro (German) SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<23E9C&>195%IPID=I) T1(DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # No service packs Fingerprint Microsoft Windows XP Pro (Italian) Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<3CF14&>33C) T1(DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Fingerprint Microsoft Windows XP Pro (Spanish) SP2 Fingerprint Microsoft Windows XP Pro (Spanish) SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Microsoft Windows XP Pro or Windows 2000 Professional SP2+ Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<16%SI=<25AEE&>6B%IPID=I) T1(DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Pro RC1+ through final release Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<2959A&>356%IPID=I) T1(DF=Y|N%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microaodr Windows XP Pro with SP! and latest Windows Update patches as of June 1, 2005 Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # bsed on msg 2236, 1304 # Microsoft R Windows Version 5.1 (Build 2600.xpsp2.040919-1003 : Service Pack 1) # Microsoft Windows XP version 5.1 (no. 2600 xpsp2.040919-1003: Service Pack 1) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2553A&>42E%IPID=I) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNT) T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<31812&>7D7%IPID=I) T1(DF=Y%W=7D00%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Professional Edition Version 5.1 Build (2600.xpsp2.030422-1633: Service Pack 1) # Microsoft Windows XP Professional SP1 and latest patches as of Jan 31,2004 # Microsoft Windows XP Professional (Italian) SP1 build 2600.xpsp2.030422-1633# Microsoft Windows XP Pro (Spanish) SP1 (Build 2600.xpsp2.030422-1633 : Service Pack 1) Intel Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<29446&>49E%IPID=I) T1(DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<10225A&>105E) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Windows XP Version 5.1 (Build 2600.xpsp2.030422-1633: Service pack 1) # Windows XP Professional With serice pack 1... English.. 2600.xpsp1.020828-1920 Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<9A6AA&>18A0%IPID=I%TS=U) T1(DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS|A%Ops=M|) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS||A%Ops=M||) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows XP Professional Version 5.1 (Build 2600.xpsp2.030422-1633: Service Pack1) # Windows XP SP1 running ZoneAlarm # Microsoft Windows XP Professional Version 5.1 (Build 2600.xpsp2_gdr.040517-1325: Service Pack 1) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<63826&>D28%IPID=I%TS=U) T1(DF=Y%W=3BB8|6270|8000|9448|A1D3|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=3BB8|6270|8000|9448|A1D3|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2F7D8&>239%IPID=I) T1(DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<14686&>1A0%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows Xp Professional Service Pack 1 version 5.1 - Build 2600 # Microsoft Windows XP version 5.1 (build 2600.xpsp2.030422-1633 : Service Pack 1) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<3316C&>33B%IPID=I) T1(DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<17D36&>18B%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP [Version 5.1.2600] (XP Professional SP1) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=C00|800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S%Flags=R%Ops=WNMETL) T4(DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL) T7(DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Version 5.1 Build 2600.xpsp2.030825-2117: Service Pack 1 # Microsoft Windows XP Professional SP1 build 2600, latest windows updates (march 27, 2005) Fingerprint Microsoft Windows XP Pro SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1B1AC&>29E%IPID=I%TS=U) T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows XP Professional 2002 - Service Pack 1 - Hotfixes # Windows XP Profesional build 2600.xpsp2.030422-1633: Service Pack 1 # Windows XP Professional SP1 build 2600.xpsp1.030422-166: Service Pack 1 # Windows XP Professional (Italian) build 2600 with SP1 and latest Windows Update patches as of middle Sept. 2004 circa # Microsoft Windows 2000 SP4 all updates as of Apr 17 2004 Fingerprint Microsoft Windows XP Pro SP1 or 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<209B8&>33C%IPID=I) T1(DF=Y%W=6270|FC00%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Professional SP1 # Microsoft Windows 2000 Advanced Server with Service Pack 3 Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 Advanced Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<272A4&>31E%IPID=I%TS=U) T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|5C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows XP Professional Build 2600.xpsp1.020828-1920 with Windows Services for UNIX 3.0 installed # Windows 2000 Advanced Server with SP3 # Microsoft Windows 2000 Server version 5.0 build 2195 Service Pack 3 # Windows 2000 SP3 Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<57472&>68D%IPID=I) T1(DF=N|Y%W=0|FFF0%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=0|FFF0%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Professional w/ SP1 V5.1.2600 and most WU patches as of 4/20/05 # Microsoft Windows XP Professional 5.1.2600 Service Pack 1 Build 2600 # Microsoft Windows XP Home Edition (English) with Service Pack 2 # Windows XP Professional (Version 5.1 - Build 2600.xpsp2.050301-1526: Service Pack 1) # version 5.1 build 2600 xpsp2 040919-1003 service pack 1 # Windows 2000 SP4 Version 5.0 (Build 2195: Service Pack 4) on a 2 GHz Pentium 4 # Microsoft Windows 2000 s/SP4 build 5.00.2195 # Microsoft Windows 2000 Professional 5.00.2195 SP4 - all patches as of 02 Jun 2005 (OEM) # Windows 2000 Advanced Server SP4 and patches as of June 17 2004 # Microsoft Windows 2000 Professional (v5.0, Build 2195, SP4), all current hotfixes applied 7th June # Microsoft Windows 2000 Professional with SP4 and latest Windows Update patches as of June 21, 2005 # Microsoft Windows 2000 Advanced SP4 running Sphinx a-Wall # Microsoft Windows XP Professional SP1a build 2600.xpsp2.050301-1526 # Microsoft Windows XP Professional (German) SP1 build 2600.xpsp1.050301-1526 Fingerprint Microsoft Windows XP Pro SP1/SP2 or 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows XP Professionnel (5.1) Service Pack 2 Fingerprint Microsoft Windows XP Pro SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=C00|800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|800|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) # Microsoft Windows XP Professional Service Pack 2 Build 5 1 2600 Fingerprint Microsoft Windows XP Pro SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Microsoft Windows Version 5.1 (Build 2600.xpsp_sp2_trm.040803-2158 : Service Paxk 2) (XP Professional +SP2 + Hotfix) Fingerprint Microsoft Windows XP Pro SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Windows xp Professional SP2 German (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) with Agnitum Outpost Firewall Pro ver.+2.1.303.4009 (314) # Microsoft Windows XP Professional Version 2002 SP2 build 5.1.2600 latest MS patches as of Feb 9, 2005 Fingerprint Microsoft Windows XP Pro SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=FB8B|FC00%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Fingerprint Microsoft Windows XP Professional SP2 and latest updates Fingerprint Microsoft Windows XP Pro SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=R%Ops=WNMETL) T4(DF=N%W=800|1000%ACK=S%Flags=R%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=R%Ops=WNMETL) T7(DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # bsed on msg 1079 # Fingerprint Microsoft Windows XP Proffesional (Polish) with SP2 and all patches available on January 19, 2005 Fingerprint Microsoft Windows XP Pro SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Professional SP2 ( Build 2600.xpsp_sp2_rtm.040803-2158) # Microsoft WIndows XP Proffesional Version 2002 Service Pack 2 Fingerprint Microsoft Windows XP Pro SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows XP Professional SP2: Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158: Service Pack 2 (firewall disabled) Fingerprint Microsoft Windows XP Pro SP2 (firewall disabled) Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%IPID=I%TS=0) T1(Resp=Y%DF=Y%W=FC94%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(Resp=Y%DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Professional CORP. ED. Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) # Microsoft Windows 2003 Enterprize Edition (version 5.2 (build 3790.srv03_gdr.040410-1234)) # Microsoft Windows XP Professional SP2 5.1.2600 SP2 Build 2600, Athlon x86, no firewall # Windows 2003 Enterprise Server 5.2 build 3790, srv03_gdr.040410-1234 as of Feb 22, 2003 # Mircosoft Windows Server 2003 Enterprise SP1 build 3790.srv03_sp1_rtm.050324-1447 Fingerprint Microsoft Windows XP Pro SP2 or 2003 Server Enterprise Edition Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Pro Version 5.1 Build 2600 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<32578&>18D%IPID=I) T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Microsoft Windows XP Prof (Build 2600.xpsp2.030422-1633: SP1 Fingerprint Microsoft Windows XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=702%TS=U) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=291F) T1(DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Version 5.1 (Build 2600.xpsp 1.020828-1920: Service Pack 1) > latest Windows Update patch too (1/31/03) # Windows 2000 with Service Pack 3 Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2461C&>3BA%IPID=I%TS=U) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP SP1 (Build 2600.XP SP2.030422-1633:Service Pack 1) # Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of Oct 12, 2003 except Q817778 # Windows 2000 Professional with SP4 and latest Windows Update patches as of november 25th, 2003 Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP4 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<18DEE&>24B%IPID=I) T1(DF=Y%W=402E|FC00|FD20%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows XP2 - version 5.1 (Build 2600.xpsp_sp2_gdr.050301-1519 : Service Pack 2) Fingerprint Microsoft Windows XP SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=F0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP SP2 (English) Build 2600.xpsp2_rtm.040803-2158 # Microsoft Windows XP Professional Version 5.1 (Build 2600.xpsp2_gdr.050301-1519 : Service Pack 2) # Microsoft Windows XP Professional (Spanizh) with SP2 and latest Windows Update patches as June 5,+2005 Fingerprint Microsoft Windows XP SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=C6C|4000|7D41%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=C6C|4000|7D41%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # windows XP Professional SP2 and latest updates as of 3/7/05 # Microsoft Windows XP version 5.1 600.xpsp_sp2_rtm.040803-2158 : service pack 2 Fingerprint Microsoft Windows XP SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # base on msg 570, 1033 # Windows XP SP2 (firewall off). Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) # Microsoft Windows Windows XP Corporate (French) SP2 build 2600.xpsp_sp2_rtm.040803-2158 on Intel Pentium 4 1.2 GHz Fingerprint Microsoft Windows XP SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=7E4A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7E4A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Home Edition (English) SP2 build 2600.xpsp_sp2_rtm.040803-2158 # Microsoft Windows XP Home Edition (English) SP2 build 2600.xpsp_sp2_rtm.040803-2158 # Microsoft Windows XP Professional with SP2 (Version 5.1 Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) # Microsoft Windows XP Professional SP2 (Build 2600.xpsp_sp2_rtm.040803-2158) # Microsoft Windows XP Professional SP2 # Windows XP SP2 (build 2600.xpsp_sp2_gdr.050301-1519 : Service Pack 2) Fingerprint Microsoft Windows XP SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U|0) T1(DF=Y%W=6360|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Version 5.1 (Build 2600.XPSP_SP2_GDR.050301-1519 : Service Pack 2) Fingerprint Microsoft Windows XP SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Professional Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2 # Microsoft Windows XP Professional SP2 build 2600.xpsp_sp2_rtm.040803-2158 # Microsoft Windows XP Professional SP2 and latest Windows Updates patches as of Dec 15, 2004 # Windows Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) # Microsoft Windows XP Professional (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) # Microsoft Windows XP Professional (Spanish) SP2 build 2600.xpsp_sp2_trm.040803-2158 # Windows Server 2003 Standard edition, Microsoft windows vers.5.2 build 3790.srv03_rtm.030324-2048 # Microsoft Windows XP Professional Version 2002 Service Pack 2 # Windows 2003 Server Standard Edition germany # Microsoft Windows Server 2003 EE Version 5.2 (Build 3790.srv03_gdr.040410-1234) # Microsoft Windows XP Home Edition (hebrew) with SP2 Fingerprint Microsoft Windows XP SP2 or 2003 Server Class Microsoft | Windows | NT/2K/XP | general purpose Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2003 Enterprise Server patches as of 3 May 2003 - NO SP1 # Microsoft windows Server 2003 Standard Edition (Corp. build) - Version 5.2 (Build+3790.srv03_gdr.040410-1234) Fingerprint Microsoft Windows XP SP2 or 2003 Server Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP Jornada running Windows CE 2.11 (Handheld/PC Pro 3.0) running on StrongARM 1100 Fingerprint HP Jornada running Microsoft Windows CE 2.11 (Handheld/PC Pro 3.0 PDA) Class Microsoft | Windows | PocketPC/CE | PDA TSeq(Class=TD%gcd=<36%SI=<28%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft PocketPC 3.0.11171 running on Compaq iPAQ 3870 Pocket PC Class Microsoft | Windows | PocketPC/CE | PDA TSeq(Class=TD%gcd=<6%SI=<104%IPID=BI) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows CE 3.0 build 126 on StrongARM Fingerprint Microsoft Windows CE 3.0 Class Microsoft | Windows | PocketPC/CE | specialized TSeq(Class=TD%gcd=12A%IPID=I) T1(DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 Pro, Build 2195 SP4 Fingerprint Microsoft Windows 2000 Professional SP4 Class Microsoft | Windows || general purpose TSeq(Class=RI%gcd=<6%SI=<457D6&>35E%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Professional with SP4 and latest Windows Update patches as of August 11, 2004 Class Microsoft | Windows || general purpose TSeq(Class=RI%gcd=<6%SI=<15E32&>1A1%IPID=I) T1(DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP3 Class Microsoft | Windows || general purpose TSeq(Class=RI%gcd=<6%SI=<30714&>2A7%IPID=I) T1(DF=Y%W=2DA0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2DA0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows Longhorn eval build 4051 Class Microsoft | Windows || general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MikroTik RouterOS 2.7.20 Class MikroTik | RouterOS || software router TSeq(Class=RI%gcd=<6%SI=<1B9B36E&>46A4A%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Minix 32-bit/Intel 2.0.0 Class Minix | Minix || general purpose TSeq(Class=RI|TD%gcd=1|2|3|457%SI=C2B%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Motorola BSR 1000R(tm) version 1.1.19.PRR Fingerprint Motorola BSR 1000R Class Motorola | BSD-misc || general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Motorola System V/68 version R3V7 on a 68030 Class Motorola | BSD-misc || general purpose TSeq(Class=RI%gcd=<14%SI=<52F8&>C0) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Motorola Surfboard SB5100e VxWorks Version: 5.4 # Motorola CG4500E Communication Gateway (cable modem) # Thomson TCM390 cable modem; Software Version: ST33.07.00; Software Model: A801; Bootloader: 2.1.4c # Motorola Surfboard Cable modem Software Version: SB5100-2.3.1.3-SCM00-NOSHHardware Version: 3MIB+Version: IIGUI Version: 1.0VxWorks Version: 5.4 # Motorola Cable Modem SB5100E SW_REV: SB5100E-2.3.1.3-SCM01-NOSH # Motorola SB5100 Surfboard 5100 Cable Modem vSB5100-2.3.1.6-SCM01-NOSH # Thomson Cable Modem TCM410 Fingerprint Motorola (SB5100/CG4500E) or Thomson (TCM390/TCM410) Cable Modem Class Motorola | VxWorks || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Motorola SurfBoard 4401 provided by adelphia Fingerprint Motorola SurfBoard 4401 cable modem Class Motorola | VxWorks || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F|0%ULEN=134%DAT=E) # VxWorks Version: 5.3; Software Version: SB4100E-4.1.11-SCM05-NOSHELL; Hardware Version: 3 Fingerprint Motorola SurfBoard SB4100E Cable Modem Class Motorola | VxWorks || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Motorola Surfboard SB5100 running Software version SB5100-2.3.1.6-SCM01-NOSH Fingerprint Motorola Surfboard SB5100 cable modem Class Motorola | VxWorks || broadband router TSeq(Class=RI%gcd=<6%SI=286BF%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=16D0%ACK=S++|O%Flags=AS|A%Ops=MNW|) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Motorola SURFboard SBG1000-0.1.3.0-SCM05-NOSH Fingerprint Motorola SURFboard SBG1000 Broadband router Class Motorola | VxWorks || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint MultiTech standalone firewall box, version 3 Class MultiTech | embedded || firewall TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) Fingerprint MultiTech MultiVoIP Version 2.01A Firmware Class MultiTech | embedded || telecom-misc TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MultiTech CommPlete (modem server) RAScard Class MultiTech | embedded || terminal server TSeq(Class=TD%gcd=388|710|A98%SI=<44) T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MultiTech CommPlete Controller (terminal server) Class MultiTech | embedded || terminal server TSeq(Class=TR|RI%gcd=<6%SI=>FFFF) T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Multi-Tech Voice over IP Box. Model number (MultiVoip 2410) Fingerprint MultiTech MultiVoip 2410 Class MultiTech | embedded || VoIP gateway TSeq(Class=TD%gcd=<1F502%SI=<1E%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400|800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint NAT LANB/290 router Console Program V4.00 Class NAT | embedded || router TSeq(Class=TD%gcd=<80004%SI=<14) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) # NCD X server (SNMP says: NCD16 server 2.3.0 03/12/91 downloaded) Fingerprint NCD X server (NCD16 server 2.3.0 03/12/91) Class NCD | embedded || X terminal TSeq(Class=64K) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NCR MP-RAS 3.0.x Class NCR | BSD-misc || general purpose TSeq(Class=64K) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NCR MP-RAS 3.01 Class NCR | BSD-misc || general purpose TSeq(Class=i800) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NCR S26 server (i386) running NCR MP-RAS SVR4 UNIX System Class NCR | BSD-misc || general purpose TSeq(Class=RI%gcd=<6%SI=<2BB718&>6FD5) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NCR server running MP-RAS SVR4 UNIX System Version 3 Class NCR | BSD-misc || general purpose TSeq(Class=RI%gcd=<6%SI=<31BA1E&>7F38) T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NEC UX/4800 Class NEC | UX/4800 || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Netcomm NB1300 ADSL Ethernet Modem/Router Fingerprint Netcomm NB1300 DSL router Class Netcomm | embedded || broadband router T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Host information: @WorkStation (i960 based) X-terminal # Neoware (was HDS) NetOS V. 2.0.1 # Hewlett-Packard Entria Model C3230A Server Version B.05.30 # Cisco 11151/Arrowpoint 150 Load Balancer Fingerprint Cisco 11151/Arrowpoint 150 load balancer, Neoware (was HDS) NetOS V. 2.0.1 or HP Entria C3230A Class Neoware | NetOS || X terminal Class HP | embedded || X terminal Class Cisco | embedded || load balancer TSeq(Class=64K) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetApp Data ONTAP 3.1.6 or BSDi 1.1 Class NetApp | Data ONTAP || fileserver TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetApp Data ONTAP 5.1.2 - 5.3.5r2 Class NetApp | Data ONTAP || fileserver TSeq(Class=RI%gcd=<6%SI=>BBB) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E) Fingerprint NetApp Data ONTAP 6.1.2R3 on an F840 filer Class NetApp | Data ONTAP || fileserver TSeq(Class=RI%gcd=<6%SI=<83FEA&>B28%IPID=BI%TS=2HZ) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # NetApp Data ONTAP Release 6.3.1: Wed Nov 20 13:03:17 PST 2002 Fingerprint NetApp Data ONTAP Release 6.3.1 Class NetApp | Data ONTAP || fileserver TSeq(Class=RI%gcd=<6%SI=<44A20&>AE7%IPID=BI%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint NetApp F360 or F760 Filer Class NetApp | Data ONTAP || fileserver TSeq(Class=RI%gcd=<6%SI=<7CA10&>CA2%IPID=BI%TS=2HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # NetApp Release 6.5.2R1: Wed Sep 8 17:00:29 PDT 2004 # NetApp Filer F820 running Ontap Release 6.5.2R1 # NetApp NetCache 5.6 # Network Appliance DataOnTap v6.5.2 "NetApp Release 6.5.2: Sun Jul 25 10:56:02 PDT 2004" # NetApp NetCache Release 5.6.2 # NetCache OS 6.0.1 Fingerprint NetApp Filer (Data OnTap 6.5.2) or NetCache (NetApp 5.6 - 6.0.1) Class NetApp | Data ONTAP || fileserver Class NetApp | embedded || web proxy TSeq(Class=TR%gcd=<6%IPID=BI%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetApp ONTAP Release 6.3.3 Class NetApp | Data ONTAP || fileserver TSeq(Class=RI%gcd=<6%SI=<7128C&>B45%IPID=BI%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Network Appliance Filer running Data ONTAP Release 6.4.3 Class NetApp | Data ONTAP || fileserver TSeq(Class=RI%gcd=<6%SI=<93792&>969%IPID=RPI|RD%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # NetCache 5.1D4 on a NetApp C1100 Box Fingerprint NetApp NetCache C1100 (NetApp 5.1D4) Class NetApp | embedded || web proxy TSeq(Class=RI%gcd=<6%SI=1371%IPID=BI%TS=2HZ) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Network Appliance NetCache C1100 (NetApp 5.0) Fingerprint NetApp NetCache C1100 with NetAppliance 5.0 Class NetApp | embedded || web proxy TSeq(Class=RI%gcd=<6%SI=<93D5A&>95A%IPID=BI%TS=2HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint NetApp NetCache C6100 (NetApp 5.5) Class NetApp | embedded || web proxy TSeq(Class=RI%gcd=<6%SI=<2642EC&>3974%IPID=BI%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint NetApp NetCache C760 os 4.x Class NetApp | embedded || web proxy TSeq(Class=RI%gcd=<6%SI=<4E51740&>FAA%IPID=I%TS=2HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=5000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint NetApp NetCache running OS 5.4R2 Class NetApp | embedded || web proxy TSeq(Class=RI%gcd=<6%SI=<22AD62&>1619%IPID=BI%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.0 big endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=64K) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Notes on NetBSD (written by Charles M. Hannum ): # * The set of options in a SYN-ACK depends on the state of the # `net.inet.tcp.rfc1323' flag. # * Releases prior to 1.3 did not randomize the ISS at all. # * Releases prior to 1.3 incorrectly added the IP header length to the IP # packet length when returning an ICMP unreachable. # * Releases prior to 1.3 calculated the window size slightly wrong. # * Releases prior to 1.3 returned a non-zero window size when sending a RST # in response to an ACK on a listening socket (thereby making them # susceptible to stealth scanning). # * Releases prior to 1.3H/1.3.4 did not return a response to the null flag # test (thereby making them susceptible to stealth scanning). # * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in # the encapsulated IP header when sending an ICMP reply. On little endian # machines the IP ID field was byte-swapped. The checksums were always # zeroed. # * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when # MTU discovery was enabled. Fingerprint NetBSD 1.0 i386 Class NetBSD | NetBSD || general purpose TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.0 little endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=64K) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.1 - 1.2.1 litle endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.2 - 1.2.1 big endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3 - 1.3.3 big endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3 - 1.3.3 little endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3H-1.5 big endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # NetBSD 1.3I (after 19990119) # NetBSD 1.4 x86 # NetBSD 1.6L/Alpha # NetBSD 1.6 NetBSD 1.6 (GENERIC) #0 Sun Sep 8 2002 i386 Fingerprint NetBSD 1.3I through 1.6 Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.5.2 running on a Commodore Amiga (68040 processor) Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<7AAB142&>874A7%IPID=I%TS=2HZ) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.5_ALPHA i386 Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<5CF5F1C&>EDF97) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.6 Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<8%SI=<601F422&>60539%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint NetBSD 1.6 - 1.6.1 (Alpha) Class NetBSD | NetBSD || general purpose TSeq(Class=RI|TR%gcd=<6%SI=<656F846%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.6 BETA 4 i386 (20020630 snapshot) Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<76BC4C8&>A6C26%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=4801%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.6.2 (alpha) Class NetBSD | NetBSD || general purpose T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # 1262 # NetBSD 1.6.2 (GENERIC) #0: Wed Feb 11 08:05:11 UTC 2004 sparc Fingerprint NetBSD 1.6.2 (x86) Class NetBSD | NetBSD || general purpose T1(DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # NetBSD 1.6.2 on x86 # Avocent Switchview net KVM switch - this is a embedded device that makes a regular KVM accessible over IP. # NetBSD 2.0_BETA i386 Fingerprint NetBSD 1.6.2 - 2.0_BETA or Avocent Switchview net KVM switch Class NetBSD | NetBSD || general purpose Class Avocent | embedded || specialized TSeq(Class=RI%gcd=<6%SI=<7679164&>F13C6%IPID=I) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.6ZC (SPARC) Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<67F4F30&>941F1%IPID=RD) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint NetBSD 1.6ZD Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<8%SI=<7C2EB86&>76383%IPID=RD) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # netbsd 1.6ZH GENERIC # NetBSD 1.6ZK NetBSD 1.6ZK #1: Thu Feb 19 18:05:56 EST 2004 # NetBSD 2.0 # NetBSD alpha1 2.0_RC4 # NetBSD 2.0.1 # NetBSD 2.0.2 (GENERIC_LAPTOP) #0: Wed Mar 23 08:59:09 UTC 2005 i386 # NetBSD 2.0.2 i386 # NetBSD 2.0.2 on sparc64 Fingerprint NetBSD 1.6ZH or 2.0 - 2.0.2 Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<714D5B4&>50BA4%IPID=I) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # NetBSD 2.0 (GENERIC) i386 Fingerprint NetBSD 2.0 Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<71C334A&>9705A%IPID=I%TS=U) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # NetBSD 2.0 (GENERIC) IP Filter: v4.1.3 (396) Dsl Router x86 Fingerprint NetBSD 2.0 Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<73607AC&>AC1A6%IPID=RD) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD/Alpha 1.5.2 on a DEC 000/300 LX Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<736B300&>106DED%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint Netburner Model 5282 Embedded Ethernet Microcontroller Class Netburner | embedded || specialized TSeq(Class=RI|TD%gcd=<6%SI=<45498%IPID=I%TS=U) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=MNNNL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=MNNNL) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Netgear DG824M Wireless (WAP) & 4-Port ADSL Router - Version 1.4 Release 05 Fingerprint Netgear DG824M WAP Class Netgear | embedded || broadband router TSeq(Class=TD%gcd=<104%SI=<14%IPID=I%TS=U) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # NETGEAR FVL238 Firmware Version Version 1.5 Release 09 Fingerprint Netgear FVL238 vpn/firewall/router Class Netgear | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<2E7205A&>76E53%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Netgear FVL328 vpn/firewall/router Class Netgear | embedded || broadband router T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(Resp=N) Fingerprint Netgear WGR614 Wireless router Class Netgear | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Netgear FM114P ProSafe Wireless Firewall with Print Server # netgear wgr614 v4 Wireless router # REPOTEC IP515H Cable Router / Print Server Fingerprint Netgear Wireless router or Netgear FM114P/REPOTEC IP515H Router & Print Server Class Netgear | embedded || broadband router TSeq(Class=TD%gcd=<404%SI=<1E%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Netgear PS101 print server with firmware 6026 Fingerprint Netgear PS101 Print Server Class Netgear | embedded || print server T1(DF=N%W=5B4%ACK=S++%Flags=APS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Netgear Printer Server PS110 firmware version: 6017 Fingerprint Netgear PS110 Print Server Class Netgear | embedded || print server TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U) T1(DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Netgear GS724T Gigabit Smart Switch Class Netgear | embedded || switch TSeq(Class=TD%gcd=<18%SI=<14%IPID=I%TS=U) T1(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=Y%W=800|1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint NetJet Version 3.0 - 4.0 Printer Class NetJet | embedded || printer TSeq(Class=TD%gcd=<4%SI=<4) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|800%ACK=S++%Flags=AR%Ops=|M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # IPAD Model 5000 (see www.ipad-canada.com) # eSoft IPAD, v.1.52 -- 64 line option on i86 hardware Fingerprint IPAD (Internet Protocol Adapter) Model 5000 or V.1.52 Class NetMatrix | embedded || general purpose TSeq(Class=TD|RI%gcd=1000|2000|3000%SI=<444) T1(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Broadband Router (Farralon Netopia or Compatible Systems 900i) Class Netopia | embedded || broadband router Class Compatible Systems | embedded || router TSeq(Class=TD%gcd=388|710|A98%SI=50) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) Fingerprint NetSilicon NetARM running ThreadX 2.0 Class NetSilicon | ThreadX || specialized TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Network Systems router NS6614 (NSC 6600 series) Class Network Systems | embedded || router TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Nexland ISB Pro800 Turbo, Firmware version: V1 Rel 5U Fingerprint Nexland ISB Pro800 Turbo Cable/DSL router Class Nexland | embedded || broadband router TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # A NeXT Turbo, unknown version number Fingerprint NeXT Mach Class NeXT | Mach || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NeXTStep/OpenStep 4.2/Intel Class NeXT | NeXTStep || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenStep 4.0-4.2 or NeXTStep 1.0-3.3 (Intel) Class NeXT | NeXTStep || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenStep 4.1/NeXTStep 3.3 Class NeXT | NeXTStep || general purpose TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NIB 450-E printer network interface Class NIB | embedded || printer T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Nokia M1122 DSL Router (Nokia Mrouter rel-Gx1x2220.R08) Fingerprint Nokia M1122 DSL Router Class Nokia | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<1AF18&>43B%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Nokia Rooftop Wireless Router model R240A Class Nokia | embedded || router T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=40%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Nokia IP530 Network Appliance (IPSO 3.4-3.4.2) Class Nokia | IPSO || firewall TSeq(Class=RI%gcd=<8%SI=<85DD6&>987%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Nokia IPSO 3.7-BUILD026 x86 Fingerprint Nokia IPSO 3.7 running CheckPoint FW-1 Class Nokia | IPSO || firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0|E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Nokia IPSO 3.8 Build039 (IPSO 3.8-BUILD039 releng 1404 07.23.2004-193500+i386) # Nokia IPSO 3.8.1-BUILD028 releng 1518 12.02.2004-222502 i386 Fingerprint Nokia IPSO 3.8.x Class Nokia | IPSO || firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Symbian OS 6.1 on Nokia N-Gage v 4.03 Fingerprint Symbian OS 6.1 on Nokia N-Gage v 4.03 phone Class Nokia | Symbian || phone TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Nortel Networks BayStack 450-24T Versions: HW:RevL FW:V1.48 SW:v4.2.0.16 ISVN:2 Fingerprint Nortel Networks BayStack switch Class Nortel | embedded || switch TSeq(Class=RI%gcd=<6%SI=<762A&>C8%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Nortel Networks Passport 1100 (version 2.0.7.2) Fingerprint Nortel Networks Passport 1100 switch Class Nortel | embedded || switch TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=N) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Nortel Networks Passport 8600 routing switch sw 3.3.0.0 Class Nortel | embedded || switch TSeq(Class=RI%gcd=<6%SI=113A%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Nortel CallPilot 100 voicemail system # 3Com superstack 3 4300 (3c17100) Hardware Version: V4.0 Software Version: V1.12 # Cisco 1538M Micro Hub running latest firmware # HP TopTools Remote Control Card # Enterasys VH2402 Switch Firmware 2.05.02 # NTT East VoIP gateway of some sort ( http://www.ntt-east.co.jp/ced/goods/voip/index.html ) Fingerprint Nortel CallPilot 100 voicemail system, 3Com Superstack 3 switch, Enterasys switch, HP TopTools remote control card, or Cisco 1538M hub Class Nortel | embedded || telecom-misc Class NTT | embedded || telecom-misc Class 3Com | embedded || switch Class Cisco | embedded || hub Class Enterasys | embedded || switch Class HP | embedded || remote management TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) # Northern Telecom Supernode - Nortel Micronode telephone switch running OS version GSM15 Fingerprint Nortel Micronode telephone switch running OS version GSM15 Class Nortel | embedded || telecom-misc TSeq(Class=TD%gcd=<120004%SI=<14%IPID=Z%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Nortel Passport 4400 Series - Release 4.0.3 Fingerprint Nortel Passport 4400 Series multiservice access switch Class Nortel | embedded || telecom-misc TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Nortel Networks CVX1800 RAS. Software version 2.02 Class Nortel | embedded || terminal server TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 3.12 - 5.00 Class Novell | NetWare | 3.X | general purpose Class Novell | NetWare | 4.X | general purpose Class Novell | NetWare | 5.X | general purpose TSeq(Class=TD%gcd=10|20|30|40%SI=<64) T1(DF=Y|N%W=7D0|8000|2000|1FFF|7FFF|8000|FFFF%ACK=S++%Flags=AS%Ops=M|ME) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=7D0|8000|2000|1FFE|7FFF|8000|FFFF%ACK=O|S++%Flags=AS|ASF%Ops=M|ME) T4(Resp=N) T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 3.12 or 386 TCP/IP Class Novell | NetWare | 3.X | general purpose TSeq(Class=TD%gcd=<6B4A%SI=<1E) T1(DF=N%W=73F|F87|3F25%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS|ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetWare 4.11 SP7- 5 SP3A BorderManager 3.5 Class Novell | NetWare | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1843D74&>3E1D0) T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint NetWare 4.11 SP8a - NetWare 5 SP4 Class Novell | NetWare | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2DB195E&>74F88) T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint novell netware 4.11 Class Novell | NetWare | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Novell NetWare 4.11-5.0SP5 Class Novell | NetWare | 4.X | general purpose Class Novell | NetWare | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2B302C0&>6E8E8) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetWare 5.0 SP 3a Class Novell | NetWare | 5.X | general purpose TSeq(Class=RI%gcd=<8%SI=<5641338&>DCCE9) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetWare 5.1 SP3 Class Novell | NetWare | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2385886&>53F65%IPID=RPI|BI|RD%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.0 with Border Manager Class Novell | NetWare | 5.X | general purpose TSeq(Class=RI%gcd=<5%SI=>BBBBB) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Novell NetWare 5 Support Pack Revision 06 Server Version 5.00.09 Fingerprint Novell NetWare 5.00.09 SP06 Class Novell | NetWare | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1EDA0D4&>2F197%IPID=I%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Novell NetWare 5.1 SP5 with Groupwise Fingerprint Novell NetWare 5.1 SP5 Class Novell | NetWare | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2378ABE&>57780%IPID=BI%TS=U) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M|MEWN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.1 SP5 with Groupwise Class Novell | NetWare | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Novell NetWare 5.1 SP8 # Novell NetWare 6.5 SP3 # Novell Open Enterprise Server, NetWare 6.5 Support Pack Revision 03 # Novell NetWare Open Enterprise Server (OES) (English, First Customer Shipping version) installed with everything on it, x86 Fingerprint Novell NetWare 5.1 SP8 or 6.5 SP3 Class Novell | NetWare | 5.X | general purpose Class Novell | NetWare | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=BI|RPI%TS=U) T1(DF=N|Y%W=17FF%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.1-6.0 Class Novell | NetWare | 5.X | general purpose Class Novell | NetWare | 6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2883446&>599C6%IPID=RD|RPI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.1SP4 - 6.0 Class Novell | NetWare | 5.X | general purpose Class Novell | NetWare | 6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<253064A&>5F32F%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.1SP5 - 6.5 Class Novell | NetWare | 5.X | general purpose Class Novell | NetWare | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.x Class Novell | NetWare | 5.X | general purpose TSeq(Class=RI%gcd=<8%SI=<286248A&>1B465%IPID=I%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # NetWare 6.5 SP2 (running on a Compaq Proliant ML370) Fingerprint NetWare 6.5 SP2 Class Novell | NetWare | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint Novell Netware 6 (no service packs) Class Novell | NetWare | 6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<3B034FE&>24038%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 6 SP1 Class Novell | NetWare | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Novell NetWare 6 SP2 running BM3.7 (with no service packs) Fingerprint Novell NetWare 6 SP2 Class Novell | NetWare | 6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<30102C2&>766BA%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 6.0 SP3 Class Novell | NetWare | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 6.0 SP4 Class Novell | NetWare | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=N) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 6.5 SP2 Class Novell | NetWare | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # NSG 500 router. OS version 7.6.1 (http://www.nsg.ru) # NSG-520/Network Systems Group, running Version 7.6.1 # NX-300/3wl/1e1/Network Systems Group running Version 7.6.3 Fingerprint NSG-300/500 series router running Version 7.6.x Class NSG | embedded || router TSeq(Class=TD%gcd=<50004%SI=<3C%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # OkiData 20nx printer with OkiLAN 6100e TCP/IP Ethernet module Fingerprint OkiData 20nx printer with OkiLAN ethernet module Class Okidata | embedded || printer TSeq(Class=C%IPID=I%TS=U) T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Okidata 7200 Printer Class Okidata | embedded || printer T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Okidata OKI C5100 Laser Printer Class Okidata | embedded || printer T1(DF=N%W=C00%ACK=S++%Flags=AS|AR%Ops=M||MNW) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Okidata OKI C7200 Printer Class Okidata | embedded || printer T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Open Network 501r or 531r (ADSL Router) Class Open Networks | embedded || broadband router TSeq(Class=TD%gcd=<2C%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.7/SPARC or NFR IDS Appliance ( 12/10/00 ) Class OpenBSD | OpenBSD | 2.7 | general purpose TSeq(Class=RI%gcd=<6%SI=<8FC28&>16EC) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint OpenBSD 2.1 - 2.3/SPARC Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=>FF) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # This fingerprint had LAND patch installed Fingerprint OpenBSD 2.1/x86 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=>BBB) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenBSD 2.2 - 2.3 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenBSD 2.6 with all available patches as of roughly Feb01 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<4C22A&>C1A) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F|E%UCK=F|E%ULEN=134%DAT=E) # With more info provided by Theo De Raadt # OpenBSD 2.6 Fingerprint OpenBSD 2.6-2.8 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1869F6&>3E6B) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134|3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.6-2.8 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=1B9B) T1(DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.8 (x86) Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=TD|RI%gcd=<6%SI=1%IPID=RPI|BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.9-beta through release (x86) Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y|N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y|N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint OpenBSD 2.9-stable Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD Post 2.4 (November 1998) - 2.5 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=>FFF&62A0A%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Packet Engines PowerRail 5200 router version 2.6.0r10 - 16 Sep, 1999 Class Packet Engines | embedded || router TSeq(Class=64K) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Packet8 BPA410 broadband phone adapter Fingerprint Packet8 BPA410 Broadband Phone Adapter Class Packet8 | embedded || VoIP adapter TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=578%ACK=O%Flags=R%Ops=) T5(DF=Y%W=578%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=578%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Packet8 DTA310 VoIP/POTS gateway Class Packet8 | embedded || VoIP adapter TSeq(Class=TD%gcd=<200034%SI=<1E%TS=U) T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=) T4(DF=N%W=578%ACK=O%Flags=R%Ops=) T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=578%ACK=O%Flags=R%Ops=) T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) # Packet8 DTA-310 (DTA version 1.0 US (8x8 001239)) # Packet 8 DTA310 broadband phone adapter Fingerprint Packet8 DTA310 VoIP/POTS gateway Class Packet8 | embedded || VoIP adapter TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T4(DF=Y%W=578%ACK=O%Flags=R%Ops=) T5(DF=Y%W=578%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=578%ACK=O%Flags=R%Ops=) T7(DF=Y%W=578%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Packeteer PacketShaper 4000 v4.1.3b2 2000-04-05 Class Packeteer | pSOS || load balancer TSeq(Class=64K) T1(DF=N%W=430%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Packeteer IP-PacketShaper 2000 V3.1 Fingerprint pSOS embedded IP stack, such as Packeteer IP-PacketShaper 2000 V3.1 Class Packeteer | pSOS || load balancer TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint PalmOS 3.5.1 on m100 PDA Class Palm | PalmOS | 3.X | PDA TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U) T1(DF=N%W=A78%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=A78%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Panasonic IP Technology Broadband Networking Gateway, KX-HGW200 Class Panasonic | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<27BE484&>16928%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(Resp=N) # (printer, scanner, copier, fax machine) Fingerprint Panasonic DP-3520 multi-function printer Class Panasonic | embedded || printer TSeq(Class=TD%gcd=27) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Panasonic WJ-NT104 Network Interface Unit w/firmware version : V1.01G 010323A Fingerprint Panasonic WJ-NT104 Network video device Class Panasonic | embedded || webcam TSeq(Class=RI%gcd=<6%SI=<3183A&>7C8%IPID=I%TS=U) T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Parks Altavia 671R router Class Parks | embedded || broadband router TSeq(Class=TD%gcd=21%IPID=I%TS=U) T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Pelco Network Camera Class Pelco | embedded || webcam TSeq(Class=RI%gcd=<6%SI=<1000018&>28F48%IPID=I%TS=U) T1(DF=N%W=B4%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=B4%ACK=S%Flags=R%Ops=) T3(Resp=Y%DF=N%W=B4%ACK=S++%Flags=AS%Ops=) T4(DF=N%W=B4%ACK=S%Flags=R%Ops=) T5(DF=N%W=B4%ACK=S++%Flags=R%Ops=) T6(DF=N%W=B4%ACK=S%Flags=R%Ops=) T7(DF=N%W=B4%ACK=S%Flags=R%Ops=) PU(Resp=N) # Perle 594e Network Controller Fingerprint Perle 594e Network Controller Class Perle | embedded || remote management T1(DF=Y%W=C39%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=C39%ACK=O%Flags=AS%Ops=M) T4(DF=Y%W=100%ACK=O%Flags=R%Ops=) T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=100%ACK=O%Flags=R%Ops=) T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Perle JetStream 8500 Serial/Access Server, v 2.6.0 Class Perle | embedded || terminal server TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FC%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Philips ReplayTV 5000 DVR Class Philips | embedded || media device TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Pigtail Express VoIP phone (runs VxWorks) Class Pigtail | VxWorks || VoIP phone TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Pirelli Microbusiness ADSL router Class Pirelli | embedded || broadband router TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Pitney Bowes DL550 photocopier # Konica IP Controller Internal Print Server Module for Konica Multi-Purpose Printer/Fax/Scanner, Model KCA_018823 Fingerprint Pitney Bowes photocopier, Konica printer/fax/scanner, or Toshiba E-Studio16 printer Class Pitney Bowes | embedded || printer Class Konica Minolta | embedded || printer Class Toshiba | embedded || printer T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # switch planet-fgsw-2620vs http://www.planet.com.tw/news/productnews/FGSW-2620VS.htm Fingerprint Planet FGSW-2620VS switch Class Planet | embedded || switch TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Planet WAP 1950 Wireless Access Point Class Planet | embedded || WAP TSeq(Class=TD%gcd=<1C%SI=<14%IPID=I%TS=U) T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Polycom Video Conference node Class Polycom | embedded || webcam TSeq(Class=C%Val=8B6A000%IPID=I%TS=U) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Polycom ViewStation Class Polycom | embedded || webcam TSeq(Class=C) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Polycom ViewStation 512K videoconferencing system Class Polycom | embedded || webcam TSeq(Class=C) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|80%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Polycom ViewStation video-conferencing system (firmware v7.2) Class Polycom | embedded || webcam TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint PowerShow NetworKam webcam Class PowerShow | embedded || webcam TSeq(Class=TD%gcd=<194%SI=<14%IPID=I%TS=U) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Proteon OpenRoute 3.0 gt series router Class Proteon | OpenRoute || router TSeq(Class=TD%gcd=1%SI=0) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Proxim Stratum MP FW: 7_8_18; managed via HTTP and only relevant data is (I guess) the firmware version: FW: 7_8_18 Fingerprint Proxim Stratum MP Wireless bridge Class Proxim | embedded || bridge TSeq(Class=TD%gcd=<61AC%SI=<46%IPID=I%TS=1000HZ) T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Proxim 8571 802.11a Access Point Software Version: 2.0-B11 : Aug 12 2002 11:08:16 Fingerprint Proxim 8571 802.11a Access Point Class Proxim | embedded || WAP TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U) T1(DF=N%W=1770%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1770%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint QMS Magicolor 2200 DeskLaser printer Class QMS | embedded || printer T1(DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint QNX 4.24 - 4.25 realtime embedded OS Class QNX | QNX || general purpose TSeq(Class=64K) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint QNX 6.00 realtime embedded OS (x86) Class QNX | QNX || general purpose TSeq(Class=TD%gcd=<7D4%SI=<8C%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) # QNX 6.00 2000/10/17-14:59:25edt x86pc x86 Fingerprint QNX 6.00 realtime embedded OS (x86) Class QNX | QNX || general purpose TSeq(Class=TD%gcd=<4AB54%SI=<82%IPID=I%TS=U) T1(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=N) T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00|1000|800%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) # Quanterra OS/9 V2.4 on 68K (Quanterra Q4124 - 68030) Fingerprint Quanterra seismic data acquisition system running OS/9 V2.4 on 68K Class Quanterra | OS/9 || specialized TSeq(Class=i800) T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=) T4(DF=N%W=C000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Quantum Snap server 4100 Class Quantum | embedded || storage-misc TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2238%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Quantum Snap Server Network Storage Box Class Quantum | embedded || storage-misc TSeq(Class=i800) T1(Resp=Y%DF=N%W=4470%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4470%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=4470%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Racal 7100 Host Security Module 1.05 / 5.05 Class Racal | embedded || encryption accelerator TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Radware Content Inspection Director v2.10.03 Class Radware | embedded || security-misc TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Raptor firewall 5.03 on NT 4 Class Raptor | embedded || firewall TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=N) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Raptor Firewall 6 on Solaris 2.6 Class Raptor | Solaris | 2.X | firewall TSeq(Class=RI%gcd=<6%SI=24B0) T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1538M HUB running Cisco 1538M EES (1.00.00) or Assured Access Technology ISAS Switch Release-2.3.0 or Thomson Multimedia RCA DCM245 Cable Modem Class RCA | embedded || broadband router Class Cisco | embedded || hub TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint RCA/Thomson cable modem DCM-235/245 Class RCA | embedded || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Redback SMS 1800 router Class Redback | AOS || router TSeq(Class=RI%gcd=<6%SI=<4CA7C&>C2F) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Redback SMS 1800 router AOS Release 5.0.3.8 # Redback Networks SMS 10000 AOS 6.0.5.0 # Thomson TMC 390 cable modem Fingerprint Redback SMS 1800/10000 router or Thomson TMC 390 cable modem Class Redback | AOS || router Class Thomson | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<7B6BA&>BA7%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Redback SMS500 Redback Networks AOS Release 5.0.4.0 PRODUCTION RELEASE # Redback Networks AOS Release 5.0.3.8 PRODUCTION MAINTENANCE RELEASE Fingerprint Redback SMS500 Redback Networks router AOS Release 5.0.3.8 - 5.0.4.0 Class Redback | AOS || router TSeq(Class=RI%gcd=<6%SI=<56DF6&>337%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|E|F%UCK=0|F%ULEN=134%DAT=E) Fingerprint Redback SMS 1000-2000 DSL Router Class Redback | embedded || broadband router TSeq(Class=RI%gcd=<4%SI=>1000&1BB%IPID=RD%TS=U) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # RiverStone RS3000 System Software version 9.1.2.5 Fingerprint RiverStone RS3000 router Class RiverStone | embedded || router TSeq(Class=RI%gcd=<6%SI=<60158&>7CD%IPID=I%TS=2HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=400|1000|800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint RoadLanner Broadband router BRL-04FW 6.15.02r Build 0091 L:01 Class RoadLanner | embedded || broadband router TSeq(Class=TD%gcd=<6E004%SI=<14%IPID=I%TS=1000HZ) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Rockwell Spectrum 100 POTS switcher release 7.2 Class Rockwell | embedded || telecom-misc TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Ricoh Aficio 270 copier Ver. 1.4.9, Network Interface Board Ver. 4.0.7 (ELAND__99) Fingerprint Savin 9927 Copier or Ricoh Aficio 270 copier Class Savin | embedded || printer Class Ricoh | embedded || printer TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=2000%ACK=O%Flags=UR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=1C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Scientific Atlanta Explorer 4200 - Digital Cable Box Fingerprint Scientific Atlanta Explorer 4200 Digital Cable Box Class Scientific Atlanta | embedded || media device TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=68%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Scientific Atlanta PowerVu Program Receiver Model D9850/9010, Version: 1.51 2004-02-06 14:45:06 Fingerprint Scientific Atlanta PowerVu Program Receiver Model D9850/9010 Class Scientific Atlanta | embedded || media device TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ) T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO OpenServer 5.0.5 Class SCO | OpenServer || general purpose TSeq(Class=RI%gcd=<5%SI=>FFFF) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO OpenServer 5.0.7 Class SCO | OpenServer || general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=832C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=8058%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO OpenServer Release 5 Class SCO | OpenServer || general purpose TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO OpenServer Release 5 Class SCO | OpenServer || general purpose TSeq(Class=RI%gcd=<6%SI=<34A71A&>86B6) T1(DF=N%W=1000|6000|111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SCO Open Desktop ( Same as SCO UNIX?) Fingerprint SCO Open Desktop 2.0 Class SCO | SCO UNIX || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint SCO UNIX release 3.2 Class SCO | SCO UNIX || general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint SCO UnixWare 2.01 Class SCO | UnixWare || general purpose TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 2.1 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) # SCO UnixWare 2.1 LiveScan Fingerprint Server Fingerprint SCO UnixWare 2.1 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=<6D77C0&>B174%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 2.1.2 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 7.0.0 or OpenServer 5.0.4-5.0.6 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=FFFF) T1(W=60F4%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=) T4(W=0%ACK=O%Flags=R%Ops=) T5(W=0%ACK=S++%Flags=AR%Ops=) T6(W=0%ACK=O%Flags=R%Ops=) T7(W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 7.1.0 - 7.1.1 (x86) Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=<403094&>8C71%IPID=I%TS=100HZ) T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 7.1.0 x86 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=<442BB8&>AE70) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # UnixWare 7.1.1 i386 x86at SCO UNIX_SVR5 Fingerprint SCO UnixWare 7.1.1 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=<874330&>B9D5%IPID=I%TS=U) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=) T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Secure Computing SECUREZone Firewall Version 2.0 Class Secure Computing | embedded || firewall TSeq(Class=TR%gcd=<6) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Secure Computing Sidewinder firewall 3.2 update 4 Class Secure Computing | embedded || firewall TSeq(Class=RI%gcd=<5%SI=>FFF&23) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Sequent DYNIX/ptx 4.4.6 x86 Class Sequent | DYNIX || general purpose TSeq(Class=RI%gcd=<6%SI=<2E4AA&>752%IPID=I%TS=U) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Sequent DYNIX/ptx V4.2.1 Class Sequent | embedded || general purpose TSeq(Class=RI%gcd=FF&8%IPID=I%TS=2HZ) T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SGI IRIX 6.5.14, SGI O2 # SGI IRIX 6.5 IP32 Fingerprint SGI IRIX 6.5.14 Class SGI | IRIX | 6.X | general purpose TSeq(Class=RI%gcd=257%IPID=I%TS=2HZ) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint SGI IRIX 6.5.15m on SGI O2 Class SGI | IRIX | 6.X | general purpose TSeq(Class=TD%gcd=<104%SI=<1AE%IPID=I%TS=2HZ) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint SGI IRIX 6.5.16m Class SGI | IRIX | 6.X | general purpose TSeq(Class=RI|i800%gcd=<144%SI=<712%IPID=RPI%TS=2HZ) T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IRIX 6.5 6.5.20m IP32 Fingerprint SGI IRIX 6.5.20m Class SGI | IRIX | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SGI Indigo2 R10000 running IRIX64 6.5.20m Fingerprint SGI IRIX 6.5.20m Class SGI | IRIX | 6.X | general purpose TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=N) T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.5.25 Class SGI | IRIX | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.5.7f-6.5.8f Class SGI | IRIX | 6.X | general purpose TSeq(Class=64K) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # SGI O2 running SGI IRIX 6.5.7f Fingerprint SGI IRIX 6.5.7f-6.5.8f Class SGI | IRIX | 6.X | general purpose TSeq(Class=64K) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Sharp DIGITAL Imager (copier) AR-507 Class Sharp | embedded || printer T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sharp Network Printer AR-337 Class Sharp | embedded || printer T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Shiva AccessPort Bridge/Router Software V 2.1.0 # 3Com HiPer Access Router Card hardware 1.0.0 software 4.1.59 Fingerprint Shiva AccessPort Bridge/Router Software V 2.1.0 or 3Com HiPer Access Router Card hardware V1.0.0 software V4.1.59 Class Shiva | embedded || router Class 3Com | embedded || router TSeq(Class=TD%gcd=<6%SI=8E%IPID=I%TS=U) T1(DF=N%W=1FFE%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=1FFE%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=1FFE%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens Speedstream 2602 DSL/Cable router Class Siemens | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<22E601A&>31AA1%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Siemens HICOM 300 Phone switch (PBX) (WAML LAN card) Fingerprint Siemens HICOM 300 Phone switch (PBX) Class Siemens | embedded || PBX TSeq(Class=64K) T1(DF=N%W=808%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=808%ACK=O%Flags=A%Ops=) T4(DF=N%W=808%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Siemens HICOM Phone switch (PBX) Class Siemens | embedded || PBX TSeq(Class=RI%gcd=4EB3%IPID=I%TS=100HZ) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens HiPATH3500 VoIP PBX Class Siemens | embedded || PBX TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Siemens S7-400 PLC CPU-416-2 Fingerprint Siemens S7-400 programmable logic controller Class Siemens | embedded || specialized TSeq(Class=RI%gcd=<6%SI=<583DCAE&>977AD%IPID=I%TS=U) T1(DF=N%W=230%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=230%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Siemens HiCom 300E business phone system Release 6.5 Class Siemens | embedded || VoIP phone TSeq(Class=RI%gcd=<6%SI=<5D131C&>4A3C%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint ReliantUNIX-Y 5.44 B0033 RM600 1/256 R10000 Class Siemens | ReliantUNIX || general purpose TSeq(Class=64K) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Reliant UNIX 5.45B20 running on an RM400 (Siemens stuff) Fingerprint Siemens Reliant UNIX 5.45B20 Class Siemens | ReliantUNIX || general purpose TSeq(Class=RI%gcd=<6%SI=100C%IPID=I%TS=2HZ) T1(DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Siemens RM200-C40 running ReliantUNIX-N 5.45 Class Siemens | ReliantUNIX || general purpose TSeq(Class=RI%gcd=<6%SI=<7DF64&>AAA%IPID=I%TS=2HZ) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Siemens SINIX-N 5.41C0005 Class Siemens | SINIX || general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=0%ULEN=134%DAT=E) Fingerprint Siemens SINIX-N 5.43C3002 Class Siemens | SINIX || general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=NW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=NW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens SINIX-Y 5.43B0045 Class Siemens | SINIX || general purpose TSeq(Class=64K) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens SINIX-Y 5.43C4001 Class Siemens | SINIX || general purpose TSeq(Class=RI%gcd=<6%SI=<26E76&>625) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW) T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Sipura SPA-2000 VoIP Firmware version 2.09d # SPA-841 VoIP Phone (SIP) with firmware 0.9.5 # Sipura SPA SPA-1000 Software Version: 1.0.33 Hardware Version: 2.0.1 # Sipura SPA-2000 VoIP Adapter # Sipura SPA-2000 Software Version: 2.0.10(d) IP Phone Adaptor # Sipura SPA-3000, firmware 2.0.13(GWg) Fingerprint Sipura SPA-841/1000/2000/3000 POTS<->VoIP gateway Class Sipura | embedded || VoIP adapter TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SMC Barricade SMC7004VR2.0EU DSL-Router Firmware R1.02-DDNS Fingerprint SMC Barricade SMC7004VR2.0EU DSL router Class SMC | embedded || broadband router TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) T1(DF=N%W=16D0%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Panasonic KX-HCM10 network camera # SMC EZConnect Wireless Access Point SMC2655W V.2 Fingerprint Panasonic network camera or SMC WAP Class SMC | embedded || WAP Class Panasonic | embedded || webcam TSeq(Class=TD%gcd=474%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Softek Digi One RealPort serial device server # Digi One SP Serial to Ethernet Converter Version 82000774_E 06/13/2003 Fingerprint Softek Digi One serial device server Class Softek | embedded || specialized T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=8E%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SonicWALL Pro 200 Firmware Version 6.4.2.0 Fingerprint SonicWALL Pro 200 firewall Class SonicWALL | embedded || firewall TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N|Y%W=0|402E%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=0|402E%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT) T4(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=) # SonicWALL 4060 firewall running SonicOS Enhaced 2.5 Fingerprint SonicWALL 4060 firewall Class SonicWALL | SonicOS || firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # base on msg 2615 # PRO 3060 Standard SonicOS Standard 3.1.0.1-60s Fingerprint SonicWALL PRO 3060 firewall Class SonicWALL | SonicOS || firewall TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Cisco 350 Access Point, software rev 12.02T1 # Accelerated Networks VoDSL - But what sort of device? Fingerprint SonicWALL SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL, or Cisco 350 Access Point Class SonicWALL | SonicOS || firewall Class Enterasys | embedded || switch Class Cisco | embedded || WAP TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint SonicWALL SOHO-3 firewall Class SonicWALL | SonicOS || firewall T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SonicWALL SOHO-3 firewall Class SonicWALL | SonicOS || firewall TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # SonicWALL SOHO3 (CPU: Toshiba 3927 H2 / 133 Mhz) Firmware version: 6.6.0.6 ROM version: 6.2.0.0 Fingerprint SonicWALL SOHO3 firewall Class SonicWALL | SonicOS || firewall TSeq(Class=RI%gcd=<6%SI=<708FA&>904%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # SonicWALL TZ 170 SonicOS 2.5.0.2 Enhanced Fingerprint SonicWALL TZ 170 firewall Class SonicWALL | SonicOS || firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SonicWALL TZ 170 firewall Class SonicWALL | SonicOS || firewall TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # SonicWALL TZ170 Firewall with SonicOS # SonicWALL FZ170 Unrestricted (firewall/VPN appliances) with SonicOS 2.6 # SonicOS 3.0.0.4-41s on SonicWALL TZ 170 Fingerprint SonicWALL TZ 170 firewall Class SonicWALL | SonicOS || firewall TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint SonicWALL/10 firewall Class SonicWALL | SonicOS || firewall TSeq(Class=TR) T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=7FE0|7FDF%ACK=O|S++%Flags=A|ASF%Ops=ME) T4(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SonicWALL/10 firewall Class SonicWALL | SonicOS || firewall TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Sony AIBO ERS-7 running AIBO Mind 2 Class Sony | embedded || robotic pet TSeq(Class=TR|TD%gcd=<186A4%SI=<64%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint PS2 Linux 1.0 on Sony PS2 game console Class Sony | Linux || game console TSeq(Class=RI%gcd=<6%SI=<20E2FE8&>5428C%IPID=I%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNT) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) # This appears to be used by game developers to test performance. Fingerprint Sony PlayStation 2 Performance Analyser Class Sony | Linux || specialized TSeq(Class=RI%gcd=<6%SI=<18EC23A&>3FCBC%IPID=I%TS=100HZ) T1(DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sony NewsOS 6.1.2 Class Sony | NewsOS || general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Sony Ericsson P800 mobile phone, Symbian OS v7.0 Class Sony | Symbian || phone TSeq(Class=RI%gcd=<8%SI=<31996C&>200D%IPID=I) T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL) T2(Resp=N) T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Soyo G668 VoIP phone Class Soyo | embedded || VoIP phone TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=514%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) # speedstream router 5871 v4.0.1 Fingerprint Speedstream 5871 DSL router Class SpeedStream | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Spirent AX4000 Network Testing Tool Class Spirent | embedded || specialized TSeq(Class=RI%gcd=<6%SI=<761F6&>E8E%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint StackTools StackTos 1.0 embedded networking OS Class StackTools | StackTos || general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=A8%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint StackTos 2.1 Class StackTools | StackTos || general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Stratus VOS Release 14.3.1ae Class Stratus | VOS || general purpose T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) # Sun StorEdge T3 / Sun StorEdge T3B, Workgroup Storage Array Fingerprint Sun StorEdge T3 Storage Array Class Sun | embedded || storage-misc TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 5.10.1 Class Sun | Solaris | 10 | general purpose TSeq(Class=RI%gcd=<6%SI=<1C36BAC&>4838E%IPID=RPI%TS=U) T1(DF=Y%W=C0B7%ACK=O|S++%Flags=A|AS%Ops=NNT|NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SunOS 5.10 Generic sun4u sparc SUNW,Sun-Fire-V250 Fingerprint SunOS 5.10 (sparc) Class Sun | Solaris | 10 | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SunOS webbox 5.10 Generic i86pc i386 i86pc Fingerprint SunOS webbox 5.10 Generic Class Sun | Solaris | 10 | general purpose TSeq(Class=RI%gcd=<6%SI=D98%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.3 - 2.4 Class Sun | Solaris | 2.X | general purpose TSeq(Class=64K) T1(DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.4 w/most Sun patches (jumbo cluster patch, security patches, etc) Class Sun | Solaris | 2.X | general purpose TSeq(Class=64K) T1(DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.5, 2.5.1 Class Sun | Solaris | 2.X | general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y|N%W=2229|2332|4452|FFAF|8377|8EDA|879B%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 Class Sun | Solaris | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<512B6&>CE8) T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=NNTME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # SunOS dabox 5.6 Generic_105181-30 sun4u sparc SUNW,Ultra-Enterprise Fingerprint Sun Solaris 2.6 (SPARC) Class Sun | Solaris | 2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=0 Class Sun | Solaris | 2.X | general purpose Class Sun | Solaris | 7 | general purpose TSeq(Class=64K) T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=2 Class Sun | Solaris | 2.X | general purpose Class Sun | Solaris | 7 | general purpose TSeq(Class=TR%IPID=I%TS=100HZ) T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 7 x86 Class Sun | Solaris | 2.X | general purpose Class Sun | Solaris | 7 | general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y%W=2491|462B%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 8 (SPARC) Class Sun | Solaris | 2.X | general purpose Class Sun | Solaris | 7 | general purpose Class Sun | Solaris | 8 | general purpose TSeq(Class=RI%gcd=<6%SI=<57A26&>DF1) T1(DF=Y|N%W=109|212|2297|2788|4431|8371|8F4D|ABCD|FFF7|FFFF|2297%ACK=S++%Flags=AS%Ops=NNTNWME) T2(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T3(Resp=N) T4(DF=Y|N%W=0%ACK=O%Flags=R%Ops=|WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y|N%W=0%ACK=O|S%Flags=AR|R%Ops=|WNMETL) T7(DF=Y|N%W=0%ACK=S|O%Flags=AR|R%Ops=|WNMETL) PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=F|E%ULEN=134%DAT=E) # Sun Solaris 8 // Sun Fire 80080 Fingerprint Sun Solaris 8 Class Sun | Solaris | 8 | general purpose TSeq(Class=RI|TR%gcd=<8%SI=E0F%IPID=I%TS=100HZ) T1(DF=Y%W=5B4|60DA|801B|807A|B68%ACK=S++%Flags=AS%Ops=NNTNWM|NNTM) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Sun Solaris 8 Class Sun | Solaris | 8 | general purpose TSeq(Class=RI%gcd=<8%SI=<7FA08&>620%IPID=I%TS=U) T1(DF=Y%W=6050%ACK=S++%Flags=AS%Ops=NWM) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Sun Solaris 8 Class Sun | Solaris | 8 | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=N) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Sun Netra T1 - SunOS 5.8 Generic_108528-24 sun4u sparc SUNW,UltraAX-i2 # SunOS 5.8 Generic 117000-03, sun4u+sparc SUNW,UltraAX-i2 Fingerprint Sun Solaris 8 Class Sun | Solaris | 8 | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=60DA%ACK=S++%Flags=AS|A%Ops=NNTNWM|NNT) T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SunOS 5.8 Generic_108528-05 sun4u sparc SUNW,Ultra-5_10 # SunOS fenix 5.8 Generic_117350-22 sun4u sparc SUNW,Sun-Fire-880 Fingerprint Sun Solaris 8 Class Sun | Solaris | 8 | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=Y%DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|400|800%ACK=S%Flags=AR%Ops=WNMETL) PU(Resp=N) # SunOS 5.8 Generic_108528-16 sun4u sparc SUNW,Ultra-5_10 Fingerprint Sun Solaris 8 Class Sun | Solaris | 8 | general purpose TSeq(Class=RI%gcd=<6%SI=10B4%IPID=I%TS=100HZ) T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=N) T3(Resp=N) T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Trusted Solaris 8 - SunOS SunRayServer 5.8 TS8 sun4u sparc SUNW,Ultra-60 Fingerprint Sun Trusted Solaris 8 Class Sun | Solaris | 8 | general purpose TSeq(Class=RI%gcd=<8%SI=109A%IPID=I%TS=100HZ) T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=138%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SunOS 5.9 Generic_117171-11 sun4u sparc SUNW,Sun-Fire-480R Fingerprint Sun Solaris 9 Class Sun | Solaris | 9 | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=R%Ops=WNMETL) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # SunOS 5.9 Generic_117171-02 sun4u sparc SUNW,Sun-Fire-V440 SPARC # SunOS 5.9 Generic_117171-17 sun4u sparc SUNW,Sun-Fire-V440 Fingerprint Sun Solaris 9 Class Sun | Solaris | 9 | general purpose TSeq(Class=RI%gcd=<6%SI=<2B77E4&>160F%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=Y%DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Solaris 9 on a V120 Fingerprint Sun Solaris 9 Class Sun | Solaris | 9 | general purpose TSeq(Class=RI%gcd=<8%SI=<9501A&>68E%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Sun Solaris 9 Beta through Release on SPARC # solaris 9 i386 # Solaris 9 4/04 version (SPARC) # Solaris 10 Fingerprint Sun Solaris 9 or 10 Class Sun | Solaris | 9 | general purpose Class Sun | Solaris | 10 | general purpose TSeq(Class=RI%gcd=<6%SI=116A%IPID=I%TS=100HZ) T1(DF=Y%W=5B4|C0B7|801B|807A%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Sun Solaris 9 with TCP_STRONG_ISS set to 2 Class Sun | Solaris | 9 | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=N|Y%W=C0B7|8000|807A%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun RSC (Remote System Control card) v1.14 (in Solaris 2.7) Class Sun | SunOS || general purpose T1(DF=N%W=2000%ACK=S++|O%Flags=ARS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Sun SunOS 4.0.3 Class Sun | SunOS || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Sun SunOS 4.1.1 - 4.1.4 (or derivative), or GatorBox CS LocalTalk/Ethernet bridge # GatorBox CS LocalTalk/Ethernet bridge running GatorShare version 3.0.3 (build X4) software Fingerprint Sun SunOS 4.1.1 - 4.1.4 (or derivative) Class Sun | SunOS || general purpose Class Gatorbox | GatorShare || bridge TSeq(Class=64K) T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E) Fingerprint Sun SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI Class Sun | SunOS || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Swissvoice IP 10S VoIP phone Class Swissvoice | embedded || VoIP phone TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Symantec SGS 5310 Firewall Fingerprint Symantec Gateway Security 5310 Firewall Class Symantec | embedded || firewall TSeq(Class=TR%gcd=<6%TS=U) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(Resp=N) # Symantec Gateway Security model 5420 (Iwill mobo) Fingerprint Symantec Gateway Security 5420 firewall Class Symantec | embedded || firewall TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Symantec Enterprise Firewall v7.0.4 (on Solaris 8) Class Symantec | Solaris | 8 | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) Fingerprint Symantec Enterprise Firewall 7.0 running on Windows 2000 SP2 Class Symantec | Windows | NT/2K/XP | firewall TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(Resp=N) Fingerprint Symbol/Spectrum24 Wireless AP Class Symbol | embedded || WAP TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # http://www.systech.com/catalog/RCS3000Entry.html # RCS/3182 - Firmware rev. 06D (Apr 26 2001 15:15:33) - OS ver. RCS_3000_BDNL Version 06F (May 18 2001 16:15:18) Fingerprint Systech RCS/3182 Ethernet serial port server (firmware 06D) Class Systech | embedded || specialized TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFC%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Tahoe OS 1.2.1 running on Tahoe router Class Tahoe | Tahoe OS || router TSeq(Class=RI%gcd=<8%SI=6430%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Tainet WANpro 2000i Broadband router Class Tainet | embedded || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Talaris 1794 Printstation, firmware version 4.3.2, released 6/21/93 Fingerprint Talaris 1794 Printstation Class Talaris | embedded || printer TSeq(Class=RI%gcd=<6%SI=<4010&>8F%IPID=BI%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Tally 9112 Printer Class Tally | embedded || printer TSeq(Class=TD%gcd=B05%IPID=I%TS=U) T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # From a Tektronix Phaser 350 # Tektronix Phaser printer with shared Ethernet card, firmware version 3.01 Fingerprint Tektronix Phaser printer Class Tektronix | embedded || printer TSeq(Class=RI%gcd=888&<4444) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|1000%ACK=S++|O%Flags=AR|AS%Ops=|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Tektronix Phaser 860 Printer # Tektronix Phaser 840 Fingerprint Tektronix Phaser printer Class Tektronix | embedded || printer T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Tektronix Phaser 360 Extended # Tektronix Phaser 750 Fingerprint Tektronix/Xerox Phaser printer Class Tektronix | embedded || printer TSeq(Class=i800) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Telebit NetBlazer router version 3.0 Class Telebit | embedded || router TSeq(Class=TD%gcd=<100004%SI=<3C) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Telebit NetBlazer router Version 3.05 Class Telebit | embedded || router TSeq(Class=TD%gcd=40000|80000|C0000%SI=78B67%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Treck Inc. TCP/IP stack (v2.1) on Orbacom T5 System Manager card (CPC-CAD) Fingerprint Treck TCP/IP stack v2.1 Class Treck | Treck || general purpose TSeq(Class=TD%gcd=<3D094%SI=3F1C4%IPID=Z%TS=100HZ) T1(DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint WTI Internet Power Switch 1.01 Class WTI | embedded || power-device TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(Resp=N) Fingerprint WTI Network Power Switch v3.02 Class WTI | embedded || power-device TSeq(Class=TD%gcd=<2A%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Wyse Winterm System Version 4.2.077 Class Wyse | Wyse OS || terminal server TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=F000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # WYSE OS Firmware V4.2.137 Fingerprint Wyse Winterm terminal server Class Wyse | Wyse OS || terminal server TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=7800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7800%ACK=O%Flags=A%Ops=) T4(DF=N%W=7800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint XCD Xconnect Print Server, firmware version CC8S-3.58 (98.09.21) Class XCD | embedded || print server TSeq(Class=TD%gcd=<272A%SI=<1E) T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Dell Laser Printer 5100cn Class Xerox | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=4E4%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Xerox 8830 Plotter Class Xerox | embedded || printer TSeq(Class=TD%gcd=1000%SI=1) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Xerox Document Centre 440 w/ CentreWare Internet Services Class Xerox | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Xerox Document Centre ColorSeries 50 Class Xerox | embedded || printer TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Xerox DocuPrint C55 Class Xerox | embedded || printer TSeq(Class=TD%gcd=1000|2000|3000|4000%SI=