?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge pull request #56 from wuruilong01/master
[prads.git] / etc / tcp-synack.fp
blobe566f4256e5f1798be7931ad3221f8d887c5ae4e
1 #
2 # p0f - SYN+ACK fingerprints
3 # --------------------------
4 #
5 # .-------------------------------------------------------------------------.
6 # | The purpose of this file is to cover signatures for outgoing TCP/IP |
7 # | connections (SYN+ACK packets). This mode of operation can be enabled |
8 # | with -A option. Please refer to p0f.fp for information on the metrics |
9 # | used to create a signature, and for a guide on adding new entries to |
10 # | those files. This database is somewhat neglected, and is looking for a |
11 # | caring maintainer. |
12 # `-------------------------------------------------------------------------'
13 #
14 # (C) Copyright 2000-2006 by Michal Zalewski <lcamtuf@coredump.cx>
15 #
16 # Plenty of signatures contributed in bulk by rain forest puppy, Paul Woo and
17 # Michael Bauer.
18 #
19 # Submit all additions to the authors. Read p0f.fp before adding any
20 # signatures. Run p0f -A -C after making any modifications. This file is
21 # NOT compatible with SYN, RST+, or stray ACK modes. Use only with -A option.
22 #
23 # Feel like contributing? You can run p0f -A -K, then test/tryid -iR nnn...
24 #
25 # IMPORTANT INFORMATION ABOUT THE INTERDEPENDENCY OF SYNs AND SYN+ACKs
26 # --------------------------------------------------------------------
27 #
28 # Some systems would have different SYN+ACK fingerprints depending on
29 # the system that sent SYN. More specifically, RFC1323, RFC2018 and
30 # RFC1644 extensions sometimes show up only if SYN had them enabled.
31 #
32 # Also, some silly systems may copy WSS from the SYN packet you've sent,
33 # in which case, you need to wildcard the value. Use test/sendsyn.c, which
34 # uses a distinct WSS of 12345, to test for this condition if unsure.
35 #
36 # IMPORTANT INFORMATION ABOUT DIFFERENCES IN COMPARISON TO p0f.fp:
37 # ----------------------------------------------------------------
38 #
39 # - 'A' quirk would be present on almost every signature here. ACK number
40 # is unusual for SYN packets, but is a commonplace in SYN+ACK packets,
41 # of course. It is still possible to have a signature without 'A', when
42 # the ACK flag is present but the value is zero - this, however, is
43 # very uncommon.
44 #
45 # - 'T' quirk would show up on almost all signatures for systems implementing
46 # RFC1323. The second timestamp is only unusual for SYN packets. SYN+ACK
47 # are expected to have it set.
48 #
49
50 ##########################
51 # Standard OS signatures #
52 ##########################
53
54 # ---------------- Linux -------------------
55
56 32736:64:0:44:M*:A:Linux:2.0
57 S22:64:1:60:M*,S,T,N,W0:AT:Linux:2.2
58 S22:64:1:52:M*,N,N,S,N,W0:A:Linux:2.2 w/o timestamps
59
60 5792:64:1:60:M*,S,T,N,W0:AT:Linux:older 2.4
61 5792:64:1:60:M*,S,T,N,W0:ZAT:Linux:recent 2.4 (1)
62 S4:64:1:44:M*:ZA:Linux:recent 2.4 (2)
63 5792:64:1:44:M*:ZA:Linux:recent 2.4 (3)
64
65 S4:64:1:52:M*,N,N,S,N,W0:ZA:Linux:2.6 or 2.4 w/o timestamps
66
67 # SYNACK response when Linux talk to Linux
68 #5792:64:1:60:M*,S,T,N,W*:ZA:Linux:2.6 (Generic:SYN from Linux)
69 5792:64:1:60:M*,S,T,N,W0:ZAT:Linux:2.6 (newer, 0)
70 5792:64:1:60:M*,S,T,N,W1:ZAT:Linux:2.6 (newer, 1)
71 5792:64:1:60:M*,S,T,N,W2:ZAT:Linux:2.6 (newer, 2)
72 5792:64:1:60:M*,S,T,N,W2:ZAT!:Linux:2.6 (arm, newer2)
73 5712:64:1:40:M*,S,T,N,W2:ZAT:Linux:2.6 (newer, 2) IPv6
74 5792:64:1:60:M*,S,T,N,W3:ZAT:Linux:2.6 (newer, 3)
75 5712:64:1:40:M*,S,T,N,W3:ZAT:Linux:2.6 (newer, 3) IPv6
76 5792:64:1:60:M*,S,T,N,W4:ZAT:Linux:2.6 (newer, 4)
77 5712:64:1:40:M*,S,T,N,W4:ZAT:Linux:2.6 (newer, 4) IPv6
78 5792:64:1:60:M*,S,T,N,W5:ZAT:Linux:2.6 (newer, 5)
79 5712:64:1:40:M*,S,T,N,W5:ZAT:Linux:2.6 (newer, 5) IPv6
80 5792:64:1:60:M*,S,T,N,W6:ZAT:Linux:2.6 (newer, 6)
81 5696:64:1:60:S,T,M*,N,W6:ZAT:Linux:2.6 (newer, 6) IPSec
82 5712:64:1:40:M*,S,T,N,W6:ZAT:Linux:2.6 (newer, 6) IPv6
83 5792:64:1:60:M*,S,T,N,W7:ZAT:Linux:2.6 (newer, 7)
84 5712:64:1:40:M*,S,T,N,W7:ZAT:Linux:2.6 (newer, 7) IPv6
85 5792:64:0:60:M*,S,T,N,W7:ZAT:Linux:2.6 (newer, 7)
86 5792:64:1:60:M*,S,T,N,W8:ZAT:Linux:2.6 (newer, 8)
87 5712:64:1:40:M*,S,T,N,W8:ZAT:Linux:2.6 (newer, 8) IPv6
88 5792:64:1:60:M*,S,T,N,W9:ZAT:Linux:2.6 (newer, 9)
89 5712:64:1:40:M*,S,T,N,W9:ZAT:Linux:2.6 (newer, 9) IPv6
90 5792:128:1:60:M*,S,T,N,W9:ZAT:Linux:2.6 (newer, 10)
91
92 # Different response when Windows talk to Linux:
93 #S4:64:1:52:M*,N,N,S,N,W*:ZA:Linux:2.6 (Generic:SYN from Windows)
94 #S4:64:1:52:M*,N,N,S,N,W0:ZA:Linux:2.6 (newer, 0)
95 S4:64:1:52:M*,N,N,S,N,W1:ZA:Linux:2.6 (newer, 1)
96 S4:64:1:52:M*,N,N,S,N,W2:ZA:Linux:2.6 (newer, 2)
97 S4:64:1:52:M*,N,N,S,N,W3:ZA:Linux:2.6 (newer, 3)
98 S4:64:1:52:M*,N,N,S,N,W4:ZA:Linux:2.6 (newer, 4)
99 S4:64:1:52:M*,N,N,S,N,W5:ZA:Linux:2.6 (newer, 5)
100 S4:64:1:52:M*,N,N,S,N,W6:ZA:Linux:2.6 (newer, 6)
101 S4:64:1:52:M*,N,N,S,N,W7:ZA:Linux:2.6 (newer, 7)
102 S4:64:1:52:M*,N,N,S,N,W8:ZA:Linux:2.6 (newer, 8)
103 S4:64:1:52:M*,N,N,S,N,W9:ZA:Linux:2.6 (newer, 9)
104
105 # Different response when FreeBSD talk to Linux
106 #5792:64:1:60:M*,N,N,T,N,W*:ZA:Linux:2.6 (Generic:SYN from FreeBSD)
107 5792:64:1:60:M*,N,N,T,N,W0:ZAT:Linux:2.6 (newer, 0)
108 5792:64:1:60:M*,N,N,T,N,W1:ZAT:Linux:2.6 (newer, 1)
109 5792:64:1:60:M*,N,N,T,N,W2:ZAT:Linux:2.6 (newer, 2)
110 5792:64:1:60:M*,N,N,T,N,W3:ZAT:Linux:2.6 (newer, 3)
111 5792:64:1:60:M*,N,N,T,N,W4:ZAT:Linux:2.6 (newer, 4)
112 5792:64:1:60:M*,N,N,T,N,W5:ZAT:Linux:2.6 (newer, 5)
113 5792:64:1:60:M*,N,N,T,N,W6:ZAT:Linux:2.6 (newer, 6)
114 5792:64:1:60:M*,N,N,T,N,W7:ZAT:Linux:2.6 (newer, 7)
115 5792:64:1:60:M*,N,N,T,N,W8:ZAT:Linux:2.6 (newer, 8)
116 5792:64:1:60:M*,N,N,T,N,W9:ZAT:Linux:2.6 (newer, 9)
117
118 # Different response when *Unknown* connects:
119 S4:64:1:48:M1460,N,N,S:ZA:Linux:2.6 (Generic 2, SYN from Windows)
120 S4:64:1:48:M1460,N,W6:ZA:Linux:2.6 (newer, 6, SYN from HP-UX/11.11)
121 S4:64:1:48:M1460,N,W7:ZA:Linux:2.6 (newer, 7, SYN from Unknown, HP-UX?)
122 5672:64:0:60:M1430,S,T,N,W6:AT:Linux:2.6 (Google)
123 5392:64:1:60:M*,S,T,N,W9:ZAT:Linux:2.6 (Google mini)
124 5792:64:1:56:M1460,S,T:ZAT:Linux:2.6 (Syn from Unknown)
125 5792:64:1:60:M1460,S,T,N,W5:ZA:Linux:2.6 (newer, 5,SYN from Unknown)
126
127 # Red Hat rhel 4uX
128 # 2.6.9-55.ELsmp
129 5776:64:1:56:M*,S,T:ZAT:Linux:2.6.9 (rhel4)
130 # 2.6.9-34.ELsmp
131 5792:64:1:56:M*,S,T:ZAT:Linux:2.6.9 (rhel4)
132 # Red Hat rhel 5uX
133 # 2.6.18-164.15.1.el5
134 5792:60:1:56:M*,N,N,T:ZAT:Linux:2.6.18 (rhel5)
135
136 # Astaro Security Gateway v7.xxx
137 5792:64:1:56:M*,S,T:ZAT:Linux:2.6 (ASG 7)
138
139 # --------------- Windows ------------------
140
141 8192:64:1:60:M1460,N,W0,N,N,T:AT:Windows:NT 4.0 (Embedded)
142 6384:64:1:60:M1460,N,W0,N,N,T:AT:Windows:NT 4.0 (Embedded)
143 65535:128:1:64:M*,N,W0,N,N,T0,N,N,S:A:Windows:2000 SP4
144 S44:128:1:64:M*,N,W0,N,N,T0,N,N,S:A:Windows:XP SP1
145 S12:128:1:64:M*,N,W0,N,N,T0,N,N,S:A:Windows:2000 (SP1+)
146 17424:126:1:64:M*,N,W0,N,N,T0,N,N,S:A:Windows:2000 (SP1+ Userapp1?) (UC)
147 S12:126:1:52:M*,N,W0,N,N,S:A:Windows:2000 (SP1+ Userapp2?) (UC)
148 S12:126:1:48:M*,N,N,S:A:Windows:2000 (SP1+ Userapp3?) (UC)
149 17424:126:1:48:M*,N,N,S:A:Windows:2000 (SP1+ Userapp4?) (UC)
150 S6:128:1:44:M*:A:Windows:NT 4.0 SP1+
151 65535:128:1:48:M*,N,N,S:A:Windows:98 (SE)
152 65535:128:1:44:M*:A:Windows:2000 (1)
153 16616:128:1:44:M*:A:Windows:2003
154 16384:128:1:44:M*:A:Windows:2000 (2)
155 S16:128:1:44:M*:A:Windows:2000 (3)
156 8192:128:1:56:M*,S,T:A:Windows:2000 SP2+, XP SP1+ (seldom 98)
157 8192:128:1:60:M*,N,W8,S,T:AT:Windows:Server 2008 (R2 Standard 64-bit)
158
159 # TEST SIG from msn.no - UC=Unconfirmed
160 8190:255:1:44:M*:A:Windows:Server 2008 (UC)
161
162 # ------------------- OpenBSD --------------
163
164 17376:64:1:64:M*,N,N,S,N,W0,N,N,T:AT:OpenBSD:3.3
165 16384:64:1:64:M*,N,N,S,N,W0,N,N,T:AT:OpenBSD:4.6 (UC)
166
167 # ------------------- NetBSD ----------------
168
169 16384:64:0:60:M*,N,W0,N,N,T0:AT:NetBSD:1.6
170
171 # ----------------- HP/UX ------------------
172
173 32768:64:1:44:M*:A:HPUX:10.20
174
175 # ----------------- Tru64 ------------------
176
177 S23:60:0:48:M*,N,W0:A:Tru64:5.0 (1)
178 65535:64:0:44:M*:A:Tru64:5.0 (2)
179
180 # ----------------- Novell -----------------
181
182 6144:128:1:52:M*,W0,N,S,N,N:A:Novell:Netware 6.0 (SP3)
183 32768:128:1:44:M*:A:Novell:Netware 5.1
184
185 # ------------------ IRIX ------------------
186
187 60816:60:1:60:M*,N,W0,N,N,T:AT:IRIX:6.5.0
188
189 # ----------------- Solaris ----------------
190
191 49232:64:1:64:N,N,T,M*,N,W0,N,N,S:AT:Solaris:9 (1)
192 S34:63:1:52:M1460,N,W0,N,N,S:A:Solaris:9-10 (UC)
193 49232:64:1:64:N,N,T,M*,N,W0,N,N,S:A:Solaris:10
194 S1:255:1:60:N,N,T,N,W0,M*:AT:Solaris:7
195 24656:64:1:44:M*:A:Solaris:8
196 33304:64:1:60:N,N,T,M*,N,W1:AT:Solaris:9 (2)
197 9576:255:1:64:N,N,T,N,W0,N,N,S,M*:A:Solaris:8 (1)?
198 24616:64:1:64:N,N,T,N,W0,N,N,S,M*:A:Solaris:8 (2)?
199 33304:64:1:64:N,N,T,N,W1,N,N,S,M*:A:Solaris:9 (3)
200 33304:64:1:64:N,N,T,M*,N,W1,N,N,S:A:olaris:9 (4)
201 32806:61:1:64:N,N,T,M1460,N,W5,N,N,S:AT:Solaris:Sun OpenStorage 7310
202
203 # ----------------- FreeBSD ----------------
204
205 16384:64:1:60:M*,N,W0,N,N,T:AT:FreeBSD:4.4
206 65535:64:1:60:M*,N,W1,N,N,T:AT:FreeBSD:5.0
207 57344:64:1:44:M*:A:FreeBSD:4.6-4.8
208 65535:64:1:44:M*:A:FreeBSD:4.4
209
210 57344:64:1:48:M1460,N,W0:A:FreeBSD:4.6-4.8 (wscale)
211 57344:64:1:60:M1460,N,W0,N,N,T:AT:FreeBSD:4.6-4.8 (RFC1323)
212 65535:64:1:48:M1460,S:A:FreeBSD:7.0
213 65535:64:1:60:M1460,N,W3,S,T:AT:FreeBSD:7.2
214 65535:64:1:60:M1368,N,W3,S,T:AT:FreeBSD:FreeBSD 20061110 (UC)
215 #65535:64:1:60:M1368,N,W3,S,T:AT:FreeBSD:FreeBSD 20090522 (UC)
216 65535:64:1:40:M1220,N,W3,S,T:ATL:FreeBSD:7.2 (UC) IPv6
217 65535:64:1:60:M1368,N,W3,S,T:AT:FreeBSD:unknown (UC)
218 65535:64:1:60:M1460,N,W6,S,T:AT:FreeBSD:8.0 (UC)
219 S4:64:1:60:M1460,S,T,N,W4:A:FreeBSD:6-8 (UC 4)
220 S4:64:1:60:M1460,S,T,N,W6:A:FreeBSD:6-8 (UC 6)
221
222 # ------------------- AIX ------------------
223
224 S17:255:1:44:M536:A:AIX:4.2
225
226 S12:64:0:44:M1460:A:AIX:5.2 ML04 (1)
227 S42:64:0:44:M1460:A:AIX:5.2 ML04 (2)
228
229 # ------------------ BSD/OS ----------------
230
231 S6:64:1:60:M1460,N,W0,N,N,T:AT:BSD/OS:4.0.x
232
233 # ------------------ OS/390 ----------------
234
235 2048:64:0:44:M1460:A:OS/390:?
236
237 # ------------------ Novell ----------------
238
239 6144:128:1:44:M1400:A:Novell:iChain 2.2
240
241 # ------------------ MacOS -----------------
242
243 33304:64:1:60:M*,N,W0,N,N,T:AT:MacOS:X 10.2.6
244
245 # ----------- Iron Port (Cisco) -------------
246
247 16384:64:1:48:M1380,S,E,E:PA:Cisco:AsyncOS phoebe 7.1.x (Iron Port)
248 16384:64:1:44:M1380:A:Cisco:AsyncOS phoebe 7.1.x (Iron Port)
249
250 # ------------------ Commodore 64 ----------
251 # We just needed to have this one!
252 #1460:64:0:44:M1412:A:C64:Commodore 64 Web V2 (c64web.com)
253
254 #################################################################
255 # Contributed by Ryan Kruse <rkruse@alterpoint.com> - trial run #
256 #################################################################
257
258 # S4:255:0:44:M1024:A:Cisco:LocalDirector
259 # 1024:255:0:44:M536:A:Cisco,3COM,Nortel:CatIOS,SuperStack,BayStack
260 # S16:64:0:44:M512:A:Nortel:Contivity
261 # 8192:64:0:44:M1460:A:Cisco,Nortel,SonicWall,Tasman:Aironet,BayStack Switch,Soho,1200
262 # 4096:255:0:44:M1460:A:Cisco:PIX,CatOS
263 # 8192:128:0:44:M1460:A:Cisco:VPN Concentrator
264 # 8192:128:0:60:M1460,N,W0,N,N,T:AT:Cisco:VPN Concentrator
265 # 4096:32:0:44:M1460:A:Cisco,3COM,Extreme,Nortel:Catalyst Switch CatOS,CoreBuilder,Summit,Passport
266 # S4:255:0:44:M536:ZA:Cisco:IOS
267 # 1024:32:0:44:M1480:UA:Nortel:BayStack Switch
268 # 4096:60:0:44:M1460:A:Adtran:NetVanta
269 # 4096:64:0:44:M1008:A:Adtran:TSU
270 # S4:32:0:44:M1024:A:Alcatel:Switch
271 # S8:255:0:44:M536:ZA:Cisco:IOS
272 # 50:255:0:44:M536:ZA:Cisco:CatIOS
273 # 512:64:0:40:.:A:Dell:Switch
274 # 4096:64:0:40:.:A:Enterasys:Vertical Horizon Switch
275 # 17640:64:1:44:M1460:A:F5,Juniper,RiverStone:BigIP,Juniper OS,Router 7.0+
276 # 16384:64:0:44:M1460:A:Foundry,SonicWall:BigIron,TZ
277 # 4096:64:0:44:M1452:A:HP:ProCurve Switch
278 # 1024:64:0:44:M1260:A:Marconi:ES
279 # 10240:30:0:44:M1460:A:Milan:Switch
280 # 4096:64:0:44:M1380:A:NetScreen:Firewall
281 # S32:64:0:44:M512:A:Nokia:CheckPoint
282 # 1024:64:0:44:M536:A:Nortel:BayStack Switch
283 # 4128:255:0:44:M*:ZA:Cisco:IOS
284 # 1024:16:0:44:M536:A:Nortel:BayStack Switch
285 # 1024:30:0:44:M1480:A:Nortel:BayStack Switch
286 # S4:64:0:44:M1460:A:Symbol:Spectrum Access Point
287 # S2:255:0:44:M512:A:ZyXEL:Prestige
288 # S16:255:0:44:M1024:A:ZyXEL:ZyAI
289
290 ###########################################
291 # Appliance / embedded / other signatures #
292 ###########################################
293
294 16384:64:1:44:M1460:A:F5:BigIP LB 4.1.x (sometimes FreeBSD)
295 S3:250:1:64:M1460,N,W0,N,N,T,S,E,E:PAT:F5:BigIP
296 S3:255:1:60:M1380,N,W0,N,N,T:A:F5:BigIP
297 S12:64:1:60:M1460,N,W4,N,N,T:A:F5:BigIP Link Controller
298 4128:255:0:44:M*:ZA:Cisco:Catalyst 2900 12.0(5)
299 4096:60:0:44:M*:A:Brother:HL-1270N
300 S1:30:0:44:M1730:A:Cyclades:PR3000
301 8192:64:1:44:M1460:A:NetApp:Data OnTap 6.x
302 5792:64:1:60:W0,N,N,N,T,M1460:ZAT:FortiNet:FortiGate 50
303 S1:64:1:44:M1460:A:NetCache:5.3.1
304 8192:64:0:44:M1380:A:Juniper:NetScreen 6 (Firewall+VPN)
305 65535:64:1:64:M1460,N,W1,N,N,T,S,E,E:PAT:Juniper:JUNOS 9.3S7.2
306 #4096:26:0:44:M1460:A JunOS ?
307
308 2048:64:0:44:M1460:A:Radware: UC
309 S32:64:0:48:M512,N,W0:A:SonicWALL: UC
310
311 S1:64:0:44:M512:A:Printer:controller (?)
312 4096:128:0:40:.:A:Sequent:DYNIX 4.2.x
313 S16:64:0:44:M512:A:3Com:NBX PBX (BSD/OS 2.1)
314 16000:64:0:44:M1442:A:CastleNet:DSL router
315 S2:64:0:44:M32728:A:D-Link:DSL-500
316 S4:60:0:44:M*:A:HP:JetDirect A.05.32
317 8576:64:1:44:M*:A:Raptor:firewall
318 S12:64:1:44:M1400:A:Cequrux Firewall:4.x
319 2048:255:0:44:M1400:A:Netgear:MR814
320 16384:128:0:64:M1460,N,W0,N,N,T0,N,N,S:A:Akamai:??? (1)
321 16384:128:0:60:M1460,N,W0,N,N,T0:A:Akamai:??? (2)
322
323 8190:255:0:44:M1452:A:Citrix:Netscaler 6.1
324
325 # Whatever they run. EOL boys...
326 S6:128:1:48:M1460,E:PA:@Slashdot:or BusinessWeek (???)
327
328 # Omniture
329 S3:255:1:64:M1460,N,W0,N,N,T,N,N,S:A:Omniture:DC/1.2
330
331 # BeOS UC
332 16384:128:0:60:M1380,N,W0,N,N,T0:A:BeOS:X.X.X UC
333
334 # Bing.com
335 #S3:255:1:64:M1460,N,W0,N,N,T,S,E,E:PAT:Microsoft:Bing.com
336 S3:255:1:64:M1460,N,W0,N,N,T,S,E:PAT:Microsoft:Bing.com
337
338 # Spiders
339 S4:50:1:60:M1452,S,N,N,N,N,N,N,N,N,N,N,N,N,N:A!:Baidu:2.0 (baiduspider)
340
341 ###################
342 # PRADS TEST SIGS #
343 ###################
344 # Should be verified!
345 S3:255:1:64:M1460,N,W0,N,N,T,S:A:NetCache: UC (Generic 1?)
346 S3:255:1:64:M1460,N,W5,N,N,T,S:A:NetCache: UC (Generic 2?)
347 S16:64:0:60:M512,N,W0,N,N,T:A:VxWorks:VxWorks 5.4.2
348 5840:64:0:44:M1380:A:HP:iLO card
349 5792:64:0:60:M1460,S,T,N,W5:A:MacOS:Intel Mac OS X 10.6
350 5792:64:0:60:M1460,S,T,N,W4:A:MacOS:Intel Mac OS X 10.X?
351 #65535:50:0:48:M1460,S,E,E:PA:?:? <-- 220.255.7.13 : 22
352 8192:128:1:44:M1460:A:UNKNOWN:UNKNOWN 208.83.20.102
353 16384:128:0:48:M1460,N,N,S:A:unknown:something
354 16384:128:0:64:M1460,N,W0,N,N,T0,N,N,S:A:Windows?:Akamai (UC)
355 #16384:128:0:64:M1380,N,W0,N,N,T0,N,N,S:A:Win?:Apache/2.2.10 (Win32) mod_ssl/2.2.10 OpenSSL/0.9.8i PHP/5.2.6
356 16384:128:0:64:M*,N,W0,N,N,T0,N,N,S:A:Linux:SUSE SLES10 (UC)
357 #16384:128:0:48:M1460,N,N,S:A:Win?:Server: Microsoft-IIS/6.0
358 16384:128:1:60:M1460,S,N,N,N,N,N,N,N,N,N,N,N,W0:A:UNKNOWN:some firewall???
359 5792:64:1:60:M1460,S,T,N,W8:T:Linux:Yahoo! (*.crawl.yahoo.net)
360 6144:64:0:60:M1460,N,W0,N,N,T:AT:OpenVMS:X.Y (MultiNet V5.2(16) stack) (UC)
361
362 8688:64:1:64:M1460,N,W0,N,N,S,N,N,T:AT:HP:Officejet (printer) (UC)
363 1448:255:1:60:M1460,S,T0,N,W0:ZAT:Lexmark:T634 (printer) (UC)
364 S1:64:1:60:M1460,N,W0,N,N,T:AT:HP:LaserJet (printer cp4005) (UC)
365
PRADS is a Passive Real-time Asset Detection System. It passively listen to network traffic and gathers information on hosts and services it sees on the network.