etc/os.fp

   1 #
   2 # p0f - SYN fingerprints
   3 # ----------------------
   4 #
   5 # .-------------------------------------------------------------------------.
   6 # | The purpose of this file is to cover signatures for incoming TCP/IP     |
   7 # | connections (SYN packets). This is the default mode of operation for    |
   8 # | p0f. This is also the biggest and most up-to-date set of signatures     |
   9 # | shipped with this project. The file also contains a detailed discussion |
  10 # | of all metrics examined by p0f, and some practical notes on how to      |
  11 # | add new signatures.                                                     |
  12 # `-------------------------------------------------------------------------'
  13 #
  14 # (C) Copyright 2000-2006 by Michal Zalewski <lcamtuf@coredump.cx>
  15 #
  16 # Each line in this file specifies a single fingerprint. Please read the
  17 # information below carefully before attempting to append any signatures
  18 # reported by p0f as UNKNOWN to this file to avoid mistakes. Note that
  19 # this file is compatible only with the default operation mode, and not
  20 # with -R or -A options (SYN+ACK and RST+ modes).
  21 #
  22 # We use the following set metrics for fingerprinting:
  23 #
  24 # - Window size (WSS) - a highly OS dependent setting used for TCP/IP
  25 #   performance control (max. amount of data to be sent without ACK).
  26 #   Some systems use a fixed value for initial packets. On other
  27 #   systems, it is a multiple of MSS or MTU (MSS+40). In some rare
  28 #   cases, the value is just arbitrary.
  29 #
  30 #   NEW SIGNATURE: if p0f reported a special value of 'Snn', the number
  31 #   appears to be a multiple of MSS (MSS*nn); a special value of 'Tnn'
  32 #   means it is a multiple of MTU ((MSS+40)*nn). Unless you notice the
  33 #   value of nn is not fixed (unlikely), just copy the Snn or Tnn token
  34 #   literally. If you know this device has a simple stack and a fixed
  35 #   MTU, you can however multiply S value by MSS, or T value by MSS+40,
  36 #   and put it instead of Snn or Tnn. One system may exhibit several T
  37 #   or S values. In some situations, this might be a source of some
  38 #   additional information about the setup if you have some time to dig
  39 #   thru the kernel sources; in some other cases, like Windows, there seem
  40 #   to be a multitude of variants and WSS selection algorithms, but it's
  41 #   rather difficult to find a pattern without having the source.
  42 #
  43 #   If WSS looks like a regular fixed value (for example is a power of two),
  44 #   or if you can confirm the value is fixed by looking at several
  45 #   fingerprints, please quote it literaly. If there's no apparent pattern
  46 #   in WSS chosen, you should consider wildcarding this value - but this
  47 #   should be the last option.
  48 #
  49 #   NOTE: Some NAT devices, such as Linux iptables with --set-mss, will
  50 #   modify MSS, but not WSS. As a result, MSS is changed to reflect
  51 #   the MTU of the NAT device, but WSS remains a multiple of the original
  52 #   MSS. Fortunately for us, the source device would almost always be
  53 #   hooked up to Ethernet. P0f handles it automatically for the original
  54 #   MSS of 1460, by adding "NAT!" tag to the result.
  55 #
  56 #   In certain configurations, Linux erratically (?) uses MTU from another
  57 #   interface on the default gw interface. This only happens on systems with
  58 #   two network interfaces. Thus, some Linux systems that do not go thru NAT,
  59 #   but have multiple interfaces instead, will be also tagged this way.
  60 #
  61 #   P0f recognizes and automatically wildcards WSS of 12345, as generated
  62 #   by sendack and sendsyn utilities shipped with the program, when
  63 #   reporting a new signature. See test/sendack.c and test/sendsyn.c for more
  64 #   information about this.
  65 #
  66 # - Overall packet size - a function of all IP and TCP options and bugs.
  67 #   While this is partly redundant in the real world, we record this value
  68 #   to capture rare cases when there are IP options (which we do not currently
  69 #   examine) or packet data past the headers. Both situations are rare.
  70 #
  71 #   Packet size MAY be wildcarded, but the meaning of the wildcard is
  72 #   very special, and means the packet must be larger than PACKET_BIG
  73 #   (defined in config.h as 100). This is usually not necessary, except
  74 #   for some really broken implementations in RST+ mode. For more information,
  75 #   see p0fr.fp. P0f automatically wildcards big packets when reporting
  76 #   new signatures.
  77 #
  78 #   NEW SIGNATURE: Copy this value literally.
  79 #
  80 # - Initial TTL - We check the actual TTL of a received packet. It can't
  81 #   be higher than the initial TTL, and also shouldn't be dramatically
  82 #   lower (maximum distance is defined in config.h as 40 hops).
  83 #
  84 #   NEW SIGNATURE: *Never* copy TTL from a p0f-reported signature literally.
  85 #   You need to determine the initial TTL. The best way to do it is to
  86 #   check the documentation for a remote system, or check its settings.
  87 #   A fairly good method is to simply round the observed TTL up to
  88 #   32, 64, 128, or 255, but it should be noted that some obscure devices
  89 #   might not use round TTLs (in particular, some shoddy appliances and
  90 #   IRIX and Tru64 are known to use "original" initial TTL settings). If not
  91 #   sure, use traceroute or mtr to see how far you are from the host.
  92 #
  93 #   Note that -F option overrides this check if no signature can be found.
  94 #
  95 # - Don't fragment flag (DF) - some modern OSes set this to implement PMTU
  96 #   discovery. Others do not bother.
  97 #
  98 #   NEW SIGNATURE: Copy this value literally. Note: this setting is
  99 #   sometimes cleared by firewalls and/or certain connectivity clients.
 100 #   Try to find out what's the actual state for a given OS if you see both,
 101 #   and add the right one. P0f will automatically detect a case when a
 102 #   firewall removed the DF flag and will append "(firewall!)" suffix to
 103 #   the signature, so if the DF version is the right one, don't add no-DF
 104 #   variant, unless it has a different meaning.
 105 #
 106 # - Maximum segment size (MSS) - this setting is usually link-dependent. P0f
 107 #   uses it to determine link type of the remote host.
 108 #
 109 #   NEW SIGNATURE: Always wildcard this value, except for rare cases when
 110 #   you have an appliance with a fixed value, know the system supports only
 111 #   a very limited number of network interface types, or know the system
 112 #   is using a value it pulled out of nowhere. I use specific unique MSS
 113 #   to tell Google crawlbots from the rest of Linux population, for example.
 114 #
 115 #   If a specific MSS/MTU is unique to a certain link type, be sure to
 116 #   add it to mtu.h instead of creating several variants of each signature.
 117 #
 118 # - Window scaling (WSCALE) - this feature is used to scale WSS.
 119 #   It extends the size of a TCP/IP window to 32 bits, of sorts. Some modern
 120 #   systems implement this feature.
 121 #
 122 #   NEW SIGNATURE: Observe several signatures. Initial WSCALE is often set
 123 #   to zero or other low value. There's usually no need to wildcard this
 124 #   parameter.
 125 #
 126 # - Timestamp - some systems that implement timestamps set them to
 127 #   zero in the initial SYN. This case is detected and handled appropriately.
 128 #
 129 #   NEW SIGNATURE: Copy T or T0 option literally.
 130 #
 131 # - Selective ACK permitted - a flag set by systems that implement
 132 #   selective ACK functionality,
 133 #
 134 #   NEW SIGNATURE: copy S option literally.
 135 #
 136 # - NOP option - its presence, count and sequence is a useful OS-dependent
 137 #   characteristic,
 138 #
 139 #   NEW SIGNATURE: copy N options literally.
 140 #
 141 # - Other and unrecognized options (TTCP-related and such) - implemented by
 142 #   some eccentric or very buggy TCP/IP stacks ;-),
 143 #
 144 #   NEW SIGNATURE: copy ? options literally.
 145 #
 146 # - EOL option. Contrary to the popular belief, the presence of EOL
 147 #   option is actually quite rare, most systems just NOP-pad to the
 148 #   packet boundary.
 149 #
 150 #   NEW SIGNATURE: copy E option literally.
 151 #
 152 # - The sequence of TCP all options mentioned above - this is very
 153 #   specific to the implementation,
 154 #
 155 #   NEW SIGNATURE: Copy the sequence literally.
 156 #
 157 # - Quirks. Some buggy stacks set certain values that should be zeroed in a
 158 #   TCP packet to non-zero values. This has no effect as of today, but is
 159 #   a valuable source of information. Some systems actually seem to leak
 160 #   memory there. Other systems just exhibit harmful but very specific
 161 #   behavior. This section captures all unusual yes-no properties not
 162 #   related to the main and expected header layout. We detect the following:
 163 #
 164 #   - Data past the headers. Neither SYN nor SYN+ACK packets are supposed
 165 #     to carry any payload. If they do, we should take notice. The actual
 166 #     payload is not examined, but will be displayed if use the -X option.
 167 #     Note that payload is not unusual in RST+ mode (see p0fr.fp), very
 168 #     rare otherwise.
 169 #
 170 #   - Options past EOL. Some systems have some trailing data past EOL
 171 #     in the options section of TCP/IP headers. P0f does not examine this
 172 #     data as of today, simply detects its presence. If there is a
 173 #     confirmed sizable population of systems that have data past EOL, it
 174 #     might be a good idea to look at it. Until then, you have to recompile
 175 #     p0f with DEBUG_EXTRAS set or use -x to display this data,
 176 #
 177 #   - Zero IP ID. This again is a (mostly) harmless setting to use a fixed
 178 #     IP ID for packets with DF set. Some systems reportedly use zero ID,
 179 #     most OSes do not. There is a very slight probability of a false
 180 #     positive when IP ID is "naturally" chosen to be zero on a system
 181 #     that otherwise does set proper values, but the probability is
 182 #     neglible (if it becomes a problem, recompile p0f with IGNORE_ZEROID
 183 #     set in the sources).
 184 #
 185 #   - IP options specified. Usually, packets do not have any IP options
 186 #     set, but there can be some. Until there is a confirmed sizable
 187 #     population of systems that do have IP options in a packet, p0f
 188 #     does not examine those in detail, but it might change (use
 189 #     DEBUG_EXTRAS or -x to display IP options if any found),
 190 #
 191 #   - URG pointer value. SYN packets do not have URG flag set, so the
 192 #     value in URG pointer in TCP header is ignored. Most systems set it
 193 #     to zero, but some OSes (some versions of Windows, for example) do
 194 #     not zero this field or even simply leak memory; the actual value is
 195 #     not examined, because most cases seem to be just random garbage
 196 #     (you can use DEBUG_EXTRAS or -x to report this information though);
 197 #     see doc/win-memleak.txt for more information,
 198 #
 199 #   - "Unused" field value. This should be always zero, but some systems
 200 #     forget to clear it. This might result in some funny issues in the
 201 #     future. P0f checks for non-zero value (and will display it if
 202 #     DEBUG_EXTRAS is set, or you can use -x),
 203 #
 204 #   - ACK number non-zero. ACK value in SYN packets with no ACK flag
 205 #     is disregarded and is usually set to zero (just like with URG
 206 #     pointer), but some systems forget to do it. The exact value is
 207 #     not examined (but will be displayed with DEBUG_EXTRAS, or you can
 208 #     use -x). Note that this is not an anomaly in SYN+ACK and RST+ modes,
 209 #
 210 #   - Non-zero second timestamp. The initial SYN packet should have the
 211 #     second timestamp always zeroed. SYN+ACK and RST+ may "legally" have
 212 #     this quirk though,
 213 #
 214 #   - Unusual flags. If, in addition to SYN (or SYN+ACK), there are some
 215 #     auxilinary flags that do not modify the very meaning of a packet,
 216 #     p0f records this (this can be URG, PUSH, or something else).
 217 #
 218 #     Note: ECN flags (ECE and CWR) are ignored and denoted in a separate
 219 #     way. ECN is never by default, because some systems can't handle it,
 220 #     and it probably does not make much sense to include it in signatures
 221 #     right now.
 222 #
 223 #   - TCP option segment parsing problems. If p0f fails to decode options
 224 #     because of a badly broken packet, it records this fact.
 225 #
 226 #   There are several other quirks valid only in RST+ mode, see p0fr.fp for
 227 #   more information. Those quirks are unheard of in SYN and SYN+ACK
 228 #   modes.
 229 #
 230 #   NEW SIGNATURE: Copy "quirks" section literally.
 231 #
 232 # We DO NOT use ToS for fingerprinting. While the original TCP/IP
 233 # fingerprinting research believed this value would be useful for this
 234 # purpose, it is not. The setting is way too often tweaked by network
 235 # devices.
 236 #
 237 # To wildcard MSS, WSS or WSCALE, replace it with '*'. You can also use a
 238 # modulo operator to match any values that divide by nnn - '%nnn' (and,
 239 # as stated above, WSS also supports special values Snn and Tnn).
 240 #
 241 # Fingerprint entry format:
 242 #
 243 # wwww:ttt:D:ss:OOO...:QQ:OS:Details
 244 #
 245 # wwww     - window size (can be * or %nnn or Sxx or Txx)
 246 #            "Snn" (multiple of MSS) and "Tnn" (multiple of MTU) are allowed.
 247 # ttt      - initial TTL
 248 # D        - don't fragment bit (0 - not set, 1 - set)
 249 # ss       - overall SYN packet size (* has a special meaning)
 250 # OOO      - option value and order specification (see below)
 251 # QQ       - quirks list (see below)
 252 # OS       - OS genre (Linux, Solaris, Windows)
 253 # details  - OS description (2.0.27 on x86, etc)
 254 #
 255 # If OS genre starts with '*', p0f will not show distance, link type
 256 # and timestamp data. It is useful for userland TCP/IP stacks of
 257 # network scanners and so on, where many settings are randomized or
 258 # bogus.
 259 #
 260 # If OS genre starts with @, it denotes an approximate hit for a group
 261 # of operating systems (signature reporting still enabled in this case).
 262 # Use this feature at the end of this file to catch cases for which
 263 # you don't have a precise match, but can tell it's Windows or FreeBSD
 264 # or whatnot by looking at, say, flag layout alone.
 265 #
 266 # If OS genre starts with - (which can prefix @ or *), the entry is
 267 # not considered to be a real operating system (but userland stack
 268 # instead). It is important to mark all scanners and so on with -,
 269 # so that they are not used for masquerade detection (also add this
 270 # prefix for signatures of application-induced behavior, such as
 271 # increased window size with Opera browser).
 272 #
 273 # Option block description is a list of comma or space separated
 274 # options in the order they appear in the packet:
 275 #
 276 # N        - NOP option
 277 # E        - EOL option
 278 # Wnnn     - window scaling option, value nnn (or * or %nnn)
 279 # Mnnn     - maximum segment size option, value nnn (or * or %nnn)
 280 # S        - selective ACK OK
 281 # T        - timestamp
 282 # T0       - timestamp with zero value
 283 # ?n       - unrecognized option number n.
 284 #
 285 # P0f can sometimes report ?nn among the options. This means it couldn't
 286 # recognize this option (option number nn). It's either a bug in p0f, or
 287 # a faulty TCP/IP stack, or, if the number is listed here:
 288 #
 289 #   http://www.iana.org/assignments/tcp-parameters
 290 #
 291 # ...the stack might be simply quite exotic.
 292 #
 293 # To denote no TCP options, use a single '.'.
 294 #
 295 # Quirks section is usually an empty list ('.') of oddities or bugs of this
 296 # particular stack. List items are not separated in any way. Possible values:
 297 #
 298 # P     - options past EOL,
 299 # Z     - zero IP ID,
 300 # I     - IP options specified,
 301 # U     - urg pointer non-zero,
 302 # X     - unused (x2) field non-zero,
 303 # A     - ACK number non-zero,
 304 # T     - non-zero second timestamp,
 305 # F     - unusual flags (PUSH, URG, etc),
 306 # D     - data payload,
 307 # !     - broken options segment.
 308 #
 309 # WARNING WARNING WARNING
 310 # -----------------------
 311 #
 312 # Do not add a system X as OS Y just because NMAP says so. It is often
 313 # the case that X is a NAT firewall. While nmap is talking to the
 314 # device itself, p0f is fingerprinting the guy behind the firewall
 315 # instead.
 316 #
 317 # When in doubt, use common sense, don't add something that looks like
 318 # a completely different system as Linux or FreeBSD or LinkSys router.
 319 # Check DNS name, establish a connection to the remote host and look
 320 # at SYN+ACK (p0f -A -S should do) - does it look similar?
 321 #
 322 # Some users tweak their TCP/IP settings - enable or disable RFC1323,
 323 # RFC1644 or RFC2018 support, disable PMTU discovery, change MTU, initial
 324 # TTL and so on. Always compare a new rule to other fingerprints for
 325 # this system, and verify the system isn't "customized". It is OK to
 326 # add signature variants caused by commonly used software (PFs, security
 327 # packages, etc), but it makes no sense to try to add every single
 328 # possible /proc/sys/net/ipv4/* tweak on Linux or so.
 329 #
 330 # KEEP IN MIND: Some packet firewalls configured to normalize outgoing
 331 # traffic (OpenBSD pf with "scrub" enabled, for example) will, well,
 332 # normalize packets. Signatures will not correspond to the originating
 333 # system (and probably not quite to the firewall either).
 334 #
 335 # NOTE: Try to keep this file in some reasonable order, from most to
 336 # least likely systems. This will speed up operation. Also keep most
 337 # generic and broad rules near ehe end.
 338 #
 339 # Still decided to add signature? Let us know - mail a copy of your discovery
 340 # to lcamtuf@coredump.cx. You can help make p0f better, and I can help you
 341 # make your signature more accurate.
 342 #
 343
 344 ##########################
 345 # Standard OS signatures #
 346 ##########################
 347
 348 # ----------------- AIX ---------------------
 349
 350 # AIX is first because its signatures are close to NetBSD, MacOS X and
 351 # Linux 2.0, but it uses a fairly rare MSSes, at least sometimes...
 352 # This is a shoddy hack, though.
 353
 354 45046:64:0:44:M*:.:AIX:4.3
 355
 356 16384:64:0:44:M512:.:AIX:4.3.2 and earlier
 357
 358 16384:64:0:60:M512,N,W%2,N,N,T:.:AIX:4.3.3-5.2 (1)
 359 32768:64:0:60:M512,N,W%2,N,N,T:.:AIX:4.3.3-5.2 (2)
 360 65535:64:0:60:M512,N,W%2,N,N,T:.:AIX:4.3.3-5.2 (3)
 361
 362 65535:64:0:64:M*,N,W1,N,N,T,N,N,S:.:AIX:5.3 ML1
 363
 364 # ----------------- Linux -------------------
 365
 366 S1:64:0:44:M*:A:Linux:1.2.x
 367 512:64:0:44:M*:.:Linux:2.0.3x (1)
 368 16384:64:0:44:M*:.:Linux:2.0.3x (2)
 369
 370 # Endian snafu! Nelson says "ha-ha":
 371 2:64:0:44:M*:.:Linux:2.0.3x (MkLinux) on Mac (1)
 372 64:64:0:44:M*:.:Linux:2.0.3x (MkLinux) on Mac (2)
 373
 374 S4:64:1:60:M1360,S,T,N,W0:.:Linux:2.4 (Google crawlbot)
 375 S4:64:1:60:M1430,S,T,N,W0:.:Linux:2.4-2.6 (Google crawlbot)
 376
 377 S2:64:1:60:M*,S,T,N,W0:.:Linux:2.4 (large MTU?)
 378 S3:64:1:60:M*,S,T,N,W0:.:Linux:2.4 (newer)
 379 S4:64:1:60:M*,S,T,N,W0:.:Linux:2.4-2.6
 380
 381 S3:64:1:60:M*,S,T,N,W1:.:Linux:2.6, seldom 2.4 (older, 1)
 382 S4:64:1:60:M*,S,T,N,W1:.:Linux:2.6, seldom 2.4 (older, 2)
 383 S3:64:1:60:M*,S,T,N,W2:.:Linux:2.6, seldom 2.4 (older, 3)
 384 S4:64:1:60:M*,S,T,N,W2:.:Linux:2.6, seldom 2.4 (older, 4)
 385 T4:64:1:60:M*,S,T,N,W2:.:Linux:2.6 (older, 5)
 386
 387 S4:64:1:60:M*,S,T,N,W5:.:Linux:2.6 (newer, 1)
 388 S4:64:1:60:M*,S,T,N,W6:.:Linux:2.6 (newer, 2)
 389
 390 # added -kwy
 391 S2:64:1:60:M*,S,T,N,W6:.:Linux:2.6 (newer, 2 loopback)
 392 S4:64:1:60:M*,S,T,N,W7:.:Linux:2.6 (newer, 3)
 393 T4:64:1:60:M*,S,T,N,W7:.:Linux:2.6 (newer, 4)
 394 S4:64:1:60:M*,S,T,N,W8:.:Linux:2.6 (newer, 5)
 395 #T4:64:1:60:M*,S,T,N,W8:.:Linux:2.6 (newer, 5)
 396
 397 S20:64:1:60:M*,S,T,N,W0:.:Linux:2.2 (1)
 398 S22:64:1:60:M*,S,T,N,W0:.:Linux:2.2 (2)
 399 S11:64:1:60:M*,S,T,N,W0:.:Linux:2.2 (3)
 400
 401 # Popular cluster config scripts disable timestamps and
 402 # selective ACK:
 403
 404 S4:64:1:48:M1460,N,W0:.:Linux:2.4 in cluster
 405
 406 # This happens only over loopback, but let's make folks happy:
 407 32767:64:1:60:M16396,S,T,N,W0:.:Linux:2.4 (loopback)
 408 32767:64:1:60:M16396,S,T,N,W2:.:Linux:2.6 (newer, loopback)
 409 S8:64:1:60:M3884,S,T,N,W0:.:Linux:2.2 (loopback)
 410
 411 # Opera visitors:
 412 16384:64:1:60:M*,S,T,N,W0:.:-Linux:2.2 (Opera?)
 413 32767:64:1:60:M*,S,T,N,W0:.:-Linux:2.4 (Opera?)
 414
 415 # Some fairly common mods & oddities:
 416 S22:64:1:52:M*,N,N,S,N,W0:.:Linux:2.2 (tstamp-)
 417 S4:64:1:52:M*,N,N,S,N,W0:.:Linux:2.4 (tstamp-)
 418 S4:64:1:52:M*,N,N,S,N,W2:.:Linux:2.6 (tstamp-)
 419 S4:64:1:44:M*:.:Linux:2.6? (barebone, rare!)
 420 T4:64:1:60:M1412,S,T,N,W0:.:Linux:2.4 (rare!)
 421
 422 # ----------------- FreeBSD -----------------
 423
 424 16384:64:1:44:M*:.:FreeBSD:2.0-4.2
 425 16384:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.4 (1)
 426
 427 1024:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.4 (2)
 428
 429 57344:64:1:44:M*:.:FreeBSD:4.6-4.8 (RFC1323-)
 430 57344:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.6-4.9
 431
 432 32768:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.8-5.1 (or MacOS X 10.2-10.3)
 433 65535:64:1:60:M*,N,W0,N,N,T:.:FreeBSD:4.7-5.2 (or MacOS X 10.2-10.4) (1)
 434 65535:64:1:60:M*,N,W1,N,N,T:.:FreeBSD:4.7-5.2 (or MacOS X 10.2-10.4) (2)
 435
 436 65535:64:1:60:M*,N,W0,N,N,T:Z:FreeBSD:5.1 (1)
 437 65535:64:1:60:M*,N,W1,N,N,T:Z:FreeBSD:5.1 (2)
 438 65535:64:1:60:M*,N,W2,N,N,T:Z:FreeBSD:5.1 (3)
 439 65535:64:1:64:M*,N,N,S,N,W1,N,N,T:.:FreeBSD:5.3-5.4
 440 65535:64:1:64:M*,N,W1,N,N,T,S,E:P:FreeBSD:6.x (1)
 441 65535:64:1:64:M*,N,W0,N,N,T,S,E:P:FreeBSD:6.x (2)
 442 65535:64:1:48:M1460,S:.:FreeBSD:7.0
 443
 444 65535:64:1:44:M*:Z:FreeBSD:5.2 (RFC1323-)
 445
 446 # 16384:64:1:60:M*,N,N,N,N,N,N,T:.:FreeBSD:4.4 (tstamp-)
 447
 448 # ----------------- NetBSD ------------------
 449
 450 16384:64:0:60:M*,N,W0,N,N,T:.:NetBSD:1.3
 451 65535:64:0:60:M*,N,W0,N,N,T0:.:-NetBSD:1.6 (Opera)
 452 16384:64:1:60:M*,N,W0,N,N,T0:.:NetBSD:1.6
 453 65535:64:1:60:M*,N,W1,N,N,T0:.:NetBSD:1.6W-current (DF)
 454 65535:64:1:60:M*,N,W0,N,N,T0:.:NetBSD:1.6X (DF)
 455 32768:64:1:60:M*,N,W0,N,N,T0:.:NetBSD:1.6Z or 2.0 (DF)
 456 32768:64:1:64:M1416,N,W0,S,N,N,N,N,T0:.:NetBSD:2.0G (DF)
 457 32768:64:1:64:M*,N,W0,S,N,N,N,N,T0:.:NetBSD:3.0 (DF)
 458
 459 # ----------------- OpenBSD -----------------
 460
 461 16384:64:1:64:M*,N,N,S,N,W0,N,N,T:.:OpenBSD:3.0-3.9
 462 57344:64:1:64:M*,N,N,S,N,W0,N,N,T:.:OpenBSD:3.3-3.4
 463 16384:64:0:64:M*,N,N,S,N,W0,N,N,T:.:OpenBSD:3.0-3.4 (scrub)
 464 65535:64:1:64:M*,N,N,S,N,W0,N,N,T:.:-OpenBSD:3.0-3.4 (Opera?)
 465 32768:64:1:64:M*,N,N,S,N,W0,N,N,T:.:OpenBSD:3.7
 466
 467 # ----------------- Solaris -----------------
 468
 469 S17:64:1:64:N,W3,N,N,T0,N,N,S,M*:.:Solaris:8 (RFC1323 on)
 470 S17:64:1:48:N,N,S,M*:.:Solaris:8 (1)
 471 S17:255:1:44:M*:.:Solaris:2.5-7 (1)
 472
 473 # Sometimes, just sometimes, Solaris feels like coming up with
 474 # rather arbitrary MSS values ;-)
 475
 476 S6:255:1:44:M*:.:Solaris:2.5-7 (2)
 477 S23:64:1:48:N,N,S,M*:.:Solaris:8 (2)
 478 S34:64:1:48:M*,N,N,S:.:Solaris:9
 479 S34:64:1:48:M*,N,N,N,N:.:Solaris:9 (no sack)
 480 S44:255:1:44:M*:.:Solaris:7
 481
 482 4096:64:0:44:M1460:.:SunOS:4.1.x
 483
 484 S34:64:1:52:M*,N,W0,N,N,S:.:Solaris:10 (beta)
 485 32850:64:1:64:M*,N,N,T,N,W1,N,N,S:.:Solaris:10 (1203?)
 486 32850:64:1:64:M*,N,W1,N,N,T,N,N,S:.:Solaris:9.1
 487
 488 # ----------------- IRIX --------------------
 489
 490 49152:60:0:44:M*:.:IRIX:6.2-6.4
 491 61440:60:0:44:M*:.:IRIX:6.2-6.5
 492 49152:60:0:52:M*,N,W2,N,N,S:.:IRIX:6.5 (RFC1323+) (1)
 493 49152:60:0:52:M*,N,W3,N,N,S:.:IRIX:6.5 (RFC1323+) (2)
 494
 495 61440:60:0:48:M*,N,N,S:.:IRIX:6.5.12-6.5.21 (1)
 496 49152:60:0:48:M*,N,N,S:.:IRIX:6.5.12-6.5.21 (2)
 497
 498 49152:60:0:64:M*,N,W2,N,N,T,N,N,S:.:IRIX:6.5 IP27
 499
 500 # ----------------- Tru64 -------------------
 501 # Tru64 and OpenVMS share the same stack on occassions.
 502 # Relax.
 503
 504 32768:60:1:48:M*,N,W0:.:Tru64:4.0 (or OS/2 Warp 4)
 505 32768:60:0:48:M*,N,W0:.:Tru64:5.0 (or OpenVMS 7.x on Compaq 5.0 stack)
 506 8192:60:0:44:M1460:.:Tru64:5.1 (no RFC1323) (or QNX 6)
 507 61440:60:0:48:M*,N,W0:.:Tru64:v5.1a JP4 (or OpenVMS 7.x on Compaq 5.x stack)
 508
 509 # ----------------- OpenVMS -----------------
 510
 511 6144:64:1:60:M*,N,W0,N,N,T:.:OpenVMS:7.2 (Multinet 4.3-4.4 stack)
 512
 513 # ----------------- MacOS -------------------
 514
 515 S2:255:1:48:M*,W0,E:.:MacOS:8.6 classic
 516
 517 16616:255:1:48:M*,W0,E:.:MacOS:7.3-8.6 (OTTCP)
 518 16616:255:1:48:M*,N,N,N,E:.:MacOS:8.1-8.6 (OTTCP)
 519 32768:255:1:48:M*,W0,N:.:MacOS:9.0-9.2
 520
 521 32768:255:1:48:M1380,N,N,N,N:.:MacOS:9.1 (OT 2.7.4) (1)
 522 65535:255:1:48:M*,N,N,N,N:.:MacOS:9.1 (OT 2.7.4) (2)
 523
 524 # ----------------- Windows -----------------
 525
 526 # Windows TCP/IP stack is a mess. For most recent XP, 2000 and
 527 # even 98, the pathlevel, not the actual OS version, is more
 528 # relevant to the signature. They share the same code, so it would
 529 # seem. Luckily for us, almost all Windows 9x boxes have an
 530 # awkward MSS of 536, which I use to tell one from another
 531 # in most difficult cases.
 532
 533 8192:32:1:44:M*:.:Windows:3.11 (Tucows)
 534 S44:64:1:64:M*,N,W0,N,N,T0,N,N,S:.:Windows:95
 535 8192:128:1:64:M*,N,W0,N,N,T0,N,N,S:.:Windows:95b
 536
 537 # There were so many tweaking tools and so many stack versions for
 538 # Windows 98 it is no longer possible to tell them from each other
 539 # without some very serious research. Until then, there's an insane
 540 # number of signatures, for your amusement:
 541
 542 S44:32:1:48:M*,N,N,S:.:Windows:98 (low TTL) (1)
 543 8192:32:1:48:M*,N,N,S:.:Windows:98 (low TTL) (2)
 544 %8192:64:1:48:M536,N,N,S:.:Windows:98 (13)
 545 %8192:128:1:48:M536,N,N,S:.:Windows:98 (15)
 546 S4:64:1:48:M*,N,N,S:.:Windows:98 (1)
 547 S6:64:1:48:M*,N,N,S:.:Windows:98 (2)
 548 S12:64:1:48:M*,N,N,S:.:Windows:98 (3
 549 T30:64:1:64:M1460,N,W0,N,N,T0,N,N,S:.:Windows:98 (16)
 550 32767:64:1:48:M*,N,N,S:.:Windows:98 (4)
 551 37300:64:1:48:M*,N,N,S:.:Windows:98 (5)
 552 46080:64:1:52:M*,N,W3,N,N,S:.:Windows:98 (RFC1323+)
 553 65535:64:1:44:M*:.:Windows:98 (no sack)
 554 S16:128:1:48:M*,N,N,S:.:Windows:98 (6)
 555 S16:128:1:64:M*,N,W0,N,N,T0,N,N,S:.:Windows:98 (7)
 556 S26:128:1:48:M*,N,N,S:.:Windows:98 (8)
 557 T30:128:1:48:M*,N,N,S:.:Windows:98 (9)
 558 32767:128:1:52:M*,N,W0,N,N,S:.:Windows:98 (10)
 559 60352:128:1:48:M*,N,N,S:.:Windows:98 (11)
 560 60352:128:1:64:M*,N,W2,N,N,T0,N,N,S:.:Windows:98 (12)
 561
 562 # What's with 1414 on NT?
 563 T31:128:1:44:M1414:.:Windows:NT 4.0 SP6a (1)
 564 64512:128:1:44:M1414:.:Windows:NT 4.0 SP6a (2)
 565 8192:128:1:44:M*:.:Windows:NT 4.0 (older)
 566
 567 # Windows XP and 2000. Most of the signatures that were
 568 # either dubious or non-specific (no service pack data)
 569 # were deleted and replaced with generics at the end.
 570
 571 65535:128:1:48:M*,N,N,S:.:Windows:2000 SP4, XP SP1+
 572 65535:64:1:48:M*,N,N,S:.:Windows:2000 SP4, XP SP1+ (Low TTL 1)
 573 65535:32:1:48:M*,N,N,S:.:Windows:2000 SP4, XP SP1+ (Low TTL 2)
 574 %8192:128:1:48:M*,N,N,S:.:Windows:2000 SP2+, XP SP1+ (seldom 98)
 575 %8192:64:1:48:M*,N,N,S:.:Windows:2000 SP2+, XP SP1+ (seldom 98, Low TTL1)
 576 %8192:32:1:48:M*,N,N,S:.:Windows:2000 SP2+, XP SP1+ (seldom 98, Low TTL2)
 577 S20:128:1:48:M*,N,N,S:.:Windows:SP3
 578 S45:128:1:48:M*,N,N,S:.:Windows:2000 SP4, XP SP1+ (2)
 579 40320:128:1:48:M*,N,N,S:.:Windows:2000 SP4
 580
 581 S6:128:1:48:M*,N,N,S:.:Windows:XP, 2000 SP2+
 582 S12:128:1:48:M*,N,N,S:.:Windows:XP SP1+ (1)
 583 S44:128:1:48:M*,N,N,S:.:Windows:XP SP1+, 2000 SP3
 584 64512:128:1:48:M*,N,N,S:.:Windows:XP SP1+, 2000 SP3 (2)
 585 32767:128:1:48:M*,N,N,S:.:Windows:XP SP1+, 2000 SP4 (3)
 586
 587 # Windows 2003 & Vista
 588
 589 8192:128:1:52:M*,W8,N,N,N,S:.:Windows:Vista (beta)
 590 8192:128:1:48:M1460,N,N,S:.:Windows:Vista SP1
 591 32768:32:1:52:M1460,N,W0,N,N,S:.:Windows:2003 AS
 592 65535:64:1:52:M1460,N,W2,N,N,S:.:Windows:2003 (1)
 593 65535:64:1:48:M1460,N,N,S:.:Windows:2003 (2)
 594
 595 # Odds, ends, mods:
 596
 597 S52:128:1:48:M1260,N,N,S:.:Windows:XP/2000 via Cisco
 598 65520:128:1:48:M*,N,N,S:.:Windows:XP bare-bone
 599 16384:128:1:52:M536,N,W0,N,N,S:.:Windows:2000 w/ZoneAlarm?
 600 2048:255:0:40:.:.:Windows:.NET Enterprise Server
 601 44620:64:0:48:M*,N,N,S:.:Windows:ME no SP (?)
 602 S6:255:1:48:M536,N,N,S:.:Windows:95 winsock 2
 603 32000:128:0:48:M*,N,N,S:.:Windows:XP w/Winroute?
 604 16384:64:1:48:M1452,N,N,S:.:Windows:XP w/Sygate? (1)
 605 17256:64:1:48:M1460,N,N,S:.:Windows:XP w/Sygate? (2)
 606
 607 # No need to be more specific, it passes:
 608 *:128:1:48:M*,N,N,S:U:-Windows:XP/2000 while downloading (leak!)
 609
 610 # ----------------- HP/UX -------------------
 611
 612 32768:64:1:44:M*:.:HP-UX:B.10.20
 613 32768:64:1:48:M*,W0,N:.:HP-UX:11.00-11.11
 614
 615 # Whoa. Hardcore WSS.
 616 0:64:0:48:M*,W0,N:.:HP-UX:B.11.00 A (RFC1323+)
 617
 618 # ----------------- RiscOS ------------------
 619
 620 16384:64:1:68:M1460,N,W0,N,N,T,N,N,?12:.:RISC OS:3.70-4.36 (inet 5.04)
 621 12288:32:0:44:M536:.:RISC OS:3.70 inet 4.10
 622 4096:64:1:56:M1460,N,N,T:T:RISC OS:3.70 freenet 2.00
 623
 624 # ----------------- BSD/OS ------------------
 625
 626 8192:64:1:60:M1460,N,W0,N,N,T:.:BSD/OS:3.1-4.3 (or MacOS X 10.2)
 627
 628 # ---------------- NetwonOS -----------------
 629
 630 4096:64:0:44:M1420:.:NewtonOS:2.1
 631
 632 # ---------------- NeXTSTEP -----------------
 633
 634 S8:64:0:44:M512:.:NeXTSTEP:3.3 (1)
 635 S4:64:0:44:M1024:.:NeXTSTEP:3.3 (2)
 636
 637 # ------------------ BeOS -------------------
 638
 639 1024:255:0:48:M*,N,W0:.:BeOS:5.0-5.1
 640 12288:255:0:44:M*:.:BeOS:5.0.x
 641 # Unconfirmed
 642 65535:128:0:44:M1380:.:BeOS:X.X.X UC
 643
 644 # ------------------ OS/400 -----------------
 645
 646 8192:64:1:60:M1440,N,W0,N,N,T:.:OS/400:V4R4/R5
 647 8192:64:0:44:M536:.:OS/400:V4R3/M0
 648 4096:64:1:60:M1440,N,W0,N,N,T:.:OS/400:V4R5 + CF67032
 649
 650 28672:64:0:44:M1460:A:OS/390:?
 651
 652 # ------------------ ULTRIX -----------------
 653
 654 16384:64:0:40:.:.:ULTRIX:4.5
 655
 656 # ------------------- QNX -------------------
 657
 658 S16:64:0:44:M512:.:QNX:demodisk
 659 16384:64:0:60:M1460,N,W0,N,N,T0:.:QNX:6.x
 660
 661 # ------------------ Novell -----------------
 662
 663 16384:128:1:44:M1460:.:Novell:NetWare 5.0
 664 6144:128:1:44:M1460:.:Novell:IntranetWare 4.11
 665 6144:128:1:44:M1368:.:Novell:BorderManager ?
 666
 667 # According to rfp:
 668 6144:128:1:52:M*,W0,N,S,N,N:.:Novell:Netware 6 SP3
 669
 670 # -------------- SCO UnixWare ---------------
 671
 672 S3:64:1:60:M1460,N,W0,N,N,T:.:SCO:UnixWare 7.1
 673 S17:64:1:60:M*,N,W0,N,N,T:.:SCO:UnixWare 7.1.x
 674 S23:64:1:44:M1380:.:SCO:OpenServer 5.0
 675
 676 # ------------------- DOS -------------------
 677
 678 2048:255:0:44:M536:.:DOS:Arachne via WATTCP/1.05
 679 T2:255:0:44:M984:.:DOS:Arachne via WATTCP/1.05 (eepro)
 680 16383:64:0:44:M536:.:DOS:Unknown via WATTCP (epppd)
 681
 682 # ------------------ OS/2 -------------------
 683
 684 S56:64:0:44:M512:.:OS/2:4
 685 28672:64:0:44:M1460:.:OS/2:Warp 4.0
 686
 687 # ----------------- TOPS-20 -----------------
 688
 689 # Another hardcore MSS, one of the ACK leakers hunted down.
 690 0:64:0:44:M1460:A:TOPS-20:version 7
 691
 692 # ------------------ AMIGA ------------------
 693
 694 S32:64:1:56:M*,N,N,S,N,N,?12:.:AMIGA:3.9 BB2 with Miami stack
 695
 696 # ------------------ Minix ------------------
 697
 698 # Not quite sure.
 699 # 8192:210:0:44:M1460:X:@Minix:?
 700
 701 # ------------------ Plan9 ------------------
 702
 703 65535:255:0:48:M1460,W0,N:.:Plan9:edition 4
 704
 705 # ----------------- AMIGAOS -----------------
 706
 707 16384:64:1:48:M1560,N,N,S:.:AMIGAOS:3.9 BB2 MiamiDX
 708
 709 # ----------------- FreeMiNT ----------------
 710
 711 S44:255:0:44:M536:.:FreeMiNT:1 patch 16A (Atari)
 712
 713 ###########################################
 714 # Appliance / embedded / other signatures #
 715 ###########################################
 716
 717 # ---------- Firewalls / routers ------------
 718
 719 S12:64:1:44:M1460:.:@Checkpoint:(unknown 1)
 720 S12:64:1:48:N,N,S,M1460:.:@Checkpoint:(unknown 2)
 721 4096:32:0:44:M1460:.:ExtremeWare:4.x
 722
 723 S32:64:0:68:M512,N,W0,N,N,T,N,N,?12:.:Nokia:IPSO w/Checkpoint NG FP3
 724 S16:64:0:68:M1024,N,W0,N,N,T,N,N,?12:.:Nokia:IPSO 3.7 build 026
 725
 726 S4:64:1:60:W0,N,S,T,M1460:.:FortiNet:FortiGate 50
 727
 728 8192:64:1:44:M1460:.:@Eagle:Secure Gateway
 729
 730 # ------- Switches and other stuff ----------
 731
 732 4128:255:0:44:M*:Z:Cisco:7200, Catalyst 3500, etc
 733 S8:255:0:44:M*:.:Cisco:12008
 734 S4:255:0:44:M536:Z:Cisco:IOS 11.0
 735 60352:128:1:64:M1460,N,W2,N,N,T,N,N,S:.:Alteon:ACEswitch
 736 64512:128:1:44:M1370:.:Nortel:Contivity Client
 737
 738 # ---------- Caches and whatnots ------------
 739
 740 8190:255:0:44:M1428:.:Google:Wireless Transcoder (1)
 741 8190:255:0:44:M1460:.:Google:Wireless Transcoder (2)
 742 8192:64:1:64:M1460,N,N,S,N,W0,N,N,T:.:NetCache:5.2
 743 16384:64:1:64:M1460,N,N,S,N,W0,N:.:NetCache:5.3
 744 65535:64:1:64:M1460,N,N,S,N,W*,N,N,T:.:NetCache:5.3-5.5 (or FreeBSD 5.4)
 745 20480:64:1:64:M1460,N,N,S,N,W0,N,N,T:.:NetCache:4.1
 746 S44:64:1:64:M1460,N,N,S,N,W0,N,N,T:.:NetCache:5.5
 747
 748 32850:64:1:64:N,W1,N,N,T,N,N,S,M*:.:NetCache:Data OnTap 5.x
 749
 750 65535:64:0:60:M1460,N,W0,N,N,T:.:CacheFlow:CacheOS 4.1
 751 8192:64:0:60:M1380,N,N,N,N,N,N,T:.:CacheFlow:CacheOS 1.1
 752
 753 S4:64:0:48:M1460,N,N,S:.:Cisco:Content Engine
 754
 755 27085:128:0:40:.:.:Dell:PowerApp cache (Linux-based)
 756
 757 65535:255:1:48:N,W1,M1460:.:Inktomi:crawler
 758 S1:255:1:60:M1460,S,T,N,W0:.:LookSmart:ZyBorg
 759
 760 16384:255:0:40:.:.:Proxyblocker:(what's this?)
 761
 762 65535:255:0:48:M*,N,N,S:.:Redline: T|X 2200
 763
 764 # ----------- Embedded systems --------------
 765
 766 S9:255:0:44:M536:.:PalmOS:Tungsten T3/C
 767 S5:255:0:44:M536:.:PalmOS:3/4
 768 S4:255:0:44:M536:.:PalmOS:3.5
 769 2948:255:0:44:M536:.:PalmOS:3.5.3 (Handera)
 770 S29:255:0:44:M536:.:PalmOS:5.0
 771 16384:255:0:44:M1398:.:PalmOS:5.2 (Clie)
 772 S14:255:0:44:M1350:.:PalmOS:5.2.1 (Treo)
 773 16384:255:0:44:M1400:.:PalmOS:5.2 (Sony)
 774
 775 S23:64:1:64:N,W1,N,N,T,N,N,S,M1460:.:SymbianOS:7
 776 8192:255:0:44:M1460:.:SymbianOS:6048 (Nokia 7650?)
 777 8192:255:0:44:M536:.:SymbianOS:(Nokia 9210?)
 778 S22:64:1:56:M1460,T,S:.:SymbianOS:? (SE P800?)
 779 S36:64:1:56:M1360,T,S:.:SymbianOS:60xx (Nokia 6600?)
 780 S36:64:1:60:M1360,T,S,W0,E:.:SymbianOS:60xx
 781
 782 32768:32:1:44:M1460:.:Windows:CE 3
 783
 784 # Perhaps S4?
 785 5840:64:1:60:M1452,S,T,N,W1:.:Zaurus:3.10
 786
 787 32768:128:1:64:M1460,N,W0,N,N,T0,N,N,S:.:PocketPC:2002
 788
 789 S1:255:0:44:M346:.:Contiki:1.1-rc0
 790
 791 4096:128:0:44:M1460:.:Sega:Dreamcast Dreamkey 3.0
 792 T5:64:0:44:M536:.:Sega:Dreamcast HKT-3020 (browser disc 51027)
 793 S22:64:1:44:M1460:.:Sony:Playstation 2 (SOCOM?)
 794
 795 S12:64:0:44:M1452:.:AXIS:Printer Server 5600 v5.64
 796
 797 3100:32:1:44:M1460:.:Windows:CE 2.0
 798
 799 ####################
 800 # Fancy signatures #
 801 ####################
 802
 803 1024:64:0:40:.:.:-*NMAP:syn scan (1)
 804 2048:64:0:40:.:.:-*NMAP:syn scan (2)
 805 3072:64:0:40:.:.:-*NMAP:syn scan (3)
 806 4096:64:0:40:.:.:-*NMAP:syn scan (4)
 807
 808 1024:64:0:40:.:A:-*NMAP:TCP sweep probe (1)
 809 2048:64:0:40:.:A:-*NMAP:TCP sweep probe (2)
 810 3072:64:0:40:.:A:-*NMAP:TCP sweep probe (3)
 811 4096:64:0:40:.:A:-*NMAP:TCP sweep probe (4)
 812
 813 1024:64:0:60:W10,N,M265,T,E:P:-*NMAP:OS detection probe (1)
 814 2048:64:0:60:W10,N,M265,T,E:P:-*NMAP:OS detection probe (2)
 815 3072:64:0:60:W10,N,M265,T,E:P:-*NMAP:OS detection probe (3)
 816 4096:64:0:60:W10,N,M265,T,E:P:-*NMAP:OS detection probe (4)
 817
 818 1024:64:0:60:W10,N,M265,T,E:PF:-*NMAP:OS detection probe w/flags (1)
 819 2048:64:0:60:W10,N,M265,T,E:PF:-*NMAP:OS detection probe w/flags (2)
 820 3072:64:0:60:W10,N,M265,T,E:PF:-*NMAP:OS detection probe w/flags (3)
 821 4096:64:0:60:W10,N,M265,T,E:PF:-*NMAP:OS detection probe w/flags (4)
 822 4096:64:0:60:W10,N,M265,T,S:PF:-*NMAP:OS detection probe w/flags (4)
 823
 824 32767:64:0:40:.:.:-*NAST:syn scan
 825
 826 12345:255:0:40:.:A:-p0f:sendsyn utility
 827
 828 # UFO - see tmp/*:
 829 56922:128:0:40:.:A:-@Mysterious:port scanner (?)
 830 5792:64:1:60:M1460,S,T,N,W0:T:-@Mysterious:NAT device (2nd tstamp)
 831 S12:128:1:48:M1460,E:P:@Mysterious:Chello proxy (?)
 832 S23:64:1:64:N,W1,N,N,T,N,N,S,M1380:.:@Mysterious:GPRS gateway (?)
 833
 834 #####################################
 835 # Generic signatures - just in case #
 836 #####################################
 837
 838 *:128:1:52:M*,N,W0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w, tstamp-)
 839 *:128:1:52:M*,N,W*,N,N,S:.:@Windows:XP/2000 (RFC1323+, w+, tstamp-)
 840 #*:32:1:52:M*,N,W3,N,N,S:.:@Windows:XP/2000 (RFC1323+, w+, tstamp-)
 841 #*:64:1:52:M*,N,N,S,N,W2:.:@Windows:XP/2000 (RFC1323+, w+, tstamp-)
 842 *:128:1:52:M*,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w-, tstamp+)
 843 *:128:1:64:M*,N,W0,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w, tstamp+)
 844 *:128:1:64:M*,N,W*,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w+, tstamp+)
 845 *:64:1:64:M*,N,W*,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w+, tstamp+, ttl- ?)
 846
 847 *:128:1:48:M536,N,N,S:.:@Windows:98
 848 *:128:1:48:M*,N,N,S:.:@Windows:XP/2000
 849
 850 ###################
 851 # PRADS TEST SIGS #
 852 ###################
 853 #65535:128:1:48:M1460,N,N,S:.:Windows:XP
 854 # NT 6.0 = 2008 Server ?
 855 8192:128:1:52:M1460,N,W2,N,N,S:.:Windows:2008 Server
 856
 857 # Generic Linux
 858 S4:64:1:60:M*,S,T,N,W*:.:@Linux:2.6 (Generic dfrag+)
 859 S4:64:0:60:M*,S,T,N,W*:.:@Linux:2.6 (Generic dfrag-)
 860
 861 S4:64:0:60:M1430,S,T,N,W6:.:Linux:2.6 (Google)
 862
 863
 864 ###########################
 865 # PRADS EXPERIMENTAL SIGS #
 866 ###########################
 867 # I Have no clue what theese are, but collecting :)
 868
 869 # Netcache OnTap
 870 #24576:64:1:64:M1460,N,W0,N,N,T,S:.:NetCache: OnTap (?) (Windows NT 5.1)
 871 #65535:64:1:64:M1460,N,W1,N,N,T,S:.:UNKNOWN:UNKNOWN (Closest: NetCache' => '5.3)
 872 #16384:64:1:64:M1460,N,N,S,N,W0,N:.:NetCache:5.3
 873 #65535:64:1:64:M1460,N,W1,N,N,T,S:.:UNKNOWN:UNKNOWN (Closest: NetCache' => '5.3)
 874 65535:64:1:64:M1460,N,W*,N,N,T,S:.:NetCache:5.3 (Generic?)
 875
 876 # WinNT
 877 #65535:128:1:48:M1432,N,N,S:.:Windows: NT 5.1
 878 #53760:64:1:64:M1440,N,W3,N,N,T0,N,N,S:.:@Windows:XP/2000 (RFC1323+, w+, tstamp+)  (closest match)
 879 #S48:128:0:48:M1360,N,N,S:.:Windows:XP w/Winroute? (closest match)
 880 #65535:128:1:48:M1460,N,N,S:.:Windows:2003 Server/msnbot
 881 #53760:64:1:64:M1440,N,W3,N,N,T0,N,N,S:.:UNKNOWN:UNKNOWN @Windows' => 'XP/2000 (RFC1323+, w+, tstamp+)
 882
 883 # UNKNOWN:UNKNOWN - We would like to know what this is and if it is a valid fingerprint.
 884 # Since they can be b0rked packets - hench not interresting to match on.
 885 65535:128:0:44:M1360:.:UNKNOWN:UNKNOWN
 886 S4:64:1:48:M1460,N,W8:.:UNKNOWN:UNKNOWN
 887 65535:128:0:48:M1460,N,N,S:A:Redline:T|X 2200
 888 #Packet has no match for zero timestamp:0
 889 8192:128:1:52:M1380,N,W2,N,N,N,N:.:UNKNOWN:UNKNOWN
 890 #Packet has no match for option count:0
 891 16384:128:0:40:.:.:ULTRIX:4.x? UC
 892 #Packet has no match for option count:7
 893 16384:128:1:60:M1460,N,N,T0,N,N,S:.:UNKNOWN:UNKNOWN
 894 #Packet has no match for option count:17
 895 65535:64:0:60:M1460,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N:.:UNKNOWN:UNKNOWN
 896
 897
 898