# Nmap OS Fingerprint List. -*- mode: fundamental; -*- # $Id$ # # Contributions to this database are welcome. If Nmap obtains a new # fingerprint (and test conditions are favorable), it will print out a # URL you can use to submit the fingerprint. If Nmap guesses wrong, # please send the full Nmap output and the exact destination host OS # name and version to fyodor@insecure.org . Thanks! # # By submitting fingerprints you are transfering any and all copyright # interest in the data to Fyodor so that he can modify it, relicense it, # incorporate it into programs, etc. # # This collection of fingerprint data is (C) 1998-2003 by # Insecure.Com LLC. This data is available for # free use by open source software under the terms of the GNU General # Public License. We also license the data to selected # commercial/proprietary vendors under less restrictive terms. # Contact sales@insecure.com for more information. # # TEST DESCRIPTION: # Tseq is the TCP sequenceability test # T1 is a SYN packet with a bunch of TCP options to open port # T2 is a NULL packet w/options to open port # T3 is a SYN|FIN|URG|PSH packet w/options to open port # T4 is an ACK to open port w/options # T5 is a SYN to closed port w/options # T6 is an ACK to closed port w/options # T7 is a FIN|PSH|URG to a closed port w/options # PU is a UDP packet to a closed port Fingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0 TSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com Access Builder 4000 Switch T1(DF=N%W=0|800%ACK=S++%Flags=AR|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint 3Com terminal server ESPL CS2100 TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # 3Com NBX Superstack 3 IP PBX running firmware 4_1_11 # 3com NBX-100 (version R4_1_4) Phone System Processor Fingerprint 3Com NBX PBX TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint 3com Office Connect Router 810 TSeq(Class=TD%gcd=<186A4%SI=<14) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint 3Com OfficeConnect Remote 812 ADSL Router TSeq(Class=TD%gcd=<C354%SI=<1E) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Switch 1100, 3300 Fingerprint 3Com SuperStack II switch (OS v 2.0) TSeq(Class=C) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com SuperStack II switch SW/NBSI-CF,11.1.0.00S38 TSeq(Class=TD%gcd=<68%SI=<3C) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com Netbuilder & Netbuilder II router OS v8.1 TSeq(Class=TD%gcd=32|64|96%SI=<FF) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) # 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1) Fingerprint 3Com Netbuilder Remote Office 222 router TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1) TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint 3Com Netbuilder II Router Ver 11.4.0.51 TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com NetBuilder-II, OS version SW/NB2M-BR-5.1.0.27 TSeq(Class=TD%gcd=32|64|96%SI=<F) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS|AP%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint 3Com NetBuilder & NetBuilder II OS v 9.3 TSeq(Class=TD%gcd=3C%SI=<FF) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) # 3COM Sharkfin/Tailfin Cable Modem boot code 01.00.003a main image 1.17 hardware 2.00 web 604 Fingerprint 3Com Sharkfin/Tailfin Cable Modem TSeq(Class=TD%gcd=<D6DC%SI=<14%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com Sharkfin/Tailfin Cable Modem TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint 4.3BSD-tahoe on a MicroVax III TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Dell Powervault 132T Automated Tape Library TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # DELL PowerVault 132T Library (Firmware 103D.GY001) Fingerprint Dell Powervault 132T Automated Tape Library TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=578%ACK=O%Flags=A%Ops=) T4(DF=N%W=578%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Tested ACC Amazon 9.2.29, ACC Congo 9.2.35 Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Alteon Networks ACEswitch 180e Software Version 8.0.62.7 TSeq(Class=RI%gcd=<14%SI=<D45BC&>85A%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Actiontec 1520 DSL gateway with GlobespanVirata chipset hardware version RD6700 BSP v1.1 (ISOS 8.2) / He100/2xx CSP v2.3, firmware version 8.2.0.16 Fingerprint Actiontec 1520 DSL gateway firmware 8.2.0.16 TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U) T1(DF=N%W=1194%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=1194%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=1194%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Avaya G3 PBX version 8.3 TSeq(Class=RI%gcd=<6%SI=<652372&>89CC%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Avaya TN2302 Prowler/Medpro H.323 gateway HW03/FW022 Fingerprint Avaya TN2302 Prowler/Medpro H.323 gateway TSeq(Class=TD%gcd=<6%SI=<14%IPID=I) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SMC Barricade Wireless Broadband Router (firmware R1.93e) # D-LINK DL-707 Cable/DSL Router Fingerprint SMC Barricade or D-Link DL-707 Wireless Broadband Router TSeq(Class=TD%gcd=<130%SI=<1E%IPID=RD|I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SMC Barricade Wireless Broadband Router (firmware R1.93e) TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # SMC Barricade7004VBR Boot Code v1.05 # SMC 7004VBR broadband router - firmware v1.2 # SMC Wireless AP 7004WFW # SMC7004vwbr Barricade Wireless Cable/DSL Broadband Router Fingerprint SMC Barricade DSL Router/Modem/Wireless AP TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SMC Barricade Router, firmware 1.94a TSeq(Class=TD%gcd=<68%SI=<32%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Cisco 350 Access Point, software rev 12.02T1 # Accelerated Networks VoDSL - But what sort of device? Fingerprint SonicWall SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL, or Cisco 360 Access Point TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Acorn RISC OS 3.60 (Acorn TCP/IP Stack 4.07) TSeq(Class=TR) T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd) TSeq(Class=RI%gcd=<6) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # AGE Logic, Inc. IBM X-Station Fingerprint AGE Logic, Inc. IBM XStation TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge TSeq(Class=C%Val=0) T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps wireless access point TSeq(Class=TR%gcd=<6) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Aironet Wireless Bridge running firmware V5.0J TSeq(Class=C|TR) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=) T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint IBM AIX 3.2 TSeq(Class=64K) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2 TSeq(Class=64K) T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2 running on RS/6000 TSeq(Class=64K) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2.3 running on RS6000 model 560 TSeq(Class=64K) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2.5 (Bull HardWare) TSeq(Class=64K) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.0 - 4.2 TSeq(Class=64K) T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AIX 4.02.0001.0000 TSeq(Class=TR) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AIX v4.2 TSeq(Class=TR%gcd=<6) T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E) Fingerprint IBM AIX 4.1-4.1.5 TSeq(Class=64K) T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX v4.1 running on a C10 TSeq(Class=64K) T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AIX 4.1 TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.2 TSeq(Class=TR) T1(DF=N%W=FFAF|FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.2-4.3.3 TSeq(Class=TR) T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.2.X-4.3.3.0 TSeq(Class=TR%IPID=I%TS=U) T1(DF=N|Y%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Fingerprint IBM AIX 4.3.3 on an RS/6000 H50 # Fingerprint IBM AIX 4.3.3 on a p660-6M1 # IBM AIX 4.3.3 ML10 Fingerprint IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/* TSeq(Class=TR%gcd=<6) T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0|F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM 8239 Token-Ring Stackable Hub TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4R2M0 TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4R5M0 T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IBM proprietary operating system for AS/400 systems (now known as "iSeries") Fingerprint IBM OS/400 V5R1M0 TSeq(Class=RI%gcd=<24%SI=<19DCD2&>6D3%IPID=I) T1(DF=N|Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V5R2M0 TSeq(Class=RI%gcd=<24%SI=<41D304&>7BC%IPID=I) T1(DF=N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # OS/400 V5R1M0 w/ C2134 + Autumn '02 Hiper, DB & Java Fingerprint IBM OS/400 V5R1M0 TSeq(Class=TD%gcd=<22222%SI=<14%IPID=I%TS=1000HZ) T1(DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Fingerprint IBM-RS/6000 7017-S80 AIX-Version 4.3.3.0 Fingerprint IBM AIX 4.3.3.0 on an IBM RS/* TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.3 TSeq(Class=TR%gcd=<6) T1(DF=Y%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX Version 4.3 TSeq(Class=TR%gcd=<6) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1 on a p610-6C1 TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Fingerprint IBM AIX 5.1.0.0 maintenance level 3 Fingerprint IBM AIX 5.1 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0|4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Alcatel 1000 ADSL (modem) TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Alcatel 1000 DSL Router TSeq(Class=RI%gcd=<5%SI=>AAA&<AAAAA) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Alcatel Advanced Reflexes IP Phone, Version: E/AT400/46.8 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint Alcatel OmniStack switch version 4.3.3 GA TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Alcaltel Speed Touch Home running GV8BAA3.235 (992640) # Alcatel SpeedTouch Pro ADSL Router running NZ OS 3.281 # Alcatel Speed Touch Home ADSL Modem (POTS), Ver 3.2 Fingerprint Alcatel Speed Touch *DSL modem/router TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E|F%ULEN=134%DAT=E) # Alcaltel Speed Touch 510 *DSL router (uses THOMSON Unix embeded Version 4.0.0.9.0) Fingerprint Alcatel Speed Touch 510 *DSL modem/router TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub TSeq(Class=C) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA TSeq(Class=TD%gcd=FA|1F4%SI=<FFF) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Allied Telesyn AT-RP24i Rapier 24i version 2.3.1-04 # Ericsson Home internet Solution ver. 2.0 Fingerprint Allied Telesyn AT-RP24i switch or Ericcson HiS V2.0 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Alteon AceSwitch 110 (software 4.0.37) # Centillion C100 ATM Switch OS Version 2.0.2. Fingerprint Alteon AceSwitch 110 or Cantillion C100 ATM Switch TSeq(Class=TD%gcd=<9C8%SI=<1E) T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Alteon ACEswitch 184 Software Version 8.0.49 Fingerprint Alteon ACEswitch 184 V. 8.0.49 TSeq(Class=RI%gcd=<34%SI=<C698A&>215%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AmigaOS Miami 2.1-3.0 TSeq(Class=TR) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami 3.0 TSeq(Class=TR) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami 3.1-3.2 TSeq(Class=TR) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B TSeq(Class=TR) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m TSeq(Class=TR%gcd=<6) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0c TSeq(Class=TR%gcd=<6) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS AmiTCP/IP 4.3 TSeq(Class=64K) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS AmiTCP/IP Genesis 4.6 TSeq(Class=64K) T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Amos 2.3A TSeq(Class=i800%gcd=<6%SI=<14) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AOS/VS on a Data General mainframe TSeq(Class=TD%gcd=32|64|96%SI=1) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Apollo Domain/OS SR10.4 TSeq(Class=TD|RI%gcd=<6%SI=<FF) T1(DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M) T4(DF=N%W=239C%ACK=O%Flags=R%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=O%Flags=R%Ops=) T7(DF=N%W=800%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint AOS/VS or VSII TSeq(Class=TD%gcd=40|80|C0%SI=0) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint APC MasterSwitch Network Power Controller TSeq(Class=TR) T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint APC Web/SNMP UPS management card TSeq(Class=RI%gcd=<6%SI=<52FB700&>D46DF) T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Smart-UPS 3000RM Firmware: 92.14.I Fingerprint APC Smart-UPS 3000RM TSeq(Class=TD%gcd=<138C%SI=<DC%IPID=I) T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint ARESCOM NetDSL 1000NDS series ADSL router TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint ARLAN BR2000E V5.0E Radio Bridge TSeq(Class=TR%gcd=<6) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Ascend DSLPipe DSL-50S-CELL DSL router TSeq(Class=RI%gcd=<6%SI=<671E2&>114%IPID=I%TS=U) T1(DF=Y%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend P130 Router TSeq(Class=RI%gcd=<6%SI=>BBB&<BBBB) T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Ascend Max 1800 50Ap8+ or 2024 router TSeq(Class=TD%gcd=388|710|A98%SI=<F) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash - I think meant TAOS Fingerprint Ascend / Lucent MAX TNT Running TAOS version 8.0.1 w/ VoIP Hash TSeq(Class=RI%gcd=<6%SI=<14F46&>346) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Ascend/Lucent Max (HP,4000-6000) version 6.1.3 - 7.0.2+ TSeq(Class=RI%gcd=<6%SI=>1000) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline 50 running 5.1A Firmware TSeq(Class=64K) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline 50 TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline 50 rev 4.6C TSeq(Class=TD%gcd=388|710%SI=<5) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend GRF Router running Ascend Embedded/OS 2.1 TSeq(Class=RI%gcd=<5%SI=>600) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Ascend P75 router TSeq(Class=RI%gcd=<6%SI=>500&<FFFF) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline P130 or 50 TSeq(Class=TD%gcd=388|710|A98%SI=<BB) T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline 400/T1 (Software V 4.5B) TSeq(Class=TD%gcd=388|710|A98%SI=<FF) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend TNT OS +5.0Ap48+ TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Airport Extreme Base Station (WAP) TSeq(Class=RI%gcd=<6%SI=<94160&>15CB%IPID=I%TS=2HZ) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # on Macintosh GS server Fingerprint Apple Mac OS 8.5.1 (Appleshare IP 6.0) TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 running on a PowerPC G3 (iMac) TSeq(Class=64K) T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.6 TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # MacOS 8.6 running WebStar http server Fingerprint Apple Mac OS 8.6 TSeq(Class=64K%IPID=I%TS=U) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Mac OS 9 on a Power Macintosh 7200/75 # iMac running Mac OS 9.1 Fingerprint Apple Mac OS 9 - 9.1 TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Mac OS X Server 1.0 - 1.0-1 <-- should be 10.1.0? Fingerprint Apple Mac OS X Server 1.0-1.0-1 (Rhapsody 5.3 - 5.4) TSeq(Class=RI%gcd=<5%SI=>BBB&<FFFF) T1(W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(W=2000%ACK=O%Flags=R%Ops=) T5(W=0%ACK=S++%Flags=AR%Ops=) T6(W=0%ACK=O%Flags=R%Ops=) T7(W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Mac OS X 1.1-1.2 Fingerprint Apple Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3 TSeq(Class=RI%gcd=<5) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.1 - 10.1.4 TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.1.4 (Darwin Kernel 5.4) on iMac TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.1.5 TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Mac OS 10.2.6, darwin kernel 6.6 Fingerprint Apple Mac OS X 10.1.5-10.2.6 TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.2.6 (Jaguar) TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Newton MessagePad 2100, Newton OS 2.1 T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=R%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=R%Ops=) T7(DF=N%W=1000%ACK=S%Flags=R%Ops=) PU(Resp=N) # Actually it is not constant seq class -- it just seems that way # because it takes so long to increment Fingerprint Apple Color LaserWriter 600 Printer TSeq(Class=C) T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=A28%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=800%ACK=O%Flags=R%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Color LaserWriter 600 Printer TSeq(Class=C) T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Color LaserWriter 12/660 PS (Model No. M3036) T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=C00%ACK=O%Flags=R%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple LaserWriter 16/600 PS, HP 6P, or HP 5 Printer TSeq(Class=C) T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) # The sequence prediction is never really true random, but sometimes it # has two unique "tracks" which make it look random to nmap. Here is a # real example: Sequence numbers: 5576001 25D001 5576001 25D001 Fingerprint Apple LaserWriter 8500 (PostScript version 3010.103) TSeq(Class=TR|C) T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Asante 6524-2G GigE switch TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Asante IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 )) TSeq(Class=C%Val=4090000) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Asante IntraSwitch 5324 TSeq(Class=C%Val=80000) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Asante IntraSwitch 62xx (6216M in this case) Firmware v2.05A (16-port managed switch) Fingerprint Asante IntraSwitch 6216M firmware v2.05A TSeq(Class=TD%gcd=<C28C%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AsanteHub 2072 Ethernet Hu TSeq(Class=C) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Asante FriendlyNet FR3004 Series Internet Hub TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Auspex Fileserver (AuspexOS 1.9.1/SunOS 4.1.4) TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Atari Mega STE running JIS-68k 3.0 TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86) T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AtheOS ( www.atheos.cx ) TSeq(Class=RI%gcd=<8%SI=<A78&>6) T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint AtheOS/Syllable 0.4.2 TSeq(Class=RI%gcd=<A%SI=<1BDA%IPID=I%TS=U) T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint ATT Unix SVR4.2 on a Lucent Definity voicemail system TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Apple A/UX 3.1.1 SVR2 or OpenStep 4.2 TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Axent Raptor Firewall running on Windows NT TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) # Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) Fingerprint AXIS or Meridian Data Network CD-ROM server TSeq(Class=C) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=) T4(DF=N%W=200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS 540/542 print server v5.30 Jan 24 1997 Fingerprint AXIS 540/542 print server v5.30 TSeq(Class=C) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Axis 540 e'net print server ver 5.48 TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Axis 540 print server T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Axis 2120 network camera TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AXIS NetEye Camera Server V1.20 TSeq(Class=C) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS NetEye Camera Server V1.20 # Axis NPS 53X Printer Server V4.26 Jul 01 1995 # AXIS StorPoint CD-Rom server V 4.20 # AXIS Camera 200pV1.41 Fingerprint AXIS Stack -- CD-ROM Server or Print Server or Camera Server TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Axis 200+ Web Camera running OS v1.42 T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) # The AXIS 2100 Network Camera Operating System, Linux/CRIS, is based on the Linux 2.0 kernel with non-MMU CPU patches from uC-Linux. The HTTP server used is based on Boa. The source code for the Linux/CRIS kernel, Boa and more is available at http://developer.axis.com/. Fingerprint Axis 2100 Network Camera running Linux/CRIS v2.32 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=) T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AXIS 540+/542+ Network Print Server T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=) T4(DF=N%W=100%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99) # Bay Networks ASN Processor revision 9, SE100NM and SFNM modules Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9 T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Bay Networks BayStack 310T switch TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=<F) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint BayStack 28115/ADV Fast Ethernet Switch TSeq(Class=TD%gcd=<6%SI=<FF) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Baystack Instant Internet 400 SoHo Router TSeq(Class=RI%gcd=<24%SI=<4D33C&>C46) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S%Flags=R%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Running on a BeBox 66Mhz Fingerprint BeOS 4 - 4.5 TSeq(Class=TD%gcd=1%SI=0) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint BeOS R5.03 Personal Edition TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint BeOS 5.0.4 (BeOS 5 Pro + BONE 7a) TSeq(Class=TD%gcd=<6%SI=<C8%IPID=I%TS=U) T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint BeOS 5.1d0/DANO on x86 TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U) T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # F5 labs BigIp Load balancer. BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386 # F5 BIG-IP 540 loadbalancer. Fingerprint F5 Labs BigIp Load balancer Kernel 4.1.1PTF-03 (X86) TSeq(Class=TR%gcd=<6) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint F5 Labs Big-IP load balancer kernel 4.2PTF-05a (X86) TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint FiberLine WL-1200R1 (also known as InterEpoch IWE-1200A-1) Wireless Broadband Router (WAP) TSeq(Class=TD%gcd=<8%SI=<14%IPID=I%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # XS SW Release 4.9.1 ISDN access router # Bintec BIANCA XM OS-Version 4.93 Fingerprint Bintec XS/XM ISDN access router V. 4.9.1-4.9.3 TSeq(Class=RI%gcd=<6%SI=>FF&<FFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=0%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Borderware 5.0 Firewall TSeq(Class=TR|RI%gcd=<204%SI=<14) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Borderware 5.2 firewall TSeq(Class=TR%gcd=<6) T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=N) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Borderware 6.0.2 firewall TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) # http://www.brixnetworks.com/products/brix1000.html Fingerprint Brix 1000 Verifier TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 2.0 - 2.1 TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD) TSeq(Class=RI%gcd=<6) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 4.0-4.0.1 TSeq(Class=RI%gcd=<A%SI=<1974A&>16F) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 4.0.1 TSeq(Class=RI%gcd=<6%SI=<F85E8&>27A9) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # (rel. ID: 17908) Fingerprint CacheFlow 6000 web proxy running Security Gateway 2.1.0 TSeq(Class=RI%gcd=<6%SI=<CB91C&>15C0%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint CacheOS (CacheFlow 2000 proxy cache) TSeq(Class=RI%gcd=<5%SI=>1111) T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Canon GP 160 PF printer TSeq(Class=TD%gcd=<C04%SI=<1E%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Canon IR6000 printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Canon photocopier/fax/scanner/printer GP30F TSeq(Class=TD%gcd=600%SI=0) T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Capellix 3000 Modular SAN Switch TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Chase IOLan Terminal Server T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(Resp=N) Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build) TSeq(Class=RI%gcd=<6%SI=<18358&>3CB) T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Checkpoint Firewall-1 on Windows NT 4.0 Server SP4-SP5 TSeq(Class=TD%gcd=<8%SI=<154) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Checkpoint Firewall-1/VPN-1 SecurePlatform NG, running FeaturePack 3 Fingerprint Checkpoint SecurePlatform NG FP3 TSeq(Class=RI%gcd=<6%SI=<1C6F042&>48C8B%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1200 access point (WAP) running IOS 12.2(8) TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco AIR-WGB340 V8.38 Workgroup Bridge 340 Fingerprint Cisco AIR-WGB340 V8.38 wireless workgroup bridge 340 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1F4|1000%ACK=S++%Flags=AR|AS%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco WGB350 802.11b WorkGroup Bridge TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=5C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1) TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=<F) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 766 non-IOS software 4.2(3.5) TSeq(Class=TD%gcd=82000%SI=<F) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1538M HUB running Cisco 1538M EES (1.00.00) or Assured Access Technology ISAS Switch Release-2.3.0 or Thomson Multimedia RCA DCM245 Cable Modem TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 2620 router running IOS 12.1(6) TSeq(Class=RI%gcd=<6%SI=<ABC2&>78%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Cisco 3600 router running IOS 12.2(6c) TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 1720 router running 12.2.8T4 with IP/FW/PLUS/3DES feature set # CISCO 801 router running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1) Fingerprint Cisco 801/1720 router running IOS 12.2.8 TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 827 aDSL router running IOS 112.2(11) TSeq(Class=RI%gcd=<6%SI=<1B1F2&>24E%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Found on Cisco 1720/1750/2611/3640/AS5300 routers Fingerprint Cisco router running IOS 12.1.5-12.2.13a TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1601R router running IOS 12.1(5) TSeq(Class=TD%gcd=<6%SI=<32%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 4500 router running IOS 11.2(2) T1(DF=N%W=860%ACK=S++|O%Flags=AS|A%Ops=M|) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Cisco 7206 running IOS 11.1(24) TSeq(Class=RI%gcd=<5%SI=<CCCC&>CC) T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Cache Engine Web Proxy TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco CPA2500 (68030) or 2511 router TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(Resp=N) # Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5) # Cisco Catalyst 5500 with OS Version 6.3(5) # Alcatel Omni Switch/Router! Version 4.3.1 GA Fingerprint Cisco Catalyst 5500/6500 or Alcatel Omni Switch/Router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco AS5200 terminal server TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 4006 Switch running NmpSW 7.4(2) SInfo(V=3.00%P=i686-pc-linux-gnu%D=2/12%Time=3E4A758F%O=23%C=1) TSeq(Class=TR%IPID=I%TS=U) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # The "True Random" is bogus, it is because of sequences # from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869 Fingerprint Cisco Localdirector 430, running OS 2.1 TSeq(Class=TR|C) T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL) T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL) T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco PIX 4.2(2) Internal Interface TSeq(Class=C) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall running PIX 4.1(5) TSeq(Class=C%Val=211E005F) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX v4.2 Firewall TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 515 firewall running software 4.4(5) TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 506 Firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall Version 6.1(2) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 515 or 525 running 6.1(4) - 6.2(1) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall Version 6.2(2) - 6.3 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall Version 6.2(1) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) # Cisco 535 IOS 6.2 PIX running in failover mode... ie.. idle # PIX 506 running PIX IOS 6.2 Fingerprint Cisco Firewall (PIX 6.1.4 - 6.2.2) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco Secure PIX Firewall Version 5.0(2) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) # Cisco PIX running IOS 6.1(1) - Internal interface Fingerprint Cisco PIX w/IOS 6.1(1) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 501 firewall running PIX 6.1(1) TSeq(Class=TR%IPID=I%TS=U) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T6(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) # Cisco 3640 router IOS 11.1(7)AX [KUONG(7)AX] # Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6 Fingerprint Cisco switch/router with IOS 11.1(7)-11.2(8.10) TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF) T1(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 2501, 4500 Fingerprint Cisco 2501/4500 router with IOS Version 10.3(15) - 11.1(20) TSeq(Class=RI|TD%gcd=<6%SI=<2000) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IP Phone 7910 or 7940 Firmware 3.1 TSeq(Class=TD%gcd=<1E004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=578%ACK=O%Flags=R%Ops=) T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=578%ACK=S%Flags=R%Ops=) T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IP phone (POS3-04-3-00, PC030301) TSeq(Class=TD%gcd=<C004%SI=<14%IPID=I%TS=U) T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E8%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=3E8%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1) TSeq(Class=RI%gcd=<6%SI=>BBB) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 5200 router running IOS v12.0(15) TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 4500-M router running IOS 11.3(6) IP Plus TSeq(Class=RI|TD%gcd=1%SI=<FFF) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 1900 switch, Bay networks 350-450 switch, or Netopia DSL/ISDN router TSeq(Class=TD%gcd=<6000%SI=<1E) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 2820 switch Management Console TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N|Y) Fingerprint Cisco IOS 11.3 - 12.0(11) TSeq(Class=TD|RI%gcd=<6) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 1700 running IOS 12.0(7)T Fingerprint IOS 12.0(7)T (on a 1700 router) TSeq(Class=RI%gcd=<6%SI=<7A6C&>D%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS 12.0(21) (On a 2514 router) TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco IOS 12.0(16a) Service Provider feature set # Cisco WS-C3508G-XL running 12.0(5)WC3 Fingerprint Cisco IOS 12.0(5)WC3 - 12.0(16a) TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 2950 switch running IOS 12.0(5.3)WC(1) TSeq(Class=TR%gcd=<6%IPID=C%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 827 ADSL router running IOS 12.1(1)XB1 TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 7206 router (IOS 11.1(17) TSeq(Class=RI%gcd=<6%SI=>666) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1600/3640/7513 Router (IOS 11.2(14)P) TSeq(Class=RI%gcd=<6%SI=<11170) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Local Director 420 version 2.1.1 TSeq(Class=C) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T TSeq(Class=RI%gcd=<4%SI=<999&>CC) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # 25XX/45XX router, 29XX switch, RSP2 processor Fingerprint Cisco Router/Switch with IOS 11.2 TSeq(Class=RI%gcd=<6%SI=<18000) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS 12.0(3.3)S (perhaps a 7200 router) TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # A Cisco ATA 186 is a little box that allows a standard POTS # telephone to be used as a voice-over-Ip phone. There is a # variation, the ATA 188 that has a pass-through port, much like the # Cisco 7960 phone. Fingerprint Cisco ATA 186 POTS<->VOIP phone gateway device TSeq(Class=TD%gcd=<A0000%SI=<1E%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=ARF%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint Cisco 675 DSL router -- cbos 2.1 T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M) T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 760 Series ISDN router (non IOS) or IBM Stackable Hub TSeq(Class=TD|i800%gcd=<14004%SI=<14) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco ATA-186 or 7905 VoIP Phone TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco CacheOS (1.1.0) TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco Content Engine 505 Software V. 4.2.1 TSeq(Class=RI%gcd=<6%SI=<2D75904&>5AE06%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0|CC%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # running Application and Content Networking System Software 4.2.3 # Fingerprint Cisco Content Engine 560 Software V. 4.2.3 Fingerprint Cisco Content Engine 560 running Content Networking System V. 4.2.3 TSeq(Class=RI%gcd=<6%SI=<19440B6&>40ACE%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco uBR 7223 router TSeq(Class=TR%gcd=<6%IPID=C%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # 3COM 4924 gigabit switch ver 2.04 # Cisco VPN 3000 3.5 Fingerprint Cisco VPN 3000 or 3Com 4924 GigE Switch TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 3000 Series VPN Concentrator TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4) T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Intergraph CLiX R3.1 Vr.7.6.20 6480 TSeq(Class=TD%gcd=<416%SI=<1E) T1(DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Cnet CNIG904B Internet Broadband Gateway firmware version 1.11 TSeq(Class=TD%gcd=<F4%SI=<1D6%IPID=Z%TS=U) T1(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # CNT UltraNet EDGE (SAN Router) softwareversion 1.4.1.2 Fingerprint CNT UltraNet EDGE (SAN Router) V. 1.4.1.2 TSeq(Class=TD%gcd=<61AC%SI=<1E%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cobalt Linux 4.0 (Fargo) Kernel 2.0.34C52_SK on MIPS or TEAMInternet Series 100 WebSense TSeq(Class=TR%gcd=<6) T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # corega BAR SW-4P [Part number:CG-BARSW4P] Fingerprint Corega BAR SW-4P Broadband Access Router T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Commodore 64 with TFE Ethernet Card (uIP TCP/IP stack) TSeq(Class=C%Val=FFFFFFFF%IPID=RD%TS=U) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=APF%Ops=) T3(Resp=Y%DF=N%W=16D0|1CA%ACK=O%Flags=APF%Ops=) T4(DF=N%W=16D0|5B4%ACK=O%Flags=APF%Ops=) T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Commodore 64 with TFE Ethernet Card (Contiki) TSeq(Class=TD%gcd=<18%SI=<1E%IPID=RD|I%TS=U) T1(DF=N%W=F4%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Tested against: 3 RISC Routers (2600i, 2800, and 3500R) all running # firmware 4.5 and two IntraPorts running 4.4.02. I'm told this also # applies to firmare 4.2 on RISC routers, but I have not checked. Fingerprint Compatible Systems (RISC Router, IntraPort) TSeq(Class=TD%gcd=388|710|A98%SI=<6) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Computone Power Rack IntelliServer terminal server Release 1.5.4d TSeq(Class=TD%gcd=40%SI=0) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint ComOS based terminal server - Livingston PortMaster or U.S. Robotics/3Com Total Control T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2 T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Convex OS Release 10.1 TSeq(Class=64K) T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cray UNICOS/mk 8.6 TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1 TSeq(Class=RI%gcd=<6) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL) T2(Resp=N) T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint UNICOS 10.0.0 on Cray 90 TSeq(Class=RI%gcd=<F%SI=<22222&>2222) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL) T2(Resp=N) T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2 TSeq(Class=RI%gcd=<6%SI=>F) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL) T2(Resp=N) T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cyberguard 4.0 firewall TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Cyclades PathRouter V 1.2.4 TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12 TSeq(Class=TD%gcd=30C382%SI=<BB) T1(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=218|0%ACK=S|S++%Flags=AR%Ops=|M) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRAS Remote Access Server v1.1.7 TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRouter TSeq(Class=TD|RI%gcd=<618708%SI=<EEE47C) T1(DF=N%W=46%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=46%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRouter/PC TSeq(Class=RI|TD%gcd=<618708%SI=<1F343) T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06 TSeq(Class=RI%gcd=<6%SI=>18000) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # DECbrouter90T1 Runs Cisco IOS 10.2(5) # Cisco 1601, IOS 11.0 Fingerprint Cisco 1601 (IOS 11.0) or DECbrouter90T1 (Runs Cisco IOS 10.2(5)) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 12008 running IOS 12.0(18.6)S1 # Cisco 7206VXR running IOS 12.0(18)S Fingerprint Cisco router running IOS 12.0(18)S or 12.0(18)S1 TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco IOS 12.0(5)WC5a on a catalyst 2900XL switch TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS 12.1(4) on a 2600 router TSeq(Class=RI%gcd=<A%SI=<9772&>3A%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 3620 running IOS 12.2.1 # IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1) Fingerprint Cisco router running IOS 12.1(5)-12.2(7a) TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 2621 running IOS 12.2.8T # Cisco SOHO 77 running IOS 12.2(8)T Fingerprint Cisco router running IOS 12.2(8)T TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 7507 running 12.2(8)T5 Fingerprint Cisco IOS 12.2(8)T5 on a 7507 router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint DECNIS 600 V4.1.3B multiprotocol bridge/router TSeq(Class=TD%gcd=30D4|C35%SI=<F) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # DECserver 700-16, Network Access SW V2.2 Fingerprint DECserver 700-16 terminal server, Network Access SW V2.2 TSeq(Class=64K) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=600%ACK=S++|O%Flags=AR|A%Ops=) T4(DF=N%W=600%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC VAX/VMS 5.3 on a MicroVAX II TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC VAX/VMS v5.5, CMU-TEK TCP/IP stack TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=64%ACK=O%Flags=AR%Ops=) T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=64%ACK=O%Flags=AR%Ops=) T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint DEC VAX 7000-610 or 4200/SPX OR 6000-430 TSeq(Class=64K) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1800%ACK=O%Flags=A%Ops=) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC VMS MultiNet V4.1(16) TSeq(Class=TR%gcd=<6) T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.1 TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS V6.1 on VAX 4000-105A TSeq(Class=64K) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.2 - 7.2-1 on VAX or AXP TSeq(Class=TR%gcd=<6) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=1800%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS AXP 6.2 running Attachmate Pathway 3.1 TCP stack TSeq(Class=i800|64K) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.2/Alpha TSeq(Class=TR%gcd=<6) T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=2200%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.2 TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=2200%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS Alpha 6.2 running DIGITAL TCP/IP Services (UCX) v4.0 TSeq(Class=64K) T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=) T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.2 TSeq(Class=RI%gcd=<6%SI=<4D8%IPID=BI%TS=U) T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=AS%Ops=MWL) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Digital TCP/IP Services for OpenVMS Alpha Version V4.2 - ECO 4 on a AlphaServer 8400 5/625 running OpenVMS V6.2-1H3 Fingerprint DEC OpenVMS 6.2 TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package TSeq(Class=RI|TD%gcd=<6%SI=<BBBB) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MWL) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4 TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U) T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint DEC OpenVMS 7.1 Alpha running Digital's UCX v4.1ECO2 TCP/IP package TSeq(Class=64K) T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=) T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2 TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS V7.1 on VAX 6000-530 TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC VMS MultiNet V4.2(16)/ OpenVMS V7.1-2 TSeq(Class=TR%gcd=<6) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC VMS MultiNet V4.4 / OpenVMS V7.1 TSeq(Class=TR%gcd=<6%TS=2HZ) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.1 TSeq(Class=TR) T1(DF=N%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2200%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A - ECO 1 on a AlphaServer DS20 500 MHz running OpenVMS V7.2-1 Fingerprint DEC OpenVMS 7.2 TSeq(Class=RI%gcd=<8%SI=<527E2&>543%IPID=I%TS=U) T1(DF=N%W=C3A5%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=C3A5%ACK=O%Flags=A%Ops=) T4(DF=N%W=C350%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.2 TSeq(Class=RI%gcd=<44%SI=<2670&>3B%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.3-1 TSeq(Class=RI%gcd=<6%SI=<56E82&>B37%IPID=I%TS=U) T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # DEC VAXVMS TCPIP V5.1-15 Full LP Installed Fingerprint DEC OpenVMS v7.3 on VAXStation 4000/60 TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # OpenVMS 7.3 with TCP/IP 5.3 Fingerprint DEC OpenVMS 7.3 (Alpha) TCP/IP 5.3 TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.3 (Compaq TCP/IP 5.3) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Digital Networks VNswitch 900 TSeq(Class=TD%gcd=<4%SI=<4) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Digitel NetRouter NR3000 TSeq(Class=RI%gcd=<2004%SI=<10CC&>16) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Digitel NetRouter NR3100 TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Data General DG/UX Release R4.11MU02 TSeq(Class=TD%gcd=10000|20000|30000%SI=<F) T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Data General DG/UX Release R4.20MU02 TSeq(Class=TD%gcd=<20004%SI=<1E) T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # dgux DataGeneral_Server R4.20MU04 generic AViiON PentiumPro Fingerprint Data General DG/UX Release R4.20MU04 TSeq(Class=RI%gcd=<6%SI=<32CBC&>281) T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Data General DG/UX Release R4.20MU06 TSeq(Class=RI%gcd=<6%SI=<E21EE&>779%IPID=I%TS=U) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Digital Link DL2001 CSU/DSU Management Access Processor TSeq(Class=TD%gcd=<2780%SI=<14) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Digital UNIX OSF1 V 3.0,3.2,3.2C TSeq(Class=64K) T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Digital UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F TSeq(Class=RI|TD|64K%gcd=<6) # Boy, OSF1 comes in all colors! T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Draytek Vigor 2000 ISDN router T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Draytek Vigor 2200e DSL router v2.1b TSeq(Class=RI%gcd=<6%SI=<2D38FC2&>72E8A%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Fingerprint Draytek Vigor 2200e DSL Router v2.1a TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Integrated Lights Out remote configuration Board TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=O%Flags=R%Ops=) T2(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Proliant DL580 Integrated Lights-Out remote configuration board V1.06 14.5.2002 Fingerprint Compaq Proliant DL580 Integrated Lights-Out remote configuration board V1.06 TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U) T1(DF=N%W=400%ACK=O%Flags=R%Ops=) T2(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=) T4(DF=N%W=400%ACK=O%Flags=R%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Compaq iPAQ Connection Point (WAP) model CP-2W Rev1.00 # NetGear MR814 WAP Fingerprint WAP: Compaq iPAQ Connection Point or Netgear MR814 T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Compaq Tru64 UNIX (formerly Digital UNIX) 4.0e TSeq(Class=C) T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX 4.0e TSeq(Class=RI%gcd=<6%SI=<7BE80&>DAF%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Compaq Tru64 UNIX 5.0 on AlphaServer # DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A on a DEC 4000 Model 610 running OpenVMS V7.2 Fingerprint Compaq Tru64 UNIX 5.0 or DEC OpenVMS 7.2 TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732) TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732) TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885) TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885) TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Quanterra OS/9 V2.4 on 68K (Quanterra Q4124 - 68030) Fingerprint Quanterra seismic data acquisition system running OS/9 V2.4 on 68K TSeq(Class=i800) T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=) T4(DF=N%W=C000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint OSF1 5.0 Rev. 910 (AKA Compaq/Digital Tru64 Unix) TSeq(Class=RI%gcd=<6%SI=<E88&>11) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OSF/1 V1.3A - 2.0 TSeq(Class=64K) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OSF1 (AKA Compaq/Digital Tru64 UNIX) Version 5.0.0 TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint OSF/1 (AKA Compaq/Digital Tru64 UNIX) 5.60 TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint DEC Digital UNIX OSF1 V 4.0-4.0F TSeq(Class=C|RI%gcd=<6) T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint Sequent DYNIX/ptx 4.0 V4.4.6 i386 TSeq(Class=RI%gcd=<6%SI=<2E4AA&>752%IPID=I%TS=U) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Sequent Dynix/PTX 4.4.2 TSeq(Class=RI%gcd=<6%SI=<15E0&>23) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Software version VIK-1.35.020320j -- www.easytel.fi Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Edimax BR-6004 broadband router TSeq(Class=i800%IPID=I%TS=2HZ) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Edimax PS-901 Print Server model 1P/13E-9.5.12 TSeq(Class=RI%gcd=<2004%SI=<12D4&>1C%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Eicon Diva1830 ISDN router running 1.5 firmware TSeq(Class=TD%gcd=<20004%SI=<14%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M) T2(Resp=Y%DF=N%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M) T4(DF=N%W=1%ACK=O%Flags=R%Ops=) T5(DF=N%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1%ACK=O%Flags=R%Ops=) T7(DF=N%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # ELSA LANCOM DSL/10 Office 2.62.0002 Fingerprint ELSA LANCOM DSL/10 Office router v2.62.0002 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # ELSA LANCOM DSL/I-1611 Office 2.70.0025 / 06.08.2002 http://www.lancom-systems.de/ # ELSA LANCOM DSL/I-1611 Office 2.50.0005 / 15.11.2001 Fingerprint ELSA LANCOM DSL/I-1611 Office router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint EMC DART running on a Data Mover fileserver. Version T4.1.8.1 TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint EMC IP4700 Filer TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Enterasys XP-2400 switch running Enterasys E9.0.0.0 # Cabletron Smartswitch 6000 running Enterasys E8.2.0.0 Fingerprint Enterasys/Cabletron switch running Enterasys E8.2.0.0 - E9.0.0.0 TSeq(Class=RI%gcd=<6%SI=<7A31E&>10AD%IPID=I%TS=2HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20 T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=) T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98 TSeq(Class=TR) T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=) T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Ericsson HM220dp ADSL modem/router TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Exabyte X80 tape backup robot TSeq(Class=TD%gcd=<6004%SI=<14%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0|0%ACK=S++|O%Flags=AS|AR%Ops=M|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Extreme Networks Alpine 3804 Switch running Extremeware 6.2.1 TSeq(Class=RI%gcd=<6%SI=<1598C&>223) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Extreme Networks Black Diamond switch TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Extreme Gigabit switch (unknown version) TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint NAT LANB/290 router Console Program V4.00 TSeq(Class=TD%gcd=<80004%SI=<14) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint NCR server running MP-RAS SVR4 UNIX System Version 3 TSeq(Class=RI%gcd=<6%SI=<31BA1E&>7F38) T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NCR S26 server (i386) running NCR MP-RAS SVR4 UNIX System TSeq(Class=RI%gcd=<6%SI=<2BB718&>6FD5) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint F5 Labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86) TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Broadband Router (Farralon Netopia or Compatible Systems 900i) TSeq(Class=TD%gcd=388|710|A98%SI=<F) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint FastComm FRAD (Frame Relay Access Device) F9200-DS-DNI -- Ver. 4.2.3A TSeq(Class=TD|RI%gcd=<8%SI=<1E) T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=) T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Fore ForeThought 7.1.0 ATM switch TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Foundry 1500 OS Ver 7.2.06T51 # Foundry ServerIron XL 16 Port 7.3.06T12 Fingerprint Foundry Load Balancer OS Ver 7.2.X - 7.3.X TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Foundry FastIron Edge Switch (load balancer) 2402 TSeq(Class=RI%gcd=<6%SI=<3E418&>988%IPID=RD%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry FastIronII 4000 load balancer running 06.6.34T43 TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry NetIron load balancer OS Ver. 7.1.23T13 TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry Networks, Inc. Router/Load balancer, IronWare Version 06.5.12T43 TSeq(Class=C) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry ServerIron XL load balancing IP Switch Version 06.0.00T12 TSeq(Class=C) T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Galacticomm WorldGroup BBS / Vircom TCP/IP stack TSeq(Class=C) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Galacticomm WorldGroup BBS (MajorBBS) w/TCP/IP TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&<BBBBBB) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Gandalf LanLine Router TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Genius print server T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Gnat Box Light firewall v3.0.3 (from the inside interface) TSeq(Class=RI%gcd=<6%SI=<F708&>264) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Gauntlet 4.0a firewall on Solaris 2.5.1 TSeq(Class=RI%gcd=<6%SI=<10540A&>89C%IPID=I%TS=U) T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) # GNet BB0040 DSL router # SAR-703 Combined ADSL Modem/Router Fingerprint GNet BB0040 or SAR 703 DSL modem + router TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Compatible Systems ISDN/leased-line/dialup MicroRouter 900i v3.0.9 TSeq(Class=TD%gcd=388|710|A98%SI=<F) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Compatible Systems ISDN/leased-line/dialup Microrouter 2220R w/ firmware v4.5 TSeq(Class=TD%gcd=388|710|A98%SI=<14) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router TSeq(Class=TD%gcd=<6%SI=<FF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Flowpoint 144 or 22XX DSL Router v3.0.8 # SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready Fingerprint DSL Router: Flowpoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1 TSeq(Class=TR%gcd=<6) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E) # speedstream router 5871 v4.0.1 Fingerprint Speedstream 5871 DSL router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 2.2.1 - 4.1 TSeq(Class=RI%gcd=<8%SI=<38E50&>906) T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M) T4(DF=N%W=4000|0|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E) Fingerprint FreeBSD 2.1.0 - 2.1.5 TSeq(Class=64K) T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 2.2.1-STABLE TSeq(Class=RI%gcd=<8%SI=<74A54&>1295) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 3.2-4.0 TSeq(Class=RI%gcd=<6%SI=<92D42&>1769) T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint FreeBSD 3.4-RELEASE TSeq(Class=RI%gcd=<6%SI=<58AD4&>3BB) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.0-20000208-CURRENT TSeq(Class=RI%gcd=<6%SI=<63074&>FC4) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.1.1 - 4.3 (X86) TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.3 - 4.4-RELEASE TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.3 - 4.4PRERELEASE TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002 Fingerprint FreeBSD 4.4-STABLE TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.4 for i386 (IA-32) TSeq(Class=TR%gcd=<6) T1(DF=Y%W=5B4|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.5-RELEASE (or -STABLE) (X86 # FreeBSD 4.6-RC Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) through 4.6-RC (X86) TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6 TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6-RC on Alpha TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # 4.6-RELEASE # 4.6-STABLE # 4.6.2-RELEASE-p6 Fingerprint FreeBSD 4.6 through 4.6.2 (July 2002) (X86) TSeq(Class=TR%IPID=I%TS=100HZ) T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6 TSeq(Class=RI%gcd=<6%SI=<8AAA2&>96A%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6.2-RELEASE TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.7-RELEASE (X86) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.8-RELEASE # 4.7-STABLE FreeBSD 4.7-STABLE #0: Tue Nov 19 16:13:55 2002 Fingerprint FreeBSD 4.6.2-RELEASE - 4.8-RELEASE TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.7-RELEASE-p3 FreeBSD 4.7-RELEASE-p3 #0: Wed Jan 8 21:31:21 CET 2003 i386 Fingerprint FreeBSD 4.7-RELEASE TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD-4.7-RELEASE-p3 on i386 Fingerprint FreeBSD-4.7-RELEASE-p3 TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.7-STABLE (Jan 2003) Fingerprint FreeBSD 4.7-STABLE TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.7-RELEASE TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.8-STABLE (June 2003) Fingerprint FreeBSD 4.8-STABLE TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|1000HZ) T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.8-STABLE (June 2003) Fingerprint FreeBSD 4.8-STABLE T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002 Fingerprint FreeBSD 5.0-CURRENT (Apr 2002) TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD somehost.someplace 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Jan 29 12:31:51 CST 2003 i386 # FreeBSD 5.0-RELEASE Alpha Fingerprint FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003) TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.0-RELEASE (x86) TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.0-RELEASE TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.0-RELEASE TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.1-CURRENT (June 2003) on Sparc64 TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeSCO 0.27 (Linux kernel 2.0.38) TSeq(Class=RI%gcd=<6%SI=<1F22A6E&>4E0A2%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint FreeSCO 0.27 (Linux kernel 2.0.38) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint GNU Hurd 0.2 (GNUmach-1.2/Hurd-0.2) X86 TSeq(Class=TD|i800%gcd=<3000%SI=<1E%IPID=I%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Hitachi HI-UX/MPP TSeq(Class=64K) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=MNNTWL) T2(Resp=N) T3(Resp=Y%DF=N%W=FF5E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E) # HP Router 210 with OS 9.72 # Netgear RP114 DSL-Router with 4-Port Switch Fingerprint HP Advancestack Etherswitch 224T or 210 or Netgear RP114 DSL-Router w/Switch TSeq(Class=TD%SI=<20) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=400%ACK=O%Flags=R%Ops=) T5(DF=N%W=400%ACK=O%Flags=R%Ops=) T6(DF=N%W=400%ACK=O%Flags=R%Ops=) T7(DF=N%W=400%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Don't ask me what this is :) David says # it is "a Utah port of BSD to HP machines" Fingerprint HP-BSD 2.0 TSeq(Class=64K) T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint HP Deskjet 6127 printer TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ) T1(DF=N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP Entria X station (running Netstation 7.x) TSeq(Class=64K) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HP j4813A ProCurve Switch 2524 # Copper Mountain Networks DSL Concentrator # Compaq Remote Insight Lights-Out remote console card # 3Com Home Wireless Gateway 3CRWE50194-E1, firmware 1.14 # TrueTime NTS-200 GPS Network Time Server # Compaq Lights Out Edition firmware v2.41 # 3Com NBX 25 (Phone System) Version: R1_0_3 Fingerprint Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com NBX 25 phone system or Home Wireless Gateway, or TrueTime NTP clock TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HP JetDirect Print Server Fingerprint HP printer w/JetDirect card TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=N%W=16D0|C90%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=|M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP printer w/JetDirect card TSeq(Class=TD%gcd=<10%SI=<14%IPID=I%TS=U) T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP printer w/JetDirect card TSeq(Class=TD%gcd=<6%SI=<F) T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # HP printer w/JetDirect card (Firmware Rev. H.06.00) Fingerprint HP printer w/JetDirect card TSeq(Class=TD%gcd=<8%SI=<14) T1(DF=N%W=860|16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # JetDirect J6057A, firmware R.24.06, connected to an HP 2200 printer # JetDirect 610n (Model J4169A) firmware L.24.06 Fingerprint HP printer w/JetDirect card TSeq(Class=RI%gcd=<6%SI=<AF762&>9E9%IPID=I%TS=2HZ) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint HP JetDirect J6057A Firmware Version R.22.09 in 4100mpf printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=O%Flags=A%Ops=) T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550 # HP LaserJet 2200 with JetDirect (J6057A) Fingerprint HP JetDirect Card in a LaserJet printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=) T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # 2100 Series, 4000 TN, 4000 PS, 8000 DN Fingerprint HP LaserJet Printer TSeq(Class=TD%gcd=<6%SI=<100) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP LaserJet 4000N Printer TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP LaserJet 4100N printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=A%Ops=) T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint HP pritner w/JetDirect J2556b card Firmware A.05.32 T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # This is a HP 5si printer with a Jetdirect Ethernet card model# J2556b Firmware A.05.32 Fingerprint HP printer w/JetDirect J2556b card (firmware A.05.32) T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Jet Direct Model J3113A, Firmware Rev G.07.20 # HP Color LaserJet 4500N, Jet Direct J3113A/2100 Fingerprint HP Printer w/Jet Direct J3113A/2100 card T1(DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=M|) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP LaserJet 5 TSeq(Class=TD%gcd=<6%SI=<FF) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP Procurve Routing Switch 9304M TSeq(Class=C) T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777 TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 9.01 - 9.07 TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # XXX: It crashed the machine again, but I got a full # scan this time. Fingerprint HP-UX B.10.01 A 9000/715 TSeq(Class=64K|TR) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0 Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0 TSeq(Class=64K) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1 TSeq(Class=RI%gcd=<6%SI=<18000) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 10.20 A 9000/715 or 9000/899 TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.10.20 A 9000/750 TSeq(Class=64K%IPID=I%TS=U) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX release B.10.20 version A TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.10.20 9000/897 TSeq(Class=64K) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0 TSeq(Class=64K) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2 TSeq(Class=RI%gcd=<6%SI=<18000) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # This is a wierd one Fingerprint HP-UX 11.00 TSeq(Class=TD%gcd=>20000%SI=<3) T1(Resp=N) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B11.00 U 9000/839 TSeq(Class=RI%gcd=<10%SI=<2114C&>536) T1(Resp=N) T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.11.00 A 9000/800 TSeq(Class=RI%gcd=<6%SI=<8E148&>846%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint HP-UX B.11.00 A 9000/785 TSeq(Class=RI%gcd=<6%SI=<B108A&>630%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP9000 Model 804 K450 running HP/UX 11.00 # Mac OS9 Fingerprint Mac OS 9, or HP/UX 11.00 TSeq(Class=RI%gcd=<6%SI=<4F254&>C95) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP MPE/iX 5.5 TSeq(Class=TD%gcd=<6%SI=<14) T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint HP MPE/iX 5.5 on HP 3000 TSeq(Class=TD%gcd=<6%SI=<1E%TS=U) T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=6000%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Huawei Quidway R2621 router running VRP 1.5.6(1) TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ) T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Hua Wei Quidway Router R2621E VRP 1.5.6 TSeq(Class=TD%gcd=<1E806%SI=<14%IPID=I%TS=2HZ) T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Hydra HydraWEB 5000 TSeq(Class=RI%gcd=1|2|3|4%SI=<FFFF&>1111) T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM 2210 router TSeq(Class=TD%gcd=<6%SI=<F) T1(DF=N%W=0|200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S|O|S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IBM 8210 Multiprotocol Switching Server for ATM networks, Model 3 (p/n 31L3 340), Fingerprint IBM 8210 Multiprotocol Switching Server/router for ATM networks TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM 8222 hub TSeq(Class=TD%gcd=<6%SI=<1A4%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM 2210 Router MRS 2.x on Token Ring interface TSeq(Class=TR%gcd=<6) T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR|R%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM 3494 Magnetic Tape Library TSeq(Class=RI%gcd=<6%SI=<A5B22&>1A6E%IPID=I%TS=U) T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # IBM AIX v3.2.5 running on 8xPower-2 wide nodes # Fingerprint AIX Version 4 Fingerprint IBM AIX v3.2.5 - 4 TSeq(Class=TR%gcd=<6) T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.3.1 on a IBM RS/6000 R40 TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # IBM AIX 5L 5.1 # IBM AIX 5.1 ML00 Fingerprint IBM AIX 5.1 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1 - 5.2 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1-5.2 on RS/6000 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM Infoprint 12 Net-Printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 V 2.1 TSeq(Class=64K) T1(DF=N%W=6FCC%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=6FCC%ACK=O%Flags=A%Ops=) T4(DF=N%W=7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 V.3 TSeq(Class=i800) T1(DF=N%W=7000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7000%ACK=O%Flags=A%Ops=) T4(DF=N%W=7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 Warp 4.0 TSeq(Class=i800) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF) T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF) T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AS/400 running OS/400 R4.4 TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AS400 running OS/400 5.1 TSeq(Class=TD%gcd=<6000%SI=<14%IPID=I) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # added by Beat Rubischon <beat@rubis.ch> Fingerprint IBM AS/400 V3 and V4 TSeq(Class=RI%gcd=<6) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM VM/CMS (mainframe) TSeq(Class=RI%gcd=64|C8%SI=>CC&<CCC) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint IBM VM/ESA 2.2.0 CMS Mainframe System TSeq(Class=RI|TD%gcd=64|C8|12C|1F4|190%SI=<FFF) T1(DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # D-LINK DI-713P wireless router (firmware 2.60 build 6a) # 704P Ethernet Broadband Gateway Fingerprint D-Link 704P Broadband Gateway or DI-713P WAP TSeq(Class=RI|TD%gcd=<68%SI=<3A2%IPID=I|BI%TS=U) T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DLink DI-604 ethernet router using firmware 1.62 build 2 TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DLink DI-604 ethernet router TSeq(Class=TD%gcd=<2C0%SI=<14%IPID=BI%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9 TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled # Date: Oct 14 1997, Time: 09:35:04 (claims software version 2.04B3, # boot PROM version 2.21) Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21 TSeq(Class=TD%gcd=1388%SI=0) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link DI-701, Version 2.22 TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=N) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint D-Link DI-713P Wireless Gateway (2.57 build 3a) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=) T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # DLink DI-804 Cable/DSL Residential Gateway (with firmware v2.00B7) Fingerprint DLink DI-804 Cable/DSL Residential Gateway (firmware v2.00B7) TSeq(Class=TD%gcd=<10%SI=<3C%IPID=I%TS=U) T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link DCS-1000 webcam with firmware 1.06 TSeq(Class=TD%gcd=<E0%SI=<14%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=ASF%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # D-Link DSL-300G+ version 7.1.0.30 ANNEXA (Oct 18 2002) R2.05.b4t9uk Fingerprint D-Link DSL-300G+ DSL modem TSeq(Class=TD%gcd=<1731C%SI=<14%IPID=I%TS=U) T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint D-Link DSL-500 DSL modem TSeq(Class=TD%gcd=<1FBD4%SI=<14%IPID=I%TS=U) T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link Print Server TSeq(Class=TD%gcd=<72%SI=<1E) T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # DI-701 Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30 Fingerprint DI-701 Residential Gateway or KA9Q NOS - KO4KS-TNOS v. 2.30 TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=N) T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint D-Link DWL-5000AP WAP/BSP 1.3 TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # D-Link Wireless Access Point (WAP) DRC-1000AP - v3.2.28 # 3com 11Mpbs Wireless LAN Access Point 2000 (Firmware 1.2) Fingerprint wireless access point (WAP): D-Link DRC-1000AP or 3com Access Point 2000 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Intel Corporation, ER9100 Express Router 9100 # Fingerprint by Ron van Daal (ronvdaal@syntonic.net) Fingerprint Intel Corporation, ER9100 Express Router 9100 TSeq(Class=TD%gcd=10|20|30%SI=1) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Intel Express 510T switch TSeq(Class=TD%gcd=10|20|30%SI=<BB) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Intel InBusiness Print Station TSeq(Class=64K) T1(DF=N%W=424%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Intel NetportExpress 10 3-port print server TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Intel Netport Express PRO print server V04.33a TSeq(Class=TD%gcd=1%SI=0) T1(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Intel NetportExpress(tm) 10/100 3-port ROM: V05.10a Fingerprint Intel NetportExpress 10/100 3-port print server TSeq(Class=64K) T1(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME) T4(Resp=Y%DF=N%W=16D0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=R%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Intel NetportExpress XL print server TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Intel NetStructure 470T Switch TSeq(Class=TD%gcd=<7534%SI=<64%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Labtam MT300, X-Terminal Kernel TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix ETS16 terminal server Version V3.4/5(961028) TSeq(Class=RI%gcd=<6%SI=<9D1C&>91%IPID=BI%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix ETS16P terminal server Version V3.5/2(970721) TSeq(Class=RI%gcd=<6%SI=<404C&>90) T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix EPS1 print server version V3.5/1(970325) TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF) T1(DF=N%W=E00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix EPS2 print server Version V3.5/2(970721) TSeq(Class=RI|TD%gcd=<6) T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620) TSeq(Class=RI%gcd=<6%SI=<9318E&>1688%IPID=BI%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620) TSeq(Class=RI%gcd=<8%SI=<404C&>8C%IPID=BI%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint LG Goldstream LR3100p router, software version 1.0-1.5 TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint LG Goldstream LR3001f router, software version 4.0 TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Microbase VirtuOS v3.00b R.09 TSeq(Class=TD%gcd=<2120004%SI=<14%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MultiTech CommPlete Controller (terminal server) TSeq(Class=TR|RI%gcd=<6%SI=>FFFF) T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint MultiTech MultiVOIP Version 2.01A Firmware TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MultiTech standalone firewall box, version 3 TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) Fingerprint IBM MVS TCP/IP TCPMVS 3.2 TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2 TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200) T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) Fingerprint IBM MVS TCP/IP TCPOE 3.3 TSeq(Class=RI%gcd=<6%SI=<BB0) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM MVS TSeq(Class=RI%gcd=64|C8|12C|190) T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Innovaphone 200 V4.00 sr4 IP200[02-4283], Bootcode[205], HW[202] 2048/8192 # Innovaphone IP400 V4.00 hotfix IP400[02-4253], Bootcode[315], HW[102] 2048/4096 Fingerprint Innovaphone IP200/IP400 VOIP phone/gateway TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U) T1(DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Bay Networks Instant Internet router TSeq(Class=TD%gcd=1000|2000|3000%SI=<BB) T1(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Intergraph Workstation (2000 Series) running CLiX R3.1 TSeq(Class=TD%gcd=209|1048|E3F%SI=<5) T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # IPAD Model 5000 (see www.ipad-canada.com) # esoft IPAD, v.1.52 -- 64 line option on i86 hardware Fingerprint IPAD (Internet Protocol Adapter) Model 5000 or V.1.52 TSeq(Class=TD|RI%gcd=1000|2000|3000%SI=<444) T1(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 5.2 TSeq(Class=64K) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=F000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 5.3 TSeq(Class=64K) T1(DF=N%W=EF2A|F000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=EF2A|F000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=EF2A|F000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.2 TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=1FA0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1FA0%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.2 - 6.5 TSeq(Class=TD|64K|RI%gcd=<6|3E8|7D0|BB8|FA0) T1(DF=N%W=EF2A|C000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A|C000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.2 - 6.5 TSeq(Class=i800) T1(DF=N%W=C000|EF2A%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.4 - 6.5.3m # Lamont Granquist (again :) TSeq(Class=RI|TD%gcd=28|50|78|A0|C8|F0|140%SI=<3E8) T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.5 TSeq(Class=RI%gcd=10%SI=<2222) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.5 Origin2 TSeq(Class=64K) T1(Resp=Y%DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IP19/IP27/IP30/IP32 Fingerprint SGI IRIX 6.5-6.5.15m TSeq(Class=RI|64K|i800%gcd=<144%SI=<FFFF&>8%IPID=I%TS=2HZ) T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.5.7f-6.5.8f TSeq(Class=64K) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint SGI IRIX 6.5.15m on SGI O2 TSeq(Class=TD%gcd=<104%SI=<1AE%IPID=I%TS=2HZ) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # SGI O2 running SGI IRIX 6.5.7f Fingerprint SGI IRIX 6.5.7f-6.5.8f TSeq(Class=64K) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # SGI IRIX 6.5.14, SGI O2 # SGI IRIX 6.5 IP32 Fingerprint SGI IRIX 6.5.14 TSeq(Class=RI%gcd=<C%SI=<13876&>257%IPID=I%TS=2HZ) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Isolation Systems Infocrypt Enterprise TSeq(Class=C) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL traffic generation and analysis server TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Juniper Router running JUNOS TSeq(Class=RI%gcd=<5%SI=>FFF) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Juniper Networks JUNOS 5.3 on an Olive router TSeq(Class=RI%gcd=<6%SI=<ABEB4&>661%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Juniper Networks JUNOS 5.5R1.2 built 2002-09-28 Fingerprint Juniper Networks router JUNOS 5.5R1.2 TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # JUNOS <hostname> 5.6R1.3 JUNOS 5.6R1.3 #0: 2003-01-02 20:38:33 UTC -- This one was no Juniper Hardware Router but a JunOS installed on a simple i386 box. Fingerprint Juniper Networks JUNOS 5.6R1.3 routing software on X86 box TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # KA9Q is a networking OS used mostly by amateur radio operators for radio to # internet gateways. Fingerprint KA9Q amateur radio OS TSeq(Class=TD%gcd=37000%SI=<1E) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # 3com OfficeConnect 812 ADSL router firmware 2.0.0 # Kentrox Datasmart 656 CSU/DSU or USR Netserver/16 Fingerprint Kentrox Datasmart 656 CSU/DSU, USR Netserver/16, or 3Com OfficeConnect ADSL router TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=<A) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Kronos Time clock TSeq(Class=TD%gcd=<7C%SI=<32%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Kyocera IB-21 Printer NIC TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U) T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=100%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=100%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Lantronix LSB4 Ethernet Switch TSeq(Class=RI%gcd=<6%SI=>CCC&<FFFF) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint RoadLanner broadband router BRL-04FW 6.15.02r Build 0091 L:01 TSeq(Class=TD%gcd=<6E004%SI=<14%IPID=I%TS=1000HZ) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Rockwell Spectrum 100 POTS switcher release 7.2 TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or # Trancell Webramp router or Xylan Omni Switch 3.2.X.X - 3.4.X.X # Epson Stylus Color 1520C with 100BTX-NIC from Epson # CISCO 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX # SonicWall firewall appliance 10meg firmware 3.3.1 Fingerprint Router/Switch/Printer/Firewall (LanPlex 2500/Cisco Catalyst 5505/CISCO 6509/Trancell Webramp/Xylan Omni Switch)/Epson Stylus (100BTX-NIC HP Secure Web Console, SonicWall firewall appliance 3.3.1) TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Leunig ePower Switch b723 v5.2 TSeq(Class=TR) T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Lexmark M412n network printer TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ) T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Lexmark Optra S 1659 (MarkNetS) # Lexmark Optra S 2455 and SC 1275 Fingerprint Lexmark Optra S Printer TSeq(Class=TD%gcd=1393|2726|3AB9|4E4C|61DF%SI=<30) T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N|Y) # Lexmark Optra T612 (printer) running firmware 3.11.17 # Lexmark Optra S 2420 Fingerprint Lexmark Optra printer TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U) T1(DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Lexmark Marknet X2031e printer TSeq(Class=RI%gcd=<6%SI=<AFDAC&>16E0%IPID=I%TS=2HZ) T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Lexmark MarkNet XL Internal Printer Network Adapter on a Lexmark Optra LaserPrinter Fingerprint Lexmark Optra printer w/MarkNet XL Network Adapter TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1 TSeq(Class=TD%gcd=1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Lexmark T522 printer TSeq(Class=RI%gcd=<6%SI=<24E3426&>5E5DB%IPID=Z%TS=100HZ) T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Lexmark T522/T622 printer TSeq(Class=RI%gcd=<8%SI=<2C2D254&>387BA%IPID=Z%TS=100HZ) T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linksys BEFW11S4 802.11B WAP # Linksys BEFSR41 firmware ver. 1.40.2 Fingerprint Linksys BEFW11S4 WAP or BEFSR41 router TSeq(Class=TD%gcd=<F4%SI=<500%IPID=Z%TS=U) T1(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linksys EtherFast print server T1(DF=N%W=0|C80%ACK=S++%Flags=AR|APS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Linksys EtherFast print server TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Linksys WAP11 v2.6 firmware 1.06 Fingerprint Linksys WAP11 Wireless AP TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U) T1(DF=N%W=1200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1200%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linksys WAP11 wireless AP v2.2 firmware 1.06 TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linksys WET-11 wireless ethernet bridge running firmware rev. 1.43 Fingerprint Linksys WET-11 wireless ethernet bridge TSeq(Class=RI%gcd=<6%SI=<2C30D0&>52F7%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Pitney Bowes DL550 photocopier # Konica IP Controller Internal Print Server Module for Konica Multi-Purpose Printer/Fax/Scanner, Model KCA_018823 Fingerprint Pitney Bowes photocopier, Konica printer/fax/scanner, or Toshiba E-Studio16 printer T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint PS2 Linux 1.0 on Sony PS2 game console TSeq(Class=RI%gcd=<6%SI=<20E2FE8&>5428C%IPID=I%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNT) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) # fingerprint! Fingerprint Linux 1.0.9 TSeq(Class=TD%gcd=30|60%SI=<F) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=ASF%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 1.2.8 - 1.2.13 TSeq(Class=RI%gcd=<6%SI=<BBBB) T1(DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 1.2.13 TSeq(Class=TD%gcd=1%SI=1C) T1(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 1.3.20 (X86) T1(DF=N%W=77FF|0%ACK=S++%Flags=AS|BAR%Ops=ME|) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.0 TSeq(Class=RI%gcd=<6) T1(DF=N%W=7C00%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=6%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.27 - 2.0.30 TSeq(Class=TR) T1(DF=N%W=7C00|3C00%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7C00|3C00%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.32-34 TSeq(Class=TR%gcd=<6) T1(DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # On very rare cases, I get a T2 response back -- weird Fingerprint Linux 2.0.32-34 TSeq(Class=TR) T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.34-38 TSeq(Class=TR) T1(DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=AS%Ops=ME|M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FDF|7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=ASF%Ops=|ME|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0|20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint Linux 2.0.39 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=3FE0|0%ACK=S++%Flags=ARSF|AR%Ops=ME|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.35 (S.u.S.E. Linux 5.3 (i386) TSeq(Class=TR%gcd=<6) T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.24 PowerPC TSeq(Class=TR) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.76 TSeq(Class=TR) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.1.88 TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7) T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.91 - 2.1.103 TSeq(Class=RI%gcd=<6%SI=>7A000) T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.19 - 2.2.25 TSeq(Class=RI%gcd=<8%SI=>10000%IPID=I%TS=100HZ) T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=28|C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Linux 2.2.20 SMP TSeq(Class=RI%gcd=<6%SI=<277C73C&>6371B%IPID=I%TS=100HZ) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) # SuSE Linux 6.3 (i386) - Kernel 2.2.13 Fingerprint Linux kernel 2.2.13 (SuSE; X86) TSeq(Class=RI%gcd=<6%SI=<21DE76C&>2B4E4%IPID=I%TS=100HZ) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.2.5 - 2.2.13 SMP TSeq(Class=RI%gcd=<6%SI=<D49FAE&>2203C) T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E) Fingerprint Linux 2.2.12 - 2.2.19 TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.2.13 TSeq(Class=RI%gcd=<6%SI=<E5F68C&>24CA0) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Linux 2.2.14 TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7) T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E) Fingerprint Linux 2.2.19 - 2.2.20 TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U) T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.2.19 on a DEC Alpha 233mhz Multia Fingerprint Linux 2.2.19 on a DEC Alpha TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E) # IPCop 1.20 dedicated firewall Linux distro old Pentium 1 hardware + 3C509B cards http://ipcop.org/ Fingerprint IPCop 1.20 Linux 2.2.2X-based firewall TSeq(Class=RI%gcd=<6%SI=<95DBC&>116E%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Linux 2.2.21 SMP (X86) TSeq(Class=RI%gcd=<6%SI=<1921FE8&>404B1%IPID=I%TS=U) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.2.22 TSeq(Class=RI%gcd=<6%SI=<22AB988&>58BFF%IPID=I%TS=U) T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.12 TSeq(Class=RI%gcd=<20%SI=>DDDD) T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.28-33 TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3) T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.49 x86 TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E) T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86 TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA) T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.6 as on Sharp Zaurus PDA TSeq(Class=RI%gcd=<6%SI=<1E74A9A&>4DF5C%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.4.0-test5 TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8) T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E) # Cobalt Linux 6.0 Kernel 2.2.16c32_III on an i586 Fingerprint Linux kernel 2.2.16 TSeq(Class=RI%gcd=<6%SI=<23D760E&>5BBDD%IPID=Z) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.4.18 (x86) TSeq(Class=RI%gcd=<6%SI=<5BA02C&>EA7B%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.4.19 (X86) TSeq(Class=RI%gcd=<6%SI=<25CEE8A&>341B8%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++|O%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.4.0 - 2.5.20 TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U) T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y|N%TOS=0|8|14|20|28|40|C0|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # Linux kernel 2.4.18 on Alpha EV4 # Linux Kernel 2.5.70 (X86) Fingerprint Linux Kernel 2.4.18 - 2.5.70 (X86) TSeq(Class=RI%gcd=<6%SI=<20DBA72&>5419C%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20-4GB-athlon i686 # SuSE Linux 8.2 2.4.20-64GB-SMP Fingerprint Linux Kernel 2.4.20 TSeq(Class=RI%gcd=<6%SI=<22D7C86&>2AE00%IPID=I%TS=100HZ) T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.7 (zLinux on OS/390) Fingerprint Linux 2.4.7 (zLinux on OS/390) TSeq(Class=RI%gcd=<6%SI=<152381A&>3616E%IPID=Z%TS=100HZ) T1(DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Strangely enough, I have received several prints like this that claim a T2: Fingerprint Linux 2.4.16 - 2.4.18 TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.4.0 - 2.5.20 w/o tcp_timestamps TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U) T1(DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # linux kernel 2.4.20 (i586) Preemptible # Linux kernel 2.4.18 Fingerprint Linux kernel 2.4.18 - 2.4.20 (X86) TSeq(Class=RI%gcd=<8%SI=<25C5808&>30578%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # I don't put "Gentoo" as the vendor for the classification because it # makes output ugly when there are a bunch of Linux matches due to # firewalling or similar problems. Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5) TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.18 TSeq(Class=RI%gcd=<8%SI=<1C15A06&>23F17%IPID=Z) T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20 (Gentoo 1.2; X86) # Linux Kernel 2.4.18-14 Fingerprint Linux 2.4.18 - 2.4.20 (X86) TSeq(Class=RI%gcd=<6%SI=<2B9C772&>6FA19%IPID=Z%TS=100HZ) T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.4.18 TSeq(Class=RI%gcd=<6%SI=<21BFEA2&>46B9B%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.19 w/grsecurity patch TSeq(Class=RI%gcd=<6%SI=<2A492C6&>6C3F2%IPID=RD%TS=1000HZ) T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.4.20 TSeq(Class=RI%gcd=<6%SI=<18D4252&>3F8B9%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.4.20 TSeq(Class=RI%gcd=<6%SI=<14B7282&>11A94%IPID=Z%TS=100HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20-xfs-rmap15d-ptrace #1 Debian GNU/Linux Fingerprint Linux 2.4.20 TSeq(Class=RI%gcd=<6%SI=<15580A6&>30FB7%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.4.20-gentoo-r5 w/grsecurity Fingerprint Linux 2.4.20 - 2.4.21 w/grsecurity.org patch TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.5.25 - 2.5.70 or Gentoo 1.2 Linux 2.4.19 rc1-rc7) TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux Kernel 2.4.3-2.10.1smp (RedHat 7.0.98 Wolverine) Fingerprint Linux Kernel 2.4.3 SMP (RedHat) TSeq(Class=RI%gcd=<6%SI=<2E7A750&>76F8A%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.7 (X86) TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U) T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.17 on HP 9000 s700 TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Astaro Security Linux 4 (Kernel 2.4.19) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # http://www.sics.se/~adam/lwip/ Fingerprint lwIP (Lightweight TCP/IP stack) version lwip-0.5.3-win32 TSeq(Class=TD%gcd=<6%SI=<3C%IPID=I%TS=U) T1(DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME) T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Not really constant -- just slow incrementation # This is an LCIII Fingerprint Apple Mac OS 7.1 TSeq(Class=C) T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6 TSeq(Class=C|TD) T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 7.5.5 - 9 TSeq(Class=64K) T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.0 TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0) T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8 running on an LC 475 TSeq(Class=TR) T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 TSeq(Class=64K) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 TSeq(Class=64K) T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 TSeq(Class=64K) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.5 TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Apple Mac OS 8.6 TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Apple Mac OS 8.6 TSeq(Class=64K%IPID=I%TS=U) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Apple Mac OS 9.2.2 TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ) T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP-UX B.11.00 Fingerprint Apple Mac OS 9.04 or HP-UX B.11.00 TSeq(Class=RI%gcd=<9%SI=>3FFF) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0|A0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Apple Mac OS X Server 1.2 (ppc) -- 1.2 == 10.1.2? Fingerprint Apple Mac OS X Server 10.1.2 (ppc) TSeq(Class=RI%gcd=<6%SI=<199A9C&>4177) T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Magna SG10 intranet router TSeq(Class=RI%gcd=<6%SI=<31AD68E&>5F62F%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint FreeBSD 4.4-5 or Apple Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13) TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ) T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Maxim-IC TiniOS DS80c400 TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint MegaBit Gear TE4111C modem TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) TSeq(Class=TD%gcd=40000%SI=<A) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=) T4(DF=N%W=200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Xylogics Micro Annex ELS terminal server x7.1.8 TSeq(Class=64K) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Microplex Print Server TSeq(Class=C) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Microplex M205 Pocket Print Server v5.7 # IBM 6400 Printer - Network Printer Server Version 7.0.9.6 [ network card ] Fingerprint IBM 6400 printer or Microplex Pocket Print Server TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint MiNT with MiNTnet 1.03 running on Atari TT TSeq(Class=TD%gcd=3E7%SI=0) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=N) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Minix 32-bit/Intel 2.0.0 TSeq(Class=RI|TD%gcd=1|2|3|457%SI=<FFF) T1(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=) T4(Resp=N) T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint minix v2.0.2 32bits T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=) T4(Resp=N) T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Minix 32-bit/Intel 2.0.3 T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MiraPoint messaging server v3.1 TSeq(Class=RI%gcd=<6%SI=<DCCC6&>C2B%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Mirapoint messaging server M1000 (OS v 1.0.0) TSeq(Class=RI%gcd=<6) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=0%ULEN=134%DAT=E) # VxWorks Version: 5.3; Software Version: SB4100E-4.1.11-SCM05-NOSHELL; Hardware Version: 3 Fingerprint Motorola SurfBoard SB4100E Cable Modem TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Motorola SurfBoard 4401 provided by adelphia Fingerprint Motorola SurfBoard 4401 cable modem TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F|0%ULEN=134%DAT=E) Fingerprint Motorola System V/68 version R3V7 on a 68030 TSeq(Class=RI%gcd=<14%SI=<52F8&>C0) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint MOTOROLA VANGUARD 320 IP router running OS version 5.4 TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Motorola Vanguard 320 multi-protocol network access device V5.5 - 5.6 TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint MultiTech CommPlete (modem server) RAScard TSeq(Class=TD%gcd=388|710|A98%SI=<44) T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NEC UX/4800 TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # NCD X server (SNMP says: NCD16 server 2.3.0 03/12/91 downloaded) Fingerprint NCD X server (NCD16 server 2.3.0 03/12/91) TSeq(Class=64K) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NCR MP-RAS 3.0.x TSeq(Class=64K) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NCR MP-RAS 3.01 TSeq(Class=i800) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NCSA Telnet (dos) TSeq(Class=C) T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # I'm not 100% sure this version is for DOS, just a guess Fingerprint NCSA Telnet 2.3.08 for the PC (DOS) TSeq(Class=C) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Host information: @WorkStation (i960 based) X-terminal # Neoware (was HDS) NetOS V. 2.0.1 # Hewlett-Packard ENTRIA Model C3230A Server Version B.05.30 # Cisco 11151/Arrowpoint 150 Load Balancer Fingerprint Cisco 11151/Arrowpoint 150 load balancer, Neoware (was HDS) NetOS V. 2.0.1 or HP ENTRIA C3230A TSeq(Class=64K) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetApp F360 or 760 Filer TSeq(Class=RI%gcd=<6%SI=<7CA10&>CA2%IPID=BI%TS=2HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint NetApp Data OnTap 6.1.2R3 on an F840 filer TSeq(Class=RI%gcd=<6%SI=<83FEA&>B28%IPID=BI%TS=2HZ) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # NetApp DataOnTap Release 6.3.1: Wed Nov 20 13:03:17 PST 2002 Fingerprint NetApp DataOnTap Release 6.3.1 TSeq(Class=RI%gcd=<6%SI=<44A20&>AE7%IPID=BI%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint NetApp NetCache C760 os 4.x TSeq(Class=RI%gcd=<6%SI=<4E51740&>FAA%IPID=I%TS=2HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=5000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint NetApp NetCache running OS 5.4R2 TSeq(Class=RI%gcd=<6%SI=<22AD62&>1619%IPID=BI%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetApp Data OnTap 3.1.6 or BSDi 1.1 TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetApp Data OnTap 5.1.2 - 5.3.5r2 TSeq(Class=RI%gcd=<6%SI=>BBB) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E) # NetCache 5.1D4 on a NetApp C1100 Box Fingerprint Network Appliance NetCache 5.1D4 TSeq(Class=RI%gcd=<6%SI=<ABC02&>1371%IPID=BI%TS=2HZ) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Notes on NetBSD (written by Charles M. Hannum <root@ihack.net>): # * The set of options in a SYN-ACK depends on the state of the # `net.inet.tcp.rfc1323' flag. # * Releases prior to 1.3 did not randomize the ISS at all. # * Releases prior to 1.3 incorrectly added the IP header length to the IP # packet length when returning an ICMP unreachable. # * Releases prior to 1.3 calculated the window size slightly wrong. # * Releases prior to 1.3 returned a non-zero window size when sending a RST # in response to an ACK on a listening socket (thereby making them # susceptible to stealth scanning). # * Releases prior to 1.3H/1.3.4 did not return a response to the null flag # test (thereby making them susceptible to stealth scanning). # * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in # the encapsulated IP header when sending an ICMP reply. On little endian # machines the IP ID field was byte-swapped. The checksums were always # zeroed. # * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when # MTU discovery was enabled. Fingerprint NetBSD 1.0 i386 TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.0 little endian arch TSeq(Class=64K) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.0 big endian arch TSeq(Class=64K) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.1 - 1.2.1 litle endian arch TSeq(Class=64K) T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.2 - 1.2.1 big endian arch TSeq(Class=64K) T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3 - 1.3.3 little endian arch TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3 - 1.3.3 big endian arch TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3H-1.5 big endian arch TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # NetBSD 1.3I (after 19990119) # NetBSD 1.4 x86 # NetBSD 1.6L/Alpha # NetBSD 1.6 NetBSD 1.6 (GENERIC) #0 Sun Sep 8 2002 i386 Fingerprint NetBSD 1.3I through 1.6 TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.5_ALPHA i386 TSeq(Class=RI%gcd=<6%SI=<5CF5F1C&>EDF97) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.5.2 running on a Commodore Amiga (68040 processor) TSeq(Class=RI%gcd=<6%SI=<7AAB142&>874A7%IPID=I%TS=2HZ) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD/Alpha 1.5.2 on a DEC 3000/300 LX TSeq(Class=RI%gcd=<6%SI=<736B300&>106DED%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint NetBSD 1.6 BETA 4 i386 (20020630 snapshot) TSeq(Class=RI%gcd=<6%SI=<76BC4C8&>A6C26%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=4801%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.6 TSeq(Class=RI%gcd=<8%SI=<601F422&>60539%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Netgear FM144P ProSafe Wireless Firewall with Print Server # Repotec IP515H Cable Router / Print Server Fingerprint Netgear FM144P/Repotec IP515H Router & Print Server TSeq(Class=TD%gcd=<104%SI=<1E%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Netopia 4541 ADSL router v5.3.4 # Netopia R7100 SDSL router Fingerprint Netopia 4541/R7100 DSL router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Netopia DSL router TSeq(Class=TR) T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetScreen-100 TSeq(Class=RI%gcd=<6%SI=<276A&>50) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) Fingerprint NetSilicon NetARM running ThreadX 2.0 TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Nokia IPSO 3.2-3.2.1 releng 783-849 # IPSO 3.4-FCS4A releng 767 Running CheckPoint 4.1 SP6 # Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based) # Nokia IPSO 4.3.1-FCS5 Fingerprint Nokia IPSO 3.2-4.3.1-FCS5 Running checkpoint FW1 TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319) T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Nokia IPSO 3.2 Running Checkpoint Firewall-1 # IPSO 3.5-FCS8 releng 1020 Running Checkpoint FW-1 NG FP2 Fingerprint Nokia IPSO 3.2-3.5 Running Checkpoint Firewall-1 or NG FP2 TSeq(Class=RI%gcd=<6%SI=<E4656&>2476) T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E) # Nokia IPSO 3.6 FCS 6 releng 1061 01.21.2003-230310 i386 w/ CheckPoint FW-1 NG FP 2, SSL & DNS hotfix and SmartDefense Supplimental Fingerprint Nokia IPSO 3.6 running CheckPoint FW-1 NG FP2 TSeq(Class=RI%gcd=<6%SI=<7A148&>A01%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Nokia M1122 DSL Router (Nokia Mrouter rel-Gx1x2220.R08) Fingerprint Nokia M1122 DSL Router TSeq(Class=RI%gcd=<6%SI=<1AF18&>43B%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Netopia R3100-I DSL Router Firmware version v4.7.2 TSeq(Class=TD%gcd=<EA64%SI=<10E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetJet Version 3.0 - 4.0 Printer TSeq(Class=TD%gcd=<4%SI=<4) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|800%ACK=S++%Flags=AR%Ops=|M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Netscreen 5XP firewall + vpn (OS 3.0.1r2) TSeq(Class=TD%gcd=1000%SI=<FF) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Netscreen 5XP firewall+vpn (os 4.0.3r2.0) TSeq(Class=TR%gcd=<6) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Network Systems router NS6614 (NSC 6600 series) TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Nexland ISB Pro800 Turbo, Firmware version: V1 Rel 5U Fingerprint Nexland ISB Pro800 Turbo Cable/DSL router TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # A NeXT Turbo, unknown version number Fingerprint NeXT Mach TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Nokia IP530 Network Appliance (IPSO 3.4-3.4.2) TSeq(Class=RI%gcd=<8%SI=<85DD6&>987%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Nortel/Alteon ACE Director 3 Hardware Revision: B Software Version 6.0.42 Fingerprint Nortel/Alteon ACE Director 3 Version 6.0.42-B TSeq(Class=TR%gcd=<6%IPID=RD) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) # Nortel Networks BayStack 450-24T Versions: HW:RevL FW:V1.48 SW:v4.2.0.16 ISVN:2 Fingerprint Nortel Networks BayStack switch TSeq(Class=RI%gcd=<6%SI=<762A&>C8%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Nortel CallPilot 100 voicemail system # 3com superstack 3 4300 (3c17100) Hardware Version: V4.0 Software Version: V1.12 # Cisco 1538M micro hub running latest firmware # HP TopTools Remote Control Card # Enterasys VH2402 Switch Firmware 2.05.02 # NTT East VoIP gateway of some sort ( http://www.ntt-east.co.jp/ced/goods/voip/index.html ) Fingerprint Nortel CallPilot 100 voicemail system, 3Com Superstack 3 switch, Enterasys switch, HP TopTools remote control card, or Cisco 1538M hub TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Nortel Networks CVX1800 RAS. Software version 2.02 TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Nortel Networks Passport 8600 routing switch sw 3.3.0.0 TSeq(Class=RI%gcd=<6%SI=<E1C8A&>113A%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Novell NetWare 3.12 or 386 TCP/IP TSeq(Class=TD%gcd=<6B4A%SI=<1E) T1(DF=N%W=73F|F87|3F25%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS|ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 3.12 - 5.00 TSeq(Class=TD%gcd=10|20|30|40%SI=<64) T1(DF=Y|N%W=7D0|8000|2000|1FFF|7FFF|8000|FFFF%ACK=S++%Flags=AS%Ops=M|ME) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=7D0|8000|2000|1FFE|7FFF|8000|FFFF%ACK=O|S++%Flags=AS|ASF%Ops=M|ME) T4(Resp=N) T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetWare 4.11 SP7- 5 SP3A BorderManager 3.5 TSeq(Class=RI%gcd=<6%SI=<1843D74&>3E1D0) T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint NetWare 4.11 SP8a - Netware 5 SP4 TSeq(Class=RI%gcd=<6%SI=<2DB195E&>74F88) T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.0 with Border Manager TSeq(Class=RI%gcd=<5%SI=>BBBBB) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Novell Netware 5.x TSeq(Class=RI%gcd=<8%SI=<286248A&>1B465%IPID=I%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Netware 5.0 SP 3a TSeq(Class=RI%gcd=<8%SI=<5641338&>DCCE9) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Novell Netware 5 Support Pack Revision 06 Server Version 5.00.09 Fingerprint Novell Netware 5.00.09 SP06 TSeq(Class=RI%gcd=<6%SI=<1EDA0D4&>2F197%IPID=I%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 4.11-5.0SP5 TSeq(Class=RI%gcd=<6%SI=<2B302C0&>6E8E8) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Netware 5.1 SP3 TSeq(Class=RI%gcd=<6%SI=<2385886&>53F65%IPID=RPI|BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 5.1-6.0 TSeq(Class=RI%gcd=<6%SI=<2883446&>599C6%IPID=RD|RPI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.1SP4 - 6.0 TSeq(Class=RI%gcd=<6%SI=<253064A&>5F32F%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 5.1 SP5 with Groupwise TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Novell Netware 5.1 SP5 with Groupwise Fingerprint Novell Netware 5.1 SP5 TSeq(Class=RI%gcd=<6%SI=<2378ABE&>57780%IPID=BI%TS=U) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M|MEWN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 6 SP1 TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Novell Netware 6sp2 running BM3.7 (with no service packs) Fingerprint Novell Netware 6 SP2 TSeq(Class=RI%gcd=<6%SI=<30102C2&>766BA%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) Fingerprint NSG 500 router. OS version 7.6.1 (http://www.nsg.ru) TSeq(Class=TD%gcd=<14004%SI=<28%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenStep 4.0-4.2 or NeXTStep 1.0-3.3 (Intel) TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenStep 4.1/NeXTStep 3.3 TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NeXTStep/OpenStep 4.2/Intel TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Okidata 7200 Printer T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint OpenBSD 2.1 - 2.3/SPARC TSeq(Class=RI%gcd=<6%SI=>FF) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # This fingerprint had LAND patch installed Fingerprint OpenBSD 2.1/X86 TSeq(Class=RI%gcd=<6%SI=>BBB) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenBSD 2.2 - 2.3 TSeq(Class=RI%gcd=<6) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenBSD Post 2.4 (November 1998) - 2.5 TSeq(Class=RI%gcd=<6%SI=>FFF&<BBBBB) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # With more info provided by Theo De Raadt # OpenBSD 2.6 Fingerprint OpenBSD 2.6-2.8 TSeq(Class=RI%gcd=<6%SI=<1869F6&>3E6B) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134|3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.6-2.8 TSeq(Class=RI%gcd=<6%SI=<AD084&>1B9B) T1(DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.6 with all available patches as of roughly Feb01 TSeq(Class=RI%gcd=<6%SI=<4C22A&>C1A) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F|E%UCK=F|E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.7/SPARC or NFR IDS Appliance ( 12/10/00 ) TSeq(Class=RI%gcd=<6%SI=<8FC28&>16EC) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint OpenBSD 2.8 (X86) TSeq(Class=TD|RI%gcd=<6%SI=<A8C&>1%IPID=RPI|BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.9-beta through release (X86) TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y|N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y|N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint OpenBSD 2.9-stable TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # OpenBSD 3.0 (x86 or SPARC) # OpenBSD 3.3 (hppa) # OpenBSD 3.3 (GENERIC) i386 Fingerprint OpenBSD 3.0 or 3.3 TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=2HZ) T1(DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=4000|FFFF%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.0-STABLE (X86) TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.0 SPARC with pf "scrub in all" feature TSeq(Class=TR%gcd=<6%IPID=RD%TS=U|2HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.1 on an Alpha TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.1 (X86) TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.1 (X86) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint OpenBSD 3.2 with pf scrub and no-df TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.2 (X86) TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.3 TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Savin 9927 Copier TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=2000%ACK=O%Flags=UR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=1C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Sequent DYNIX/ptx(R) V4.2.1 TSeq(Class=RI%gcd=<F%SI=>FF&<FFFFF) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Sequent DYNIX/ptx(R) V4.4.6 TSeq(Class=RI|TD%gcd=<6%SI=<3FC) T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=A%Ops=) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens HiCom 300E business phone system Release 6.5 TSeq(Class=RI%gcd=<6%SI=<5D131C&>4A3C%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Siemens HICOM 300 Phone switch (PBX) (WAML LAN card) Fingerprint Siemens HICOM 300 Phone switch (PBX) TSeq(Class=64K) T1(DF=N%W=808%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=808%ACK=O%Flags=A%Ops=) T4(DF=N%W=808%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Siemens HICOM Phone switch (PBX) TSeq(Class=RI%gcd=<A%SI=<4184D0&>4EB3%IPID=I%TS=100HZ) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens RM200-C40 running ReliantUNIX-N 5.45 TSeq(Class=RI%gcd=<6%SI=<7DF64&>AAA%IPID=I%TS=2HZ) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Siemens SINIX-N 5.43C3002 TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=NW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=NW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens SINIX-N 5.41C0005 TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=0%ULEN=134%DAT=E) Fingerprint SINIX-Y 5.43B0045 TSeq(Class=64K) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens SINIX-Y 5.43C4001 TSeq(Class=RI%gcd=<6%SI=<26E76&>625) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW) T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens Speedstream 2602 DSL/Cable router TSeq(Class=RI%gcd=<6%SI=<22E601A&>31AA1%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Smoothwall Linux-based firewall 2.2.23 TSeq(Class=RI%gcd=<6%SI=<F1DA6&>474%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SonicWall/10 firewall TSeq(Class=TR) T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=7FE0|7FDF%ACK=O|S++%Flags=A|ASF%Ops=ME) T4(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SonicWall SOHO-3 firewall T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SonicWall SOHO-3 firewall TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SonicWall/10 Firewall TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SONY NewsOS 6.1.2 TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Sega Dreamcast game console TSeq(Class=TD%gcd=<780%SI=<14) T1(DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint StackTools StackTos 1.0 embedded networking OS TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=A8%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Proxim Stratum MP FW: 7_8_18; managed via HTTP and only relevant data is (I guess) the firmware version: FW: 7_8_18 Fingerprint Proxim Stratum MP wireless bridge TSeq(Class=TD%gcd=<61AC%SI=<46%IPID=I%TS=1000HZ) T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Stratus VOS Release 14.3.1ae T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Symantec Enterprise Firewall 7.0 running on Windows 2000 SP2 TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(Resp=N) # http://www.systech.com/catalog/RCS3000Entry.html # RCS/3182 - Firmware rev. 06D (Apr 26 2001 15:15:33) - OS ver. RCS_3000_BDNL Version 06F (May 18 2001 16:15:18) Fingerprint Systech RCS/3182 ethernet serial port server (firmware 06D) TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFC%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/390 V2R10 TSeq(Class=RI%gcd=<6%SI=<17C1E&>128%IPID=I%TS=1000HZ) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint IBM OS/390 V5R0M0 TSeq(Class=RI%gcd=<5%SI=>F&<BBBB) T1(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4 r4-5 TSeq(Class=RI%gcd=<C%SI=<C1C&>3%IPID=I%TS=1000HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Packet Engines PowerRail 5200 router version 2.6.0r10 - 16 Sep, 1999 TSeq(Class=64K) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Panasonic KX-HCM10 network camera TSeq(Class=TD%gcd=<F4%SI=<1E%TS=U) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Packeteer IP-PacketShaper 2000 V3.1 Fingerprint pSOS embedded IP stack, such as Packeteer IP-PacketShaper 2000 V3.1 TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Packeteer PacketShaper 4000 v4.1.3b2 2000-04-05 TSeq(Class=64K) T1(DF=N%W=430%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Panasonic IP Technology Broadband Networking Gateway, KX-HGW200 TSeq(Class=RI%gcd=<6%SI=<27BE484&>16928%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Panasonic panafax DX2000 SuperG3 fax machine TSeq(Class=TD|RI%gcd=<18%SI=<177A&>27) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Pigtail Express VoIP phone (runs VxWorks) TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Bell Labs Plan9 Second Edition TSeq(Class=TR) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Bell Labs Plan9 Release 4 (x86) TSeq(Class=TR%gcd=<6) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Planet WAP 1950 Wireless Access Point TSeq(Class=TD%gcd=<1C%SI=<14%IPID=I%TS=U) T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Polycom ViewStation 512K videoconferencing system TSeq(Class=C) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Polycom ViewStation TSeq(Class=C) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint PolyCom ViewStation video-conferencing system (firmware v7.2) TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Proteon OpenRoute 2.1 on a RBX200 Router or IBM 2210 Router TSeq(Class=TD%gcd=<6%SI=<BB) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Proteon OpenRoute 3.0 gt series router TSeq(Class=TD%gcd=1%SI=0) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint QMS Magicolor 2200 DeskLaser printer T1(DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint QNX 4.24 - 4.25 realtime embedded OS TSeq(Class=64K) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint QNX 6.00 realtime embedded x86 TSeq(Class=TD%gcd=<7D4%SI=<8C%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Racal 7100 Host Security Module 1.05 / 5.05 TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Radionics Ram IV Alarm System # Lantronix CoBox DR1-IAP serial device server Fingerprint Lantronix CoBox serial device server or Radionics Ram IV Alarm TSeq(Class=TD%gcd=<404%SI=<6E%IPID=I%TS=U) T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Raptor firewall 5.03 on NT 4 TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=N) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Raptor Firewall 6 on Solaris 2.6 TSeq(Class=RI%gcd=<6%SI=<E5CB8&>24B0) T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint RCA/Thomson cable modem DCM-235/245 TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Redback SMS 1000-2000 DSL Router TSeq(Class=RI%gcd=<4%SI=>1000&<FFFF) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Redback SMS500 Redback Networks AOS Release 5.0.4.0 PRODUCTION RELEASE Fingerprint Redback SMS500 Redback Networks router AOS Release 5.0.4.0 TSeq(Class=RI%gcd=<6%SI=<56DF6&>337%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0|F%ULEN=134%DAT=E) # Redback SMS 1800 router AOS Release 5.0.3.8 # Redback Networks SMS 10000 AOS 6.0.5.0 # Thomson TMC 390 cable modem Fingerprint Redback SMS 1800/10000 router or Thomson TMC 390 cable modem TSeq(Class=RI%gcd=<6%SI=<7B6BA&>BA7%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Redback SMS 1800 router TSeq(Class=RI%gcd=<6%SI=<4CA7C&>C2F) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint ReliantUNIX-Y 5.44 B0033 RM600 1/256 R10000 TSeq(Class=64K) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Ricoh Aficio AP4500 Network Laser Printer TSeq(Class=C%Val=0) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ringdale RP21 Print server TSeq(Class=TR%gcd=<6) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=) T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SCO UNIX release 3.2 TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint SCO OpenServer Release 5 TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO OpenServer(TM) Release 5 TSeq(Class=RI%gcd=<6%SI=<34A71A&>86B6) T1(DF=N%W=1000|6000|111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO OpenServer 5.0.5 TSeq(Class=RI%gcd=<5%SI=>FFFF) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Unisys LX/NX MCP 46.1/HMP 5.0 on an Unisys LX5120 Fingerprint Cray Unisys LX/NX MCP 46.1/HMP 5.0 on LX5120 TSeq(Class=RI%gcd=<6%SI=<7868FCE&>CF0B8%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SCO UnixWare 2.01 TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 2.1 TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 2.1.2 TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 7.0.0 or OpenServer 5.0.4-5.0.6 TSeq(Class=RI%gcd=<BB%SI=>FFFF) T1(W=60F4%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=) T4(W=0%ACK=O%Flags=R%Ops=) T5(W=0%ACK=S++%Flags=AR%Ops=) T6(W=0%ACK=O%Flags=R%Ops=) T7(W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 7.1.0 x86 TSeq(Class=RI%gcd=<6%SI=<442BB8&>AE70) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 7.1.0 - 7.1.1 (x86) TSeq(Class=RI%gcd=<6%SI=<403094&>8C71%IPID=I%TS=100HZ) T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SCO Open Desktop ( Same as SCO UNIX?) Fingerprint SCO Open Desktop 2.0 TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Secure Computing Sidewinder firewall 3.2 update 4 TSeq(Class=RI%gcd=<5%SI=>FFF&<FFFFF) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Secure Computing Sidewinder firewall 5.2.1.06 TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Secure Computing SECUREZone Firewall Version 2.0 TSeq(Class=TR%gcd=<6) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Sharp Digital Imager (copier) AR-507 T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Shiva AccessPort Bridge/Router Software V 2.1.0 # 3Com HiPer Access Router Card hardware 1.0.0 software 4.1.59 Fingerprint Shiva AccessPort Bridge/Router Software V 2.1.0 or 3Com HiPer Access Router Card hardware V1.0.0 software V4.1.59 TSeq(Class=TD%gcd=<6%SI=<F) T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Shiva LanRover/8E Version 3.5 TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Quantum Snap Server Network Storage Box TSeq(Class=i800) T1(Resp=Y%DF=N%W=4470%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4470%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=4470%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Quantum Snap server 4100 TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2238%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Sun Remote System Console version 1.12 # Brocade Fibre Switch, Firmware 2.6.0 Fingerprint Brocade Fibre Switch or Sun Remote System Console TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.3 - 2.4 TSeq(Class=64K) T1(DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.4 w/most Sun patches (jumbo cluster patch, security patches, etc) TSeq(Class=64K) T1(DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.5, 2.5.1 TSeq(Class=RI%gcd=<6) T1(DF=Y|N%W=2229|2332|4452|FFAF|8377|8EDA|879B%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SunOS dabox 5.6 Generic_105181-30 sun4u sparc SUNW,Ultra-Enterprise Fingerprint Sun Solaris 2.6 (SPARC) TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 7 (SPARC) TSeq(Class=RI%gcd=<6%SI=<57A26&>DF1) T1(DF=Y%W=2297|2788|4431|8371|8F4D|ABCD|FFF7|FFFF|2297|212%ACK=S++%Flags=AS%Ops=NNTNWME) T2(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T3(Resp=N) T4(DF=Y|N%W=0%ACK=O%Flags=R%Ops=|WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y|N%W=0%ACK=O|S%Flags=AR|R%Ops=|WNMETL) T7(DF=Y|N%W=0%ACK=S|O%Flags=AR|R%Ops=|WNMETL) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=F|E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 7 X86 TSeq(Class=RI%gcd=<6) T1(DF=Y%W=2491|462B%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 TSeq(Class=RI%gcd=<6%SI=<512B6&>CE8) T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=NNTME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=0 TSeq(Class=64K) T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=2 TSeq(Class=TR%IPID=I%TS=100HZ) T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Sun Solaris 8 early access beta through actual release TSeq(Class=RI|TR%gcd=<8%SI=<FEC86&>E0F%IPID=I%TS=100HZ) T1(DF=Y%W=5B4|60DA|807A|B68%ACK=S++%Flags=AS%Ops=NNTNWM|NNTM) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # Trusted Solaris 8 - SunOS SunRayServer 5.8 TS8 sun4u sparc SUNW,Ultra-60 Fingerprint Sun Trusted Solaris 8 TSeq(Class=RI%gcd=<8%SI=<AD48A&>109A%IPID=I%TS=100HZ) T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=138%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Sun Solaris 9 Beta through Release on SPARC # solaris 9 i386 Fingerprint Sun Solaris 9 TSeq(Class=RI%gcd=<6%SI=<A927C&>116A%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7|807A%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint Sun Solaris 9 with TCP_STRONG_ISS set to 2 TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7|8000|807A%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Convex SPP-UX 5.2.1 TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=) T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SPP-UX 5.x on a Convex SPP-1600 TSeq(Class=C) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=R%Ops=) T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun SunOS 4.0.3 TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Sun SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Sun SunOS 4.1.1 - 4.1.4 (or derivative) TSeq(Class=64K) T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E) Fingerprint Sun RSC (Remote System Control card) v1.14 (in Solaris 2.7) T1(DF=N%W=2000%ACK=S++|O%Flags=ARS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Ericsson Tigris Access Server V. 12.1.15 with 10.2 ISDN code # Integrated Access Platform, Software Version = 12.1.1.22 (ISDN Software Version 10.1) Fingerprint Ericsson Tigris Access Server Software V. 12.1.* TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Tahoe OS 1.2.1 running on Tahoe router TSeq(Class=RI%gcd=<8%SI=<A5A1E0&>6430%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Tally 9112 Printer TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U) T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Tandberg X-terminal TSeq(Class=64K) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=) T4(DF=N%W=400%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Tandem NSK D39 TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=0|2000%ACK=S++%Flags=AR|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|2000%ACK=S++|O%Flags=AR|A%Ops=) T4(DF=N%W=0|2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Tandem NSK D40 TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Tektronix Phaser 350 firmware 3.3 (printer) T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Tektronix Phaser 360 Extended Fingerprint Tektronix Phaser 360 printer TSeq(Class=i800) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # From a Tektronix Phaser 350 Fingerprint Tektronix Phaser(TM) printer with share ethernet card, firmware version 3.01 TSeq(Class=RI%gcd=<F%SI=>888&<4444) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|1000%ACK=S++|O%Flags=AR|AS%Ops=|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Tektronix Phaser 560 printer TSeq(Class=RI%gcd=<6%SI=<8C8C0&>B05%IPID=I%TS=U) T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Telebit's NetBlazer 3.0 router TSeq(Class=TD%gcd=<100004%SI=<3C) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Telebit NetBlazer router Version 3.05 TSeq(Class=TD%gcd=40000|80000|C0000%SI=<BB) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # (Telebit router - 18 async/1 ether) Fingerprint Telebit NetBlazer Version 3.1, patch level 13 TSeq(Class=TD|TR%gcd=40000|80000|C0000|100000|200000%SI=<FF) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Telindus 11xx ADSL Router TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint Telocity (DirectTVDSL) Gateway x2 Model TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Teltrend (aka Securicor 3net) Router TSeq(Class=TD%gcd=388|710%SI=<F) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC TOPS-20 Monitor 7(21733),KL-10 (DEC 2065) TSeq(Class=TD%gcd=<60004%SI=<1E%TS=U) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint DEC TOPS-20 Monitor 7(102540)-1,TD-1 TSeq(Class=TD%gcd=30000|60000|90000%SI=<BB) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Toshiba TR650 ISDN Router TSeq(Class=TD%gcd=<9%SI=<14) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # TurtleBeach Audiotron with firmware 3.0.0 Fingerprint TurtleBeach Audiotron network MP3 player TSeq(Class=TD%gcd=<68%SI=<14%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Audiotron with 3.0.26 Firmware Fingerprint TurtleBeach Audiotron network MP3 player TSeq(Class=TD%gcd=<68%SI=<1E%IPID=RPI|RD%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # http://www.turtlebeach.com/site/products/audiotron/producthome.asp Fingerprint Turtle Beach AudioTron 100 network MP3 player TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O|S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC Ultrix 4.1 TSeq(Class=64K) T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ultrix 4.2 - 4.5 TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint US Robotics USR8022 broadband wireless router (WAP) TSeq(Class=TD|RI%gcd=<68%SI=<636%IPID=I%TS=U) T1(DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # U.S. Robotics Broadband Router (Model # 8000-02, Version V2.5) Fingerprint US Robotics broadband router (model #8000-02) TSeq(Class=TD%gcd=<130%SI=<1E%IPID=BI%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint US Robotics Total Control NETServer Card TSeq(Class=C%Val=7F) T1(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint 3Com / USR TotalSwitch Firmware: 02.02.00R TSeq(Class=C|TD%gcd=3D090%SI=0) T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint VersaNet ISP-Accelerator(TM) Remote Access Server TSeq(Class=TD%gcd=<2004%SI=<14) T1(DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=ARF%Ops=) T3(Resp=Y%DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=RF%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=Y%W=0%ACK=O%Flags=RF%Ops=) T7(DF=Y%W=0%ACK=S%Flags=ARF%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Virtual Access LinXpeed Pro 120 router running Software 7.4.33CM TSeq(Class=C|TD%gcd=<10004%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) T3(Resp=Y|N%DF=Y%W=1000%ACK=O%Flags=AS%Ops=M) T4(DF=Y%W=100%ACK=O%Flags=R%Ops=) T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=100%ACK=O%Flags=R%Ops=) T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=) PU(Resp=N) # HPJ2600A Ethernet hub or HP ProCurve Switch 4000M # Bay Networks MicroAnnex XL running firmware 10.0B Fingerprint VxWorks 5.3.x bases system (usually an ethernet hub or switch such as HP ProCurve) or Bay Networks MicroAnnex XL terminal server TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint WatchGuard Firebox SOHO V5.x firewall TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # VxWorks (for Destiny D8405 Pass 2 (Firmware build for Pass 1)) version 5.4.2. Fingerprint Minolta QMS Printer running VxWorks 5.4.2 TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=6000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Microsoft Windows 3.1 with Trumpet Winsock 2.0 revision B TSeq(Class=TD%gcd=10000%SI=<FF) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Windows for Workgroups 3.11 / TCP/IP-32 3.11b stack or Windows 98 TSeq(Class=TD%gcd=<F%SI=<F) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Win95 4.00.950B - IE 5 5.50.4807.2300 Fingerprint Microsoft Windows 95 4.00.950B TSeq(Class=TD%gcd=<6%SI=<3C%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Windows NT 3.10 (Build 528) TSeq(Class=RI|TD%gcd=<24%SI=<69A%IPID=I%TS=U) T1(DF=N%W=1400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows NT 3.51 SP5 Fingerprint Microsoft Windows NT 3.51 SP5, NT 4.0 or 95/98/98SE TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4%IPID=BI|RPI|RD%TS=U|0) T1(DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=A|AS%Ops=|M|MNWNNT) T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=AS%Ops=M|MNWNNT) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 98 4.10.2222.A # "Windows 98 Second Edition, patched up to date" (1/25/03) Fingerprint Microsoft Windows 98SE TSeq(Class=TD%gcd=<A%SI=<46%IPID=RPI|RD|BI%TS=U) T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 98 Second Edition (build 2222) Fingerprint Microsoft Windows 98SE TSeq(Class=TD%gcd=<6%SI=<46%IPID=RPI|RD|BI%TS=U) T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft PocketPC 3.0.11171 running on Compaq iPAQ 3870 Pocket PC TSeq(Class=TD%gcd=<6%SI=<104%IPID=BI) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 95 4.00.950B (IE 5 5.00 2314.1003) TSeq(Class=TD%gcd=<14%SI=<32%IPID=BI) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O|S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98SE + IE5.5sp1 T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=2DA0|0%ACK=S++|O%Flags=AS|R%Ops=M|) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N|Y) Fingerprint Microsfot Windows 98SE with security patch A TSeq(Class=TD%gcd=<6%SI=<AA%IPID=BI%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98 4.10.1998 TSeq(Class=TD%gcd=<6%SI=<78%IPID=BI%TS=U) T1(DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98 SP2 TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U) T1(DF=Y%W=270F%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=270F%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98SE 4.10.2222A TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP3 TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73) T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT) T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP3 TSeq(Class=TD%gcd=<F4%SI=<3C%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S|S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 95/98/NT 4.0 or PocketPC TSeq(Class=TD|RI%gcd=1|2|3|4|5|8|A|14|1E|28|5A|17C%SI=<1F4) T1(DF=Y%W=2017|16D0|860|8000|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP5-SP6 TSeq(Class=RI%gcd=<6%SI=<DA16&>21A) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows NT4 Workstation SP6a # windows nt4 swith service pack 6 Fingerprint Microsoft Windows NT 4.0 Workstation SP6a TSeq(Class=RI%gcd=<A%SI=<1A66C&>112%IPID=RPI|BI%TS=U) T1(DF=Y%W=4470|7210|AC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4470|7210|AC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP6a TSeq(Class=RI%gcd=<6%SI=<8D3CE&>1017%IPID=RPI|RD%TS=U) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows NT Version 4.0 (Build 1381 - Service Pack 6), Revised Service Pack 6a Fingerprint Microsoft Windows NT 4.0 Workstation SP6a TSeq(Class=TD%gcd=<8%SI=<46%IPID=RPI|RD|BI%TS=U) T1(DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 Workstation SP6a TSeq(Class=TD%gcd=<6%SI=<46%IPID=BI%TS=U) T1(DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 Server SP5-SP6 TSeq(Class=RI%gcd=<8%SI=<11784E&>2CA4) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP 6a + hotfixes TSeq(Class=RI%gcd=<6%SI=<40132&>290%IPID=BI|RPI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) PU(Resp=N|Y) Fingerprint Microsoft Windows NT 4.0 Terminal Server Edition TSeq(Class=RI%gcd=<8%SI=<BEF0&>1D4%IPID=BI%TS=U) T1(DF=N|Y%W=0|2017%ACK=S++%Flags=AR|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=0|2017%ACK=O|S++%Flags=AR|AS%Ops=|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # HP Journada running Windows CE 2.11 (Handheld/PC Pro 3.0) running on StrongARM 1100 Fingerprint HP Journada running Microsoft Windows CE 2.11 (Handheld/PC Pro 3.0 PDA) TSeq(Class=TD%gcd=<36%SI=<28%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98 TSeq(Class=RI%gcd=<6%SI=<FFF) T1(DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98 SP1 TSeq(Class=TD%gcd=<5%SI=<20) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 5 Beta2 or Beta3 TSeq(Class=TD%gcd=<6%SI=<1000) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows.NET Enterprise Server (build 3615 beta) # windows .net standard server build 3604 # Microsoft Windows 2003 Standard Build V5.2.3790 build 3790 Fingerprint Microsoft Windows .NET Enterprise Server (build 3604-3790) TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows Server 2003, Enterprise Edition, Build 3790 # Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947) Fingerprint Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947) TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows Server 2003 Standard Edition TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows Server 2003 TSeq(Class=TR%gcd=<6) T1(DF=Y%W=FB8B%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Server 2003 Enterprise Edition (Trial Version downloaded from microsoft as at 06/03 Fingerprint Microsoft Windows Server 2003 Enterprise Edition TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows Server 2003, build 3790 Fingerprint Microsoft Windows Server 2003 TSeq(Class=TR%gcd=<6) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows Millenium Edition v4.90.300 # Windows Me or Windows 2000 RC1 through final release # Microsoft Windows 2000 Advanced Server # Windows 2000 with SP2 and long fat pipe (RFC 1323) # Windows 2000 Professional servicepack 3 # Windows 2000 5.00.2195 Service Pack 2 and latest hotfixes # Windows 2000 Professional (x86) # Compaq ProLiant DL-380G2 running windows 2000 with SP3 and all the current patch sets (2/3/03) # Winodws XP professional version 2002 on PC Intel processor # Windows XP Build 2600 # XP Professional 5.1 (build 2600).. all patches up to June 20, 2002 # Fingerprint Windows XP Pro with all current updates to May 2002 # Windows 2000 Version 5.0 Build (2195: Service Pack 3) # Windows 2000 Advanced Server sp3 Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP TSeq(Class=RI%gcd=<6%SI=<FFFFF&>49C%IPID=I%TS=0) T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|4470|8052|B5C9|B580|C000|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT) T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|4470|8052|B5C9|B580|C000|402E|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 2000 Server with service pack 3 and MS-Exchange 2000 Server Fingerprint Microsoft Windows 2000 Server SP3 TSeq(Class=RI%gcd=<6%SI=<DF0C&>186%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=A%Ops=NNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows ME + all updates as of 1/1/03 Fingerprint Microsoft Windows Millennium Edition (Me) TSeq(Class=RI%gcd=<8%SI=<1DA74&>117%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP2 TSeq(Class=RI%gcd=<6%SI=<25224&>22C%IPID=I) T1(DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows (XP Pro) version 5.1 (numero 260.xpsp2.030422-1633:service pack 1) Fingerprint Microsoft Windows 2000 Server SP3 or Windows XP Professional SP1 TSeq(Class=RI%gcd=<6%SI=<24F5E&>47E%IPID=I%TS=U) T1(DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 version 5 build 2195 Service Pack 2 Fingerprint Microsoft Windows 2000 SP2 TSeq(Class=RI%gcd=<6%SI=<270D8&>4BF%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP3 TSeq(Class=RI%gcd=<8%SI=<255BC&>24F%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP3 TSeq(Class=RI%gcd=<6%SI=<230DC&>388%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 TSeq(Class=RI%gcd=<6%SI=<2382B18&>5AE4C%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 TSeq(Class=RI%gcd=<6%SI=<1A748&>D9%IPID=I%TS=U) T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 TSeq(Class=RI%gcd=<6%SI=<2425C&>383%IPID=I) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 TSeq(Class=RI%gcd=<6%SI=<13EEB2&>2BD%IPID=I%TS=U) T1(DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Pro SP2 # Microsoft Windows XP Pro SP1 Fingerprint Microsoft Windows 2000 Professional SP2 or Windows XP SP1 TSeq(Class=RI%gcd=<6%SI=<270D8&>3E9%IPID=I) T1(DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP3 TSeq(Class=RI%gcd=<6%SI=<269EE&>2EC%IPID=I) T1(DF=Y%W=111C|FC00|E01F|FF70%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=111C|FC00|E01F|FF70%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|D0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 TSeq(Class=RI%gcd=<6%SI=<28B54&>31B%IPID=I) T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 5.00.2195 with SP 3 Fingerprint Microsoft Windows 2000 SP3 TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 TSeq(Class=RI%gcd=<6%SI=<876AE&>98E) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # windows 2000 professional build 2195 service pack 3 Fingerprint Microsoft Windows 2000 Professional SP3 TSeq(Class=RI%gcd=<6%SI=<1BB0C&>2DC%IPID=I%TS=U) T1(DF=Y%W=9448%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=9448%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Advanced Server SP3 TSeq(Class=RI%gcd=<6%SI=<206B6&>2E7%IPID=I) T1(DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Advanced Server SP3, all available updates as of 11/13/02 Fingerprint Microsoft Windows 2000 Advanced Server SP3 TSeq(Class=RI%gcd=<6%SI=<58066&>3E9%IPID=I) T1(DF=Y%W=402E|FFF0%ACK=S++%Flags=AS%Ops=MNNT|MNWNNT) T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows Millennium Edition (Me) TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I) T1(DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Professional TSeq(Class=RI%gcd=<6%SI=<1C476&>472) T1(DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 2000 Build 2195 Service Pack 1 Fingerprint Microsoft Windows 2000 SP1 TSeq(Class=RI%gcd=<6%SI=<220164&>80000%TS=U) T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Home Edition TSeq(Class=RI%gcd=<6%SI=<23C4E&>330%IPID=I%TS=U) T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional or Windows 2000 Professional SP2+ TSeq(Class=RI%gcd=<16%SI=<25AEE&>6B%IPID=I) T1(DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 TSeq(Class=RI%gcd=<6%SI=<15374&>110%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Microsoft Windows 2000 with service pack 3 # Microsoft Windows XP Pro with SP1 and latest Windows Update patches as of February 1st, 2003 Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000, or Windows XP TSeq(Class=RI%gcd=<20%SI=<E92A&>240) T1(DF=Y%W=40E8|5B8E|7FFF|FAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=40E8|5B8E|7FFFFAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Professional RC1 or Windows 2000 Advanced Server Beta3 TSeq(Class=RI%gcd=<8%SI=<27D922&>65EE) T1(DF=Y%W=402E|2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E|2017%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional RC1+ through final release TSeq(Class=RI%gcd=<8%SI=<2959A&>356%IPID=I) T1(DF=Y|N%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP SP1 (Build 2600.XP SP2.030422-1633:Service Pack 1) Fingerprint Microsoft Windows XP SP1 TSeq(Class=RI%gcd=<6%SI=<18DEE&>24B%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional SP1 TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP SP1 TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Microsoft Windows XP Version 5.1 (Build 2600.xpsp 1.020828-1920: Service Pack 1) > lateste +windows update patch too (1/31/03) # Windows 2000 with service pack 3 Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP3 TSeq(Class=RI%gcd=<6%SI=<2461C&>3BA%IPID=I%TS=U) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # windows xp pro WITHOUT ANY service packs # windows xp sp1 Fingerprint Microsoft Windows XP Professional TSeq(Class=RI%gcd=<6%SI=<2EBEE&>45E%IPID=I%TS=U) T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP SP1 TSeq(Class=RI%gcd=<6%SI=<C99A0A&>291F) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional SP1 TSeq(Class=RI%gcd=<6%SI=<9A6AA&>18A0%IPID=I%TS=U) T1(DF=Y%W=8820%ACK=S++|O%Flags=AS|A%Ops=M|) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8820%ACK=S++|O%Flags=AS||A%Ops=M||) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows XP Pro Version 5.1 (Build 2600.xpsp2.030422-1633: Service Pack1) Fingerprint Microsoft Windows XP Professional SP1 TSeq(Class=RI%gcd=<6%SI=<63826&>D28%IPID=I%TS=U) T1(DF=Y%W=AE4C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=AE4C%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Pro SP1 # Microsoft Windows2000 advaned Server with Service pack3 Fingerprint Microsoft Windows XP Professional SP1 or Windows 2000 Advanced Server SP3 TSeq(Class=RI%gcd=<8%SI=<272A4&>31E%IPID=I%TS=U) T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|5C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional Version 5.1 Build 2600 TSeq(Class=RI%gcd=<6%SI=<32578&>18D%IPID=I) T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Windows XP Pro Build 2600.xpsp1.020828-1920 with Windows Services for Unix 3.0 installed # Windows 2000 Advanced Server with SP3 # Microsoft Windows 2000 Server version 5.0 build 2195 Service Pack 3 # Windows 2000 SP3 Fingerprint Microsoft Windows XP Professional SP1 or Windows 2000 SP3 TSeq(Class=RI%gcd=<6%SI=<57472&>68D%IPID=I) T1(DF=N|Y%W=0|FFF0%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=0|FFF0%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional SP1 TSeq(Class=RI%gcd=<6%SI=<14686&>1A0%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows Xp Pro service pack 1 version 5.1 - Build 2600 Fingerprint Microsoft Windows XP Professional SP1 TSeq(Class=RI%gcd=<6%SI=<3316C&>33B%IPID=I) T1(DF=Y%W=6270%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=6270%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Xbox (modified) running evolutionX TSeq(Class=TD%gcd=<6%SI=<2E4%IPID=I%TS=U) T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Xbox V1.1 Running Evolution-X Dashboard v1.8.3752 Fingerprint Microsoft Xbox (modified) running evolutionX TSeq(Class=RI%gcd=<6%SI=<5A14&>20%IPID=I%TS=U) T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Microsoft Xbox running Debian Linux 2.4.20 TSeq(Class=RI%gcd=<6%SI=<FB5982&>2833E%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint WNOS 5.0 on Microsoft DOS 6.22 TSeq(Class=TD%gcd=1000|2000|3000%SI=<7F) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(DF=N%W=400%ACK=O%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint WTI Network Power Switch v3.02 TSeq(Class=TD%gcd=<2A%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint XCD Xconnect print server, firmware version CC8S-3.58 (98.09.21) TSeq(Class=TD%gcd=<272A%SI=<1E) T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Xerox 8830 Plotter TSeq(Class=TD%gcd=1000%SI=1) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Xerox Document Centre ColorSeries 50 TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Xerox Document Centre 440 w/ CentreWare Internet Services TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Xerox DocuPrint C55 TSeq(Class=TD%gcd=1000|2000|3000|4000%SI=<A) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Xerox DocuPrint N24/N32/N40 Network Laser Printer TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Xerox DocuPrint N40 TSeq(Class=TD%gcd=<2004%SI=<8C) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Xerox Docuprint N2125 network printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint xMach free distributed OS version 0.1 current TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Xylan OmniSwitch 5x/9x ethernet switch, Xylogics Annex-III Comm server R10.0, or Hitachi HI-UX/WE2 TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Xyplex 1600 terminal server running MAXserver V6.0.2 firmware TSeq(Class=C|TD%gcd=<5%SI=<5) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) PU(Resp=N) Fingerprint Xylogics Remote Annex 4000 terminal server running LynxOS realtime OS TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cabletron Systems SSR 8000 smart switch router System Software, Version 3.1.B.16 TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Cabletron Smart Switch Router 8600 T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # CasheFlow CacheOS (CacheFlow 500-5000 webcache) CFOS 2.1.08 - 2.2.1 Fingerprint CasheFlow CacheOS (CacheFlow 500-5000 web proxy cache) CFOS 2.1.08 - 2.2.1 TSeq(Class=RI%gcd=<5%SI=>BBBB&<FFFFF) T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint CacheFlow CacheOS 3.1 on a model 6000 web proxy cache TSeq(Class=RI%gcd=<6%SI=<6DE6416&>1C6E5%IPID=RPI%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cacheflow 6x5 web proxy cache running CacheOS 3.1.19-4.1.05 TSeq(Class=RI%gcd=<6%SI=<CF3F0&>16F5%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint CacheFlow 6000 web proxy cache running CacheOS 4.1.05 TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint CastleNet AR502/GlobespanVirata GS8100 (same thing) DSL router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # http://www.cayman.com/ Fingerprint Cayman 2E DSL/CABLE router TSeq(Class=TR%gcd=<6) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Chase IOLAN Terminal Server v3.5.02 CDi TSeq(Class=TD%gcd=<84%SI=<1E) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # These boxes give goofy PU RIPTL results (like 3549 and 4801) so I removed # that test Fingerprint Chase IOLAN terminal server TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Xyplex Network 9000 terminal server TSeq(Class=TD%gcd=<6%SI=<6) T1(Resp=Y%DF=Y%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=) T4(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Xyplex Terminal Server v6.0.2S5 TSeq(Class=TD%gcd=1388%SI=<F) T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) PU(Resp=N) # Fingerprint Xyplex Terminal Server/Xyplex hardware CSERV-20 11.00.00 ROM 410000/Xyplex software Terminal Server v6.0.4 (info frm SNMP) Fingerprint Xyplex Terminal Server CSERV-20 software v6.0.4 TSeq(Class=TD%gcd=<2714%SI=<258%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) PU(Resp=N) # Zero One Tech. Print Server 3000 # Hawking Print Server PN7117 # Zero One Tech Printserver ZOT-PS-11 (firmware 5.4.2049) # EUSSO Technologies UPS1211-B print server Fingerprint Print Server: Zero One Tech 3000, Hawking PN7117, or EUSSO UPS1211-B TSeq(Class=TD%gcd=<C004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint ZoomAir IG-4165 wireless gateway (WAP) TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # ZyXEL ZyWALL 50 running ZyNOS V3.52(WC.2)C0 | 05/02/2003 Fingerprint Zyxel XyWALL 50 (ZyNOS 3.52) TSeq(Class=TD%gcd=<F0004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=B680%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(Resp=N) #Zyxel P128imh or P480 router (ZyNOS) #ZyNOS F/W Version: V2.50(AJ.7) | 2/28/2002 #Intel Express 8100 Router ISDN Fingerprint Zyxel ZyNOS based broadband router (ZyNOS) or Intel Express ISDN router TSeq(Class=TD%gcd=1000|2000|5000|4000|6000|8000|A000|78000|%SI=<FF%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Zyxel Prestige 642R-11 (analog ADSL router) ZyNOS F/W Version: V2.50(AJ.9) Fingerprint Zyxel Prestige 642R-11 ASDL router running ZyNOS TSeq(Class=TD%gcd=<F0004%SI=<14%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint ZyXEL P480 ISDN router running ZyNOS v2.42(O.00) TSeq(Class=TD%gcd=<2004%SI=<1E) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Hardware: Zyxel Prestige broadband router T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # ZyXEL Prestige 700 broadband router # Netgear MA314 Cable/Wireless Router Fingerprint ZyXEL Prestige 700/Netgear MA314 broadband router T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)