home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / usr / share / thcrut / nmap-os-fingerprints < prev    next >
Encoding:
Text File  |  2005-10-18  |  269.2 KB  |  7,822 lines
  1. # Nmap OS Fingerprint List.
  2. # $Id: nmap-os-fingerprints,v 1.3 2002/12/17 16:18:20 skyper Exp $ 
  3. #
  4. # Contributions to this database are welcome.  If Nmap obtains a new
  5. # fingerprint (and test conditions are favorable), it will print out a
  6. # URL you can use to submit the fingerprint.  If Nmap guesses wrong,
  7. # please send the full Nmap output and the exact destination host OS
  8. # name and version to fyodor@insecure.org .  Thanks!
  9. #
  10. # By submitting fingerprints you are transfering any and all copyright
  11. # interest in the data to Fyodor so that he can modify it, relicense it,
  12. # incorporate it into programs, etc.
  13. #
  14. # This collection of fingerprint data is (C) 1998-2002 by
  15. # Fyodor (fyodor@insecure.org ).  This data is available for
  16. # free use by open source software under the terms of the GNU General
  17. # Public License.  We also license the data to selected
  18. # commercial/proprietary vendors under less restrictive terms.
  19. # Contact sales@insecure.com for more information.
  20. #
  21. # TEST DESCRIPTION:
  22. # Tseq is the TCP sequenceability test
  23. # T1 is a SYN packet with a bunch of TCP options to open port
  24. # T2 is a NULL packet w/options to open port
  25. # T3 is a SYN|FIN|URG|PSH packet w/options to open port
  26. # T4 is an ACK to open port w/options
  27. # T5 is a SYN to closed port w/options
  28. # T6 is an ACK to closed port w/options
  29. # T7 is a FIN|PSH|URG to a closed port w/options
  30. # PU is a UDP packet to a closed port
  31. #
  32. # We have vendor (IBM, Sun, Cisco, Suse, ..)
  33. # Type (Firewall, Router [AP?], Switch, Filesharing system, ..)
  34. # Architecture: Cisco PIX, Intel, Cisco MIPS etc :/
  35. #
  36. # Classes:
  37. # 1 Windows
  38. # 1.1 Windows 95
  39. # 1.2 Windows NT
  40. # 1.2.1 Windows NT4.0/98/95
  41. # 1.2.2 Windows NT4.0
  42. # 1.3 Windows 98
  43. # 1.4 Windows ME
  44. # 1.5 Windows 2k
  45. # 1.6 Windows XP
  46. # 2 Unix
  47. # 2.1 Linux
  48. # 2.1.1 Linux SuSE
  49. # 2.1.2 Linux Debian
  50. # 2.1.3 Linux Red Hat
  51. # 2.1.4 Turbo Linux
  52. # 2.1.5 Connectiva Linux
  53. # 2.1.6 Linux Mandrake
  54. # 2.1.7 Linux Gentoo
  55. # 2.1.2.4.17 Linux 2.4.17
  56. # 2.2 Solaris
  57. # 2.2.6 Solaris 6
  58. # 2.2.7 Solaris 7
  59. # 2.2.8 Solaris 8
  60. # 2.3 BSD
  61. # 2.3.1 OpenBSD
  62. # 2.3.2 FreeBSD
  63. # 2.3.3 NetBSD
  64. # 2.4 Plan 9
  65. # 2.4.1 Plan 9 (2nd Edition)
  66. # 2.5 Mac OSX
  67. # 2.6 AIX
  68. # 2.6.4 AIX 4
  69. # 2.6.4.3 AIX 4.33
  70. # 2.7 OS/390
  71. # 2.8 Novell
  72. # 3 Switch
  73. # 3.1.1 Cisco Catalyst
  74. # 3.2 3Com
  75. # 3.2.2 3Com SuperStack II
  76. # 3.3.1 Lucent Cajun
  77. # 4 Router
  78. # 4.1 Cisco
  79. # 4.1.12.1 Cisco IOS 12.1(4)
  80. # 4.2 3Com
  81. # 4.4.1 Apple Airport Base Station
  82. # 4.5 BinTec Router
  83. # 4.5.1 BinTec Bianca/Brick XL router
  84. # 5 Printr
  85. # 6 Applience
  86. # 7 Firewall
  87. # 7.1 Cisco PIX
  88.  
  89. Fingerprint:3 3Com Switch
  90. T1(DF=N%W=0|800%ACK=S++%Flags=AR|AS%Ops=|M)
  91. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  92. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  93. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  94. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  95. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  96. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  97. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  98.  
  99. Fingerprint 3Com NetBuilder & NetBuilder II OS v 9.3
  100. TSeq(Class=TD%gcd=3C%SI=<FF) 
  101. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  102. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  103. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  104. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  105. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  106. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  107. T7(Resp=N)
  108. PU(Resp=N)
  109.  
  110. Fingerprint 3COM / USR TotalSwitch Firmware: 02.02.00R
  111. TSeq(Class=C|TD%gcd=3D090%SI=0)
  112. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  113. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  114. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  115. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  116. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  117. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  118. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  119. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  120.  
  121. Fingerprint 4.3BSD-tahoe on a MicroVax III
  122. TSeq(Class=64K%IPID=I%TS=U)
  123. T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=)
  124. T2(Resp=N)
  125. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  126. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  127. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  128. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  129. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  130. PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  131.  
  132. # Tested ACC Amazon 9.2.29, ACC Congo 9.2.35
  133. Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator
  134. TSeq(Class=64K)
  135. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  136. T2(Resp=N)
  137. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  138. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  139. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  140. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  141. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  142. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  143.  
  144. Fingerprint Avaya G3 version 8.3
  145. TSeq(Class=RI%gcd=<6%SI=<652372&>89CC%IPID=I%TS=U)
  146. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  147. T2(Resp=N)
  148. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  149. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  150. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  151. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  152. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  153. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  154.  
  155. # SMC Barricade Wireless Broadband Router (firmware R1.93e)
  156. # D-LINK DL-707 Cable/DSL Router
  157. Fingerprint SMC Barricade or D-Link DL-707 Wireless Broadband Router
  158. TSeq(Class=TD%gcd=<130%SI=<1E%IPID=RD|I%TS=U)
  159. T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  160. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
  161. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  162. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  163. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  164. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  165. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  166. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  167.  
  168. Fingerprint SMC Barricade Wireless Broadband Router (firmware R1.93e)
  169. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  170. T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  171. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
  172. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  173. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  174. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  175. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  176. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  177. PU(Resp=N)
  178.  
  179. Fingerprint SMC Router / Barricade, firmware 1.94a
  180. TSeq(Class=TD%gcd=<68%SI=<32%IPID=I%TS=U)
  181. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  182. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  183. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  184. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  185. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  186. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  187. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  188. PU(Resp=N)
  189.  
  190. Fingerprint SonicWall SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL
  191. TSeq(Class=64K)
  192. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  193. T2(Resp=N)
  194. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  195. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  196. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  197. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  198. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  199. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  200.  
  201. Fingerprint Acorn RISK OS 3.60 (Acorn TCP/IP Stack 4.07)
  202. TSeq(Class=TR)
  203. T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  204. T2(Resp=N)
  205. T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
  206. T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=)
  207. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  208. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  209. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  210. PU(Resp=N)
  211.  
  212. Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd) # Thanks to Chris Wilson
  213. TSeq(Class=RI%gcd=<6)
  214. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  215. T2(Resp=N)
  216. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  217. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  218. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  219. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  220. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  221. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  222.  
  223. Fingerprint AGE Logic, Inc. IBM XStation
  224. TSeq(Class=64K)
  225. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  226. T2(Resp=N)
  227. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  228. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  229. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  230. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  231. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  232. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  233.  
  234. Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge
  235. TSeq(Class=C%Val=0)
  236. T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=)
  237. T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
  238. T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
  239. T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
  240. T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
  241. T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
  242. T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
  243. PU(Resp=N)
  244.  
  245. Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps wireless access point
  246. TSeq(Class=TR%gcd=<6)
  247. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  248. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  249. T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  250. T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  251. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  252. T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  253. T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  254. PU(Resp=N)
  255.  
  256. Fingerprint Aironet Wireless Bridge running firmware V5.0J
  257. TSeq(Class=C|TR)
  258. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  259. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  260. T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=)
  261. T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  262. T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  263. T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  264. T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  265. PU(Resp=N)
  266.  
  267. Fingerprint AIX 3.2
  268. TSeq(Class=64K)
  269. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  270. T2(Resp=N)
  271. T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
  272. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  273. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  274. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  275. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  276. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  277.  
  278. Fingerprint AIX 3.2
  279. TSeq(Class=64K)
  280. T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M)
  281. T2(Resp=N)
  282. T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=)
  283. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  284. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  285. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  286. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  287. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  288.  
  289. Fingerprint AIX 3.2 running on RS/6000
  290. TSeq(Class=64K)
  291. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  292. T2(Resp=N)
  293. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  294. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  295. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  296. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  297. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  298. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  299.  
  300. Fingerprint AIX 3.2.3 running on RS6000 model 560
  301. TSeq(Class=64K)
  302. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  303. T2(Resp=N)
  304. T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
  305. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  306. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  307. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  308. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  309. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  310.  
  311. Fingerprint AIX 3.2.5 (Bull HardWare)
  312. TSeq(Class=64K)
  313. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
  314. T2(Resp=N)
  315. T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=)
  316. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  317. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  318. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  319. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  320. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  321.  
  322. Fingerprint AIX 4.0 - 4.2
  323. TSeq(Class=64K)
  324. T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M)
  325. T2(Resp=N)
  326. T3(Resp=N)
  327. T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=)
  328. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  329. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  330. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  331. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  332.  
  333. Fingerprint AIX 4.02.0001.0000
  334. TSeq(Class=TR)
  335. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  336. T2(Resp=N)
  337. T3(Resp=N)
  338. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  339. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  340. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  341. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  342. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  343.  
  344. Fingerprint AIX v4.2
  345. TSeq(Class=TR%gcd=<6)
  346. T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT)
  347. T2(Resp=N)
  348. T3(Resp=N)
  349. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  350. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  351. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  352. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  353. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E)
  354.  
  355. Fingerprint AIX 4.1-4.1.5
  356. TSeq(Class=64K)
  357. T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
  358. T2(Resp=N)
  359. T3(Resp=N)
  360. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  361. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  362. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  363. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  364. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  365.  
  366. Fingerprint AIX v4.1 running on a C10
  367. TSeq(Class=64K)
  368. T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  369. T2(Resp=N)
  370. T3(Resp=N)
  371. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  372. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  373. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  374. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  375. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  376.  
  377. Fingerprint AIX 4.1
  378. TSeq(Class=64K%gcd=<6%SI=<14)
  379. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  380. T2(Resp=N)
  381. T3(Resp=N)
  382. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  383. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  384. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  385. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  386. PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  387.  
  388. Fingerprint AIX 4.2
  389. TSeq(Class=TR)
  390. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
  391. T2(Resp=N)
  392. T3(Resp=N)
  393. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  394. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  395. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  396. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  397. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  398.  
  399. Fingerprint AIX 4.2-4.3.3
  400. TSeq(Class=TR)
  401. T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
  402. T2(Resp=N)
  403. T3(Resp=N)
  404. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  405. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  406. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  407. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  408. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  409.  
  410. Fingerprint AIX 4.2.X
  411. TSeq(Class=TR)
  412. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  413. T2(Resp=N)
  414. T3(Resp=N)
  415. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  416. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  417. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  418. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  419. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  420.  
  421. # Fingerprint AIX 4.3.3 on an RS/6000 H50
  422. # Fingerprint AIX 4.3.3 on a p660-6M1
  423. # AIX 4.3.3 ML10
  424. Fingerprint AIX 4.3.2.0-4.3.3.0 on an IBM RS/*
  425. TSeq(Class=TR%gcd=<6)
  426. T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  427. T2(Resp=N)
  428. T3(Resp=N)
  429. T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=)
  430. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  431. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  432. T7(Resp=N)
  433. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  434.  
  435. Fingerprint IBM 8239 Token-Ring Stackable Hub running ??? (last flash)
  436. TSeq(Class=64K%IPID=I%TS=U)
  437. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  438. T2(Resp=N)
  439. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  440. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  441. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  442. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  443. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  444. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  445.  
  446. # Fingerprint IBM-RS/6000 7017-S80 AIX-Version 4.3.3.0
  447. Fingerprint AIX 4.3.3.0 on an IBM RS/*
  448. TSeq(Class=TR%gcd=<6%TS=U)
  449. T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M)
  450. T2(Resp=N)
  451. T3(Resp=N)
  452. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  453. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  454. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  455. T7(Resp=N)
  456. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  457.  
  458. Fingerprint AIX 4.3
  459. TSeq(Class=TR%gcd=<6)
  460. T1(DF=Y%W=F87%ACK=S++%Flags=AS%Ops=M)
  461. T2(Resp=N)
  462. T3(Resp=N)
  463. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  464. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  465. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  466. T7(Resp=N)
  467. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  468.  
  469. Fingerprint AIX Version 4.3
  470. TSeq(Class=TR%gcd=<6)
  471. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  472. T2(Resp=N)
  473. T3(Resp=N)
  474. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  475. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  476. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  477. T7(Resp=N)
  478. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  479.  
  480. Fingerprint AIX 5.1 on a p610-6C1
  481. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  482. T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
  483. T2(Resp=N)
  484. T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
  485. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  486. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  487. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  488. T7(Resp=N)
  489. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  490.  
  491. Fingerprint Alcatel 1000 ADSL (modem)
  492. TSeq(Class=64K)
  493. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  494. T2(Resp=N)
  495. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  496. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  497. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  498. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  499. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  500. PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  501.  
  502. Fingerprint Alcatel 1000 DSL Router / unknown OS Rev.
  503. TSeq(Class=RI%gcd=<5%SI=>AAA&<AAAAA)
  504. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  505. T2(Resp=N)
  506. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  507. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  508. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  509. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  510. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  511. PU(Resp=N)
  512.  
  513. Fingerprint Alcatel Advanced Reflexes IP Phone, Version: E/AT400/46.8
  514. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  515. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  516. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  517. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  518. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  519. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  520. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  521. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  522. PU(Resp=N)
  523.  
  524. # Alcaltel Speed Touch Home running GV8BAA3.235 (992640)
  525. # Alcatel SpeedTouch Pro ADSL Router running NZ OS 3.281
  526. #  Alcatel Speed Touch Home ADSL Modem (POTS), Ver 3.2
  527. Fingerprint Alcaltel Speed Touch ADSL modem or router
  528. TSeq(Class=64K%IPID=I%TS=2HZ)
  529. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  530. T2(Resp=N)
  531. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  532. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  533. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  534. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  535. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  536. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  537.  
  538. Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub
  539. TSeq(Class=C)
  540. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  541. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  542. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  543. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  544. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  545. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  546. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  547. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  548.  
  549. Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA
  550. TSeq(Class=TD%gcd=FA|1F4%SI=<FFF)
  551. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  552. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  553. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  554. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  555. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  556. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  557. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  558. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  559.  
  560. # Allied Telesyn AT-RP24i Rapier 24i version 2.3.1-04
  561. # Ericsson Home internet Solution ver. 2.0
  562. Fingerprint Allied Telesyn AT-RP24i switch or Ericcson HiS V2.0
  563. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  564. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  565. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  566. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  567. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  568. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  569. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  570. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  571. PU(Resp=N)
  572.  
  573. Fingerprint Alteon AceSwitch 110 (software 4.0.37)
  574. TSeq(Class=TD%gcd=<9C8%SI=<1E)
  575. T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M)
  576. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  577. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  578. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  579. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  580. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  581. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  582. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  583.  
  584. Fingerprint AmigaOS Miami 2.1-3.0
  585. TSeq(Class=TR)
  586. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  587. T2(Resp=N)
  588. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  589. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  590. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  591. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  592. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  593. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  594.  
  595. Fingerprint AmigaOS Miami 3.0
  596. TSeq(Class=TR)
  597. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  598. T2(Resp=N)
  599. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  600. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  601. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  602. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  603. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  604. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  605.  
  606. Fingerprint AmigaOS Miami 3.1-3.2
  607. TSeq(Class=TR)
  608. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  609. T2(Resp=N)
  610. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  611. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  612. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  613. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  614. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  615. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  616.  
  617. Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B
  618. TSeq(Class=TR)
  619. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  620. T2(Resp=N)
  621. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  622. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  623. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  624. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  625. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  626. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  627.  
  628. Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m
  629. TSeq(Class=TR%gcd=<6)
  630. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  631. T2(Resp=N)
  632. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  633. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  634. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  635. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  636. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  637. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  638.  
  639. Fingerprint AmigaOS AmiTCP/IP 4.3
  640. TSeq(Class=64K)
  641. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
  642. T2(Resp=N)
  643. T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
  644. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  645. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  646. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  647. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  648. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  649.  
  650. Fingerprint AmigaOS AmiTCP/IP Genesis 4.6
  651. TSeq(Class=64K)
  652. T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M)
  653. T2(Resp=N)
  654. T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=)
  655. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  656. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  657. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  658. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  659. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  660.  
  661. Fingerprint Amos 2.3A
  662. TSeq(Class=i800%gcd=<6%SI=<14)
  663. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  664. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  665. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  666. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  667. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  668. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  669. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  670. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  671.  
  672. Fingerprint AOS/VS on a Data General mainframe
  673. TSeq(Class=TD%gcd=32|64|96%SI=1)
  674. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  675. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  676. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  677. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  678. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  679. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  680. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  681. PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  682.  
  683. Fingerprint Apollo Domain/OS SR10.4
  684. TSeq(Class=TD|RI%gcd=<6%SI=<FF)
  685. T1(DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
  686. T2(Resp=N)
  687. T3(Resp=Y%DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
  688. T4(DF=N%W=239C%ACK=O%Flags=R%Ops=)
  689. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  690. T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
  691. T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  692. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  693.  
  694. Fingerprint AOS/VS or VSII
  695. TSeq(Class=TD%gcd=40|80|C0%SI=0)
  696. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  697. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  698. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  699. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  700. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  701. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  702. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  703. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  704.  
  705. Fingerprint Ascend P130 Router
  706. TSeq(Class=RI%gcd=<6%SI=>BBB&<BBBB)
  707. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  708. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  709. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  710. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  711. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  712. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  713. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  714. PU(Resp=N)
  715.  
  716. Fingerprint Ascend Max 1800 50Ap8+ or 2024
  717. TSeq(Class=TD%gcd=388|710|A98%SI=<F)
  718. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  719. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  720. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  721. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  722. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  723. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  724. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  725. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  726.  
  727. Fingerprint Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash
  728. TSeq(Class=RI%gcd=<6%SI=<14F46&>346)
  729. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
  730. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  731. T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
  732. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  733. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  734. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  735. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  736. PU(Resp=N)
  737.  
  738. Fingerprint Ascend/Lucent Max (HP,4000-6000) version 6.1.3 - 7.0.2+
  739. TSeq(Class=RI%gcd=<6%SI=>1000)
  740. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  741. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  742. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  743. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  744. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  745. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  746. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  747. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  748.  
  749. Fingerprint Ascend Pipeline 50 running 5.1A Firmware # Thanks to Jan Koum
  750. TSeq(Class=64K)
  751. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  752. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  753. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  754. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  755. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  756. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  757. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  758. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  759.  
  760. Fingerprint Ascend Pipeline 50
  761. TSeq(Class=TD%gcd=<714%SI=<14)
  762. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  763. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  764. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  765. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  766. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  767. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  768. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  769. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  770.  
  771. Fingerprint Ascend GRF Router running Ascend Embedded/OS 2.1
  772. TSeq(Class=RI%gcd=<5%SI=>600)
  773. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  774. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  775. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  776. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  777. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  778. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  779. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  780. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  781.  
  782. Fingerprint Ascend Pipeline 50 rev 4.6C
  783. TSeq(Class=TD%gcd=388|710%SI=<5)
  784. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  785. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  786. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  787. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  788. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  789. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  790. T7(Resp=N)
  791. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  792.  
  793. Fingerprint Ascend P75
  794. TSeq(Class=RI%gcd=<6%SI=>500&<FFFF)
  795. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  796. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  797. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  798. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  799. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  800. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  801. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  802. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  803.  
  804. Fingerprint Ascend Pipeline P130 or 50
  805. TSeq(Class=TD%gcd=388|710|A98%SI=<BB)
  806. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  807. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  808. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  809. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  810. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  811. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  812. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  813. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  814.  
  815. Fingerprint Ascend Pipeline 400/T1 (Software V 4.5B)
  816. TSeq(Class=TD%gcd=388|710|A98%SI=<FF)
  817. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  818. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  819. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  820. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  821. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  822. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  823. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  824. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  825.  
  826. Fingerprint Ascend TNT OS +5.0Ap48+
  827. TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
  828. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  829. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  830. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  831. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  832. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  833. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  834. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  835. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  836.  
  837. Fingerprint Macintosh GS Server with Mac OS 8.5.1 (Appleshare IP 6.0)
  838. TSeq(Class=64K)
  839. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  840. T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  841. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  842. T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  843. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  844. T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  845. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  846. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  847.  
  848. Fingerprint Mac OS 8.1 running on a PowerPC G3 (iMac)
  849. TSeq(Class=64K)
  850. T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  851. T2(Resp=N)
  852. T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  853. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  854. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  855. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  856. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  857. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  858.  
  859. Fingerprint Mac OS 8.6
  860. TSeq(Class=64K)
  861. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  862. T2(Resp=N)
  863. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  864. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  865. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  866. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  867. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  868. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  869.  
  870. #  Mac OS 9 on a Power Macintosh 7200/75
  871. # iMac running Mac OS 9.1
  872. Fingerprint Mac OS 9 - 9.1
  873. TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D)
  874. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  875. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  876. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  877. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  878. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  879. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  880. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  881. PU(Resp=N)
  882.  
  883. Fingerprint Rhapsody 5.3 - 5.4 (Mac OS X Server 1.0 - 1.0-1)
  884. TSeq(Class=RI%gcd=<5%SI=>BBB&<FFFF)
  885. T1(W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  886. T2(Resp=N)
  887. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  888. T4(W=2000%ACK=O%Flags=R%Ops=)
  889. T5(W=0%ACK=S++%Flags=AR%Ops=)
  890. T6(W=0%ACK=O%Flags=R%Ops=)
  891. T7(W=0%ACK=S%Flags=AR%Ops=)
  892. PU(TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  893.  
  894. Fingerprint Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3
  895. TSeq(Class=RI%gcd=<5)
  896. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  897. T2(Resp=N)
  898. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
  899. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  900. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  901. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  902. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  903. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  904.  
  905. Fingerprint Mac OS X 10.1 - 10.1.4
  906. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  907. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  908. T2(Resp=N)
  909. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  910. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  911. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  912. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  913. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  914. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  915.  
  916. Fingerprint Mac OS X 10.1.4 (Darwin Kernel 5.4) on iMac
  917. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  918. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  919. T2(Resp=N)
  920. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  921. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  922. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  923. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  924. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  925. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  926.  
  927. Fingerprint Mac OS X 10.1.5
  928. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  929. T1(DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  930. T2(Resp=N)
  931. T3(Resp=Y%DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  932. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  933. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  934. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  935. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  936. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  937.  
  938. Fingerprint Mac OS X 10.1.5
  939. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  940. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  941. T2(Resp=N)
  942. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  943. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  944. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  945. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  946. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  947. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  948.  
  949. # Actually it is not constant seq class -- it just seems that way
  950. # because it takes so long to increment
  951. Fingerprint Apple Color LaserWriter 600 Printer # Thanks to Pluvius
  952. TSeq(Class=C)
  953. T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  954. T2(Resp=N)
  955. T3(Resp=Y%DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  956. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  957. T5(Resp=N)
  958. T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
  959. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  960. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  961.  
  962. Fingerprint Apple Color LaserWriter 600 Printer # Thanks to Pluvius
  963. TSeq(Class=C)
  964. T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  965. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  966. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  967. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  968. T5(Resp=N)
  969. T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  970. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  971. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  972.  
  973. Fingerprint Apple Color LaserWriter 12/660 PS (Model No. M3036)
  974. T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  975. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  976. T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=AR%Ops=)
  977. T4(DF=N%W=C00%ACK=O%Flags=R%Ops=)
  978. T5(Resp=N)
  979. T6(DF=N%W=C00%ACK=O%Flags=R%Ops=)
  980. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  981. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  982.  
  983. Fingerprint Apple LaserWriter 16/600 PS, HP 6P, or HP 5 Printer
  984. TSeq(Class=C)
  985. T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  986. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  987. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  988. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  989. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  990. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  991. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  992. PU(Resp=N)
  993.  
  994. # The sequence prediction is never really true random, but sometimes it
  995. # has two unique "tracks" which make it look random to nmap.  Here is a
  996. # real example:  Sequence numbers: 5576001 25D001 5576001 25D001
  997. Fingerprint Apple LaserWriter 8500 (PostScript version 3010.103)
  998. TSeq(Class=TR|C)
  999. T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  1000. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1001. T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  1002. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1003. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1004. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1005. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1006. PU(Resp=N)
  1007.  
  1008. Fingerprint AS5200  # Thanks to Michael Dodwell <mdodwell@vic.bigpond.net.au>
  1009. TSeq(Class=RI%gcd=<6%SI=>FFF)
  1010. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1011. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1012. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1013. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1014. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1015. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1016. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1017. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1018.  
  1019. Fingerprint Asante 6524-2G GigE switch
  1020. TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U)
  1021. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1022. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1023. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1024. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1025. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1026. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1027. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1028. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1029.  
  1030. Fingerprint Asanta IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 ))
  1031. TSeq(Class=C%Val=4090000)
  1032. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1033. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1034. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1035. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1036. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1037. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1038. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1039. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1040.  
  1041. Fingerprint Asanta IntraSwitch 5324
  1042. TSeq(Class=C%Val=80000)
  1043. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1044. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1045. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1046. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1047. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1048. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1049. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1050. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1051.  
  1052. Fingerprint AsanteHub 2072 Ethernet Hub
  1053. TSeq(Class=C)
  1054. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1055. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1056. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1057. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1058. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1059. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1060. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1061. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1062.  
  1063. Fingerprint Asante FriendlyNet FR3004 Series Internet Hub
  1064. TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U)
  1065. T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1066. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  1067. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1068. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  1069. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1070. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  1071. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1072. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1073.  
  1074. Fingerprint Auspex Fileserver (AuspexOS 1.9.1/SunOS 4.1.4)
  1075. TSeq(Class=64K)
  1076. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  1077. T2(Resp=N)
  1078. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  1079. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  1080. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1081. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1082. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1083. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1084.  
  1085. Fingerprint Atari Mega STE running JIS-68k 3.0
  1086. TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86)
  1087. T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
  1088. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1089. T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
  1090. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1091. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1092. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1093. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1094. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1095.  
  1096. Fingerprint AtheOS ( www.atheos.cx )
  1097. TSeq(Class=RI%gcd=<8%SI=<A78&>6)
  1098. T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1099. T2(Resp=N)
  1100. T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1101. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1102. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1103. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1104. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1105. PU(Resp=N)
  1106.  
  1107. Fingerprint ATT Unix SVR4.2 on a Lucent Definity voicemail system
  1108. TSeq(Class=64K)
  1109. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1110. T2(Resp=N)
  1111. T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
  1112. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1113. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1114. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1115. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1116. PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  1117.  
  1118. Fingerprint A/UX 3.1.1 SVR2 or OpenStep 4.2
  1119. TSeq(Class=64K)
  1120. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  1121. T2(Resp=N)
  1122. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  1123. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  1124. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1125. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1126. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1127. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1128.  
  1129. Fingerprint AXENT Raptor Firewall running on Windows NT
  1130. TSeq(Class=TR)
  1131. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  1132. T2(Resp=N)
  1133. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  1134. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1135. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1136. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1137. T7(Resp=N)
  1138. PU(Resp=N)
  1139.  
  1140.  
  1141. Fingerprint AXIS NetEye Camera Server V1.20 # Thanks to Pluvius
  1142. TSeq(Class=C)
  1143. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  1144. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1145. T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
  1146. T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
  1147. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1148. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1149. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1150. PU(Resp=N)
  1151.  
  1152. # AXIS NetEye Camera Server V1.20
  1153. # Axis NPS 53X Printer Server V4.26 Jul 01 1995
  1154. # AXIS StorPoint CD-Rom server V 4.20
  1155. # AXIS Camera 200pV1.41
  1156. Fingerprint AXIS Stack -- CD-ROM Server or Printer Server or Camera Server # Thanks to Pluvius
  1157. TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5)
  1158. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  1159. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1160. T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
  1161. T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
  1162. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1163. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1164. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1165. PU(Resp=N)
  1166.  
  1167. Fingerprint Axis 200+ Web Camera running OS v1.42
  1168. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME)
  1169. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1170. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1171. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1172. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1173. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1174. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1175.  
  1176. Fingerprint AXIS 540+/542+ Network Print Server
  1177. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  1178. T2(Resp=N)
  1179. T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=)
  1180. T4(DF=N%W=100%ACK=O%Flags=R%Ops=)
  1181. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1182. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1183. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1184. PU(Resp=N)
  1185.  
  1186. # Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99)
  1187. # Bay Networks ASN Processor revision 9, SE100NM and SFNM modules
  1188. Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9
  1189. T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW)
  1190. T2(Resp=N)
  1191. T3(Resp=N)
  1192. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1193. T5(Resp=N)
  1194. T6(Resp=N)
  1195. T7(Resp=N)
  1196. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1197.  
  1198. Fingerprint Bay Networks BayStack 310T switch
  1199. TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=<F)
  1200. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1201. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1202. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1203. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1204. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1205. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1206. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1207. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1208.  
  1209. Fingerprint BayStack 28115/ADV Fast Ethernet Switch  # Thanks to Jan Koum!
  1210. TSeq(Class=TD%gcd=<6%SI=<FF)
  1211. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1212. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1213. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1214. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1215. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1216. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1217. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1218. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1219.  
  1220. Fingerprint Baystack Instant Internet 400 SoHo Router
  1221. TSeq(Class=RI%gcd=<24%SI=<4D33C&>C46)
  1222. T1(Resp=N)
  1223. T2(Resp=N)
  1224. T3(Resp=N)
  1225. T4(Resp=N)
  1226. T5(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1227. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1228. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1229. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1230.  
  1231. # Running on a BeBox 66Mhz
  1232. Fingerprint BeOS 4 - 4.5
  1233. TSeq(Class=TD%gcd=1%SI=0)
  1234. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  1235. T2(Resp=N)
  1236. T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  1237. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  1238. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1239. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1240. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1241. PU(Resp=N)
  1242.  
  1243. Fingerprint BeOS R5.03 Personal Edition
  1244. TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U)
  1245. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  1246. T2(Resp=N)
  1247. T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  1248. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  1249. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1250. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1251. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1252. PU(Resp=N)
  1253.  
  1254. Fingerprint BeOS 5.1d0/DANO on x86
  1255. TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U)
  1256. T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  1257. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1258. T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  1259. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1260. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1261. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1262. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1263. PU(Resp=N)
  1264.  
  1265. # F5 labs BigIp Load balancer.  BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386
  1266. Fingerprint F5 labs BigIp Load balancer Kernel 4.1.1PTF-03 (X86)
  1267. TSeq(Class=TR%gcd=<6)
  1268. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  1269. T2(Resp=N)
  1270. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  1271. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1272. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1273. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1274. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1275. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  1276.  
  1277. # XS SW Release 4.9.1 ISDN access router
  1278. # Bintec BIANCA XM OS-Version 4.93
  1279. Fingerprint Bintec XS/XM ISDN access routers V. 4.9.1-4.9.3
  1280. TSeq(Class=RI%gcd=<6%SI=>FF&<FFF)
  1281. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1282. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1283. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1284. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1285. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1286. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1287. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1288. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=0%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  1289.  
  1290. Fingerprint Borderware 5.0 Firewall
  1291. TSeq(Class=TR|RI%gcd=<204%SI=<14)
  1292. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  1293. T2(Resp=N)
  1294. T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
  1295. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  1296. T5(Resp=N)
  1297. T6(Resp=N)
  1298. T7(Resp=N)
  1299. PU(Resp=N)
  1300.  
  1301. Fingerprint Borderware 5.2 firewall
  1302. TSeq(Class=TR%gcd=<6)
  1303. T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
  1304. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  1305. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  1306. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  1307. T5(Resp=N)
  1308. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  1309. T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  1310. PU(Resp=N)
  1311.  
  1312. Fingerprint Borderware 6.0.2 firewall
  1313. TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C)
  1314. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  1315. T2(Resp=N)
  1316. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  1317. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  1318. T5(Resp=N)
  1319. T6(Resp=N)
  1320. T7(Resp=N)
  1321. PU(Resp=N)
  1322.  
  1323. Fingerprint Brix 1000 Verifier (http://www.brixnetworks.com/products/brix1000.html)
  1324. TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U)
  1325. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  1326. T2(Resp=N)
  1327. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  1328. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1329. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1330. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1331. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1332. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1333.  
  1334. Fingerprint BSDI BSD/OS 2.0 - 2.1  # Thanks to dmessiah & tacit@bigfoot.com
  1335. TSeq(Class=RI%gcd=<6%SI=>FFF)
  1336. T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  1337. T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1338. T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT)
  1339. T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=)
  1340. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1341. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1342. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1343. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1344.  
  1345. Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD)
  1346. TSeq(Class=RI%gcd=<6)
  1347. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1348. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1349. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  1350. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1351. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1352. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1353. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1354. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1355.  
  1356. Fingerprint BSDI 4.0-4.0.1  
  1357. TSeq(Class=RI%gcd=<A%SI=<1974A&>16F)
  1358. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1359. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1360. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1361. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1362. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1363. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1364. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1365. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  1366.  
  1367. Fingerprint BSDI BSD/OS 4.0.1 Kernel
  1368. TSeq(Class=RI%gcd=<6%SI=<F85E8&>27A9)
  1369. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1370. T2(Resp=N)
  1371. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1372. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1373. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1374. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1375. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1376. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  1377.  
  1378. Fingerprint CABLETRON Systems, Incorporated, Module Firmware Revision: 01.01.01
  1379. T1(DF=N%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|)
  1380. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1381. T3(Resp=Y%DF=N%W=0|1000%ACK=S++%Flags=AR|AS%Ops=|M)
  1382. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1383. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1384. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1385. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1386. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1387.  
  1388. # (rel. ID: 17908)
  1389. Fingerprint CacheFlow 6000 running Security Gateway 2.1.0
  1390. TSeq(Class=RI%gcd=<6%SI=<CB91C&>15C0%IPID=I%TS=2HZ)
  1391. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  1392. T2(Resp=N)
  1393. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  1394. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1395. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1396. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1397. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1398. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1399.  
  1400. Fingerprint CacheOS (CacheFlow 2000 proxy cache)
  1401. TSeq(Class=RI%gcd=<5%SI=>1111)
  1402. T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M)
  1403. T2(Resp=N)
  1404. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
  1405. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  1406. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1407. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1408. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1409. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  1410.  
  1411. Fingerprint Canon photocopier/fax/scanner/printer GP30F
  1412. TSeq(Class=TD%gcd=600%SI=0)
  1413. T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  1414. T2(Resp=N)
  1415. T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=)
  1416. T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=)
  1417. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1418. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1419. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1420. PU(Resp=N)
  1421.  
  1422. Fingerprint Chase IOLan Terminal Server
  1423. T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  1424. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1425. T3(Resp=N)
  1426. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1427. T5(Resp=N)
  1428. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1429. T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  1430. PU(Resp=N)
  1431.  
  1432. Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build)
  1433. TSeq(Class=RI%gcd=<6%SI=<18358&>3CB)
  1434. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  1435. T2(Resp=N)
  1436. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  1437. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  1438. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1439. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1440. T7(Resp=N)
  1441. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1442.  
  1443. Fingerprint Olicom A/S - ILAN/XL
  1444. TSeq(Class=TD%gcd=<28004%SI=<28%IPID=I|RD%TS=U)
  1445. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  1446. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1447. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=AS%Ops=M)
  1448. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1449. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1450. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1451. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1452. PU(Resp=N)
  1453.  
  1454. Fingerprint Okidata 7200 Printer
  1455. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  1456. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1457. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1458. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1459. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1460. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1461. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1462. PU(Resp=N)
  1463.  
  1464. Fingerprint OpenBSD 2.7/SPARC or NFR IDS Appliance ( 12/10/00 )
  1465. TSeq(Class=RI%gcd=<6%SI=<8FC28&>16EC)
  1466. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  1467. T2(Resp=N)
  1468. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  1469. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  1470. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1471. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1472. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1473. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  1474.  
  1475. Fingerprint NT Server 4.0 SP4-SP5 running Checkpoint Firewall-1
  1476. TSeq(Class=TD%gcd=<8%SI=<154)
  1477. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  1478. T2(Resp=N)
  1479. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  1480. T4(Resp=N)
  1481. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1482. T6(Resp=N)
  1483. T7(Resp=N)
  1484. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  1485.  
  1486. Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1)   
  1487. TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U)
  1488. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1489. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1490. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1491. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1492. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1493. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1494. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1495. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1496.  
  1497. Fingerprint Cisco 1538M HUB running Cisco 1538M EES (1.00.00) or Assured Access Technology ISAS Switch Release-2.3.0 or Thomson Multimedia RCA DCM245 Cable Modem
  1498. TSeq(Class=64K)
  1499. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  1500. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1501. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  1502. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1503. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1504. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1505. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1506. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1507.  
  1508. Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router
  1509. TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=<F)
  1510. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1511. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1512. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1513. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1514. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1515. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1516. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1517. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1518.  
  1519. Fingerprint Cisco 2620 running IOS 12.1(6)
  1520. TSeq(Class=RI%gcd=<6%SI=<ABC2&>78%IPID=Z%TS=U)
  1521. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  1522. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1523. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1524. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1525. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1526. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1527. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1528. PU(Resp=N)
  1529.  
  1530. Fingerprint Cisco 3600 running IOS 12.2(6c)
  1531. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  1532. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  1533. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1534. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1535. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1536. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1537. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1538. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1539. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1540.  
  1541. # Cisco 1720 running 12.2.8T4 with IP/FW/PLUS/3DES feature set
  1542. # CISCO 801 running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1)
  1543. Fingerprint Cisco 801/1720 running 12.2.8
  1544. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  1545. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  1546. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1547. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  1548. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1549. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1550. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1551. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1552. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1553.  
  1554. # Found on Cisco 1720/1750/2611/3640/AS5300 routers
  1555. Fingerprint Cisco router running IOS 12.1.5-12.2(6a)
  1556. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  1557. T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
  1558. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1559. T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M)
  1560. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1561. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1562. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1563. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1564. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1565.  
  1566. Fingerprint Cisco 4500 running IOS 11.2(2)
  1567. T1(DF=N%W=860%ACK=S++|O%Flags=AS|A%Ops=M|)
  1568. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1569. T3(Resp=N)
  1570. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1571. T5(Resp=N)
  1572. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1573. T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  1574. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  1575.  
  1576. Fingerprint Cisco 7206 running IOS 11.1(24)
  1577. TSeq(Class=RI%gcd=<5%SI=<CCCC&>CC)
  1578. T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  1579. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1580. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  1581. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1582. T5(Resp=N)
  1583. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1584. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1585. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1586.  
  1587. Fingerprint Cisco CacheEngine
  1588. TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
  1589. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNW)
  1590. T2(Resp=N)
  1591. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
  1592. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  1593. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1594. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1595. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1596. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1597.  
  1598. Fingerprint Cisco CPA2500 (68030) or 2511 router
  1599. TSeq(Class=RI%gcd=<6%SI=>FFF)
  1600. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  1601. T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  1602. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  1603. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1604. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1605. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1606. T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  1607. PU(Resp=N)
  1608.  
  1609. # Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5)
  1610. Fingerprint Cisco Catalyst 6500: WS-C6509 Software 6.3(5)
  1611. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  1612. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1613. T2(Resp=N)
  1614. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  1615. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  1616. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1617. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1618. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1619. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1620.  
  1621. # Again, the "True Random" is bogus, it is because of sequences
  1622. # like this: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869
  1623. Fingerprint Cisco Localdirector 430, running OS 2.1
  1624. TSeq(Class=TR|C)
  1625. T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  1626. T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  1627. T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL)
  1628. T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
  1629. T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  1630. T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
  1631. T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  1632. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1633.  
  1634. # Contributer wishes to remain anonymous
  1635. Fingerprint Cisco PIX 4.2(2) Internal Interface
  1636. TSeq(Class=C)
  1637. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1638. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
  1639. T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL)
  1640. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  1641. T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
  1642. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  1643. T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
  1644. PU(Resp=N)
  1645.  
  1646. Fingerprint Cisco PIX 515 or 525 running 6.2(1)
  1647. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  1648. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1649. T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  1650. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1651. T4(Resp=N)
  1652. T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  1653. T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  1654. T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  1655. PU(Resp=N)
  1656.  
  1657. Fingerprint Cisco 766 non-IOS software 4.2(3.5)
  1658. TSeq(Class=TD%gcd=82000%SI=<F)
  1659. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1660. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1661. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1662. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1663. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1664. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1665. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1666. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1667.  
  1668. # Cisco 3640 IOS 11.1(7)AX [KUONG(7)AX]
  1669. # Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6
  1670. Fingerprint Cisco IOS 11.1(7)-11.2(8.10)
  1671. TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
  1672. T1(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  1673. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1674. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  1675. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1676. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1677. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1678. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1679. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1680.  
  1681. # Cisco 2501, 4500
  1682. Fingerprint IOS Version 10.3(15) - 11.1(20)  # Thanks to Pluvius
  1683. TSeq(Class=RI|TD%gcd=<6%SI=<2000)
  1684. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  1685. T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  1686. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  1687. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1688. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1689. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1690. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1691. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1692.  
  1693. Fingerprint Cisco IP Phone 7910 or 7940 Firmware 3.1
  1694. TSeq(Class=TD%gcd=<1E004%SI=<1E%IPID=I%TS=U)
  1695. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  1696. T2(Resp=N)
  1697. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  1698. T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
  1699. T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  1700. T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
  1701. T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  1702. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1703.  
  1704. Fingerprint Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1)
  1705. TSeq(Class=RI%gcd=<6%SI=>BBB)
  1706. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1707. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1708. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1709. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1710. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1711. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1712. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1713. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1714.  
  1715. Fingerprint Cisco 5200 running IOS v12.0(15)
  1716. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  1717. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1718. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1719. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1720. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1721. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1722. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1723. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1724. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1725.  
  1726. Fingerprint Cisco 4500-M running IOS 11.3(6) IP Plus
  1727. TSeq(Class=RI|TD%gcd=1%SI=<FFF)
  1728. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  1729. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1730. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  1731. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1732. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1733. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1734. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1735. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1736.  
  1737. Fingerprint Cisco Catalyst 1900 switch or Netopia DSL/ISDN router or Bay 350-450
  1738. TSeq(Class=TD%gcd=<6000%SI=<1E)
  1739. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1740. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1741. T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1742. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1743. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1744. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1745. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1746. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1747.  
  1748. Fingerprint Cisco Catalyst 2820 Management Console
  1749. TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U)
  1750. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1751. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1752. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1753. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1754. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1755. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1756. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1757. PU(Resp=N|Y)
  1758.  
  1759. Fingerprint Cisco IOS 11.3 - 12.0(11)
  1760. TSeq(Class=TD|RI%gcd=<6)
  1761. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1762. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1763. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1764. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1765. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1766. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1767. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1768. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1769.  
  1770. Fingerprint Cisco IOS 12.0(21) (On a 2514 router)
  1771. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  1772. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1773. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1774. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1775. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1776. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1777. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1778. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1779. PU(Resp=N)
  1780.  
  1781. # Cisco IOS 12.0(16a) Service Provider feature set
  1782. # Cisco WS-C3508G-XL running 12.0(5)WC3
  1783. Fingerprint Cisco IOS 12.0(5)WC3 - 12.0(16a)
  1784. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  1785. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1786. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1787. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1788. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1789. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1790. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1791. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1792. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1793.  
  1794. Fingerprint Cisco Catalyst 2950 running IOS 12.0(5.3)WC(1)
  1795. TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
  1796. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1797. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1798. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1799. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1800. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1801. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1802. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1803. PU(Resp=N)
  1804.  
  1805. Fingerprint Cisco 827 running IOS 12.1(1)XB1
  1806. TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U)
  1807. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1808. T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  1809. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1810. T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  1811. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1812. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  1813. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  1814. PU(Resp=N)
  1815.  
  1816. Fingerprint Cisco 7206  (IOS 11.1(17)  # Thanks to jfesler@gigo.com
  1817. TSeq(Class=RI%gcd=<6%SI=>666)
  1818. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  1819. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1820. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  1821. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1822. T5(Resp=N)
  1823. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1824. T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  1825. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1826.  
  1827. Fingerprint Cisco 1600/3640/7513 Router (IOS 11.2(14)P) #Thanks to Solar Designer
  1828. TSeq(Class=RI%gcd=<6%SI=<11170)
  1829. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  1830. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1831. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  1832. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1833. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1834. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1835. T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  1836. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1837.  
  1838. Fingerprint Cisco Local Director 420 version 2.1.1
  1839. TSeq(Class=C)
  1840. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1841. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL)
  1842. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1843. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  1844. T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL)
  1845. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  1846. T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL)
  1847. PU(Resp=N)
  1848.  
  1849. Fingerprint Cisco Pix Firewall running PIX 4.1(5)
  1850. TSeq(Class=C%Val=211E005F)
  1851. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1852. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
  1853. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1854. T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  1855. T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
  1856. T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  1857. T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
  1858. PU(Resp=N)
  1859.  
  1860. Fingerprint Cisco PIX v4.2 Firewall
  1861. TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03)
  1862. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1863. T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL)
  1864. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  1865. T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
  1866. T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL)
  1867. T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
  1868. T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL)
  1869. PU(Resp=N)
  1870.  
  1871. Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T
  1872. TSeq(Class=RI%gcd=<4%SI=<999&>CC)
  1873. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1874. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1875. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1876. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1877. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1878. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1879. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1880. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1881.  
  1882. # 25XX/45XX router, 29XX switch, RSP2 processor
  1883. Fingerprint Cisco Router/Switch with IOS 11.2 # Thanks to Solar Designer
  1884. TSeq(Class=RI%gcd=<6%SI=<18000)
  1885. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  1886. T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  1887. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  1888. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1889. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1890. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1891. T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  1892. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1893.  
  1894. Fingerprint Cisco IOS 12.0(3.3)S  (perhaps a 7200)
  1895. TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
  1896. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  1897. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1898. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  1899. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1900. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1901. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1902. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1903. PU(Resp=N)
  1904.  
  1905. Fingerprint Cisco 675 DSL router -- cbos 2.1
  1906. T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M)
  1907. T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  1908. T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
  1909. T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
  1910. T5(Resp=N)
  1911. T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
  1912. T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  1913. PU(Resp=N)
  1914.  
  1915. Fingerprint Cisco 760 Series (non IOS) or IBM Stackable Hub
  1916. TSeq(Class=TD|i800%gcd=<14004%SI=<14)
  1917. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1918. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1919. T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M)
  1920. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1921. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1922. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1923. T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=)
  1924. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1925.  
  1926. Fingerprint Cisco CacheOS (1.1.0)
  1927. TSeq(Class=64K)
  1928. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  1929. T2(Resp=N)
  1930. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  1931. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  1932. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1933. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1934. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1935. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1936.  
  1937. Fingerprint Cisco Secure PIX Firewall Version 5.0(2)
  1938. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1939. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  1940. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
  1941. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  1942. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  1943. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  1944. T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
  1945. PU(Resp=N)
  1946.  
  1947. Fingerprint Cisco uBR 7223
  1948. TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
  1949. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  1950. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1951. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  1952. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1953. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1954. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1955. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1956. PU(Resp=N)
  1957.  
  1958. # 3COM 4924 gigabit switch ver 2.04
  1959. # Cisco VPN 3000 3.5
  1960. Fingerprint Cisco VPN 3000 or 3COM 4924 GigE Switch
  1961. TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ)
  1962. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  1963. T2(Resp=N)
  1964. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  1965. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1966. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1967. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1968. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1969. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1970.  
  1971. Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4)
  1972. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1973. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1974. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1975. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1976. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1977. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1978. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1979. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1980.  
  1981. Fingerprint CLIX R3.1 Vr.7.6.20 6480
  1982. TSeq(Class=TD%gcd=<416%SI=<1E)
  1983. T1(DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
  1984. T2(Resp=N)
  1985. T3(Resp=Y%DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
  1986. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1987. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1988. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1989. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1990. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  1991.  
  1992. Fingerprint CNIG904B Internet Broadband Gateway firmware version 1.11
  1993. TSeq(Class=TD%gcd=<F4%SI=<1D6%IPID=Z%TS=U)
  1994. T1(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  1995. T2(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
  1996. T3(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  1997. T4(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
  1998. T5(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  1999. T6(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
  2000. T7(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  2001. PU(Resp=N)
  2002.  
  2003. Fingerprint Cobalt Linux 4.0 (Fargo) Kernel 2.0.34C52_SK on MIPS or TEAMInternet Series 100 WebSense
  2004. TSeq(Class=TR%gcd=<6)
  2005. T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  2006. T2(Resp=N)
  2007. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  2008. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2009. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2010. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2011. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2012. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  2013.  
  2014. Fingerprint corega BAR SW-4P  [Part number:CG-BARSW4P]
  2015. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2016. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2017. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2018. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2019. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2020. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2021. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2022. PU(Resp=N)
  2023.  
  2024. Fingerprint Commodore 64 with TFE Ethernet Card (uIP TCP/IP stack)
  2025. TSeq(Class=C%Val=FFFFFFFF%IPID=RD%TS=U)
  2026. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=)
  2027. T2(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=APF%Ops=)
  2028. T3(Resp=Y%DF=N%W=16D0|1CA%ACK=O%Flags=APF%Ops=)
  2029. T4(DF=N%W=16D0|5B4%ACK=O%Flags=APF%Ops=)
  2030. T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  2031. T6(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  2032. T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  2033. PU(Resp=N)
  2034.  
  2035. # Tested against: 3 RISC Routers (2600i, 2800, and 3500R) all running
  2036. # firmware 4.5 and two IntraPorts running 4.4.02.  I'm told this also
  2037. # applies to firmare 4.2 on RISC routers, but I have not checked.
  2038. Fingerprint Compatible Systems (RISC Router, IntraPort)
  2039. TSeq(Class=TD%gcd=388|710|A98%SI=<6)
  2040. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2041. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2042. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2043. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  2044. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2045. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  2046. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2047. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2048.  
  2049. Fingerprint Computone PowerRack IntelliServer Release 1.5.4d
  2050. TSeq(Class=TD%gcd=40%SI=0)
  2051. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  2052. T2(Resp=N)
  2053. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
  2054. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2055. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2056. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2057. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2058. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  2059.  
  2060. Fingerprint ComOS - Livingston PortMaster or U.S. Robotics/3com Total Control system
  2061. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2062. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2063. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2064. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2065. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2066. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2067. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2068. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2069.  
  2070. Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2
  2071. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2072. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2073. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2074. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2075. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2076. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2077. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2078. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2079.  
  2080. Fingerprint Convex OS Release 10.1
  2081. TSeq(Class=64K)
  2082. T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=)
  2083. T2(Resp=N)
  2084. T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=)
  2085. T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=)
  2086. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2087. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2088. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2089. PU(Resp=N)
  2090.  
  2091. Fingerprint Corporate IP/IPX ISDN Small Office ISDN router (version 9.9.9/8.0)
  2092. TSeq(Class=64K)
  2093. T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  2094. T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  2095. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  2096. T4(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  2097. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2098. T6(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  2099. T7(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPRF%Ops=WNMETL)
  2100. PU(Resp=N)
  2101.  
  2102. Fingerprint Cray UNICOS/mk 8.6
  2103. TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1)
  2104. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2105. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2106. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2107. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2108. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2109. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2110. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2111. PU(Resp=N)
  2112.  
  2113. Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1  # Thanks to Mea Culpa
  2114. TSeq(Class=RI%gcd=<6)
  2115. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL)
  2116. T2(Resp=N)
  2117. T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT)
  2118. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  2119. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2120. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2121. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2122. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2123.  
  2124. Fingerprint UNICOS 10.0.0 on Cray 90
  2125. TSeq(Class=RI%gcd=<F%SI=<22222&>2222)
  2126. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL)
  2127. T2(Resp=N)
  2128. T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT)
  2129. T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2130. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2131. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2132. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2133. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2134.  
  2135. Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2
  2136. TSeq(Class=RI%gcd=<6%SI=>F)
  2137. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL)
  2138. T2(Resp=N)
  2139. T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT)
  2140. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2141. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2142. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2143. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2144. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2145.  
  2146. Fingerprint Cyclades PathRouter V 1.2.4
  2147. TSeq(Class=RI%gcd=<6%SI=>BBBBB)
  2148. T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
  2149. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2150. T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
  2151. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2152. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2153. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2154. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2155. PU(Resp=N)
  2156.  
  2157. Fingerprint Cyberguard 4.0 firewall
  2158. TSeq(Class=RI%gcd=<6%SI=>FFFF)
  2159. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  2160. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2161. T3(DF=N%W=1000%ACK=O%Flags=A%Ops=)
  2162. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2163. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2164. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2165. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2166. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  2167.  
  2168. Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12
  2169. TSeq(Class=TD%gcd=30C382%SI=<BB)
  2170. T1(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  2171. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2172. T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  2173. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  2174. T5(Resp=Y%DF=N%W=218|0%ACK=S|S++%Flags=AR%Ops=|M)
  2175. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  2176. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2177. PU(Resp=N)
  2178.  
  2179. Fingerprint Cyclades PathRAS V 1.1.7 
  2180. TSeq(Class=RI%gcd=<6%SI=>BBBBB)
  2181. T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  2182. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2183. T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  2184. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2185. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2186. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2187. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2188. PU(Resp=N)
  2189.  
  2190. Fingerprint Cyclades PathRouter
  2191. TSeq(Class=TD|RI%gcd=<618708%SI=<EEE47C)
  2192. T1(DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
  2193. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2194. T3(Resp=Y%DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
  2195. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2196. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2197. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2198. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2199. PU(Resp=N)
  2200.  
  2201. Fingerprint Cyclades PathRouter/PC
  2202. TSeq(Class=RI|TD%gcd=<618708%SI=<1F343)
  2203. T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  2204. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2205. T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  2206. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2207. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2208. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2209. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2210. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2211.  
  2212. Fingerprint Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06
  2213. TSeq(Class=RI%gcd=<6%SI=>18000)
  2214. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  2215. T2(Resp=N)
  2216. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  2217. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2218. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2219. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2220. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2221. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  2222.  
  2223. # DECbrouter90T1 Runs Cisco IOS 10.2(5)
  2224. # Cisco 1601, IOS 11.0
  2225. Fingerprint Cisco 1601 (IOS 11.0) or DECbrouter90T1 (Runs Cisco IOS 10.2(5))
  2226. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  2227. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2228. T3(Resp=N)
  2229. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2230. T5(Resp=N)
  2231. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2232. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2233. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2234.  
  2235. # Cisco 12008 running IOS 12.0(18.6)S1
  2236. # Cisco 7206VXR running IOS 12.0(18)S
  2237. Fingerprint Cisco IOS 12.0(18)S or 12.0(18)S1
  2238. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  2239. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
  2240. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2241. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  2242. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2243. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2244. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2245. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2246. PU(Resp=N)
  2247.  
  2248. Fingerprint:4.1.12.1 Cisco IOS 12.1(4) on a 2600    # THCRUT
  2249. TSeq(Class=RI%gcd=<A%SI=<9772&>3A%IPID=Z%TS=U)
  2250. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  2251. T2(Resp=N)
  2252. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  2253. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2254. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2255. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2256. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2257. PU(Resp=N)
  2258.  
  2259. # Cisco 3620 running IOS 12.2.1
  2260. # IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1)
  2261. Fingerprint Cisco IOS 12.1(5)-12.2(7a)
  2262. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  2263. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  2264. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2265. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  2266. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2267. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2268. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2269. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2270. PU(Resp=N)
  2271.  
  2272. # Cisco 2621 running IOS 12.2.8T
  2273. # Cisco SOHO 77 running IOS 12.2(8)T 
  2274. Fingerprint Cisco IOS 12.2(8)T
  2275. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  2276. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  2277. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2278. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  2279. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2280. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2281. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2282. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2283. PU(Resp=N)
  2284.  
  2285. Fingerprint DECNIS 600 V4.1.3B System
  2286. TSeq(Class=TD%gcd=30D4|C35%SI=<F)
  2287. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  2288. T2(Resp=N)
  2289. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  2290. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2291. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2292. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2293. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2294. PU(Resp=N)
  2295.  
  2296. Fingerprint DECserver700-16, Network Access SW V2.2
  2297. TSeq(Class=64K)
  2298. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  2299. T2(Resp=N)
  2300. T3(Resp=Y%DF=N%W=600%ACK=S++|O%Flags=AR|A%Ops=)
  2301. T4(DF=N%W=600%ACK=O%Flags=R%Ops=)
  2302. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2303. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2304. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2305. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2306.  
  2307. Fingerprint DEC VNswitch900
  2308. TSeq(Class=TD%gcd=<4%SI=<4)
  2309. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
  2310. T2(Resp=N)
  2311. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2312. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2313. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2314. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2315. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2316. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2317.  
  2318. Fingerprint Digitel NetRouter NR3000
  2319. TSeq(Class=RI%gcd=<2004%SI=<10CC&>16)
  2320. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  2321. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2322. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  2323. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2324. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2325. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2326. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2327. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  2328.  
  2329. Fingerprint DG/UX Release R4.11MU02
  2330. TSeq(Class=TD%gcd=10000|20000|30000%SI=<F)
  2331. T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
  2332. T2(Resp=N)
  2333. T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
  2334. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  2335. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2336. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2337. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2338. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2339.  
  2340. Fingerprint DG/UX Release R4.20MU02
  2341. TSeq(Class=TD%gcd=<20004%SI=<1E)
  2342. T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
  2343. T2(Resp=N)
  2344. T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
  2345. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  2346. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2347. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2348. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2349. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2350.  
  2351. Fingerprint DG/UX Release R4.20MU06
  2352. TSeq(Class=RI%gcd=<6%SI=<E21EE&>779%IPID=I%TS=U)
  2353. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
  2354. T2(Resp=N)
  2355. T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=)
  2356. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  2357. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2358. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2359. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2360. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2361.  
  2362. Fingerprint Digital Link DL2001 Management Access Processor
  2363. TSeq(Class=TD%gcd=<2780%SI=<14)
  2364. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2365. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2366. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2367. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2368. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2369. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2370. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2371. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2372.  
  2373. Fingerprint Digital UNIX OSF1 V 3.0,3.2,3.2C  # Thanks to Lamont Granquist
  2374. TSeq(Class=64K)
  2375. T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW)
  2376. T2(Resp=N)
  2377. T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=)
  2378. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2379. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2380. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2381. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2382. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2383.  
  2384. Fingerprint Digital UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F  # Thanks to Mea Culpa & Lamont Grsnquist & Izar Tarandach
  2385. TSeq(Class=RI|TD|64K%gcd=<6)  # Boy, OSF1 comes in all colors!
  2386. T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW)
  2387. T2(Resp=N)
  2388. T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=)
  2389. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2390. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2391. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2392. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2393. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2394.  
  2395. Fingerprint Digitel NetRouter NR3100
  2396. TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U)
  2397. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  2398. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2399. T3(Resp=N)
  2400. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2401. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2402. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2403. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2404. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2405.  
  2406. Fingerprint Draytek Vigor 2000 ISDN router
  2407. T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  2408. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2409. T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  2410. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2411. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2412. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2413. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2414. PU(Resp=N)
  2415.  
  2416. Fingerprint Compaq iPAQ Connection Point CP-2W Rev1.00
  2417. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2418. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2419. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2420. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2421. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2422. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2423. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2424. PU(Resp=N)
  2425.  
  2426. Fingerprint Compaq Tru64 UNIX (formerly Digital UNIX) 4.0e
  2427. TSeq(Class=C)
  2428. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  2429. T2(Resp=N)
  2430. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  2431. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2432. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2433. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2434. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2435. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2436.  
  2437. Fingerprint Compaq Tru64 UNIX 4.0e
  2438. TSeq(Class=RI%gcd=<6%SI=<7BE80&>DAF%IPID=I%TS=U)
  2439. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  2440. T2(Resp=N)
  2441. T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=)
  2442. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2443. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2444. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2445. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2446. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2447.  
  2448. Fingerprint Compaq Tru64 UNIX 5.0 on AlphaServer
  2449. TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C)
  2450. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  2451. T2(Resp=N)
  2452. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
  2453. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2454. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2455. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2456. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2457. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2458.  
  2459. Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
  2460. TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U)
  2461. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  2462. T2(Resp=N)
  2463. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  2464. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2465. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2466. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2467. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2468. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2469.  
  2470. Fingerprint OS-9/68K V2.4 (Quanterra Q4124 - 68030)
  2471. TSeq(Class=i800)
  2472. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=)
  2473. T2(Resp=N)
  2474. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=)
  2475. T4(DF=N%W=C000%ACK=O%Flags=R%Ops=)
  2476. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2477. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2478. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2479. PU(Resp=N)
  2480.  
  2481. Fingerprint OSF1 5.0 Rev. 910 (a.k.a. Compaq/Digital Tru64 Unix)
  2482. TSeq(Class=RI%gcd=<6%SI=<E88&>11)
  2483. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  2484. T2(Resp=N)
  2485. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
  2486. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2487. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2488. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2489. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2490. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2491.  
  2492. Fingerprint DEC OSF/1 V1.3A - 2.0
  2493. TSeq(Class=64K)
  2494. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  2495. T2(Resp=N)
  2496. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
  2497. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2498. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2499. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2500. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2501. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2502.  
  2503. Fingerprint DEC OSF1 Version 5.0.0
  2504. TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U)
  2505. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  2506. T2(Resp=N)
  2507. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
  2508. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2509. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2510. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2511. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2512. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2513.  
  2514. Fingerprint OSF/1 5.60
  2515. TSeq(Class=64K)
  2516. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW)
  2517. T2(Resp=N)
  2518. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  2519. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  2520. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2521. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2522. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2523. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2524.  
  2525. Fingerprint Digital UNIX OSF1 V 4.0-4.0F
  2526. TSeq(Class=C|RI%gcd=<6)
  2527. T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW)
  2528. T2(Resp=N)
  2529. T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=)
  2530. T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=)
  2531. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2532. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2533. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2534. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  2535.  
  2536. Fingerprint Dynix/PTX 4.4.2
  2537. TSeq(Class=RI%gcd=<6%SI=<15E0&>23)
  2538. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2539. T2(Resp=N)
  2540. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  2541. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2542. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2543. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2544. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2545. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  2546.  
  2547. # Software version VIK-1.35.020320j -- www.easytel.fi
  2548. Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router
  2549. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2550. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  2551. T2(Resp=N)
  2552. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  2553. T4(Resp=N)
  2554. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  2555. T6(Resp=N)
  2556. T7(Resp=N)
  2557. PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2558.  
  2559. Fingerprint Edimax BR-6004 broadband router
  2560. TSeq(Class=i800%IPID=I%TS=2HZ)
  2561. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  2562. T2(Resp=N)
  2563. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  2564. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2565. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2566. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2567. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2568.  
  2569. Fingerprint EMC DART running on a DataMover. Version T4.1.8.1
  2570. TSeq(Class=64K%IPID=I%TS=2HZ)
  2571. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  2572. T2(Resp=N)
  2573. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  2574. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2575. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2576. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2577. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2578. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2579.  
  2580. Fingerprint EMC IP4700 Filer
  2581. TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ)
  2582. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2583. T2(Resp=N)
  2584. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  2585. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  2586. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2587. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2588. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2589. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2590.  
  2591. Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20
  2592. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  2593. T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2594. T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
  2595. T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2596. T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2597. T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2598. T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2599. PU(Resp=N)
  2600.  
  2601. Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98
  2602. TSeq(Class=TR)
  2603. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  2604. T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2605. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=)
  2606. T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2607. T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2608. T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2609. T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  2610. PU(Resp=N)
  2611.  
  2612. Fingerprint Ericsson HM220dp ADSL modem/router
  2613. TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U)
  2614. T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  2615. T2(Resp=N)
  2616. T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  2617. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  2618. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2619. T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  2620. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2621. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2622.  
  2623. Fingerprint Extreme Alpine 3804 Extremeware 6.2.1
  2624. TSeq(Class=RI%gcd=<6%SI=<1598C&>223)
  2625. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2626. T2(Resp=N)
  2627. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  2628. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  2629. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2630. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2631. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2632. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2633.  
  2634. Fingerprint Extreme Networks Black Diamond switch
  2635. TSeq(Class=64K%gcd=<6%SI=<14)
  2636. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  2637. T2(Resp=N)
  2638. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  2639. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  2640. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2641. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2642. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2643. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2644.  
  2645. Fingerprint Extreme Gigabit switch (unknown version)
  2646. TSeq(Class=64K)
  2647. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2648. T2(Resp=N)
  2649. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  2650. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  2651. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2652. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2653. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2654. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2655.  
  2656. Fingerprint NAT LANB/290 Console Program V4.00
  2657. TSeq(Class=TD%gcd=<80004%SI=<14)
  2658. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2659. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2660. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
  2661. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2662. T5(Resp=N)
  2663. T6(Resp=N)
  2664. T7(Resp=N)
  2665. PU(Resp=N)
  2666.  
  2667. Fingerprint NCR MP-RAS SVR4 UNIX System Version 3
  2668. TSeq(Class=RI%gcd=<6%SI=<31BA1E&>7F38)
  2669. T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  2670. T2(Resp=N)
  2671. T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
  2672. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  2673. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2674. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2675. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2676. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2677.  
  2678. Fingerprint NCR S26 (i386) running NCR MP-RAS SVR4 UNIX System
  2679. TSeq(Class=RI%gcd=<6%SI=<2BB718&>6FD5)
  2680. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  2681. T2(Resp=N)
  2682. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
  2683. T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
  2684. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2685. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2686. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2687. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2688.  
  2689. Fingerprint F5labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86)
  2690. TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4)
  2691. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  2692. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2693. T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT)
  2694. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2695. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2696. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2697. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2698. PU(Resp=N)
  2699.  
  2700. Fingerprint Farralon Netopia router or Compatible Systems 900i
  2701. TSeq(Class=TD%gcd=388|710|A98%SI=<F)
  2702. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2703. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2704. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2705. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2706. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2707. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2708. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2709. PU(Resp=N)
  2710.  
  2711. Fingerprint FastComm FRAD F9200-DS-DNI -- Ver. 4.2.3A
  2712. TSeq(Class=TD|RI%gcd=<8%SI=<1E)
  2713. T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=)
  2714. T2(Resp=N)
  2715. T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=)
  2716. T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=)
  2717. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2718. T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=)
  2719. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2720. PU(Resp=N)
  2721.  
  2722. Fingerprint Foundry 1500 OS Ver 7.2.06T51
  2723. TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U)
  2724. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2725. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2726. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2727. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2728. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2729. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2730. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2731. PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  2732.  
  2733. Fingerprint Foundry FastIronII 4000 running 06.6.34T43
  2734. TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U)
  2735. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  2736. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2737. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2738. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2739. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2740. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2741. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2742. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2743.  
  2744. Fingerprint Foundry NetIron OS Ver. 7.1.23T13
  2745. TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U)
  2746. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2747. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2748. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2749. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2750. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2751. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2752. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2753. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2754.  
  2755. Fingerprint Foundry Networks, Inc. Router, IronWare Version 06.5.12T43
  2756. TSeq(Class=C)
  2757. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  2758. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  2759. T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  2760. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  2761. T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  2762. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  2763. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  2764. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2765.  
  2766. Fingerprint Foundry ServerIron XL Switch Version 06.0.00T12
  2767. TSeq(Class=C)
  2768. T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M)
  2769. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  2770. T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  2771. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  2772. T5(Resp=N)
  2773. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  2774. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  2775. PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  2776.  
  2777. Fingerprint Netopia DSL router
  2778. TSeq(Class=TR)
  2779. T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  2780. T2(Resp=N)
  2781. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  2782. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2783. T5(Resp=N)
  2784. T6(Resp=N)
  2785. T7(Resp=N)
  2786. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2787.  
  2788. Fingerprint NetScreen-100
  2789. TSeq(Class=RI%gcd=<6%SI=<276A&>50)
  2790. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2791. T2(Resp=N)
  2792. T3(Resp=N)
  2793. T4(Resp=N)
  2794. T5(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  2795. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  2796. T7(Resp=N)
  2797. PU(Resp=N)
  2798.  
  2799. Fingerprint NetSilicon NetARM running ThreadX 2.0   
  2800. TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
  2801. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2802. T2(Resp=N)
  2803. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  2804. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  2805. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2806. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2807. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2808. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2809.  
  2810. Fingerprint Nokia IPSO 3.2-3.2.1 releng 783-849
  2811. TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319)
  2812. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2813. T2(Resp=N)
  2814. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2815. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2816. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2817. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2818. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2819. PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2820.  
  2821. Fingerprint Nokia IPSO 3.2 Running Checkpoint Firewall-1
  2822. TSeq(Class=RI%gcd=<6%SI=<E4656&>2476)
  2823. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2824. T2(Resp=N)
  2825. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2826. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2827. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2828. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2829. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2830. PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)
  2831.  
  2832. # Nokia M1122 DSL Router (Nokia Mrouter rel-Gx1x2220.R08)
  2833. Fingerprint Nokia M1122 DSL Router
  2834. TSeq(Class=RI%gcd=<6%SI=<1AF18&>43B%IPID=I)
  2835. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  2836. T2(Resp=N)
  2837. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  2838. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2839. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2840. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2841. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2842. PU(Resp=N)
  2843.  
  2844. Fingerprint Galacticomm WorldGroup BBS / Vircom TCP/IP stack
  2845. TSeq(Class=C)
  2846. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  2847. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2848. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  2849. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2850. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2851. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2852. T7(Resp=N)
  2853. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2854.  
  2855. Fingerprint Gandalf LanLine Router
  2856. TSeq(Class=TD%gcd=<714%SI=<14)
  2857. T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  2858. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2859. T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  2860. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2861. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2862. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2863. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2864. PU(Resp=N)
  2865.  
  2866. Fingerprint Gnat Box Light 3.0.3 (from the inside interface)
  2867. TSeq(Class=RI%gcd=<6%SI=<F708&>264)
  2868. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2869. T2(Resp=N)
  2870. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2871. T4(Resp=N)
  2872. T5(Resp=N)
  2873. T6(Resp=N)
  2874. T7(Resp=N)
  2875. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2876.  
  2877. Fingerprint Gauntlet 4.0a firewall on Solaris 2.5.1
  2878. TSeq(Class=RI%gcd=<6%SI=<10540A&>89C%IPID=I%TS=U)
  2879. T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME)
  2880. T2(Resp=N)
  2881. T3(Resp=N)
  2882. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2883. T5(Resp=N)
  2884. T6(Resp=N)
  2885. T7(Resp=N)
  2886. PU(Resp=N)
  2887.  
  2888. Fingerprint Compatible Systems MicroRouter 900i v3.0.9
  2889. TSeq(Class=TD%gcd=388|710|A98%SI=<F)
  2890. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2891. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2892. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2893. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2894. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2895. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2896. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2897. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2898.  
  2899. Fingerprint Compatible Systems Microrouter 2220R w/ firmware v4.5
  2900. TSeq(Class=TD%gcd=388|710|A98%SI=<14)
  2901. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2902. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2903. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2904. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2905. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2906. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2907. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2908. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2909.  
  2910. Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router
  2911. TSeq(Class=TD%gcd=<6%SI=<FF)
  2912. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2913. T2(Resp=N)
  2914. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2915. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2916. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2917. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2918. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2919. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2920.  
  2921. # Flowpoint 144 or 22XX DSL Router v3.0.8
  2922. # SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready
  2923. Fingerprint DSL Router: Flowpoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1
  2924. TSeq(Class=TR%gcd=<6)
  2925. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2926. T2(Resp=N)
  2927. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2928. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2929. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2930. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2931. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2932. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E)
  2933.  
  2934. Fingerprint FreeBSD 2.2.1 - 4.1
  2935. TSeq(Class=RI%gcd=<8%SI=<38E50&>906)
  2936. T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  2937. T2(Resp=N)
  2938. T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M)
  2939. T4(DF=N%W=4000|0|0%ACK=O%Flags=R%Ops=)
  2940. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2941. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2942. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2943. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E)
  2944.  
  2945. Fingerprint FreeBSD 2.1.0 - 2.1.5  # Thanks to Jan Koum!
  2946. TSeq(Class=64K)
  2947. T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
  2948. T2(Resp=N)
  2949. T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
  2950. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2951. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2952. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2953. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2954. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2955.  
  2956. Fingerprint FreeBSD 2.2.1-STABLE
  2957. TSeq(Class=RI%gcd=<8%SI=<74A54&>1295)
  2958. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  2959. T2(Resp=N)
  2960. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2961. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2962. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2963. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2964. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2965. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  2966.  
  2967. Fingerprint FreeBSD 3.2-4.0
  2968. TSeq(Class=RI%gcd=<6%SI=<92D42&>1769)
  2969. T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M)
  2970. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2971. T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  2972. T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
  2973. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2974. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2975. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2976. PU(Resp=N)
  2977.  
  2978. Fingerprint FreeBSD 4.0-20000208-CURRENT
  2979. TSeq(Class=RI%gcd=<6%SI=<63074&>FC4)
  2980. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2981. T2(Resp=N)
  2982. T3(Resp=N)
  2983. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2984. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2985. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2986. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2987. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2988.  
  2989. Fingerprint FreeBSD 4.1.1 - 4.3 (X86)
  2990. TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U)
  2991. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  2992. T2(Resp=N)
  2993. T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  2994. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2995. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2996. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2997. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2998. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2999.  
  3000. Fingerprint FreeBSD 4.3 - 4.4-RELEASE
  3001. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3002. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  3003. T2(Resp=N)
  3004. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  3005. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3006. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3007. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3008. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3009. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  3010.  
  3011. Fingerprint FreeBSD 4.3 - 4.4PRERELEASE
  3012. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  3013. T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  3014. T2(Resp=N)
  3015. T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  3016. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3017. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3018. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3019. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3020. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3021.  
  3022. Fingerprint FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002
  3023. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  3024. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  3025. T2(Resp=N)
  3026. T3(Resp=N)
  3027. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3028. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3029. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3030. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3031. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3032.  
  3033. Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) (X86)
  3034. TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
  3035. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  3036. T2(Resp=N)
  3037. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  3038. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3039. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3040. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3041. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3042. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3043.  
  3044. Fingerprint FreeBSD 4.6-RELEASE or -STABLE (July 2002) (X86)
  3045. TSeq(Class=TR%IPID=I%TS=100HZ)
  3046. T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3047. T2(Resp=N)
  3048. T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3049. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3050. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3051. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3052. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3053. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3054.  
  3055. Fingerprint FreeBSD 4.6
  3056. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  3057. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  3058. T2(Resp=N)
  3059. T3(Resp=N)
  3060. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3061. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3062. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3063. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3064. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3065.  
  3066. Fingerprint FreeBSD 4.6-RC on Alpha
  3067. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  3068. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  3069. T2(Resp=N)
  3070. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  3071. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3072. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3073. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3074. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3075. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3076.  
  3077. Fingerprint FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002
  3078. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  3079. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  3080. T2(Resp=N)
  3081. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  3082. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3083. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3084. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3085. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3086. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3087.  
  3088. Fingerprint GNU Hurd 0.2 (GNUmach-1.2/Hurd-0.2) X86
  3089. TSeq(Class=TD|i800%gcd=<3000%SI=<1E%IPID=I%TS=100HZ)
  3090. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  3091. T2(Resp=N)
  3092. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  3093. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3094. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3095. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3096. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3097. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3098.  
  3099. Fingerprint Gold Card Ethernet Interface Firmware Ver. 3.19 (95.01.16).  Apparently a MIO Network interface for HP LaserJets, etc.
  3100. TSeq(Class=C)
  3101. T1(Resp=Y%DF=N%W=40%ACK=S++%Flags=AS%Ops=M)
  3102. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  3103. T3(Resp=Y%DF=N%W=40%ACK=S++%Flags=AS%Ops=M)
  3104. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  3105. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  3106. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  3107. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  3108. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3109.  
  3110. Fingerprint Hitachi HI-UX/MPP (don't know version)
  3111. TSeq(Class=64K)
  3112. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=MNNTWL)
  3113. T2(Resp=N)
  3114. T3(Resp=Y%DF=N%W=FF5E%ACK=O%Flags=A%Ops=NNT)
  3115. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3116. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3117. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3118. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3119. PU(TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  3120.  
  3121. # HP Router 210 with OS 9.72
  3122. Fingerprint HP Advancestack Etherswitch 224T or 210
  3123. TSeq(Class=TD%SI=<20)
  3124. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  3125. T2(Resp=N)
  3126. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  3127. T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
  3128. T5(DF=N%W=400%ACK=O%Flags=R%Ops=)
  3129. T6(DF=N%W=400%ACK=O%Flags=R%Ops=)
  3130. T7(DF=N%W=400%ACK=O%Flags=R%Ops=)
  3131. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3132.  
  3133. # Don't ask me what this is :)  David says
  3134. # it is "a Utah port of BSD to HP machines"
  3135. Fingerprint HP-BSD 2.0
  3136. TSeq(Class=64K)
  3137. T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  3138. T2(Resp=N)
  3139. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  3140. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  3141. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3142. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3143. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3144. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3145.  
  3146. Fingerprint HP Entria X station (running Netstation 7.x)  # Thanks t Zippy <seth@interport.net>
  3147. TSeq(Class=64K)
  3148. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  3149. T2(Resp=N)
  3150. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  3151. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  3152. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3153. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3154. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3155. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3156.  
  3157. # HP j4813A ProCurve Switch 2524
  3158. # Copper Mountain Networks DSL Concentrator
  3159. # Compaq Remote Insight Lights-Out remote console card
  3160. Fingerprint HP ProCurve Switch, Copper Mountain Networks DSL Concentrator, or Compaq Remote Insight Lights-Out remote console card
  3161. TSeq(Class=64K%IPID=I%TS=U)
  3162. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  3163. T2(Resp=N)
  3164. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  3165. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  3166. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3167. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3168. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3169. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3170.  
  3171. Fingerprint HP JetDirect Print Server
  3172. TSeq(Class=TD%gcd=<6%SI=<1E)
  3173. T1(DF=N%W=16D0|C90%ACK=S++%Flags=AS%Ops=M)
  3174. T2(Resp=N)
  3175. T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=|M)
  3176. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3177. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3178. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3179. T7(Resp=N)
  3180. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3181.  
  3182. Fingerprint HP printer w/JetDirect card
  3183. TSeq(Class=TD%gcd=<10%SI=<14%IPID=I%TS=U)
  3184. T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
  3185. T2(Resp=N)
  3186. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3187. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3188. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3189. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3190. T7(Resp=N)
  3191. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3192.  
  3193. Fingerprint HP printer w/JetDirect card
  3194. TSeq(Class=TD%gcd=<6%SI=<F)
  3195. T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
  3196. T2(Resp=N)
  3197. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3198. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3199. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3200. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3201. T7(Resp=N)
  3202. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3203.  
  3204. Fingerprint HP JetDirect  Firmware Rev. H.06.00
  3205. TSeq(Class=TD%gcd=<8%SI=<14)
  3206. T1(DF=N%W=860|16D0%ACK=S++%Flags=AS%Ops=M)
  3207. T2(Resp=N)
  3208. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3209. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3210. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3211. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3212. T7(Resp=N)
  3213. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3214.  
  3215. Fingerprint HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550
  3216. TSeq(Class=64K%IPID=I%TS=U)
  3217. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW)
  3218. T2(Resp=N)
  3219. T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=)
  3220. T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=)
  3221. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3222. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3223. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3224. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3225.  
  3226. # 2100 Series, 4000 TN, 4000 PS, 8000 DN
  3227. Fingerprint HP LaserJet Printer # Thanks to Dmessiah
  3228. TSeq(Class=TD%gcd=<6%SI=<100)
  3229. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  3230. T2(Resp=N)
  3231. T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS%Ops=M)
  3232. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3233. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3234. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3235. T7(Resp=N)
  3236. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3237.  
  3238. Fingerprint HP LaserJet 4000N Printer  # Thanks to David O'Brien
  3239. TSeq(Class=TD%gcd=<6%SI=<1E)
  3240. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3241. T2(Resp=N)
  3242. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3243. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3244. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3245. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3246. T7(Resp=N)
  3247. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3248.  
  3249. # Jet Direct Model J3113A, Firmware Rev G.07.20
  3250. Fingerprint HP Color LaserJet 4500N, Jet Direct J3113A/2100
  3251. T1(DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=M|)
  3252. T2(Resp=N)
  3253. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3254. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3255. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3256. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3257. T7(Resp=N)
  3258. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3259.  
  3260. Fingerprint HP LaserJet 5  # Thanks to Pluvius
  3261. TSeq(Class=TD%gcd=<6%SI=<FF)
  3262. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3263. T2(Resp=N)
  3264. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3265. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3266. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3267. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3268. T7(Resp=N)
  3269. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3270.  
  3271. Fingerprint HP Procurve Routing Switch 9304M
  3272. TSeq(Class=C)
  3273. T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=M)
  3274. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  3275. T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  3276. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  3277. T5(Resp=N)
  3278. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  3279. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  3280. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3281.  
  3282. Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777
  3283. TSeq(Class=64K)
  3284. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
  3285. T2(Resp=N)
  3286. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  3287. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  3288. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3289. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3290. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3291. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3292.  
  3293. Fingerprint HP-UX 9.01 - 9.07
  3294. TSeq(Class=64K)
  3295. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  3296. T2(Resp=N)
  3297. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  3298. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  3299. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3300. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3301. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3302. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3303.  
  3304. # Note this machine crashes everytime I scan it!
  3305. # Also it used to be 64K but they upgraded seq #
  3306. # generation to true random!  I wonder if that was
  3307. # because of me?
  3308. # 
  3309. # XXX: It crashed the machine again, but I got a full
  3310. # scan this time.
  3311. Fingerprint HP-UX B.10.01 A 9000/715
  3312. TSeq(Class=64K|TR)
  3313. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  3314. T2(Resp=N)
  3315. T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=)
  3316. T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
  3317. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3318. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3319. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3320. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3321.  
  3322. # HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0
  3323. Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0
  3324. TSeq(Class=64K)
  3325. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  3326. T2(Resp=N)
  3327. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  3328. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  3329. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3330. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3331. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3332. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3333.  
  3334. Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1 #Thanks to Lamont Granquist, David O'Brien
  3335. TSeq(Class=RI%gcd=<6%SI=<18000)
  3336. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  3337. T2(Resp=N)
  3338. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  3339. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  3340. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3341. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3342. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3343. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3344.  
  3345. Fingerprint HP-UX 10.20 A 9000/715 or 9000/899
  3346. TSeq(Class=64K)
  3347. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M)
  3348. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3349. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  3350. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3351. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3352. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3353. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3354. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3355.  
  3356. Fingerprint HP-UX release B.10.20 version A
  3357. TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
  3358. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  3359. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3360. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3361. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3362. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3363. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3364. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3365. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3366.  
  3367. Fingerprint HP-UX B.10.20 9000/897
  3368. TSeq(Class=64K)
  3369. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  3370. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3371. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  3372. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3373. T5(Resp=N)
  3374. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3375. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3376. PU(Resp=N)
  3377.  
  3378. Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0
  3379. TSeq(Class=64K)
  3380. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  3381. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3382. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  3383. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3384. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3385. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3386. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3387. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3388.  
  3389. Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2
  3390. TSeq(Class=RI%gcd=<6%SI=<18000)
  3391. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  3392. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3393. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  3394. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3395. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3396. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3397. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3398. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3399.  
  3400. # This is a wierd one
  3401. Fingerprint HP-UX 11.00
  3402. TSeq(Class=TD%gcd=>20000%SI=<3)
  3403. T1(Resp=N)
  3404. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  3405. T3(Resp=N)
  3406. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  3407. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  3408. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  3409. T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  3410. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3411.  
  3412. Fingerprint HP-UX B11.00 U 9000/839
  3413. TSeq(Class=RI%gcd=<10%SI=<2114C&>536)
  3414. T1(Resp=N)
  3415. T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  3416. T3(Resp=N)
  3417. T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  3418. T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
  3419. T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  3420. T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  3421. PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3422.  
  3423. Fingerprint HP9000 Model 804 K450 running HP/UX 11.00
  3424. TSeq(Class=RI%gcd=<6%SI=<4F254&>C95)
  3425. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  3426. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3427. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  3428. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3429. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3430. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3431. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3432. PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3433.  
  3434. Fingerprint Huawei Quidway R2621 running VRP 1.5.6(1)
  3435. TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ)
  3436. T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
  3437. T2(Resp=N)
  3438. T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
  3439. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3440. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3441. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3442. T7(Resp=N)
  3443. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  3444.  
  3445. Fingerprint Hydra HydraWEB 5000
  3446. TSeq(Class=RI%gcd=1|2|3|4%SI=<FFFF&>1111)
  3447. T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  3448. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3449. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  3450. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3451. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3452. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3453. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3454. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3455.  
  3456. Fingerprint IBM 2210 router unknown patch level
  3457. TSeq(Class=TD%gcd=<6%SI=<F)
  3458. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  3459. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3460. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3461. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3462. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3463. T6(DF=N%W=0%ACK=S|O|S++%Flags=R%Ops=)
  3464. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3465. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3466.  
  3467. # IBM 8210 Multiprotocol Switching Server for ATM networks, Model 3 (p/n 31L3  340),
  3468. Fingerprint IBM 8210 Multiprotocol Switching Server for ATM networks
  3469. TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
  3470. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  3471. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3472. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3473. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3474. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3475. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3476. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3477. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3478.  
  3479. Fingerprint IBM 2210 Router MRS 2.x on Token Ring interface
  3480. TSeq(Class=TR%gcd=<6)
  3481. T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  3482. T2(Resp=N)
  3483. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  3484. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3485. T5(DF=N%W=0%ACK=S++%Flags=AR|R%Ops=)
  3486. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  3487. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3488. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3489.  
  3490. Fingerprint IBM 3494 Magnetic Tape Library
  3491. TSeq(Class=RI%gcd=<6%SI=<A5B22&>1A6E%IPID=I%TS=U)
  3492. T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW)
  3493. T2(Resp=N)
  3494. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  3495. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  3496. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3497. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3498. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3499. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3500.  
  3501. # IBM AIX v3.2.5 running on 8xPower-2 wide nodes
  3502. # Fingerprint AIX Version 4
  3503. Fingerprint IBM AIX v3.2.5 - 4
  3504. TSeq(Class=TR%gcd=<6)
  3505. T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  3506. T2(Resp=N)
  3507. T3(Resp=N)
  3508. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3509. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3510. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3511. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3512. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  3513.  
  3514. Fingerprint AIX 4.3.1 on a IBM RS/6000 R40
  3515. TSeq(Class=TR%gcd=<6%TS=U)
  3516. T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3517. T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3518. T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3519. T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3520. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3521. T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3522. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3523. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  3524.  
  3525. # IBM AIX 5L 5.1
  3526. # AIX 5.1 ML00
  3527. Fingerprint IBM AIX 5.1
  3528. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3529. T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
  3530. T2(Resp=N)
  3531. T3(Resp=Y%DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
  3532. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  3533. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3534. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3535. T7(Resp=N)
  3536. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  3537.  
  3538. Fingerprint IBM Infoprint 12 Net-Printer
  3539. TSeq(Class=64K%IPID=I%TS=U)
  3540. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  3541. T2(Resp=N)
  3542. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=)
  3543. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  3544. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3545. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3546. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3547. PU(Resp=N)
  3548.  
  3549. Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT
  3550. TSeq(Class=64K)
  3551. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  3552. T2(Resp=N)
  3553. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  3554. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3555. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3556. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3557. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3558. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3559.  
  3560. Fingerprint IBM OS/2 V 2.1
  3561. TSeq(Class=64K)
  3562. T1(DF=N%W=6FCC%ACK=S++%Flags=AS%Ops=M)
  3563. T2(Resp=N)
  3564. T3(Resp=Y%DF=N%W=6FCC%ACK=O%Flags=A%Ops=)
  3565. T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
  3566. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3567. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3568. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3569. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3570.  
  3571. Fingerprint IBM OS/2 V.3  # Thanks to van Hauser (vh@reptile.rug.ac.be)
  3572. TSeq(Class=i800)
  3573. T1(DF=N%W=7000%ACK=S++%Flags=AS%Ops=M)
  3574. T2(Resp=N)
  3575. T3(Resp=Y%DF=N%W=7000%ACK=O%Flags=A%Ops=)
  3576. T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
  3577. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3578. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3579. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3580. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3581.  
  3582. Fingerprint IBM OS/2 Warp 4.0
  3583. TSeq(Class=i800)
  3584. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
  3585. T2(Resp=N)
  3586. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  3587. T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
  3588. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3589. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3590. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3591. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3592.  
  3593. Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
  3594. TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
  3595. T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  3596. T2(Resp=N)
  3597. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  3598. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  3599. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3600. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3601. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3602. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3603.  
  3604. Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
  3605. TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
  3606. T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  3607. T2(Resp=N)
  3608. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  3609. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  3610. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3611. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3612. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3613. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3614.  
  3615. Fingerprint AS/400 running OS/400 R4.4
  3616. TSeq(Class=TD%gcd=<6%SI=<1E)
  3617. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3618. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3619. T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3620. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  3621. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3622. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  3623. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3624. PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3625.  
  3626. Fingerprint IBM AS400 running OS/400 5.1
  3627. TSeq(Class=TD%gcd=<604%SI=<14%IPID=I)
  3628. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3629. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3630. T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3631. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  3632. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3633. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  3634. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3635. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3636.  
  3637. # added by Beat Rubischon <beat@rubis.ch>
  3638. Fingerprint IBM AS/400 V3 and V4
  3639. TSeq(Class=RI%gcd=<6)
  3640. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  3641. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3642. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  3643. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  3644. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3645. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  3646. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3647. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3648.  
  3649. Fingerprint IBM VM/CMS (mainframe)
  3650. TSeq(Class=RI%gcd=64|C8%SI=>CC&<CCC)
  3651. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  3652. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3653. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  3654. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3655. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3656. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3657. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3658. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3659.  
  3660. Fingerprint IBM VM/ESA 2.2.0 CMS Mainframe System
  3661. TSeq(Class=RI|TD%gcd=64|C8|12C|1F4|190%SI=<FFF)
  3662. T1(DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
  3663. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3664. T3(Resp=Y%DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
  3665. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3666. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3667. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3668. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3669. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3670.  
  3671. Fingerprint D-Link 704P Ethernet Broadband Gateway
  3672. TSeq(Class=RI|TD%gcd=<68%SI=<3A2%IPID=I%TS=U)
  3673. T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  3674. T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
  3675. T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  3676. T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
  3677. T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  3678. T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
  3679. T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  3680. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3681.  
  3682. Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9
  3683. TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U)
  3684. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3685. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  3686. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3687. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  3688. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3689. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  3690. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3691. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3692.  
  3693. # D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled 
  3694. # Date: Oct 14 1997, Time: 09:35:04  (claims software version 2.04B3,
  3695. # boot PROM version 2.21)
  3696. Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21
  3697. TSeq(Class=TD%gcd=1388%SI=0)
  3698. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  3699. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3700. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  3701. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3702. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3703. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3704. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3705. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3706.  
  3707. Fingerprint D-Link DI-701, Version 2.22
  3708. TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1)
  3709. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  3710. T2(Resp=N)
  3711. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  3712. T4(Resp=N)
  3713. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  3714. T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  3715. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  3716. PU(Resp=N)
  3717.  
  3718. Fingerprint D-Link DCS-1000 webcam with firmware 1.06
  3719. TSeq(Class=TD%gcd=<E0%SI=<14%IPID=I%TS=U)
  3720. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  3721. T2(Resp=N)
  3722. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=ASF%Ops=M)
  3723. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3724. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3725. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3726. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3727. PU(Resp=N)
  3728.  
  3729. Fingerprint D-Link Print Server
  3730. TSeq(Class=TD%gcd=<72%SI=<1E)
  3731. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  3732. T2(Resp=N)
  3733. T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M)
  3734. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3735. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3736. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3737. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3738. PU(Resp=N)
  3739.  
  3740. Fingerprint DI-701Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30
  3741. TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00)
  3742. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  3743. T2(Resp=N)
  3744. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  3745. T4(Resp=N)
  3746. T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3747. T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3748. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3749. PU(Resp=N)
  3750.  
  3751. Fingerprint D-Link Wireless Access Point DRC-1000AP - v3.2.28
  3752. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3753. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  3754. T2(Resp=N)
  3755. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  3756. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3757. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3758. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3759. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3760. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  3761.  
  3762. # Intel Corporation, ER9100 Express Router 9100
  3763. # FingerPrint by Ron van Daal (ronvdaal@syntonic.net)
  3764. Fingerprint Intel Corporation, ER9100 Express Router 9100 
  3765. TSeq(Class=TD%gcd=10|20|30%SI=1)
  3766. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  3767. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3768. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  3769. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3770. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3771. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3772. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3773. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3774.  
  3775. Fingerprint Intel Express 510T switch
  3776. TSeq(Class=TD%gcd=10|20|30%SI=<BB)
  3777. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  3778. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3779. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  3780. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3781. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3782. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3783. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3784. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3785.  
  3786. Fingerprint Intel InBusiness Print Station
  3787. TSeq(Class=64K)
  3788. T1(DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  3789. T2(Resp=N)
  3790. T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  3791. T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
  3792. T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  3793. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3794. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  3795. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3796.  
  3797. Fingerprint Intel Netport Express PRO V04.33a
  3798. TSeq(Class=TD%gcd=1%SI=0)
  3799. T1(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3800. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  3801. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  3802. T4(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  3803. T5(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3804. T6(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  3805. T7(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3806. PU(Resp=N)
  3807.  
  3808. Fingerprint Intel NetportExpress(tm) 10/100 3-port ROM: V05.10a
  3809. TSeq(Class=64K)
  3810. T1(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  3811. T2(Resp=N)
  3812. T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  3813. T4(Resp=Y%DF=N%W=16D0%ACK=O%Flags=R%Ops=)
  3814. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=R%Ops=)
  3815. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3816. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  3817. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3818.  
  3819. Fingerprint Intel(R) NetStructure(TM) 470T Switch
  3820. TSeq(Class=TD%gcd=<7534%SI=<64%IPID=I%TS=U)
  3821. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  3822. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3823. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  3824. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3825. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3826. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3827. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3828. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3829.  
  3830. Fingerprint Labtam MT300, X-Terminal Kernel
  3831. TSeq(Class=64K)
  3832. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3833. T2(Resp=N)
  3834. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  3835. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3836. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3837. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3838. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3839. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3840.  
  3841. Fingerprint Lantronix ETS16 Version V3.4/5(961028)
  3842. TSeq(Class=RI%gcd=<6%SI=<9D1C&>91%IPID=BI%TS=U)
  3843. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  3844. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3845. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3846. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3847. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3848. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3849. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3850. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3851.  
  3852. Fingerprint Lantronix ETS16P Version V3.5/2(970721)
  3853. TSeq(Class=RI%gcd=<6%SI=<404C&>90)
  3854. T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M)
  3855. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3856. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3857. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3858. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3859. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3860. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3861. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3862.  
  3863. Fingerprint Lantronix EPS1 Version V3.5/1(970325)
  3864. TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
  3865. T1(DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
  3866. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3867. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3868. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3869. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3870. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3871. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3872. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3873.  
  3874. Fingerprint Lantronix EPS2 Printer Version V3.5/2(970721)
  3875. TSeq(Class=RI|TD%gcd=<6)
  3876. T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
  3877. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3878. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3879. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3880. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3881. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3882. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3883. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3884.  
  3885. Fingerprint LG Goldstream LR3100p software version 1.0-1.5
  3886. TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
  3887. T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
  3888. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  3889. T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
  3890. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  3891. T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  3892. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  3893. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  3894. PU(Resp=N)
  3895.  
  3896. Fingerprint LG Goldstream LR3001f software version 4.0
  3897. TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
  3898. T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
  3899. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  3900. T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
  3901. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  3902. T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  3903. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  3904. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  3905. PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  3906.  
  3907. Fingerprint MPE/iX 5.5
  3908. TSeq(Class=TD%gcd=<6%SI=<14)
  3909. T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
  3910. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3911. T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
  3912. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3913. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3914. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3915. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3916. PU(Resp=N)
  3917.  
  3918. Fingerprint HP MPE/iX 5.5 on HP 3000
  3919. TSeq(Class=TD%gcd=<6%SI=<1E%TS=U)
  3920. T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=M)
  3921. T2(Resp=N)
  3922. T3(Resp=Y%DF=N%W=6000%ACK=S++%Flags=AS%Ops=M)
  3923. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  3924. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  3925. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  3926. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  3927. PU(Resp=N)
  3928.  
  3929. Fingerprint MultiTech CommPlete Controller
  3930. TSeq(Class=TR|RI%gcd=<6%SI=>FFFF)
  3931. T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
  3932. T2(Resp=N)
  3933. T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
  3934. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3935. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3936. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3937. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3938. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  3939.  
  3940. Fingerprint MultiTech MultiVOIP Version 2.01A Firmware
  3941. TSeq(Class=TD%gcd=<714%SI=<14)
  3942. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  3943. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3944. T3(Resp=N)
  3945. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3946. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3947. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3948. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3949. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3950.  
  3951. Fingerprint MultiTech standalone firewall box, version 3
  3952. TSeq(Class=TD%gcd=<714%SI=<14)
  3953. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  3954. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3955. T3(Resp=Y%DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  3956. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3957. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3958. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3959. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3960.  
  3961. Fingerprint MVS TCP/IP TCPMVS 3.2
  3962. TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E)
  3963. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3964. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3965. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3966. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3967. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3968. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3969. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3970. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  3971.  
  3972. Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2
  3973. TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200)
  3974. T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
  3975. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3976. T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
  3977. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3978. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3979. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3980. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3981.  
  3982. Fingerprint IBM MVS TCP/IP TCPOE 3.3  # Thanks to van Hauser
  3983. TSeq(Class=RI%gcd=<6%SI=<BB0)
  3984. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  3985. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3986. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  3987. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  3988. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3989. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  3990. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3991. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3992.  
  3993. Fingerprint IBM MVS (unknown version)  # Thanks James W. Abendschan <jwa@jammed.com>
  3994. TSeq(Class=RI%gcd=64|C8|12C|190)
  3995. T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M)
  3996. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3997. T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|)
  3998. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3999. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4000. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4001. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4002. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  4003.  
  4004. Fingerprint Instant Internet box
  4005. TSeq(Class=TD%gcd=1000|2000|3000%SI=<BB)
  4006. T1(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
  4007. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4008. T3(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
  4009. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4010. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4011. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4012. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4013. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  4014.  
  4015. Fingerprint Intergraph Workstation (2000 Series) running CLiX R3.1
  4016. TSeq(Class=TD%gcd=209|1048|E3F%SI=<5)
  4017. T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  4018. T2(Resp=N)
  4019. T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  4020. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4021. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4022. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4023. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4024. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  4025.  
  4026. # IPAD Model 5000 (see www.ipad-canada.com)
  4027. # esoft IPAD, v.1.52 -- 64 line option on i86 hardware
  4028. Fingerprint IPAD Model 5000 or V.1.52 (see www.ipad-canada.com/www.esoft.com)
  4029. TSeq(Class=TD|RI%gcd=1000|2000|3000%SI=<444)
  4030. T1(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  4031. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4032. T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  4033. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4034. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4035. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4036. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4037. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4038.  
  4039. Fingerprint IRIX 5.2
  4040. TSeq(Class=64K)
  4041. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
  4042. T2(Resp=N)
  4043. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  4044. T4(DF=N%W=F000%ACK=O%Flags=R%Ops=)
  4045. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4046. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4047. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4048. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  4049.  
  4050. Fingerprint IRIX 5.3  # Thanks to David O'Brien & Mea Culpa
  4051. TSeq(Class=64K)
  4052. T1(DF=N%W=EF2A|F000%ACK=S++%Flags=AS%Ops=MNWNNT)
  4053. T2(Resp=N)
  4054. T3(Resp=Y%DF=N%W=EF2A|F000%ACK=O%Flags=A%Ops=NNT)
  4055. T4(DF=N%W=EF2A|F000%ACK=O%Flags=R%Ops=)
  4056. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4057. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4058. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4059. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4060.  
  4061. Fingerprint IRIX 6.2 - 6.5  # Thanks to  Lamont Granquist
  4062. TSeq(Class=TD|64K|RI%gcd=<6|3E8|7D0|BB8|FA0)
  4063. T1(DF=N%W=EF2A|C000%ACK=S++%Flags=AS%Ops=MNWNNT)
  4064. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4065. T3(Resp=Y%DF=N%W=EF2A|C000%ACK=O%Flags=A%Ops=NNT)
  4066. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4067. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4068. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4069. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4070. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4071.  
  4072. Fingerprint IRIX 6.2 - 6.5 # Thanks to Lamont Granquist
  4073. TSeq(Class=i800)
  4074. T1(DF=N%W=C000|EF2A%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  4075. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4076. T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
  4077. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4078. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4079. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4080. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4081. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4082.  
  4083. Fingerprint IRIX 6.4 - 6.5.3m  # Lamont Granquist (again :)
  4084. TSeq(Class=RI|TD%gcd=28|50|78|A0|C8|F0|140%SI=<3E8)
  4085. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT)
  4086. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4087. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
  4088. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4089. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4090. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4091. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4092. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4093.  
  4094. Fingerprint IRIX 6.5
  4095. TSeq(Class=RI%gcd=10%SI=<2222)
  4096. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
  4097. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4098. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  4099. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4100. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4101. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4102. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4103. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4104.  
  4105. Fingerprint IRIX 6.5 Origin2
  4106. TSeq(Class=64K)
  4107. T1(Resp=Y%DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
  4108. T2(Resp=N)
  4109. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  4110. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4111. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4112. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4113. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4114. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4115.  
  4116. # IP19/IP27/IP30/IP32
  4117. Fingerprint IRIX 6.5-6.5.15m
  4118. TSeq(Class=RI|64K%gcd=<144%SI=<FFFF&>8%IPID=I%TS=2HZ)
  4119. T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  4120. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4121. T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
  4122. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4123. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4124. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4125. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4126. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4127.  
  4128. Fingerprint IRIX 6.5.7f-6.5.8f
  4129. TSeq(Class=64K)
  4130. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  4131. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4132. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  4133. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4134. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4135. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4136. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4137. PU(Resp=N)
  4138.  
  4139. Fingerprint IRIX 6.5.15m on SGI O2
  4140. TSeq(Class=TD%gcd=<104%SI=<1AE%IPID=I%TS=2HZ)
  4141. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  4142. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4143. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  4144. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4145. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4146. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4147. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4148. PU(Resp=N)
  4149.  
  4150. # SGI O2 running IRIX 6.5.7f
  4151. Fingerprint IRIX 6.5.7f-6.5.8f
  4152. TSeq(Class=64K)
  4153. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  4154. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4155. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  4156. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4157. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4158. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4159. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4160. PU(Resp=N)
  4161.  
  4162. # IRIX 6.5.14, SGI O2
  4163. # IRIX 6.5 IP32
  4164. Fingerprint IRIX 6.5.14
  4165. TSeq(Class=RI%gcd=<C%SI=<13876&>257%IPID=I%TS=2HZ)
  4166. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  4167. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4168. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  4169. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4170. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4171. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4172. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4173. PU(Resp=N)
  4174.  
  4175. Fingerprint Isolation Systems Infocrypt Enterprise
  4176. TSeq(Class=C)
  4177. T1(Resp=N)
  4178. T2(Resp=N)
  4179. T3(Resp=N)
  4180. T4(Resp=N)
  4181. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  4182. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  4183. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  4184. PU(Resp=N)
  4185.  
  4186. Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL Server
  4187. TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI)
  4188. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  4189. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4190. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  4191. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4192. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4193. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4194. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4195. PU(Resp=N)
  4196.  
  4197. Fingerprint Juniper Router running JUNOS
  4198. TSeq(Class=RI%gcd=<5%SI=>FFF)
  4199. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  4200. T2(Resp=N)
  4201. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  4202. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  4203. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4204. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4205. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4206. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4207.  
  4208. Fingerprint Juniper Networks JUNOS 5.3 on an Olive router
  4209. TSeq(Class=RI%gcd=<6%SI=<ABEB4&>661%IPID=I%TS=100HZ)
  4210. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  4211. T2(Resp=N)
  4212. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  4213. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4214. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4215. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4216. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4217. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4218.  
  4219. # KA9Q is a networking OS used mostly by amateur radio operators for radio to
  4220. # internet gateways.
  4221. Fingerprint KA9Q
  4222. TSeq(Class=TD%gcd=37000%SI=<1E)
  4223. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
  4224. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4225. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
  4226. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4227. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4228. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4229. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4230. PU(Resp=N)
  4231.  
  4232. # 3com OfficeConnect 812 ADSL router firmware 2.0.0
  4233. # Kentrox Datasmart 656 CSU/DSU or USR Netserver/16
  4234. Fingerprint Kentrox Datasmart 656 CSU/DSU, USR Netserver/16, or 3Com OfficeConnect ADSL router
  4235. TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=<A)
  4236. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  4237. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4238. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  4239. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4240. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4241. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4242. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4243. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4244.  
  4245. Fingerprint KRONOS Time clock   
  4246. TSeq(Class=TD%gcd=<7C%SI=<32%IPID=I%TS=U)
  4247. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  4248. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  4249. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  4250. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  4251. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  4252. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  4253. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  4254. PU(Resp=N)
  4255.  
  4256. Fingerprint Kyocera IB-21 Printer NIC
  4257. TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U)
  4258. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  4259. T2(Resp=Y%DF=N%W=100%ACK=S%Flags=AR%Ops=)
  4260. T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AR%Ops=)
  4261. T4(DF=N%W=100%ACK=S%Flags=AR%Ops=)
  4262. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4263. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4264. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4265. PU(Resp=N)
  4266.  
  4267. Fingerprint Lantronix LSB4 Ethernet Switch
  4268. TSeq(Class=RI%gcd=<6%SI=>CCC&<FFFF)
  4269. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  4270. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4271. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4272. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4273. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4274. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4275. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4276. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4277.  
  4278. Fingerprint Rockwell Spectrum 100 release 7.2
  4279. TSeq(Class=i800%IPID=I%TS=U)
  4280. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=)
  4281. T2(Resp=N)
  4282. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  4283. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  4284. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4285. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4286. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4287. PU(Resp=N)
  4288.  
  4289. # LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or
  4290. # Trancell Webramp router or Xylan Omni Switch 3.2.X.X - 3.4.X.X
  4291. # Epson Stylus Color 1520C with 100BTX-NIC from Epson
  4292. # CISCO 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX
  4293. # Sonicwall firewall appliance 10meg firmware 3.3.1
  4294. Fingerprint Router/Switch/Printer (LanPlex 2500/Cisco Catalyst 5505/CISCO 6509/Trancell Webramp/Xylan Omni Switch)/Epson Stylus (100BTX-NIC HP Secure Web Console, Sonicwall firewall appliance 3.3.1) 
  4295. TSeq(Class=64K)
  4296. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4297. T2(Resp=N)
  4298. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  4299. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  4300. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4301. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4302. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4303. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4304.  
  4305. Fingerprint Lexmark M412n network printer
  4306. TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ)
  4307. T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
  4308. T2(Resp=N)
  4309. T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
  4310. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  4311. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4312. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4313. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4314. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4315.  
  4316. #  Lexmark Optra S 1659 (MarkNetS)
  4317. #  Lexmark Optra S 2455 and SC 1275
  4318. Fingerprint Lexmark Optra S Printer
  4319. TSeq(Class=TD%gcd=1393|2726|3AB9|4E4C|61DF%SI=<30)
  4320. T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
  4321. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4322. T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
  4323. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4324. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4325. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4326. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4327. PU(Resp=N|Y)
  4328.  
  4329. Fingerprint Lexmark Optra T612 (printer) running firmware 3.11.17
  4330. TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
  4331. T1(DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
  4332. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4333. T3(Resp=Y%DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
  4334. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4335. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4336. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4337. T7(Resp=N)
  4338. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  4339.  
  4340. Fingerprint Leunig ePower Switch b723 v5.2
  4341. TSeq(Class=TR)
  4342. T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  4343. T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  4344. T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  4345. T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=)
  4346. T5(Resp=N)
  4347. T6(Resp=N)
  4348. T7(Resp=N)
  4349. PU(Resp=N)
  4350.  
  4351. Fingerprint Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1
  4352. TSeq(Class=TD%gcd=1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20)
  4353. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  4354. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4355. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  4356. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  4357. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4358. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  4359. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4360. PU(Resp=N)
  4361.  
  4362. Fingerprint Linksys BEFW11S4 802.11B WAP
  4363. TSeq(Class=TD%gcd=<F4%SI=<1E%IPID=Z%TS=U)
  4364. T1(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=)
  4365. T2(Resp=Y%DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=)
  4366. T3(Resp=Y%DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=)
  4367. T4(DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=)
  4368. T5(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=)
  4369. T6(DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=)
  4370. T7(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=)
  4371. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4372.  
  4373. Fingerprint LinkSys WAP11 wireless AP firmware ver. 2.2
  4374. TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
  4375. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  4376. T2(Resp=N)
  4377. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  4378. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  4379. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4380. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4381. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4382. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4383.  
  4384. Fingerprint Pigtail Express VoIP phone (runs VxWorks)
  4385. TSeq(Class=64K%IPID=I%TS=U)
  4386. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  4387. T2(Resp=N)
  4388. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  4389. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  4390. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4391. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4392. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4393. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  4394.  
  4395. Fingerprint PS2 Linux 1.0
  4396. TSeq(Class=RI%gcd=<6%SI=<20E2FE8&>5428C%IPID=I%TS=100HZ)
  4397. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNT)
  4398. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4399. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  4400. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4401. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4402. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4403. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  4404.  
  4405. # fingerprint!
  4406. Fingerprint Linux 1.0.9
  4407. TSeq(Class=TD%gcd=30|60%SI=<F)
  4408. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4409. T2(Resp=N)
  4410. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=ASF%Ops=M)
  4411. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4412. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4413. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4414. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4415. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4416.  
  4417. Fingerprint Linux 1.2.8 - 1.2.13
  4418. TSeq(Class=RI%gcd=<6%SI=<BBBB)
  4419. T1(DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
  4420. T2(Resp=N)
  4421. T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
  4422. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4423. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4424. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4425. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4426. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4427.  
  4428. Fingerprint Linux 1.2.13
  4429. TSeq(Class=TD%gcd=1%SI=1C)
  4430. T1(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
  4431. T2(Resp=N)
  4432. T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
  4433. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4434. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4435. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4436. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4437. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4438.  
  4439. Fingerprint Linux 1.3.20 (X86)
  4440. T1(DF=N%W=77FF|0%ACK=S++%Flags=AS|BAR%Ops=ME|)
  4441. T2(Resp=N)
  4442. T3(Resp=N)
  4443. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4444. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4445. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4446. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4447. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4448.  
  4449. Fingerprint Linux 2.0.0
  4450. TSeq(Class=RI%gcd=<6)
  4451. T1(DF=N%W=7C00%ACK=S++%Flags=BAS%Ops=ME)
  4452. T2(Resp=N)
  4453. T3(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=ASF%Ops=ME)
  4454. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4455. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4456. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4457. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4458. PU(DF=N%TOS=6%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4459.  
  4460. Fingerprint Linux 2.0.27 - 2.0.30
  4461. TSeq(Class=TR)
  4462. T1(DF=N%W=7C00|3C00%ACK=S++%Flags=BAS%Ops=ME)
  4463. T2(Resp=N)
  4464. T3(Resp=Y%DF=N%W=7C00|3C00%ACK=S++%Flags=ASF%Ops=ME)
  4465. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4466. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4467. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4468. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4469. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4470.  
  4471. Fingerprint Linux 2.0.32-34
  4472. TSeq(Class=TR%gcd=<6)
  4473. T1(DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=BAS%Ops=ME)
  4474. T2(Resp=N)
  4475. T3(Resp=Y%DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=ASF%Ops=ME)
  4476. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4477. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4478. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4479. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4480. PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4481.  
  4482. # On very rare cases, I get a T2 response back -- weird
  4483. Fingerprint Linux 2.0.32-34 
  4484. TSeq(Class=TR)
  4485. T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME)
  4486. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4487. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  4488. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4489. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4490. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4491. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4492. PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4493.  
  4494. Fingerprint Linux 2.0.34-38
  4495. TSeq(Class=TR)
  4496. T1(DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=AS%Ops=ME|M)
  4497. T2(Resp=N)
  4498. T3(Resp=Y%DF=N%W=7FDF|7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=ASF%Ops=|ME|M)
  4499. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4500. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4501. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4502. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4503. PU(DF=N%TOS=C0|A0|0|20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  4504.  
  4505. Fingerprint Linux 2.0.35 (S.u.S.E. Linux 5.3 (i386)
  4506. TSeq(Class=TR%gcd=<6)
  4507. T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=ME)
  4508. T2(Resp=N)
  4509. T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=ASF%Ops=ME)
  4510. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4511. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4512. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4513. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4514. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4515.  
  4516. Fingerprint Linux 2.1.24 PowerPC
  4517. TSeq(Class=TR)
  4518. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  4519. T2(Resp=N)
  4520. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  4521. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4522. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4523. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4524. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4525. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4526.  
  4527. Fingerprint Linux 2.1.76
  4528. TSeq(Class=TR)
  4529. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
  4530. T2(Resp=N)
  4531. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
  4532. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4533. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4534. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4535. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4536. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4537.  
  4538. Fingerprint Linux Kernel 2.1.88
  4539. TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7)
  4540. T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME)
  4541. T2(Resp=N)
  4542. T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|)
  4543. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4544. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4545. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4546. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4547. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4548.  
  4549. Fingerprint Linux 2.1.91 - 2.1.103
  4550. TSeq(Class=RI%gcd=<6%SI=>7A000)
  4551. T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW)
  4552. T2(Resp=N)
  4553. T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW)
  4554. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4555. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4556. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4557. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4558. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4559.  
  4560. Fingerprint Linux 2.1.19 - 2.2.20
  4561. TSeq(Class=RI%gcd=<8%SI=>10000%IPID=I%TS=100HZ)
  4562. T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
  4563. T2(Resp=N)
  4564. T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
  4565. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4566. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4567. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4568. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4569. PU(DF=N%TOS=C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  4570.  
  4571. Fingerprint Linux 2.2.12 - 2.2.19
  4572. TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U)
  4573. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
  4574. T2(Resp=N)
  4575. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
  4576. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4577. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4578. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4579. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4580. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4581.  
  4582. Fingerprint Linux 2.2.5 - 2.2.13 SMP
  4583. TSeq(Class=RI%gcd=<6%SI=<D49FAE&>2203C)
  4584. T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
  4585. T2(Resp=N)
  4586. T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
  4587. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4588. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4589. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4590. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4591. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)
  4592.  
  4593. Fingerprint Linux kernel 2.2.13
  4594. TSeq(Class=RI%gcd=<6%SI=<E5F68C&>24CA0)
  4595. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  4596. T2(Resp=N)
  4597. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  4598. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4599. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4600. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4601. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4602. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  4603.  
  4604. Fingerprint Linux 2.2.14
  4605. TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7)
  4606. T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  4607. T2(Resp=N)
  4608. T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  4609. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4610. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4611. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4612. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4613. PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)
  4614.  
  4615. Fingerprint Linux 2.2.19 - 2.2.20
  4616. TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U)
  4617. T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
  4618. T2(Resp=N)
  4619. T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
  4620. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4621. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4622. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4623. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4624. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4625.  
  4626. # Linux 2.2.19 on a DEC Alpha 233mhz Multia
  4627. Fingerprint Linux 2.2.19 on a DEC Alpha
  4628. TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ)
  4629. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  4630. T2(Resp=N)
  4631. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  4632. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4633. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4634. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4635. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4636. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)
  4637.  
  4638. Fingerprint Linux 2.3.12
  4639. TSeq(Class=RI%gcd=<20%SI=>DDDD)
  4640. T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
  4641. T2(Resp=N)
  4642. T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
  4643. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4644. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4645. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4646. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4647. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4648.  
  4649. Fingerprint Linux 2.3.28-33
  4650. TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3)
  4651. T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  4652. T2(Resp=N)
  4653. T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  4654. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4655. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4656. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4657. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4658. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4659.  
  4660. Fingerprint Linux 2.3.49 x86
  4661. TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E)
  4662. T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  4663. T2(Resp=N)
  4664. T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  4665. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4666. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4667. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4668. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4669. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4670.  
  4671. Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86
  4672. TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA)
  4673. T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  4674. T2(Resp=N)
  4675. T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  4676. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4677. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4678. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4679. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4680. PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4681.  
  4682. Fingerprint Linux Kernel 2.4.0-test5
  4683. TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8)
  4684. T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
  4685. T2(Resp=N)
  4686. T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
  4687. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4688. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4689. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4690. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4691. PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)
  4692.  
  4693. Fingerprint Linux Kernel 2.4.0 - 2.5.20
  4694. TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U)
  4695. T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D244000|7E18|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  4696. T2(Resp=N)
  4697. T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|7E18|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  4698. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4699. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4700. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4701. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4702. PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  4703.  
  4704. # Strangely enough, I have received several prints like this that claim a T2:
  4705. Fingerprint Linux 2.4.16 - 2.4.18
  4706. TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ)
  4707. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4708. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4709. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4710. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4711. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4712. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4713. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4714. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4715.  
  4716. # Debain GNU/Linux 3.0 (Linux 2.4.19-pre4 running on a DECpc AXP 150
  4717. Fingerprint Linux 2.4.19-pre4 on Alpha
  4718. TSeq(Class=RI%gcd=<6%SI=<266A1F0&>62546%IPID=Z%TS=1000HZ)
  4719. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4720. T2(Resp=N)
  4721. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4722. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4723. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4724. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4725. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4726. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4727.  
  4728. Fingerprint Linux Kernel 2.4.0 - 2.5.20 w/o tcp_timestamps
  4729. TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U)
  4730. T1(DF=Y%W=5B4|1140|2D24|16A0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
  4731. T2(Resp=N)
  4732. T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
  4733. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4734. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4735. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4736. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4737. PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  4738.  
  4739. Fingerprint Genius print server
  4740. T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
  4741. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4742. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4743. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4744. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4745. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4746. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4747. PU(Resp=N)
  4748.  
  4749. Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5)
  4750. TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ)
  4751. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  4752. T2(Resp=N)
  4753. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  4754. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4755. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4756. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4757. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4758. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4759.  
  4760. Fingerprint Linux 2.5.25 or Gentoo 1.2 Linux 2.4.19 rc1-rc7)
  4761. TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ)
  4762. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  4763. T2(Resp=N)
  4764. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  4765. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4766. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4767. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4768. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4769. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4770.  
  4771. # Linux Kernel 2.4.3-2.10.1smp (RedHat 7.0.98 Wolverine)
  4772. Fingerprint Linux Kernel 2.4.3 SMP (RedHat)
  4773. TSeq(Class=RI%gcd=<6%SI=<2E7A750&>76F8A%IPID=Z%TS=1000HZ)
  4774. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4775. T2(Resp=N)
  4776. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4777. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4778. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4779. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4780. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4781. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4782.  
  4783. Fingerprint Linux 2.4.7 (X86)
  4784. TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U)
  4785. T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
  4786. T2(Resp=N)
  4787. T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
  4788. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4789. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4790. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4791. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4792. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4793.  
  4794. Fingerprint:2:1:2:4:17 Linux 2.4.17        # THCRUT
  4795. TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ)
  4796. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4797. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  4798. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  4799. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  4800. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4801. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  4802. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  4803. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4804.  
  4805. # Not really constant -- just slow incrementation
  4806. # This is an LCIII
  4807. Fingerprint Mac OS 7.1   # Thanks to  Renaud Deraison 
  4808. TSeq(Class=C)
  4809. T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M)
  4810. T2(Resp=N)
  4811. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  4812. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  4813. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  4814. T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  4815. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  4816. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4817.  
  4818. Fingerprint Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6
  4819. TSeq(Class=C|TD)
  4820. T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M)
  4821. T2(Resp=N)
  4822. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  4823. T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  4824. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4825. T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  4826. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4827. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4828.  
  4829. Fingerprint Mac OS 7.5.5 - 9 # Thanks to //Stany <stany@zerkalo.notbsd.org>
  4830. TSeq(Class=64K)
  4831. T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  4832. T2(Resp=N)
  4833. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  4834. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4835. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4836. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4837. T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4838. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4839.  
  4840. Fingerprint Mac OS 8.0
  4841. TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0)
  4842. T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  4843. T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  4844. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  4845. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4846. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4847. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4848. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4849. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4850.  
  4851. Fingerprint Mac OS 8 running on an LC 475
  4852. TSeq(Class=TR)
  4853. T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  4854. T2(Resp=N)
  4855. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  4856. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4857. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4858. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4859. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4860. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4861.  
  4862. Fingerprint Mac OS 8.1
  4863. TSeq(Class=64K)
  4864. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  4865. T2(Resp=N)
  4866. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  4867. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4868. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4869. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4870. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4871. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4872.  
  4873. Fingerprint Mac OS 8.1
  4874. TSeq(Class=64K)
  4875. T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
  4876. T2(Resp=N)
  4877. T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
  4878. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4879. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4880. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4881. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4882. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4883.  
  4884. Fingerprint Mac OS 8.1
  4885. TSeq(Class=64K)
  4886. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  4887. T2(Resp=N)
  4888. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  4889. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4890. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4891. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4892. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4893. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4894.  
  4895. Fingerprint Mac OS 8.5  # Thanks to A.j. Effin ReznoR <spork@exo.com>
  4896. TSeq(Class=64K)
  4897. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  4898. T2(Resp=N)
  4899. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL)
  4900. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4901. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4902. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4903. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4904.  
  4905. #FingerPrint  Mac OS 8.5.1 w/MacTCP
  4906. #TSeq(Class=64K)
  4907. #T1(Resp=Y%DF=Y%W=4137%ACK=S++%Flags=AS%Ops=MEWL)
  4908. #T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4909. #T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4910. #T3(Resp=Y%DF=Y%W=4137%ACK=S++%Flags=AS%Ops=MEWL)
  4911. #T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4912. #T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4913. #T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4914. #T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4915. #T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4916. #PU(Resp=Y%DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4917.  
  4918. Fingerprint Mac OS 8.6
  4919. TSeq(Class=64K)
  4920. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  4921. T2(Resp=N)
  4922. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  4923. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4924. T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
  4925. T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
  4926. T7(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  4927. PU(Resp=N)
  4928.  
  4929. Fingerprint Mac OS 8.6
  4930. TSeq(Class=64K%IPID=I%TS=U)
  4931. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  4932. T2(Resp=N)
  4933. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  4934. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4935. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4936. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4937. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4938. PU(Resp=N)
  4939.  
  4940. Fingerprint Mac OS 9.2.2
  4941. TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ)
  4942. T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
  4943. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4944. T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
  4945. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4946. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4947. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4948. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4949. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4950.  
  4951. Fingerprint HP-UX 11 or Apple Mac OS 9.04 or HP-UX B.11.00
  4952. TSeq(Class=RI%gcd=<9%SI=>3FFF)
  4953. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  4954. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4955. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  4956. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4957. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4958. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4959. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4960. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4961.  
  4962. Fingerprint Mac OS X Server 1.2 (ppc)
  4963. TSeq(Class=RI%gcd=<6%SI=<199A9C&>4177)
  4964. T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  4965. T2(Resp=N)
  4966. T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT)
  4967. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4968. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4969. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4970. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4971. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4972.  
  4973. Fingerprint FreeBSD 4.4-5 or Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13)
  4974. TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ)
  4975. T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  4976. T2(Resp=N)
  4977. T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  4978. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4979. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4980. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4981. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4982. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4983.  
  4984. Fingerprint FreeBSD 4.4 for i386 (IA-32)
  4985. TSeq(Class=TR%gcd=<6)
  4986. T1(DF=Y%W=5B4|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  4987. T2(Resp=N)
  4988. T3(Resp=Y%DF=Y%W=5B4|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  4989. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4990. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4991. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4992. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4993. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4994.  
  4995. Fingerprint APC MasterSwitch Network Power Controller
  4996. TSeq(Class=TR)
  4997. T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  4998. T2(Resp=N)
  4999. T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  5000. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5001. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5002. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)   
  5003. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5004. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5005.  
  5006. Fingerprint APC Web/SNMP UPS management card
  5007. TSeq(Class=RI%gcd=<6%SI=<52FB700&>D46DF)
  5008. T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  5009. T2(Resp=N)
  5010. T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  5011. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5012. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5013. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5014. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5015. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5016.  
  5017. Fingerprint ARLAN BR2000E V5.0E Radio Bridge
  5018. TSeq(Class=TR%gcd=<6)
  5019. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  5020. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  5021. T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  5022. T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  5023. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  5024. T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  5025. T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  5026. PU(Resp=N)
  5027.  
  5028. # Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
  5029. Fingerprint AXIS or Meridian Data Network CD-ROM server
  5030. TSeq(Class=C)
  5031. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  5032. T2(Resp=N)
  5033. T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
  5034. T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
  5035. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5036. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5037. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5038. PU(Resp=N)
  5039.  
  5040. Fingerprint AXIS 540/542Print ServerV5.30 Jan 24 1997
  5041. TSeq(Class=C)
  5042. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5043. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5044. T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=)
  5045. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5046. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5047. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5048. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5049. PU(Resp=N)
  5050.  
  5051. Fingerprint Axis 540 e'net print server ver 5.48
  5052. TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
  5053. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5054. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5055. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5056. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5057. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5058. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5059. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5060. PU(Resp=N)
  5061.  
  5062. Fingerprint Axis 540 print server
  5063. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5064. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5065. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5066. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5067. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5068. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5069. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5070. PU(Resp=N)
  5071.  
  5072. Fingerprint MegaBit Gear TE4111C
  5073. TSeq(Class=64K%IPID=I%TS=U)
  5074. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  5075. T2(Resp=N)
  5076. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  5077. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5078. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5079. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5080. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5081. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5082.  
  5083. Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
  5084. TSeq(Class=TD%gcd=40000%SI=<A)
  5085. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  5086. T2(Resp=N)
  5087. T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
  5088. T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
  5089. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5090. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5091. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5092. PU(Resp=N)
  5093.  
  5094. Fingerprint Micro Annex ELS x7.1.8
  5095. TSeq(Class=64K)
  5096. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
  5097. T2(Resp=N)
  5098. T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
  5099. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  5100. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5101. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5102. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5103. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5104.  
  5105. Fingerprint Microplex Print Server
  5106. TSeq(Class=C)
  5107. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  5108. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5109. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  5110. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5111. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5112. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5113. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5114. PU(Resp=N)
  5115.  
  5116. Fingerprint MiNT with MiNTnet 1.03 running on Atari TT
  5117. TSeq(Class=TD%gcd=3E7%SI=0)
  5118. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  5119. T2(Resp=N)
  5120. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  5121. T4(Resp=N)
  5122. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5123. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  5124. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5125. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5126.  
  5127. Fingerprint Minix 32-bit/Intel 2.0.0
  5128. TSeq(Class=RI|TD%gcd=1|2|3|457%SI=<FFF)
  5129. T1(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=)
  5130. T2(Resp=N)
  5131. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  5132. T4(Resp=N)
  5133. T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  5134. T6(Resp=N)
  5135. T7(Resp=N)
  5136. PU(Resp=N)
  5137.  
  5138. Fingerprint minix v2.0.2 32bits
  5139. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  5140. T2(Resp=N)
  5141. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
  5142. T4(Resp=N)
  5143. T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  5144. T6(Resp=N)
  5145. T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  5146. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5147.  
  5148. Fingerprint Mirapoint M1000 (OS v 1.0.0)
  5149. TSeq(Class=RI%gcd=<6)
  5150. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5151. T2(Resp=N)
  5152. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5153. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5154. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5155. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5156. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5157. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5158.  
  5159. Fingerprint Motorola SurfBoard 4401 provided by adelphia
  5160. TSeq(Class=64K%IPID=I%TS=U)
  5161. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  5162. T2(Resp=N)
  5163. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5164. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5165. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5166. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5167. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5168. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  5169.  
  5170. Fingerprint Motorola System V/68 version R3V7 on a 68030
  5171. TSeq(Class=RI%gcd=<14%SI=<52F8&>C0)
  5172. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  5173. T2(Resp=N)
  5174. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  5175. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5176. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5177. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5178. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5179. PU(Resp=N)
  5180.  
  5181. Fingerprint MOTOROLA VANGUARD 320 running OS version 5.4
  5182. TSeq(Class=TD%gcd=<6%SI=<1E)
  5183. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
  5184. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5185. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5186. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5187. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5188. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5189. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5190. PU(Resp=N)
  5191.  
  5192. Fingerprint MultiTech CommPlete (modem server) RAScard
  5193. TSeq(Class=TD%gcd=388|710|A98%SI=<44)
  5194. T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M)
  5195. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5196. T3(Resp=N)
  5197. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5198. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5199. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5200. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5201. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5202.  
  5203. Fingerprint NEC UX/4800
  5204. TSeq(Class=64K)
  5205. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  5206. T2(Resp=N)
  5207. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  5208. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5209. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5210. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5211. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5212. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5213.  
  5214. Fingerprint NCD X server (SNMP says: NCD16 server 2.3.0 03/12/91 downloaded)
  5215. TSeq(Class=64K)
  5216. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
  5217. T2(Resp=N)
  5218. T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
  5219. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  5220. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5221. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5222. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5223. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5224.  
  5225.  
  5226. Fingerprint NCR MP-RAS 3.0.x 
  5227. TSeq(Class=64K)
  5228. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  5229. T2(Resp=N)
  5230. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
  5231. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5232. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5233. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5234. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5235. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5236.  
  5237. Fingerprint NCR MP-RAS 3.01
  5238. TSeq(Class=i800)
  5239. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  5240. T2(Resp=N)
  5241. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
  5242. T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
  5243. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5244. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5245. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5246. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5247.  
  5248. Fingerprint NCSA Telnet (dos)
  5249. TSeq(Class=C)
  5250. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5251. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5252. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5253. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5254. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5255. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5256. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5257. PU(Resp=N)
  5258.  
  5259. Fingerprint NCSA Telnet 2.3.08 for the PC
  5260. TSeq(Class=C)
  5261. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  5262. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  5263. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  5264. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  5265. T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  5266. T6(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  5267. T7(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  5268. PU(Resp=N)
  5269.  
  5270. # Host information:  @WorkStation (i960 based) X-terminal
  5271. # Neoware (was HDS) NetOS V. 2.0.1
  5272. # Hewlett-Packard ENTRIA Model C3230A Server Version B.05.30
  5273. # Cisco 11151/Arrowpoint 150 Load Balancer
  5274. Fingerprint Cisco 11151/Arrowpoint 150 load balancer, Neoware (was HDS) NetOS V. 2.0.1 or HP ENTRIA C3230A
  5275. TSeq(Class=64K)
  5276. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=|M)
  5277. T2(Resp=N)
  5278. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  5279. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5280. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5281. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5282. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5283. PU(Resp=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5284.  
  5285. Fingerprint NetApp F360 or 760 Filer
  5286. TSeq(Class=RI%gcd=<6%SI=<7CA10&>CA2%IPID=BI%TS=2HZ)
  5287. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  5288. T2(Resp=N)
  5289. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  5290. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5291. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5292. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5293. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5294. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5295.  
  5296. Fingerprint NetApp Data OnTap 6.1.2R3 on an F840 filer
  5297. TSeq(Class=RI%gcd=<6%SI=<83FEA&>B28%IPID=BI%TS=2HZ)
  5298. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  5299. T2(Resp=N)
  5300. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  5301. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5302. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5303. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5304. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5305. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5306.  
  5307. Fingerprint NetApp NetCache C760 os 4.x
  5308. TSeq(Class=RI%gcd=<6%SI=<4E51740&>FAA%IPID=I%TS=2HZ)
  5309. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  5310. T2(Resp=N)
  5311. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  5312. T4(DF=N%W=5000%ACK=O%Flags=R%Ops=)
  5313. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5314. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5315. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5316. PU(Resp=N)
  5317.  
  5318. Fingerprint NetApp OnTap 3.1.6 or BSDi 1.1
  5319. TSeq(Class=64K)
  5320. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  5321. T2(Resp=N)
  5322. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  5323. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5324. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5325. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5326. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5327. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5328.  
  5329. Fingerprint NetApp OnTap 5.1.2 - 5.3.5r2
  5330. TSeq(Class=RI%gcd=<6%SI=>BBB)
  5331. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  5332. T2(Resp=N)
  5333. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  5334. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5335. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5336. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5337. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5338. PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E)
  5339.  
  5340. # NetCache 5.1D4 on a NetApp C1100 Box
  5341. Fingerprint Network Appliance NetCache 5.1D4
  5342. TSeq(Class=RI%gcd=<6%SI=<ABC02&>1371%IPID=BI%TS=2HZ)
  5343. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
  5344. T2(Resp=N)
  5345. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  5346. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5347. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5348. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5349. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5350. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5351.  
  5352. # Notes on NetBSD (written by Charles M. Hannum <root@ihack.net>):
  5353. # * The set of options in a SYN-ACK depends on the state of the
  5354. #   `net.inet.tcp.rfc1323' flag.
  5355. # * Releases prior to 1.3 did not randomize the ISS at all.
  5356. # * Releases prior to 1.3 incorrectly added the IP header length to the IP
  5357. #   packet length when returning an ICMP unreachable.
  5358. # * Releases prior to 1.3 calculated the window size slightly wrong.
  5359. # * Releases prior to 1.3 returned a non-zero window size when sending a RST
  5360. #   in response to an ACK on a listening socket (thereby making them
  5361. #   susceptible to stealth scanning).
  5362. # * Releases prior to 1.3H/1.3.4 did not return a response to the null flag
  5363. #   test (thereby making them susceptible to stealth scanning).
  5364. # * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in
  5365. #   the encapsulated IP header when sending an ICMP reply.  On little endian
  5366. #   machines the IP ID field was byte-swapped.  The checksums were always
  5367. #   zeroed.
  5368. # * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when
  5369. #   MTU discovery was enabled.
  5370.  
  5371. Fingerprint NetBSD 1.0 i386
  5372. TSeq(Class=64K%IPID=I%TS=2HZ)
  5373. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5374. T2(Resp=N)
  5375. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
  5376. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5377. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5378. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5379. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5380. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5381.  
  5382. Fingerprint NetBSD 1.0 little endian arch
  5383. TSeq(Class=64K)
  5384. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5385. T2(Resp=N)
  5386. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
  5387. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5388. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5389. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5390. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5391. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5392.  
  5393. Fingerprint NetBSD 1.0 big endian arch
  5394. TSeq(Class=64K)
  5395. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5396. T2(Resp=N)
  5397. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
  5398. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5399. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5400. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5401. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5402. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5403.  
  5404. Fingerprint NetBSD 1.1 - 1.2.1 litle endian arch
  5405. TSeq(Class=64K)
  5406. T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5407. T2(Resp=N)
  5408. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5409. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5410. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5411. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5412. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5413. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5414.  
  5415. Fingerprint NetBSD 1.2 - 1.2.1 big endian arch
  5416. TSeq(Class=64K)
  5417. T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5418. T2(Resp=N)
  5419. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5420. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5421. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5422. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5423. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5424. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5425.  
  5426. Fingerprint NetBSD 1.3 - 1.3.3 little endian arch
  5427. TSeq(Class=RI%gcd=<6%SI=>18000)
  5428. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5429. T2(Resp=N)
  5430. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5431. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5432. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5433. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5434. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5435. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5436.  
  5437. Fingerprint NetBSD 1.3 - 1.3.3 big endian arch
  5438. TSeq(Class=RI%gcd=<6%SI=>18000)
  5439. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5440. T2(Resp=N)
  5441. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5442. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5443. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5444. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5445. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5446. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5447.  
  5448. Fingerprint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch
  5449. TSeq(Class=RI%gcd=<6%SI=>18000)
  5450. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5451. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5452. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5453. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5454. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5455. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5456. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5457. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5458.  
  5459. Fingerprint NetBSD 1.3H-1.5  big endian arch
  5460. TSeq(Class=RI%gcd=<6%SI=>18000)
  5461. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5462. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5463. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5464. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5465. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5466. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5467. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5468. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5469.  
  5470. Fingerprint NetBSD 1.3I (after 19990119) to 1.4 x86
  5471. TSeq(Class=RI%gcd=<6%SI=>18000)
  5472. T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5473. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5474. T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  5475. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5476. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5477. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5478. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5479. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5480.  
  5481. Fingerprint NetBSD 1.5_ALPHA i386
  5482. TSeq(Class=RI%gcd=<6%SI=<5CF5F1C&>EDF97)
  5483. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5484. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5485. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5486. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5487. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5488. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5489. T7(Resp=N)
  5490. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5491.  
  5492. Fingerprint NetBSD 1.5.2 running on a Commodore Amiga (68040 processor)
  5493. TSeq(Class=RI%gcd=<6%SI=<7AAB142&>874A7%IPID=I%TS=2HZ)
  5494. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5495. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5496. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5497. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5498. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5499. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5500. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5501. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5502.  
  5503. Fingerprint NetBSD 1.6 BETA 4 i386 (20020630 snapshot)
  5504. TSeq(Class=RI%gcd=<6%SI=<76BC4C8&>A6C26%IPID=I)
  5505. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5506. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5507. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5508. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5509. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5510. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5511. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5512. PU(DF=N%TOS=0%IPLEN=38%RIPTL=4801%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5513.  
  5514. Fingerprint Netopia R3100-I DSL Router Firmware version v4.7.2
  5515. TSeq(Class=TD%gcd=<EA64%SI=<10E%IPID=I%TS=U)
  5516. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  5517. T2(Resp=N)
  5518. T3(Resp=N)
  5519. T4(Resp=N)
  5520. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5521. T6(Resp=N)
  5522. T7(Resp=N)
  5523. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5524.  
  5525. Fingerprint NetJet Version 3.0 - 4.0 Printer
  5526. TSeq(Class=TD%gcd=<4%SI=<4)
  5527. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  5528. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5529. T3(Resp=Y%DF=N%W=0|800%ACK=S++%Flags=AR%Ops=|M)
  5530. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5531. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5532. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5533. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5534. PU(Resp=N)
  5535.  
  5536. Fingerprint Netscreen 5XP (OS 3.0.1r2)
  5537. TSeq(Class=TD%gcd=1000%SI=<FF)
  5538. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5539. T2(Resp=N)
  5540. T3(Resp=N)
  5541. T4(Resp=N)
  5542. T5(Resp=N)
  5543. T6(Resp=N)
  5544. T7(Resp=N)
  5545. PU(Resp=N)
  5546.  
  5547. Fingerprint Network Systems router NS6614 (NSC 6600 series)
  5548. TSeq(Class=64K)
  5549. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  5550. T2(Resp=N)
  5551. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5552. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5553. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5554. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5555. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5556. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5557.  
  5558. # A NeXT Turbo, unknown version number
  5559. Fingerprint NeXT Mach
  5560. TSeq(Class=64K)
  5561. T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  5562. T2(Resp=N)
  5563. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  5564. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5565. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5566. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5567. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5568. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5569.  
  5570. Fingerprint Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based)
  5571. TSeq(Class=RI%gcd=<6%SI=<10F72&>2A2)
  5572. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  5573. T2(Resp=N)
  5574. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  5575. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5576. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5577. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5578. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5579. PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%ULEN=134%DAT=E)
  5580.  
  5581. Fingerprint Nokia IP530 Network Appliance (IPSO 3.4-3.4.2)
  5582. TSeq(Class=RI%gcd=<8%SI=<85DD6&>987%IPID=I%TS=2HZ)
  5583. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5584. T2(Resp=N)
  5585. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5586. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5587. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5588. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5589. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5590. PU(DF=Y%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5591.  
  5592. Fingerprint Nortel Networks CVX1800 RAS. Software version 2.02
  5593. TSeq(Class=64K%gcd=<6%SI=<14)
  5594. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  5595. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5596. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  5597. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5598. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5599. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5600. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5601. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5602.  
  5603. Fingerprint Novell NetWare 3.12 - 5.00  # Thanks to Chris Wilson
  5604. TSeq(Class=TD%gcd=10|20|30|40%SI=<64)
  5605. T1(DF=Y|N%W=7D0|8000|2000|1FFF|7FFF|8000|FFFF%ACK=S++%Flags=AS%Ops=M|ME)
  5606. T2(Resp=N)
  5607. T3(Resp=Y%DF=Y|N%W=8000|2000|1FFE|7FFF|8000|FFFF%ACK=O|S++%Flags=AS|ASF%Ops=M|ME)
  5608. T4(Resp=N)
  5609. T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  5610. T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
  5611. T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  5612. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5613.  
  5614. Fingerprint NetWare 4.11 SP7- 5 SP3A BorderManager 3.5
  5615. TSeq(Class=RI%gcd=<6%SI=<1843D74&>3E1D0)
  5616. T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
  5617. T2(Resp=N)
  5618. T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
  5619. T4(Resp=N)
  5620. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5621. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5622. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5623. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5624.  
  5625. Fingerprint NetWare 4.11 SP8a - Netware 5 SP4
  5626. TSeq(Class=RI%gcd=<6%SI=<2DB195E&>74F88)
  5627. T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
  5628. T2(Resp=N)
  5629. T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
  5630. T4(Resp=N)
  5631. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5632. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5633. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5634. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5635.  
  5636. Fingerprint Novell NetWare 5.0 with Border Manager
  5637. TSeq(Class=RI%gcd=<5%SI=>BBBBB)
  5638. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  5639. T2(Resp=N)
  5640. T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
  5641. T4(Resp=N)
  5642. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5643. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5644. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5645. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5646.  
  5647. Fingerprint Novell Netware 5.x
  5648. TSeq(Class=RI%gcd=<8%SI=<286248A&>1B465%IPID=I%TS=U)
  5649. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  5650. T2(Resp=N)
  5651. T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
  5652. T4(Resp=N)
  5653. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5654. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5655. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5656. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5657.  
  5658. Fingerprint Novell NetWare 3.12 or 386 TCP/IP
  5659. TSeq(Class=TD%gcd=<6B4A%SI=<1E)
  5660. T1(DF=N%W=73F|F87|3F25%ACK=S++%Flags=AS%Ops=ME)
  5661. T2(Resp=N)
  5662. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS|ASF%Ops=ME)
  5663. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5664. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5665. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5666. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5667. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5668.  
  5669. Fingerprint Netware 5.0 SP 3a
  5670. TSeq(Class=RI%gcd=<8%SI=<5641338&>DCCE9)
  5671. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  5672. T2(Resp=N)
  5673. T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
  5674. T4(Resp=N)
  5675. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5676. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5677. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5678. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5679.  
  5680. Fingerprint Novell Netware 4.11-5.0SP5
  5681. TSeq(Class=RI%gcd=<6%SI=<2B302C0&>6E8E8)
  5682. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  5683. T2(Resp=N)
  5684. T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
  5685. T4(Resp=N)
  5686. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5687. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5688. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5689. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5690.  
  5691. Fingerprint Netware 5.1 SP3
  5692. TSeq(Class=RI%gcd=<6%SI=<2385886&>53F65%IPID=RPI%TS=U)
  5693. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  5694. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5695. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  5696. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5697. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5698. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5699. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5700. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5701.  
  5702. Fingerprint Novell Netware 5.1-6.0
  5703. TSeq(Class=RI%gcd=<6%SI=<2883446&>599C6%IPID=RD|RPI%TS=U)
  5704. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  5705. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5706. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  5707. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5708. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5709. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5710. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5711. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5712.  
  5713. Fingerprint Novell NetWare 5.1SP4 - 6.0
  5714. TSeq(Class=RI%gcd=<6%SI=<253064A&>5F32F%IPID=BI%TS=U)
  5715. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  5716. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5717. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  5718. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5719. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5720. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5721. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5722. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5723.  
  5724. Fingerprint NSG 500 router. OS version 7.6.1 (http://www.nsg.ru)
  5725. TSeq(Class=TD%gcd=<14004%SI=<28%IPID=I%TS=U)
  5726. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5727. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5728. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5729. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5730. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5731. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5732. T7(Resp=N)
  5733. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5734.  
  5735. Fingerprint OpenStep 4.0-4.2 or NextStep 1.0-3.3 (Intel)
  5736. TSeq(Class=64K)
  5737. T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  5738. T2(Resp=N)
  5739. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  5740. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5741. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5742. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5743. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5744. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5745.  
  5746. Fingerprint OpenStep 4.1/NeXTStep 3.3
  5747. TSeq(Class=64K)
  5748. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  5749. T2(Resp=N)
  5750. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  5751. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5752. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5753. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5754. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5755. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5756.  
  5757. Fingerprint OpenStep 4.2/Intel
  5758. TSeq(Class=64K)
  5759. T1(Resp=Y%DF=N%W=F87%ACK=S++|O%Flags=AS%Ops=M)
  5760. T2(Resp=N)
  5761. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  5762. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5763. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5764. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5765. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5766. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5767.  
  5768. Fingerprint OpenBSD 2.1 - 2.3/SPARC
  5769. TSeq(Class=RI%gcd=<6%SI=>FF)
  5770. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5771. T2(Resp=N)
  5772. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5773. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5774. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5775. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5776. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) 
  5777. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5778.  
  5779. # This fingerprint had LAND patch installed
  5780. Fingerprint OpenBSD 2.1/X86
  5781. TSeq(Class=RI%gcd=<6%SI=>BBB)
  5782. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  5783. T2(Resp=N)
  5784. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  5785. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5786. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5787. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5788. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5789. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5790.  
  5791. Fingerprint OpenBSD 2.2 - 2.3
  5792. TSeq(Class=RI%gcd=<6)
  5793. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5794. T2(Resp=N)
  5795. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5796. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5797. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5798. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5799. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5800. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5801.  
  5802. Fingerprint OpenBSD Post 2.4 (November 1998) - 2.5
  5803. TSeq(Class=RI%gcd=<6%SI=>FFF&<BBBBB)
  5804. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5805. T2(Resp=N)
  5806. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5807. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5808. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5809. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5810. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5811. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5812.  
  5813. # With more info provided by Theo De Raadt
  5814. # OpenBSD 2.6
  5815. Fingerprint OpenBSD 2.6-2.8
  5816. TSeq(Class=RI%gcd=<6%SI=<1869F6&>3E6B)
  5817. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5818. T2(Resp=N)
  5819. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5820. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5821. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5822. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5823. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5824. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134|3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5825.  
  5826. Fingerprint OpenBSD 2.6-2.8
  5827. TSeq(Class=RI%gcd=<6%SI=<AD084&>1B9B)
  5828. T1(DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  5829. T2(Resp=N)
  5830. T3(Resp=Y%DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  5831. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5832. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5833. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5834. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5835. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5836.  
  5837. Fingerprint OpenBSD 2.6 with all available patches as of roughly Feb01
  5838. TSeq(Class=RI%gcd=<6%SI=<4C22A&>C1A)
  5839. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  5840. T2(Resp=N)
  5841. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  5842. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5843. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5844. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5845. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5846. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F|E%UCK=F|E%ULEN=134%DAT=E)
  5847.  
  5848. Fingerprint OpenBSD 2.8 (X86)
  5849. TSeq(Class=TD|RI%gcd=<6%SI=<A8C&>1%IPID=RPI|BI%TS=U)
  5850. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  5851. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5852. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  5853. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5854. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5855. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5856. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5857. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5858.  
  5859. Fingerprint OpenBSD 2.9-beta through release (X86)
  5860. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  5861. T1(DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5862. T2(Resp=N)
  5863. T3(Resp=Y%DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5864. T4(DF=Y|N%W=4000%ACK=O%Flags=R%Ops=)
  5865. T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  5866. T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
  5867. T7(DF=Y|N%W=0%ACK=S%Flags=AR%Ops=)
  5868. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  5869.  
  5870. Fingerprint OpenBSD 2.9-stable
  5871. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  5872. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
  5873. T2(Resp=N)
  5874. T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
  5875. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  5876. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5877. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5878. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5879. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5880.  
  5881. Fingerprint OpenBSD 3.0 (x86 or SPARC)
  5882. TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=2HZ)
  5883. T1(DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  5884. T2(Resp=N)
  5885. T3(Resp=Y%DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  5886. T4(DF=Y%W=4000|FFFF%ACK=O%Flags=R%Ops=)
  5887. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5888. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5889. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5890. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5891.  
  5892. Fingerprint OpenBSD 3.0 SPARC with pf "scrub in all" feature
  5893. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U|2HZ)
  5894. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5895. T2(Resp=N)
  5896. T3(Resp=N)
  5897. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  5898. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5899. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5900. T7(Resp=N)
  5901. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5902.  
  5903. Fingerprint OpenBSD 3.1 on an Alpha
  5904. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  5905. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  5906. T2(Resp=N)
  5907. T3(Resp=N)
  5908. T4(DF=Y%W=FFFF%ACK=O%Flags=R%Ops=)
  5909. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5910. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5911. T7(Resp=N)
  5912. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5913.  
  5914. Fingerprint OpenBSD 3.1 (X86)
  5915. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  5916. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5917. T2(Resp=N)
  5918. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5919. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5920. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5921. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5922. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5923. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5924.  
  5925. Fingerprint OpenVMS 6.1  # Thanks to Mcneil J <J.Mcneil@rhbnc.ac.uk>
  5926. TSeq(Class=64K)
  5927. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|MWN)
  5928. T2(Resp=N)
  5929. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5930. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5931. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5932. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5933. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5934. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5935.  
  5936. Fingerprint OpenVMS V6.1 on Digital VAX 4000-105A
  5937. TSeq(Class=64K)
  5938. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  5939. T2(Resp=N)
  5940. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=)
  5941. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  5942. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5943. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5944. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5945. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5946.  
  5947. Fingerprint OpenVMS 6.2 - 7.2-1 on VAX or AXP
  5948. TSeq(Class=TR%gcd=<6)
  5949. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  5950. T2(Resp=N)
  5951. T3(Resp=Y%DF=Y|N%W=1800%ACK=O%Flags=A%Ops=NNT)
  5952. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  5953. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5954. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5955. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5956. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5957.  
  5958. Fingerprint Digital OpenVMS AXP 6.2 running Attachmate Pathway 3.1 TCP stack
  5959. TSeq(Class=i800|64K)
  5960. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  5961. T2(Resp=N)
  5962. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=)
  5963. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5964. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5965. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5966. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5967. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5968.  
  5969. Fingerprint OpenVMS 6.2/Alpha
  5970. TSeq(Class=TR%gcd=<6)
  5971. T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  5972. T2(Resp=N)
  5973. T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  5974. T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  5975. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5976. T6(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  5977. T7(Resp=N)
  5978. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%UCK=0%ULEN=134%DAT=E)
  5979.  
  5980. Fingerprint OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package
  5981. TSeq(Class=RI|TD%gcd=<6%SI=<BBBB)
  5982. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MWL)
  5983. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  5984. T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MWL)
  5985. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5986. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5987. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5988. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5989. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5990.  
  5991. Fingerprint OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4
  5992. TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U)
  5993. T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL)
  5994. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  5995. T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL)
  5996. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5997. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5998. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5999. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  6000. PU(Resp=N)
  6001.  
  6002. Fingerprint OpenVMS 7.1 Alpha running Digital's UCX v4.1ECO2 TCP/IP package
  6003. TSeq(Class=64K)
  6004. T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
  6005. T2(Resp=N)
  6006. T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
  6007. T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
  6008. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6009. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6010. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6011. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6012.  
  6013. Fingerprint OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package
  6014. T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
  6015. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  6016. T3(Resp=N)
  6017. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  6018. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  6019. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  6020. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  6021. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6022.  
  6023. Fingerprint OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2
  6024. TSeq(Class=64K)
  6025. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN)
  6026. T2(Resp=N)
  6027. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6028. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6029. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6030. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6031. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6032. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) 
  6033.  
  6034. Fingerprint OpenVMS V7.1 on VAX 6000-530
  6035. TSeq(Class=64K%gcd=<6%SI=<14)
  6036. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=)
  6037. T2(Resp=N)
  6038. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  6039. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  6040. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6041. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6042. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6043. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6044.  
  6045. # DEC VAXVMS TCPIP V5.1-15  Full LP Installed
  6046. Fingerprint OpenVMS v7.3 on VAXStation 4000/60
  6047. TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U)
  6048. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  6049. T2(Resp=N)
  6050. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  6051. T4(Resp=N)
  6052. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6053. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6054. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6055. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6056.  
  6057. Fingerprint Savin 9927 Copier
  6058. TSeq(Class=i800%IPID=I%TS=U)
  6059. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  6060. T2(Resp=N)
  6061. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  6062. T4(DF=N%W=2000%ACK=O%Flags=UR%Ops=)
  6063. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6064. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6065. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6066. PU(DF=N%TOS=0%IPLEN=38%RIPTL=1C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6067.  
  6068. Fingerprint SEQUENT DYNIX/ptx(R) V4.2.1
  6069. TSeq(Class=RI%gcd=<F%SI=>FF&<FFFFF)
  6070. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  6071. T2(Resp=N)
  6072. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6073. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6074. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6075. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6076. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6077. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  6078.  
  6079. Fingerprint Sequent DYNIX/ptx(R) V4.4.6
  6080. TSeq(Class=RI|TD%gcd=<6%SI=<3FC)
  6081. T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MNW)
  6082. T2(Resp=N)
  6083. T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=A%Ops=)
  6084. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  6085. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6086. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6087. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6088. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  6089.  
  6090. Fingerprint Siemens  300E Release 6.5
  6091. TSeq(Class=RI%gcd=<6%SI=<5D131C&>4A3C%IPID=I%TS=U)
  6092. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  6093. T2(Resp=N)
  6094. T3(Resp=N)
  6095. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6096. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6097. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6098. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6099. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6100.  
  6101. Fingerprint Siemens HICOM 300 Phone switch (WAML LAN card)
  6102. TSeq(Class=64K)
  6103. T1(DF=N%W=808%ACK=S++%Flags=AS%Ops=M)
  6104. T2(Resp=N)
  6105. T3(Resp=Y%DF=N%W=808%ACK=O%Flags=A%Ops=)
  6106. T4(DF=N%W=808%ACK=O%Flags=R%Ops=)
  6107. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6108. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6109. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6110. PU(Resp=N)
  6111.  
  6112. Fingerprint SINIX-N 5.43C3002
  6113. TSeq(Class=64K%gcd=<6%SI=<14)
  6114. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=NW)
  6115. T2(Resp=N)
  6116. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=NW)
  6117. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6118. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6119. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6120. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6121. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=E%ULEN=134%DAT=E)
  6122.  
  6123. Fingerprint SINIX-N 5.41C0005
  6124. TSeq(Class=64K%gcd=<6%SI=<14)
  6125. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
  6126. T2(Resp=N)
  6127. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  6128. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6129. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6130. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6131. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6132. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=0%ULEN=134%DAT=E)
  6133.  
  6134. Fingerprint SINIX-Y 5.43B0045
  6135. TSeq(Class=64K)
  6136. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
  6137. T2(Resp=N)
  6138. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=A%Ops=)
  6139. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6140. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6141. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6142. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6143. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6144.  
  6145. Fingerprint SINIX-Y 5.43C4001
  6146. TSeq(Class=RI%gcd=<6%SI=<26E76&>625)
  6147. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  6148. T2(Resp=N)
  6149. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
  6150. T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  6151. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6152. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6153. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6154. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6155.  
  6156. Fingerprint SonicWall/10
  6157. TSeq(Class=TR)
  6158. T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  6159. T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  6160. T3(Resp=Y%DF=Y|N%W=7FE0|7FDF%ACK=O|S++%Flags=A|ASF%Ops=ME)
  6161. T4(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  6162. T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  6163. T6(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  6164. T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  6165. PU(Resp=N)
  6166.  
  6167. Fingerprint SONY NEWS-OS 6.1.2
  6168. TSeq(Class=64K%gcd=<6%SI=<14)
  6169. T1(DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
  6170. T2(Resp=N)
  6171. T3(Resp=Y%DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
  6172. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6173. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6174. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6175. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6176. PU(Resp=N)
  6177.  
  6178. Fingerprint Sega Dreamcast
  6179. TSeq(Class=TD%gcd=<780%SI=<14)
  6180. T1(DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
  6181. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6182. T3(Resp=Y%DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
  6183. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  6184. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6185. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  6186. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6187. PU(Resp=N)
  6188.  
  6189. Fingerprint Stock OpenVMS 7.1
  6190. TSeq(Class=TR)
  6191. T1(DF=N%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  6192. T2(Resp=N)
  6193. T3(Resp=Y%DF=N%W=2200%ACK=O%Flags=A%Ops=NNT)
  6194. T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  6195. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6196. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6197. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6198. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6199.  
  6200. Fingerprint Stratus VOS Release 14.3.1ae
  6201. T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
  6202. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  6203. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  6204. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  6205. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  6206. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  6207. T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  6208. PU(Resp=N)
  6209.  
  6210. Fingerprint Symantec Enterprise Firewall 7.0 running on Windows 2000 SP2
  6211. TSeq(Class=TR%gcd=<6%IPID=I)
  6212. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  6213. T2(Resp=N)
  6214. T3(Resp=N)
  6215. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6216. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6217. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6218. T7(Resp=N)
  6219. PU(Resp=N)
  6220.  
  6221. Fingerprint OpenVMS Alpha 6.2 running DIGITAL TCP/IP Services (UCX) v4.0
  6222. TSeq(Class=64K)
  6223. T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
  6224. T2(Resp=N)
  6225. T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
  6226. T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
  6227. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6228. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6229. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6230. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6231.  
  6232. Fingerprint OS/390 V5R0M0
  6233. TSeq(Class=RI%gcd=<5%SI=>F&<BBBB)
  6234. T1(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6235. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6236. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6237. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  6238. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6239. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  6240. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6241. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6242.  
  6243. Fingerprint IBM OS/400 v4r5
  6244. TSeq(Class=RI%gcd=<C%SI=<C1C&>3%IPID=I%TS=1000HZ)
  6245. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6246. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6247. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6248. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  6249. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6250. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  6251. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6252. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6253.  
  6254. Fingerprint Packet Engines PowerRail 5200 Version 2.6.0r10 - 16 Sep, 1999
  6255. TSeq(Class=64K)
  6256. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  6257. T2(Resp=N)
  6258. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  6259. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  6260. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6261. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6262. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6263. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6264.  
  6265. Fingerprint Panasonic KX-HCM10 network camera
  6266. TSeq(Class=TD%gcd=<F4%SI=<1E%TS=U)
  6267. T1(Resp=N)
  6268. T2(Resp=N)
  6269. T3(Resp=N)
  6270. T4(Resp=N)
  6271. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  6272. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  6273. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  6274. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6275.  
  6276. # Packeteer IP-PacketShaper 2000 V3.1
  6277. Fingerprint pSOS embedded IP stack, such as Packeteer IP-PacketShaper 2000 V3.1
  6278. TSeq(Class=64K)
  6279. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6280. T2(Resp=N)
  6281. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6282. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6283. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6284. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6285. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6286. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)  
  6287.  
  6288. Fingerprint PacketShaper 4000 v4.1.3b2 2000-04-05
  6289. TSeq(Class=64K)
  6290. T1(DF=N%W=430%ACK=S++%Flags=AS%Ops=)
  6291. T2(Resp=N)
  6292. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6293. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6294. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6295. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6296. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6297. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6298.  
  6299. Fingerprint Panasonic panafax DX2000 SuperG3
  6300. TSeq(Class=TD|RI%gcd=<18%SI=<177A&>27)
  6301. T1(Resp=N)
  6302. T2(Resp=N)
  6303. T3(Resp=N)
  6304. T4(Resp=N)
  6305. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  6306. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  6307. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  6308. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6309.  
  6310. Fingerprint Plan9 Second Edition
  6311. TSeq(Class=TR)
  6312. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  6313. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6314. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  6315. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6316. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6317. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6318. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6319. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6320.  
  6321. Fingerprint Planet WAP 1950 Wireless Access Point
  6322. TSeq(Class=TD%gcd=<1C%SI=<14%IPID=I%TS=U)
  6323. T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
  6324. T2(Resp=N)
  6325. T3(Resp=Y%DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
  6326. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6327. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6328. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6329. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6330. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6331.  
  6332. Fingerprint Polycom ViewStation 512K videoconferencing system
  6333. TSeq(Class=C)
  6334. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  6335. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6336. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6337. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6338. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6339. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6340. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6341. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6342.  
  6343. Fingerprint Proteon OpenRoute 2.1 on a RBX200 Router or IBM 2210 Router
  6344. TSeq(Class=TD%gcd=<6%SI=<BB)
  6345. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  6346. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6347. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6348. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  6349. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6350. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  6351. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6352. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6353.  
  6354. Fingerprint Proteon OpenRoute 3.0 gt series router
  6355. TSeq(Class=TD%gcd=1%SI=0)
  6356. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  6357. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6358. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6359. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  6360. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6361. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  6362. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6363. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6364.  
  6365. Fingerprint QNX 4.24 - 4.25
  6366. TSeq(Class=64K)
  6367. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
  6368. T2(Resp=N)
  6369. T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
  6370. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6371. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6372. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6373. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6374. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6375.  
  6376. Fingerprint QNX 6.00 x86
  6377. TSeq(Class=TD%gcd=<7D4%SI=<8C%IPID=I%TS=U)
  6378. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  6379. T2(Resp=N)
  6380. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  6381. T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  6382. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  6383. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  6384. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  6385. PU(Resp=N)
  6386.  
  6387. Fingerprint Racal 7100 Host Security Module 1.05 / 5.05
  6388. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6389. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  6390. T2(Resp=N)
  6391. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  6392. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6393. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6394. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6395. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6396. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  6397.  
  6398. Fingerprint Raptor firewall 5.03 on NT 4
  6399. TSeq(Class=TR)
  6400. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  6401. T2(Resp=N)
  6402. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  6403. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6404. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6405. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6406. T7(Resp=N)
  6407. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6408.  
  6409. Fingerprint Raptor Firewall 6 on Solaris 2.6
  6410. TSeq(Class=RI%gcd=<6%SI=<E5CB8&>24B0)
  6411. T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
  6412. T2(Resp=N)
  6413. T3(Resp=N)
  6414. T4(Resp=N)
  6415. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6416. T6(Resp=N)
  6417. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6418. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6419.  
  6420. Fingerprint RCA/Thomson cable modem DCM-235/245
  6421. TSeq(Class=64K%IPID=I%TS=U)
  6422. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  6423. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6424. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6425. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6426. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6427. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6428. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6429. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6430.  
  6431. Fingerprint Redback SMS 1000-2000 DSL Router
  6432. TSeq(Class=RI%gcd=<4%SI=>1000&<FFFF)
  6433. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  6434. T2(Resp=N)
  6435. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  6436. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6437. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6438. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6439. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6440. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6441.  
  6442. # Redback SMS500 Redback Networks AOS Release 5.0.4.0 PRODUCTION RELEASE
  6443. Fingerprint Redback SMS500 Redback Networks AOS Release 5.0.4.0
  6444. TSeq(Class=RI%gcd=<6%SI=<56DF6&>337%IPID=I%TS=U)
  6445. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  6446. T2(Resp=N)
  6447. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  6448. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6449. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6450. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6451. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6452. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0|F%ULEN=134%DAT=E)
  6453.  
  6454. Fingerprint RedBack SMS 1800
  6455. TSeq(Class=RI%gcd=<6%SI=<4CA7C&>C2F)
  6456. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  6457. T2(Resp=N)
  6458. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  6459. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6460. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6461. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6462. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6463. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6464.  
  6465. Fingerprint ReliantUNIX-Y 5.44 B0033 RM600 1/256 R10000
  6466. TSeq(Class=64K)
  6467. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  6468. T2(Resp=N)
  6469. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
  6470. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6471. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6472. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6473. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6474. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6475.  
  6476. Fingerprint Ricoh Aficio AP4500 Network Laser Printer
  6477. TSeq(Class=C%Val=0)
  6478. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  6479. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6480. T3(Resp=N)
  6481. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6482. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6483. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6484. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6485. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6486.  
  6487. Fingerprint Ringdale RP21 Print server
  6488. TSeq(Class=TR%gcd=<6)
  6489. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  6490. T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6491. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
  6492. T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6493. T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6494. T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6495. T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6496. PU(Resp=N)
  6497.  
  6498. Fingerprint SCO UNIX release 3.2
  6499. TSeq(Class=64K%IPID=I%TS=U)
  6500. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6501. T2(Resp=N)
  6502. T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
  6503. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6504. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6505. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6506. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6507. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6508.  
  6509. Fingerprint SCO Release 5
  6510. TSeq(Class=RI%gcd=<6%SI=>FFFF)
  6511. T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M)
  6512. T2(Resp=N)
  6513. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
  6514. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6515. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6516. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6517. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6518. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6519.  
  6520. Fingerprint SCO OpenServer(TM) Release 5
  6521. TSeq(Class=RI%gcd=<6%SI=<34A71A&>86B6)
  6522. T1(DF=N%W=1000|6000|111C%ACK=S++%Flags=AS%Ops=M)
  6523. T2(Resp=N)
  6524. T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=)
  6525. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6526. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6527. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6528. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6529. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6530.  
  6531. Fingerprint SCO OpenServer 5.0.5
  6532. TSeq(Class=RI%gcd=<5%SI=>FFFF)
  6533. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  6534. T2(Resp=N)
  6535. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
  6536. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6537. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6538. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6539. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6540. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6541.  
  6542. Fingerprint UnixWare 2.01
  6543. TSeq(Class=64K)
  6544. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M)
  6545. T2(Resp=N)
  6546. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6547. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6548. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6549. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6550. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6551. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6552.  
  6553. Fingerprint SCO UnixWare 2.1        # Thanks to Digital Messiah
  6554. TSeq(Class=RI%gcd=<6%SI=>FFF)
  6555. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  6556. T2(Resp=N)
  6557. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6558. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6559. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6560. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6561. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6562. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6563.  
  6564. Fingerprint SCO UnixWare 2.1.2  # Thanks to Drew Morone <tdrew@cairn.org>
  6565. TSeq(Class=RI%gcd=<6%SI=>FFFF)
  6566. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  6567. T2(Resp=N)
  6568. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6569. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6570. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6571. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6572. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6573. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6574.  
  6575. Fingerprint SCO UnixWare 7.0.0 or OpenServer 5.0.4-5.0.6
  6576. TSeq(Class=RI%gcd=<BB%SI=>FFFF)
  6577. T1(W=60F4%ACK=S++%Flags=AS%Ops=M)
  6578. T2(Resp=N)
  6579. T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=)
  6580. T4(W=0%ACK=O%Flags=R%Ops=)
  6581. T5(W=0%ACK=S++%Flags=AR%Ops=)
  6582. T6(W=0%ACK=O%Flags=R%Ops=)
  6583. T7(W=0%ACK=S%Flags=AR%Ops=)
  6584. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6585.  
  6586. Fingerprint SCO UnixWare 7.1.0 x86
  6587. TSeq(Class=RI%gcd=<6%SI=<442BB8&>AE70)
  6588. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  6589. T2(Resp=N)
  6590. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
  6591. T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
  6592. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6593. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6594. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6595. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6596.  
  6597. Fingerprint Unixware 7.1.1 (x86)
  6598. TSeq(Class=RI%gcd=<6%SI=<403094&>8C71%IPID=I%TS=100HZ)
  6599. T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  6600. T2(Resp=N)
  6601. T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
  6602. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6603. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6604. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6605. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6606. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6607.  
  6608. Fingerprint SCO Open Desktop 2.0
  6609. TSeq(Class=64K)
  6610. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  6611. T2(Resp=N)
  6612. T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
  6613. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6614. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6615. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6616. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6617. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6618.  
  6619. Fingerprint Secure Computing Sidewinder firewall 3.2 update 4
  6620. TSeq(Class=RI%gcd=<5%SI=>FFF&<FFFFF)
  6621. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  6622. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6623. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
  6624. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6625. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6626. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6627. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6628. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6629.  
  6630. Fingerprint Secure Computing SECUREZone Firewall Version 2.0
  6631. TSeq(Class=TR%gcd=<6)
  6632. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  6633. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6634. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  6635. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6636. T5(Resp=N)
  6637. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6638. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6639. PU(Resp=N)
  6640.  
  6641. Fingerprint Sharp Digital Imager AR-507
  6642. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  6643. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6644. T3(Resp=N)
  6645. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6646. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6647. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6648. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6649. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6650.  
  6651. #  Shiva AccessPort Bridge/Router Software V 2.1.0
  6652. #  3COM HiPer Access Router Card hardware 1.0.0 software 4.1.59
  6653. Fingerprint Shiva AccessPort Bridge/Router Software V 2.1.0 or 3COM HiPer Access Router Card hardware V1.0.0 software V4.1.59
  6654. TSeq(Class=TD%gcd=<6%SI=<F)
  6655. T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  6656. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6657. T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  6658. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6659. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6660. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6661. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6662. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6663.  
  6664. Fingerprint Shiva LanRover/8E Version 3.5
  6665. TSeq(Class=64K)
  6666. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  6667. T2(Resp=N)
  6668. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  6669. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6670. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6671. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6672. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6673. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6674.  
  6675. Fingerprint Snap Network Box
  6676. TSeq(Class=i800)
  6677. T1(Resp=Y%DF=N%W=4470%ACK=S++%Flags=AS%Ops=M)
  6678. T2(Resp=N)
  6679. T3(Resp=Y%DF=N%W=4470%ACK=O%Flags=A%Ops=)
  6680. T4(Resp=Y%DF=N%W=4470%ACK=O%Flags=R%Ops=)
  6681. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6682. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6683. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6684. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6685.  
  6686. Fingerprint Quantum Snap server 4100
  6687. TSeq(Class=i800%IPID=I%TS=U)
  6688. T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
  6689. T2(Resp=N)
  6690. T3(Resp=Y%DF=N%W=2238%ACK=O%Flags=A%Ops=)
  6691. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  6692. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6693. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6694. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6695. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6696.  
  6697. # Sun Remote System Console version 1.12
  6698. # Brocade Fibre Switch, Firmware 2.6.0
  6699. Fingerprint Brocade Fibre Switch or Sun Remote System Console
  6700. TSeq(Class=64K%IPID=I%TS=U)
  6701. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  6702. T2(Resp=N)
  6703. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  6704. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6705. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6706. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6707. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6708. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6709.  
  6710. Fingerprint Solaris 2.3 - 2.4  # Thanks to David O'Brien & Mea Culpa
  6711. TSeq(Class=64K)
  6712. T1(DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
  6713. T2(Resp=N)
  6714. T3(Resp=Y%DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
  6715. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6716. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6717. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6718. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6719. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6720.  
  6721. Fingerprint Solaris 2.4 w/most Sun patches (jumbo cluster patch, security patches, etc)
  6722. TSeq(Class=64K)
  6723. T1(DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
  6724. T2(Resp=N)
  6725. T3(Resp=Y%DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
  6726. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6727. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6728. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6729. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6730. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6731.  
  6732. Fingerprint Solaris 2.5, 2.5.1
  6733. TSeq(Class=RI%gcd=<6)
  6734. T1(DF=Y|N%W=2229|2332|4452|FFAF|8377|8EDA|879B%ACK=S++%Flags=AS%Ops=ME)
  6735. T2(Resp=N)
  6736. T3(Resp=N)
  6737. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6738. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6739. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6740. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6741. PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6742.  
  6743. Fingerprint Solaris 2.6 - 7 (SPARC)
  6744. TSeq(Class=RI%gcd=<6%SI=<57A26&>DF1)
  6745. T1(DF=Y%W=2297|2788|4431|8371|8F4D|ABCD|FFF7|FFFF|2297|212%ACK=S++%Flags=AS%Ops=NNTNWME)
  6746. T2(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  6747. T3(Resp=N)
  6748. T4(DF=Y|N%W=0%ACK=O%Flags=R%Ops=|WNMETL)
  6749. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6750. T6(DF=Y|N%W=0%ACK=O|S%Flags=AR|R%Ops=|WNMETL)
  6751. T7(DF=Y|N%W=0%ACK=S|O%Flags=AR|R%Ops=|WNMETL)
  6752. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=F|E%ULEN=134%DAT=E)
  6753.  
  6754. Fingerprint Solaris 2.6 - 7 X86
  6755. TSeq(Class=RI%gcd=<6)
  6756. T1(DF=Y%W=2491|462B%ACK=S++%Flags=AS%Ops=NNTNWME)
  6757. T2(Resp=N)
  6758. T3(Resp=N)
  6759. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6760. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6761. T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
  6762. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6763. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6764.  
  6765. Fingerprint Solaris 2.6
  6766. TSeq(Class=RI%gcd=<6%SI=<512B6&>CE8)
  6767. T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=NNTME)
  6768. T2(Resp=N)
  6769. T3(Resp=N)
  6770. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6771. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6772. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6773. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6774. PU(Resp=N)
  6775.  
  6776. Fingerprint Solaris 2.6 - 2.7 with tcp_strong_iss=0
  6777. TSeq(Class=64K)
  6778. T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
  6779. T2(Resp=N)
  6780. T3(Resp=N)
  6781. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6782. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6783. T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
  6784. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6785. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6786.  
  6787. Fingerprint Solaris 2.6 - 2.7 with tcp_strong_iss=2
  6788. TSeq(Class=TR%IPID=I%TS=100HZ)
  6789. T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
  6790. T2(Resp=N)
  6791. T3(Resp=N)
  6792. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6793. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6794. T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
  6795. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6796. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  6797.  
  6798. Fingerprint:2.2.8 Solaris 8         # THCRUT
  6799. TSeq(Class=RI|TR%gcd=<8%SI=<FEC86&>E0F%IPID=I%TS=100HZ)
  6800. T1(DF=Y%W=60DA|807A|B68%ACK=S++%Flags=AS%Ops=NNTNWM|NNTM)
  6801. T2(Resp=N)
  6802. T3(Resp=N)
  6803. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6804. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6805. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6806. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6807. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  6808.  
  6809. Fingerprint Solaris 9 Beta through Release on SPARC
  6810. TSeq(Class=RI%gcd=<6%SI=<A927C&>116A%IPID=I%TS=100HZ)
  6811. T1(DF=Y%W=C0B7|807A%ACK=S++%Flags=AS%Ops=NNTMNW)
  6812. T2(Resp=N)
  6813. T3(Resp=N)
  6814. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6815. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6816. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6817. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6818. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  6819.  
  6820. Fingerprint Solaris 9 with TCP_STRONG_ISS set to 2
  6821. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  6822. T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
  6823. T2(Resp=N)
  6824. T3(Resp=N)
  6825. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6826. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6827. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6828. T7(Resp=N)
  6829. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6830.  
  6831. Fingerprint SonicWall/10 Firewall
  6832. TSeq(Class=TR)
  6833. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  6834. T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  6835. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  6836. T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  6837. T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  6838. T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  6839. T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  6840. PU(Resp=N)
  6841.  
  6842. Fingerprint SPP-UX 5.2.1
  6843. TSeq(Class=64K)
  6844. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  6845. T2(Resp=N)
  6846. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  6847. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  6848. T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=)
  6849. T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=)
  6850. T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=)
  6851. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6852.  
  6853. Fingerprint SPP-UX 5.x on a Convex SPP-1600
  6854. TSeq(Class=C)
  6855. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  6856. T2(Resp=N)
  6857. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  6858. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  6859. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  6860. T6(DF=N%W=C00%ACK=S%Flags=R%Ops=)
  6861. T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  6862. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6863.  
  6864. Fingerprint SunOS 4.0.3
  6865. TSeq(Class=64K)
  6866. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  6867. T2(Resp=N)
  6868. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6869. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6870. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6871. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6872. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6873. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6874.  
  6875. Fingerprint SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI
  6876. TSeq(Class=64K)
  6877. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL)
  6878. T2(Resp=N)
  6879. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  6880. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6881. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6882. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6883. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6884. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6885.  
  6886. Fingerprint SunOS 4.1.1 - 4.1.4 (or derivative) # Thanks to Renaud Deraison, Jericho, Lamont Granquist, and others
  6887. TSeq(Class=64K)
  6888. T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M)
  6889. T2(Resp=N)
  6890. T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=)
  6891. T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=)
  6892. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6893. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6894. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6895. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)
  6896.  
  6897. Fingerprint Sun RSC (Remote System Control card) v1.14 (in Solaris 2.7)
  6898. T1(DF=N%W=2000%ACK=S++|O%Flags=ARS%Ops=MNW)
  6899. T2(Resp=N)
  6900. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
  6901. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6902. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6903. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6904. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6905. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6906.  
  6907. Fingerprint Tahoe OS 1.2.1 running on Tahoe router
  6908. TSeq(Class=RI%gcd=<8%SI=<A5A1E0&>6430%IPID=I%TS=U)
  6909. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=ME)
  6910. T2(Resp=N)
  6911. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=ASF%Ops=ME)
  6912. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6913. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6914. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6915. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6916. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6917.  
  6918. Fingerprint Tandberg X-terminal
  6919. TSeq(Class=64K)
  6920. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  6921. T2(Resp=N)
  6922. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
  6923. T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
  6924. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6925. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6926. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6927. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6928.  
  6929. Fingerprint Tandem NSK D39
  6930. TSeq(Class=64K%gcd=<6%SI=<14)
  6931. T1(DF=N%W=0|2000%ACK=S++%Flags=AR|AS%Ops=|M)
  6932. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6933. T3(Resp=Y%DF=N%W=0|2000%ACK=S++|O%Flags=AR|A%Ops=)
  6934. T4(DF=N%W=0|2000%ACK=O%Flags=R%Ops=)
  6935. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6936. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6937. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6938. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6939.  
  6940. Fingerprint Tandem NSK D40
  6941. TSeq(Class=64K)
  6942. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6943. T2(Resp=N)
  6944. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  6945. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6946. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6947. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6948. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6949. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6950.  
  6951. Fingerprint Tektronix Phaser 350 firmware 3.3 (printer)
  6952. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6953. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6954. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6955. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6956. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6957. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6958. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6959. PU(Resp=N)
  6960.  
  6961. Fingerprint Tektronix Phaser 360 Extended
  6962. TSeq(Class=i800)
  6963. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME)
  6964. T2(Resp=N)
  6965. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
  6966. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6967. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6968. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6969. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6970. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6971.  
  6972. # From a Tektronix Phaser 350
  6973. Fingerprint Tektronix Phaser(TM) Share Ethernet Card, firmware version 3.01
  6974. TSeq(Class=RI%gcd=<F%SI=>888&<4444)
  6975. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6976. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6977. T3(Resp=Y%DF=N%W=0|1000%ACK=S++|O%Flags=AR|AS%Ops=|M)
  6978. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6979. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6980. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6981. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6982. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6983.  
  6984. Fingerprint Telebit's NetBlazer 3.0
  6985. TSeq(Class=TD%gcd=<100004%SI=<3C)
  6986. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  6987. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6988. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
  6989. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6990. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6991. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6992. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6993. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6994.  
  6995. Fingerprint Telebit NetBlazer Version 3.05
  6996. TSeq(Class=TD%gcd=40000|80000|C0000%SI=<BB)
  6997. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  6998. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6999. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
  7000. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7001. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7002. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7003. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7004. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7005.  
  7006. # (Telebit router - 18 async/1 ether)
  7007. Fingerprint Telebit NetBlazer Version 3.1, patch level 13
  7008. TSeq(Class=TD|TR%gcd=40000|80000|C0000|100000|200000%SI=<FF)
  7009. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  7010. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7011. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  7012. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7013. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7014. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7015. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7016. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7017.  
  7018. Fingerprint Telindus 11xx ADSL Router
  7019. TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
  7020. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  7021. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  7022. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  7023. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  7024. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  7025. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  7026. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  7027. PU(Resp=N)
  7028.  
  7029. Fingerprint Telocity (DirectTVDSL) Gateway x2 Model
  7030. TSeq(Class=64K%IPID=I%TS=U)
  7031. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=MNW)
  7032. T2(Resp=N)
  7033. T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
  7034. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  7035. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7036. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7037. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7038. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7039.  
  7040. Fingerprint Teltrend (aka Securicor 3net) Router
  7041. TSeq(Class=TD%gcd=388|710%SI=<F)
  7042. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  7043. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7044. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  7045. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  7046. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7047. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  7048. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7049. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7050.  
  7051. Fingerprint TOPS-20 Monitor 7(21733),KL-10 (DEC 2065)
  7052. TSeq(Class=TD%gcd=<60004%SI=<1E%TS=U)
  7053. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  7054. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  7055. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  7056. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  7057. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7058. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  7059. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  7060. PU(Resp=N)
  7061.  
  7062. Fingerprint TOPS-20 Monitor 7(102540)-1,TD-1
  7063. TSeq(Class=TD%gcd=30000|60000|90000%SI=<BB)
  7064. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  7065. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7066. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  7067. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7068. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7069. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7070. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7071. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7072.  
  7073. Fingerprint Toshiba TR650 ISDN Router
  7074. TSeq(Class=TD%gcd=<9%SI=<14)
  7075. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7076. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7077. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7078. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7079. T5(Resp=N)
  7080. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7081. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7082. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7083.  
  7084. Fingerprint Turtle Beach AudioTron Firmware 3.0
  7085. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
  7086. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  7087. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7088. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  7089. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  7090. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7091. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7092. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7093. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7094.  
  7095. Fingerprint Ultrix 4.1
  7096. TSeq(Class=64K)
  7097. T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=)
  7098. T2(Resp=N)
  7099. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  7100. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7101. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7102. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7103. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7104. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7105.  
  7106. Fingerprint Ultrix 4.2 - 4.5
  7107. TSeq(Class=64K)
  7108. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=|M)
  7109. T2(Resp=N)
  7110. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  7111. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7112. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7113. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7114. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7115. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7116.  
  7117. Fingerprint VersaNet ISP-Accelerator(TM) Remote Access Server
  7118. TSeq(Class=TD%gcd=<2004%SI=<14)
  7119. T1(DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
  7120. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
  7121. T3(Resp=Y%DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
  7122. T4(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
  7123. T5(DF=Y%W=0%ACK=S++%Flags=ARF%Ops=)
  7124. T6(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
  7125. T7(DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
  7126. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7127.  
  7128. Fingerprint VirtualAccess LinxpeedPro 120 running Software 7.4.33CM
  7129. TSeq(Class=C|TD%gcd=<10004%SI=<1E%IPID=I%TS=U)
  7130. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  7131. T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  7132. T3(Resp=Y|N%DF=Y%W=1000%ACK=O%Flags=AS%Ops=M)
  7133. T4(DF=Y%W=100%ACK=O%Flags=R%Ops=)
  7134. T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=)
  7135. T6(DF=Y%W=100%ACK=O%Flags=R%Ops=)
  7136. T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  7137. PU(Resp=N)
  7138.  
  7139. Fingerprint VNS V6.2
  7140. TSeq(Class=TR)
  7141. T1(Resp=Y%DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  7142. T2(Resp=N)
  7143. T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  7144. T4(Resp=Y%DF=N%W=2200%ACK=O%Flags=R%Ops=)
  7145. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7146. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7147. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7148. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7149.  
  7150. #  HPJ2600A Ethernet hub or HP ProCurve Switch 4000M
  7151. # Bay Networks MicroAnnex XL running firmware 10.0B
  7152. Fingerprint VxWorks 5.3.x bases system (usually an ethernet hub or switch) or BayNetworks MicroAnnex XL term server
  7153. TSeq(Class=64K)
  7154. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7155. T2(Resp=N)
  7156. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  7157. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  7158. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7159. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7160. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7161. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7162.  
  7163. Fingerprint Windows 3.1 with Trumpet Winsock 2.0 revision B
  7164. TSeq(Class=TD%gcd=10000%SI=<FF)
  7165. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7166. T2(Resp=N)
  7167. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7168. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7169. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7170. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7171. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7172. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7173.  
  7174. Fingerprint Windows for Workgroups 3.11 / TCP/IP-32 3.11b stack or Win98
  7175. TSeq(Class=TD%gcd=<F%SI=<F)
  7176. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  7177. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7178. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  7179. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7180. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7181. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7182. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7183. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7184.  
  7185. Fingerprint Windows NT4 or 95/98/98SE
  7186. TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4%IPID=BI|RPI|RD%TS=U|0)
  7187. T1(DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=A|AS%Ops=|M|MNWNNT)
  7188. T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7189. T3(Resp=Y%DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=AS%Ops=M|MNWNNT)
  7190. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  7191. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7192. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  7193. T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=)
  7194. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  7195.  
  7196. Fingerprint Microsoft PocketPC  3.0.11171 running on Compaq iPAQ 3870 Pocket PC
  7197. TSeq(Class=TD%gcd=<6%SI=<104%IPID=BI)
  7198. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7199. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7200. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7201. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  7202. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7203. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  7204. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7205. PU(DF=N%TOS=40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7206.  
  7207. Fingerprint Microsoft Windows 95 4.00.950 B (IE 5 5.00 2314.1003)
  7208. TSeq(Class=TD%gcd=<14%SI=<32%IPID=BI)
  7209. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  7210. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7211. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  7212. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  7213. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7214. T6(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
  7215. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7216. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7217.  
  7218. Fingerprint Windows 98SE + IE5.5sp1
  7219. T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M)
  7220. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7221. T3(Resp=N)
  7222. T4(DF=N%W=2DA0|0%ACK=S++|O%Flags=AS|R%Ops=M|)
  7223. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7224. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7225. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7226. PU(Resp=N|Y)
  7227.  
  7228. Fingerprint Win 98 SE with security patch A
  7229. TSeq(Class=TD%gcd=<6%SI=<AA%IPID=BI%TS=U)
  7230. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7231. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7232. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7233. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7234. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7235. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7236. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7237. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7238.  
  7239. Fingerprint Windows NT 4 SP3
  7240. TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73)
  7241. T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT)
  7242. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7243. T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT)
  7244. T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
  7245. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7246. T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
  7247. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7248. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7249.  
  7250. Fingerprint Windows NT4 / Win95 / Win98
  7251. TSeq(Class=TD|RI%gcd=1|2|3|4|5|8|A|14|1E|28|5A|17C%SI=<1F4)
  7252. T1(DF=Y%W=2017|16D0|860|8000|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT)
  7253. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7254. T3(Resp=Y%DF=Y|N%W=0%ACK=O%Flags=AR%Ops=)
  7255. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  7256. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7257. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  7258. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7259. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7260.  
  7261. Fingerprint Microsoft NT 4.0 SP5-SP6
  7262. TSeq(Class=RI%gcd=<6%SI=<DA16&>21A)
  7263. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  7264. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7265. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  7266. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7267. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7268. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7269. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7270. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7271.  
  7272. Fingerprint Windows NT 4.0 Server SP5-SP6
  7273. TSeq(Class=RI%gcd=<8%SI=<11784E&>2CA4)
  7274. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  7275. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7276. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  7277. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7278. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7279. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7280. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7281. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7282.  
  7283. Fingerprint Windows NT 4.0 SP 6a + hotfixes
  7284. TSeq(Class=RI%gcd=<6%SI=<40132&>290%IPID=BI|RPI%TS=U)
  7285. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  7286. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7287. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  7288. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7289. T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  7290. T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  7291. T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  7292. PU(Resp=N|Y)
  7293.  
  7294. Fingerprint Windows 98
  7295. TSeq(Class=RI%gcd=<6%SI=<FFF)
  7296. T1(DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
  7297. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7298. T3(Resp=Y%DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
  7299. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  7300. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7301. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  7302. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7303. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7304.  
  7305. Fingerprint Windows 98 w/ Service Pack 1
  7306. TSeq(Class=TD%gcd=<5%SI=<20)
  7307. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7308. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7309. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7310. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  7311. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7312. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  7313. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7314. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7315.  
  7316. Fingerprint Windows NT 5 Beta2 or Beta3
  7317. TSeq(Class=TD%gcd=<6%SI=<1000)
  7318. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  7319. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7320. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  7321. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  7322. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7323. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  7324. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7325. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7326.  
  7327. # Microsoft Windows.NET Enterprise Server (build 3615 beta)
  7328. # windows .net standard server build 3604
  7329. Fingerprint Microsoft Windows.NET Enterprise Server (build 3604-3615 beta)
  7330. TSeq(Class=TR%gcd=<6%IPID=I)
  7331. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  7332. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7333. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  7334. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7335. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7336. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7337. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7338. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7339.  
  7340. # Windows Millenium Edition v4.90.300
  7341. # Windows 2000 Professional (x86)
  7342. # Windows Me or Windows 2000 RC1 through final release
  7343. # Microsoft Windows 2000 Advanced Server
  7344. # Winodws XP professional version 2002 on PC Intel processor
  7345. # Windows XP Build 2600
  7346. # Windows 2000 with SP2 and long fat pipe (RFC 1323)
  7347. # Windows 2K 5.00.2195 Service Pack 2 and latest hotfixes
  7348. # XP Professional 5.1 (build 2600).. all patches up to June 20, 2002
  7349. # Fingerprint Windows XP Pro with all current updates to May 2002
  7350. Fingerprint Windows Millennium Edition (Me), Win 2000, or WinXP
  7351. TSeq(Class=RI%gcd=<6%SI=<23726&>49C%IPID=I%TS=0)
  7352. T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|B5C9|B580|C000|D304|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT)
  7353. T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7354. T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|B5C9|B580|C000|402E|D304|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7355. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7356. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7357. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7358. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7359. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  7360.  
  7361. Fingerprint Windows 2000 server SP2
  7362. TSeq(Class=RI%gcd=<6%SI=<25224&>22C%IPID=I)
  7363. T1(DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
  7364. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7365. T3(Resp=Y%DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
  7366. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7367. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7368. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7369. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7370. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7371.  
  7372. Fingerprint WinME
  7373. TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I)
  7374. T1(DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT)
  7375. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7376. T3(Resp=Y%DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT)
  7377. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7378. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7379. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7380. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7381. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7382.  
  7383. Fingerprint Windows 2000 Professional
  7384. TSeq(Class=RI%gcd=<6%SI=<1C476&>472)
  7385. T1(DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
  7386. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7387. T3(Resp=Y%DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
  7388. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7389. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7390. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7391. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7392. PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  7393.  
  7394. Fingerprint Windows XP Home Edition
  7395. TSeq(Class=RI%gcd=<6%SI=<23C4E&>330%IPID=I%TS=U)
  7396. T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  7397. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7398. T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  7399. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  7400. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7401. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  7402. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7403. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7404.  
  7405. Fingerprint Win XP Pro or Windows 2000 Pro SP2+
  7406. TSeq(Class=RI%gcd=<16%SI=<25AEE&>6B%IPID=I)
  7407. T1(DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  7408. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7409. T3(Resp=Y%DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  7410. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7411. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7412. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7413. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7414. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7415.  
  7416. Fingerprint Windows 2000 SP2 
  7417. TSeq(Class=TD|RI%gcd=<14%SI=<302%IPID=BI%TS=U)
  7418. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  7419. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7420. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  7421. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7422. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7423. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7424. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7425. PU(Resp=N)
  7426.  
  7427. Fingerprint Windows 2000/XP/ME
  7428. TSeq(Class=RI%gcd=<20%SI=<E92A&>240)
  7429. T1(DF=Y%W=40E8|5B8E|FAF0|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
  7430. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7431. T3(Resp=Y%DF=Y%W=40E8|5B8E|FAF0|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
  7432. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7433. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7434. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7435. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7436. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7437.  
  7438. Fingerprint MS Windows2000 Professional RC1/W2K Advance Server Beta3
  7439. TSeq(Class=RI%gcd=<8%SI=<27D922&>65EE)
  7440. T1(DF=Y%W=402E|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  7441. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7442. T3(Resp=Y%DF=Y%W=402E|2017%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  7443. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7444. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7445. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7446. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7447. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7448.  
  7449. Fingerprint Windows XP Professional RC1+ through final release
  7450. TSeq(Class=RI%gcd=<8%SI=<2959A&>356%IPID=I)
  7451. T1(DF=Y|N%W=FAF0|402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  7452. T2(Resp=N)
  7453. T3(Resp=N)
  7454. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7455. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7456. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7457. T7(Resp=N)
  7458. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7459.  
  7460. Fingerprint WNOS 5.0 on DOS 6.22
  7461. TSeq(Class=TD%gcd=1000|2000|3000%SI=<7F)
  7462. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  7463. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7464. T3(DF=N%W=400%ACK=O%Flags=AS%Ops=M)
  7465. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7466. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7467. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7468. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7469. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7470.  
  7471. Fingerprint WorldGroup BBS (MajorBBS) w/TCP/IP
  7472. TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&<BBBBBB)
  7473. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  7474. T2(Resp=N)
  7475. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  7476. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7477. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7478. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7479. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7480. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  7481.  
  7482. Fingerprint WTI Network Power Switch v3.02
  7483. TSeq(Class=TD%gcd=<2A%SI=<1E%IPID=I%TS=U)
  7484. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
  7485. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  7486. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  7487. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  7488. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  7489. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  7490. T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  7491. PU(Resp=N)
  7492.  
  7493. Fingerprint VAX/VMS 5.3 on a MicroVAX II
  7494. TSeq(Class=64K)
  7495. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7496. T2(Resp=N)
  7497. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  7498. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  7499. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7500. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7501. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7502. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7503.  
  7504. Fingerprint VAX/VMS v5.5, CMU-TEK TCP/IP stack
  7505. TSeq(Class=RI%gcd=<6%SI=>BBBBB)
  7506. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  7507. T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=)
  7508. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  7509. T4(DF=N%W=64%ACK=O%Flags=AR%Ops=)
  7510. T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
  7511. T6(DF=N%W=64%ACK=O%Flags=AR%Ops=)
  7512. T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
  7513. PU(Resp=N)
  7514.  
  7515. Fingerprint VAX 7000-610 or 4200/SPX OR 6000-430
  7516. TSeq(Class=64K)
  7517. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  7518. T2(Resp=N)
  7519. T3(Resp=Y%DF=N%W=1800%ACK=O%Flags=A%Ops=)
  7520. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  7521. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7522. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7523. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7524. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7525.  
  7526. Fingerprint VMS MultiNet V4.1(16)
  7527. TSeq(Class=TR%gcd=<6)
  7528. T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  7529. T2(Resp=N)
  7530. T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  7531. T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  7532. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7533. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7534. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7535. PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7536.  
  7537. Fingerprint VMS MultiNet V4.2(16)/ OpenVMS V7.1-2
  7538. TSeq(Class=TR%gcd=<6)
  7539. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  7540. T2(Resp=N)
  7541. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
  7542. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  7543. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7544. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7545. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7546. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7547.  
  7548. Fingerprint VMS MultiNet V4.4 / OpenVMS V7.1
  7549. TSeq(Class=TR%gcd=<6%TS=2HZ)
  7550. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  7551. T2(Resp=N)
  7552. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
  7553. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  7554. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7555. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7556. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7557. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7558.  
  7559. Fingerprint XCD Xconnect print server, firmware version CC8S-3.58 (98.09.21)
  7560. TSeq(Class=TD%gcd=<272A%SI=<1E)
  7561. T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  7562. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7563. T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  7564. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7565. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7566. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7567. T7(Resp=N)
  7568. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  7569.  
  7570. Fingerprint Xerox 8830 Plotter
  7571. TSeq(Class=TD%gcd=1000%SI=1)
  7572. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  7573. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7574. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  7575. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7576. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7577. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7578. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7579. PU(Resp=N)
  7580.  
  7581. Fingerprint Xerox Document Centre ColorSeries 50
  7582. TSeq(Class=i800%IPID=I%TS=U)
  7583. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=ME)
  7584. T2(Resp=N)
  7585. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
  7586. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7587. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7588. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7589. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7590. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7591.  
  7592. Fingerprint Xerox Document Centre 440 w/ CentreWare Internet Services
  7593. TSeq(Class=64K%IPID=I%TS=U)
  7594. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  7595. T2(Resp=N)
  7596. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=)
  7597. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7598. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7599. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7600. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7601. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7602.  
  7603. Fingerprint Xerox DocuPrint C55
  7604. TSeq(Class=TD%gcd=1000|2000|3000|4000%SI=<A)
  7605. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  7606. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7607. T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  7608. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7609. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7610. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7611. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7612. PU(Resp=N)
  7613.  
  7614. Fingerprint Xerox DocuPrint N24/N32/N40 Network Laser Printer
  7615. TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U)
  7616. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  7617. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7618. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  7619. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7620. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7621. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7622. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7623. PU(Resp=N)
  7624.  
  7625. Fingerprint Xerox DocuPrint N40
  7626. TSeq(Class=TD%gcd=<2004%SI=<8C)
  7627. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  7628. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7629. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7630. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7631. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7632. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7633. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7634. PU(Resp=N)
  7635.  
  7636. Fingerprint xMach 0.1-CURRENT
  7637. TSeq(Class=64K%IPID=I%TS=2HZ)
  7638. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  7639. T2(Resp=N)
  7640. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  7641. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7642. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7643. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7644. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7645. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7646.  
  7647. Fingerprint Xylan OmniSwitch 5x/9x ethernet switch, Annex3 Comm server R10.0, or Hitach HI-UX/WE2
  7648. TSeq(Class=64K)
  7649. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7650. T2(Resp=N)
  7651. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  7652. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  7653. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7654. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7655. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7656. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7657.  
  7658. Fingerprint Xyplex 1600 running MAXserver V6.0.2 firmware
  7659. TSeq(Class=C|TD%gcd=<5%SI=<5)
  7660. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  7661. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7662. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  7663. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7664. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7665. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7666. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  7667. PU(Resp=N)
  7668.  
  7669. Fingerprint LynxOS Realtime OS -- Could be MeetingPlace 3.4, Xylogics  Remote Annex 4000 terminal server
  7670. TSeq(Class=64K)
  7671. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  7672. T2(Resp=N)
  7673. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  7674. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  7675. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7676. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7677. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7678. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7679.  
  7680. Fingerprint Cabletron Systems SSR 8000 System Software, Version 3.1.B.16
  7681. TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715)
  7682. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  7683. T2(Resp=N)
  7684. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  7685. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7686. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7687. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7688. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7689. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7690.  
  7691. Fingerprint CacheOS (CacheFlow 500-5000 webcache) CFOS 2.1.08 - 2.2.1
  7692. TSeq(Class=RI%gcd=<5%SI=>BBBB&<FFFFF)
  7693. T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  7694. T2(Resp=N)
  7695. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
  7696. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  7697. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7698. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7699. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7700. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7701.  
  7702. Fingerprint CacheOS 3.1 on a CacheFlow 6000
  7703. TSeq(Class=RI%gcd=<6%SI=<6DE6416&>1C6E5%IPID=RPI%TS=2HZ)
  7704. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7705. T2(Resp=N)
  7706. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  7707. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7708. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7709. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7710. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7711. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7712.  
  7713. Fingerprint Cacheflow 6x5 running CacheOS 3.1.19-4.1.05
  7714. TSeq(Class=RI%gcd=<6%SI=<CF3F0&>16F5%IPID=I%TS=2HZ)
  7715. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7716. T2(Resp=N)
  7717. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  7718. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7719. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7720. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7721. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7722. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7723.  
  7724. Fingerprint CacheFlow 6000 running CacheOS 4.1.05
  7725. TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U)
  7726. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  7727. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7728. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7729. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7730. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7731. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7732. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7733. PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  7734.  
  7735. Fingerprint Cayman 2E <http://www.cayman.com/>
  7736. TSeq(Class=TR%gcd=<6)
  7737. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  7738. T2(Resp=N)
  7739. T3(Resp=N)
  7740. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7741. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7742. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7743. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7744. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7745.  
  7746. Fingerprint Chase IOLAN Terminal Server v3.5.02 CDi
  7747. TSeq(Class=TD%gcd=<84%SI=<1E)
  7748. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=)
  7749. T2(Resp=N)
  7750. T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
  7751. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7752. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7753. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7754. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7755. PU(Resp=N)
  7756.  
  7757. Fingerprint Chase IOLAN terminal server
  7758. TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U)
  7759. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  7760. T2(Resp=N)
  7761. T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
  7762. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7763. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7764. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7765. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7766. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3549%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7767.  
  7768. Fingerprint Xyplex Network9000
  7769. TSeq(Class=TD%gcd=<6%SI=<6)
  7770. T1(Resp=Y%DF=Y%W=100%ACK=S++%Flags=AS%Ops=M)
  7771. T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7772. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
  7773. T4(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7774. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7775. T6(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7776. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
  7777. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7778.  
  7779. Fingerprint Xyplex Terminal Server v6.0.2S5
  7780. TSeq(Class=TD%gcd=1388%SI=<F)
  7781. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  7782. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7783. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  7784. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7785. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7786. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7787. T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  7788. PU(Resp=N)
  7789.  
  7790. #Zyxel P128imh or P480 router (ZyNOS)
  7791. Fingerprint Zyxel ZyNOS based router (ZyNOS)
  7792. TSeq(Class=TD%gcd=1000|2000|5000|4000|6000|8000|A000%SI=<5)
  7793. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  7794. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7795. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7796. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7797. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7798. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7799. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7800. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7801.  
  7802. Fingerprint ZyXEL P480 ISDN router running ZyNOS v2.42(O.00)
  7803. TSeq(Class=TD%gcd=<2004%SI=<1E)
  7804. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  7805. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7806. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7807. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7808. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7809. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7810. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7811. PU(Resp=N)
  7812.  
  7813. Fingerprint Hardware: Zyxel Prestige router/modem
  7814. T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
  7815. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7816. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7817. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7818. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7819. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7820. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7821. PU(Resp=N)
  7822.