home *** CD-ROM | disk | FTP | other *** search
/ PC World 2007 December / PCWorld_2007-12_cd.bin / v cisle / nmap / nmap-4.20-setup.exe / nmap-os-fingerprints < prev    next >
Text File  |  2006-12-07  |  809KB  |  21,672 lines
  1. # Nmap OS Fingerprint List. -*- mode: fundamental; -*-
  2. # $Id: nmap-os-fingerprints 4228 2006-12-08 03:01:08Z fyodor $ 
  3. #
  4. # Contributions to this database are welcome.  If Nmap obtains a new
  5. # fingerprint (and test conditions are favorable), it will print out a
  6. # URL you can use to submit the fingerprint.  If Nmap guesses wrong,
  7. # please send the full Nmap output and the exact destination host OS
  8. # name and version to fyodor@insecure.org .  Thanks!
  9. #
  10. # By submitting fingerprints you are transfering any and all copyright
  11. # interest in the data to Fyodor so that he can modify it, relicense it,
  12. # incorporate it into programs, etc.
  13. #
  14. # This collection of fingerprint data is (C) 1998-2003 by
  15. # Insecure.Com LLC.  This data is available for
  16. # free use by open source software under the terms of the GNU General
  17. # Public License.  We also license the data to selected
  18. # commercial/proprietary vendors under less restrictive terms.
  19. # Contact sales@insecure.com for more information.
  20. #
  21. # TEST DESCRIPTION:
  22. # Tseq is the TCP sequenceability test
  23. # T1 is a SYN packet with a bunch of TCP options to open port
  24. # T2 is a NULL packet w/options to open port
  25. # T3 is a SYN|FIN|URG|PSH packet w/options to open port
  26. # T4 is an ACK to open port w/options
  27. # T5 is a SYN to closed port w/options
  28. # T6 is an ACK to closed port w/options
  29. # T7 is a FIN|PSH|URG to a closed port w/options
  30. # PU is a UDP packet to a closed port
  31.  
  32. Fingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0
  33. Class 2Wire | embedded || WAP
  34. TSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ)
  35. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  36. T2(Resp=N)
  37. T3(Resp=N)
  38. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  39. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  40. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  41. T7(Resp=N)
  42. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  43.  
  44. # 3Com Home Connect Cable Modem external with USB - Model 3CR29223
  45. Fingerprint 3Com Home Connect Cable Modem
  46. Class 3Com | embedded || broadband router
  47. TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)
  48. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  49. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  50. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  51. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  52. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  53. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  54. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  55. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  56.  
  57. # 3Com 812 OfficeConnect ADSL Router Firmware version: 2.0.0
  58. Fingerprint 3Com OfficeConnect 812 aDSL router
  59. Class 3Com | embedded || broadband router
  60. TSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)
  61. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  62. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  63. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  64. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  65. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  66. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  67. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  68. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  69.  
  70. Fingerprint 3Com OfficeConnect Remote 812 aDSL Router
  71. Class 3Com | embedded || broadband router
  72. TSeq(Class=TD%gcd=<C354%SI=<1E)
  73. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  74. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  75. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  76. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  77. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  78. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  79. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  80. PU(Resp=N)
  81.  
  82. # 3Com Sharkfin/Tailfin Cable Modem boot code 01.00.003a main image 1.17 hardware 2.00 web 604
  83. Fingerprint 3Com Sharkfin/Tailfin Cable Modem
  84. Class 3Com | embedded || broadband router
  85. TSeq(Class=TD%gcd=<D6DC%SI=<14%IPID=I%TS=U)
  86. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  87. T2(Resp=N)
  88. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  89. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  90. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  91. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  92. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  93. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  94.  
  95. Fingerprint 3Com Sharkfin/Tailfin Cable Modem
  96. Class 3Com | embedded || broadband router
  97. TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)
  98. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  99. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  100. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  101. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  102. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  103. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  104. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  105. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  106.  
  107. # US Robotics USR8000 Broadband router, firmware 1.27 patched
  108. Fingerprint US Robotics USR8000 Broadband router
  109. Class 3Com | embedded || broadband router
  110. TSeq(Class=RI%gcd=<68%SI=<726%IPID=BI%TS=U)
  111. T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  112. T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)
  113. T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=)
  114. T4(DF=N%W=800|C00|400%ACK=S%Flags=AR%Ops=)
  115. T5(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=)
  116. T6(DF=N%W=1000|400|800%ACK=S%Flags=AR%Ops=)
  117. T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  118. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  119.  
  120. # 3Com NBX Superstack 3 IP PBX running firmware 4_1_11
  121. # 3Com NBX-100 (version R4_1_4) Phone System Processor
  122. Fingerprint 3Com NBX PBX
  123. Class 3Com | embedded || PBX
  124. TSeq(Class=64K%IPID=I%TS=2HZ)
  125. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  126. T2(Resp=N)
  127. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  128. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  129. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  130. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  131. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  132. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  133.  
  134. # 3Com AccessBuilder Remote Office 500 with firmware V05.T4N
  135. Fingerprint 3Com AccessBuilder Remote Office 500 router
  136. Class 3Com | embedded || router
  137. TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
  138. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  139. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  140. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=AS%Ops=ME)
  141. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  142. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  143. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  144. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  145. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  146.  
  147. Fingerprint 3Com NetBuilder & NetBuilder II OS v 9.3
  148. Class 3Com | embedded || router
  149. TSeq(Class=TD%gcd=3C%SI=<FF)
  150. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  151. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  152. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  153. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  154. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  155. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  156. T7(Resp=N)
  157. PU(Resp=N)
  158.  
  159. Fingerprint 3Com Netbuilder & Netbuilder II router OS v8.1
  160. Class 3Com | embedded || router
  161. TSeq(Class=TD%gcd=32|64|96%SI=<FF)
  162. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  163. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  164. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  165. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  166. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  167. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  168. T7(Resp=N)
  169. PU(Resp=N)
  170.  
  171. Fingerprint 3Com Netbuilder II Router Ver 11.4.0.51
  172. Class 3Com | embedded || router
  173. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  174. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  175. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  176. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  177. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  178. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  179. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  180. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  181. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  182.  
  183. Fingerprint 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
  184. Class 3Com | embedded || router
  185. TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
  186. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  187. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  188. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  189. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  190. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  191. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  192. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  193. PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  194.  
  195. # 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
  196. Fingerprint 3Com Netbuilder Remote Office 222 router
  197. Class 3Com | embedded || router
  198. TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
  199. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  200. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  201. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  202. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  203. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  204. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  205. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  206. PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  207.  
  208. Fingerprint 3Com NetBuilder-II, OS version SW/NB2M-BR-5.1.0.27
  209. Class 3Com | embedded || router
  210. TSeq(Class=TD%gcd=32|64|96%SI=<F)
  211. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS|AP%Ops=|M)
  212. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  213. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  214. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  215. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  216. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  217. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  218. PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  219.  
  220. # 3Com OfficeConnect Netbuilder router running 11.4.0.09
  221. Fingerprint 3Com OfficeConnect Netbuilder router
  222. Class 3Com | embedded || router
  223. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  224. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  225. T2(Resp=N)
  226. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  227. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  228. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  229. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  230. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  231. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  232.  
  233. # 3com OfficeConnect Remote 812 ADSL Router (Firmware V1.1.7)
  234. Fingerprint 3com OfficeConnect Remote 812 ADSL Router
  235. Class 3Com | embedded || router
  236. TSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)
  237. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  238. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  239. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  240. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  241. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  242. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  243. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  244. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  245.  
  246. Fingerprint 3Com / USR TotalSwitch Firmware: 02.02.00R
  247. Class 3Com | embedded || switch
  248. TSeq(Class=C|TD%gcd=3D090%SI=0)
  249. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  250. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  251. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  252. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  253. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  254. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  255. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  256. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  257.  
  258. # 3com Switch 7700 firmware v2.01
  259. # Huawei S6506R routing switch VRP 3.10 release 1009
  260. Fingerprint 3Com 7700/8800 Switch or Huawei S6506R routing switch VRP 3.10
  261. Class 3Com | embedded || switch
  262. Class Huawei | VRP || switch
  263. TSeq(Class=64K%IPID=I%TS=U)
  264. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  265. T2(Resp=N)
  266. T3(Resp=Y%DF=N%W=1FC4%ACK=O%Flags=A%Ops=)
  267. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  268. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  269. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  270. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  271. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  272.  
  273. Fingerprint 3Com Access Builder 4000 Switch
  274. Class 3Com | embedded || switch
  275. T1(DF=N%W=0|800%ACK=S++%Flags=AR|AS%Ops=|M)
  276. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  277. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  278. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  279. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  280. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  281. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  282. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  283.  
  284. # 3Com LANplex 6004 Extended Switching Software 7.0
  285. Fingerprint 3Com LANplex 6004 switch
  286. Class 3Com | embedded || switch
  287. TSeq(Class=64K%IPID=I%TS=U)
  288. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  289. T2(Resp=N)
  290. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  291. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  292. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  293. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  294. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  295. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  296.  
  297. # Switch 1100, 3300
  298. Fingerprint 3Com SuperStack II switch (OS v 2.0)
  299. Class 3Com | embedded || switch
  300. TSeq(Class=C)
  301. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  302. T2(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  303. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  304. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  305. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  306. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  307. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  308. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  309.  
  310. Fingerprint 3Com SuperStack II switch SW/NBSI-CF,11.1.0.00S38
  311. Class 3Com | embedded || switch
  312. TSeq(Class=TD%gcd=<68%SI=<3C)
  313. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  314. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  315. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  316. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  317. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  318. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  319. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  320. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  321.  
  322. # 3Com SuperStack II RAS 1500 software version 2.5.0, 159
  323. Fingerprint 3Com SuperStack II RAS remote access server
  324. Class 3Com | embedded || terminal server
  325. TSeq(Class=TD%gcd=<320CC%SI=<14%IPID=I%TS=U)
  326. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  327. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  328. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  329. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  330. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  331. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  332. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  333. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  334.  
  335. Fingerprint 3Com terminal server ESPL CS2100
  336. Class 3Com | embedded || terminal server
  337. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  338. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  339. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  340. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  341. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  342. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  343. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  344. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  345. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  346.  
  347. # Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06
  348. # 3Com 11Mpbs Wireless LAN Access Point 8000
  349. Fingerprint Datavoice 3Com WAP or TxPORT PRISM T1 CSU/DSU
  350. Class 3Com | embedded || WAP
  351. Class Datavoice | embedded || CSUDSU
  352. TSeq(Class=RI%gcd=<6%SI=>18000)
  353. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  354. T2(Resp=N)
  355. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  356. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  357. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  358. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  359. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  360. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  361.  
  362. # Tested ACC Amazon 9.2.29, ACC Congo 9.2.35
  363. Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator
  364. Class ACC | embedded || router
  365. TSeq(Class=64K)
  366. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  367. T2(Resp=N)
  368. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  369. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  370. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  371. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  372. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  373. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  374.  
  375. Fingerprint Acorn RISC OS 3.60 (Acorn TCP/IP Stack 4.07)
  376. Class Acorn | RISC OS || general purpose
  377. TSeq(Class=TR)
  378. T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  379. T2(Resp=N)
  380. T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
  381. T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=)
  382. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  383. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  384. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  385. PU(Resp=N)
  386.  
  387. Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd)
  388. Class Acorn | RISC OS || general purpose
  389. TSeq(Class=RI%gcd=<6)
  390. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  391. T2(Resp=N)
  392. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  393. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  394. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  395. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  396. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  397. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  398.  
  399. # Actiontec Wireless ready DSL Gateway - Model R1520SU
  400. # Actiontec 1520 DSL gateway with GlobespanVirata chipset hardware version RD6700 BSP v1.1 (ISOS 8.2) / He100/2xx CSP v2.3, firmware version 8.2.0.16
  401. Fingerprint Actiontec 1520 DSL gateway firmware 8.2.0.16
  402. Class Actiontec | embedded || broadband router
  403. TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U)
  404. T1(DF=N%W=1194%ACK=S++%Flags=AS%Ops=ME)
  405. T2(Resp=Y%DF=N%W=1194%ACK=O%Flags=R%Ops=)
  406. T3(Resp=N)
  407. T4(DF=N%W=1194%ACK=O%Flags=R%Ops=)
  408. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  409. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  410. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  411. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  412.  
  413. Fingerprint Adtran Atlas 890 digital cross-connect device
  414. Class Adtran | embedded || telecom-misc
  415. TSeq(Class=TD%gcd=<714%SI=<1E%IPID=I%TS=U)
  416. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  417. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  418. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  419. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  420. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  421. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  422. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  423. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  424.  
  425. # Aethra Vega Star Gold (Videoconferencing appliance)
  426. # Aethra Video Conference System Vega Pro S running pSOSystem
  427. Fingerprint Aethra Vega Conference System
  428. Class Aethra | embedded || webcam
  429. TSeq(Class=RI%gcd=<6%SI=<2F97016&>79D33%IPID=I%TS=U)
  430. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
  431. T2(Resp=N)
  432. T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
  433. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  434. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  435. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  436. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  437. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  438.  
  439. Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge
  440. Class Aironet | embedded || bridge
  441. TSeq(Class=C%Val=0)
  442. T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=)
  443. T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
  444. T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
  445. T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
  446. T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
  447. T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
  448. T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
  449. PU(Resp=N)
  450.  
  451. Fingerprint Aironet Wireless Bridge running firmware V5.0J
  452. Class Aironet | embedded || bridge
  453. TSeq(Class=C|TR)
  454. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  455. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  456. T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=)
  457. T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  458. T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  459. T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  460. T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  461. PU(Resp=N)
  462.  
  463. Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps Wireless access point
  464. Class Aironet | embedded || WAP
  465. TSeq(Class=TR%gcd=<6)
  466. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  467. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  468. T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  469. T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  470. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  471. T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  472. T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  473. PU(Resp=N)
  474.  
  475. Fingerprint Alcatel 1000 ADSL (modem)
  476. Class Alcatel | embedded || broadband router
  477. TSeq(Class=64K)
  478. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  479. T2(Resp=N)
  480. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  481. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  482. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  483. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  484. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  485. PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  486.  
  487. Fingerprint Alcatel 1000 DSL Router
  488. Class Alcatel | embedded || broadband router
  489. TSeq(Class=RI%gcd=<5%SI=>AAA&<AAAAA)
  490. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  491. T2(Resp=N)
  492. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  493. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  494. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  495. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  496. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  497. PU(Resp=N)
  498.  
  499. # Alcatel Speed Touch Home running GV8BAA3.235 (992640)
  500. # Alcatel SpeedTouch Pro ADSL Router running NZ OS 3.281
  501. #  Alcatel Speed Touch Home ADSL Modem (POTS), Ver 3.2
  502. Fingerprint Alcatel Speed Touch *DSL modem/router
  503. Class Alcatel | embedded || broadband router
  504. TSeq(Class=64K%IPID=I%TS=2HZ)
  505. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  506. T2(Resp=N)
  507. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  508. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  509. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  510. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  511. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  512. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E|F%ULEN=134%DAT=E)
  513.  
  514. # Alcatel Speed Touch 510 *DSL router (uses THOMSON UNIX embedded Version 4.0.0.9.0)
  515. Fingerprint Alcatel Speed Touch 510 *DSL modem/router
  516. Class Alcatel | embedded || broadband router
  517. TSeq(Class=64K%IPID=I%TS=2HZ)
  518. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  519. T2(Resp=N)
  520. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  521. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  522. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  523. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  524. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  525. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  526.  
  527. Fingerprint Alcatel Speed Touch Pro aDSL modem
  528. Class Alcatel | embedded || broadband router
  529. TSeq(Class=64K%IPID=I%TS=2HZ)
  530. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  531. T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  532. T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  533. T4(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  534. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  535. T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  536. T7(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
  537. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  538.  
  539. Fingerprint Alcatel OmniStack switch version 4.3.3 GA
  540. Class Alcatel | embedded || switch
  541. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  542. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  543. T2(Resp=N)
  544. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  545. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  546. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  547. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  548. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  549. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  550.  
  551. # Alcatel telephone system called OmniPcx 4400 Chorus MiX V.3.2 r4.1.5 COMP-386
  552. Fingerprint Alcatel OmniPcx 4400 telephone system
  553. Class Alcatel | embedded || telecom-misc
  554. TSeq(Class=RI%gcd=<6%SI=<720CE&>AEE%IPID=I%TS=U)
  555. T1(DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M)
  556. T2(Resp=N)
  557. T3(Resp=Y%DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M)
  558. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  559. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  560. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  561. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  562. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  563.  
  564. # Advanced Reflexes IP Phone, Version: E/AT400/46.8
  565. # IBM x450 remote management console (lets you switch machine on/off, check temp, etc)
  566. Fingerprint Alcatel Advanced Reflexes IP Phone or IBM x450 remote management console
  567. Class Alcatel | embedded || VoIP phone
  568. Class IBM | embedded || remote management
  569. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  570. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  571. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  572. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  573. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  574. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  575. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  576. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  577. PU(Resp=N)
  578.  
  579. Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub
  580. Class Allied Telesyn | embedded || hub
  581. TSeq(Class=C)
  582. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  583. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  584. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  585. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  586. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  587. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  588. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  589. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  590.  
  591. Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA
  592. Class Allied Telesyn | embedded || switch
  593. TSeq(Class=TD%gcd=FA|1F4%SI=<FFF)
  594. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  595. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  596. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  597. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  598. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  599. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  600. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  601. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  602.  
  603. # Allied Telesyn Layer 3 Switch AT-8748XL Version 2.6.1
  604. # Allied Telesyn Rapier 24i
  605. Fingerprint Allied Telesyn AT-8748XL or Rapier 24i Switch
  606. Class Allied Telesyn | embedded || switch
  607. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  608. T1(DF=N%W=1F40%ACK=S++%Flags=AS%Ops=M)
  609. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  610. T3(Resp=Y%DF=N%W=1F40%ACK=S++%Flags=AS%Ops=M)
  611. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  612. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  613. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  614. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  615. PU(Resp=N)
  616.  
  617. # Allied Telesyn AT-RP24i Rapier 24i version 2.3.1-04
  618. # Ericsson Home internet Solution ver. 2.0
  619. Fingerprint Allied Telesyn AT-RP24i switch or Ericcson HiS V2.0
  620. Class Allied Telesyn | embedded || switch
  621. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  622. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  623. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  624. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  625. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  626. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  627. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  628. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  629. PU(Resp=N)
  630.  
  631. Fingerprint Amos 2.3A
  632. Class Alpha Micro | AMOS || general purpose
  633. TSeq(Class=i800%gcd=<6%SI=<14)
  634. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  635. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  636. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  637. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  638. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  639. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  640. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  641. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  642.  
  643. Fingerprint Alteon Networks ACEswitch 180e Software Version 8.0.62.7
  644. Class Alteon | embedded || load balancer
  645. TSeq(Class=RI%gcd=<14%SI=<D45BC&>85A%IPID=I%TS=U)
  646. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  647. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  648. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  649. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  650. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  651. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  652. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  653. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  654.  
  655. # Nortel/Alteon ACE Director 3 Hardware Revision: B Software Version 6.0.42
  656. Fingerprint Nortel/Alteon ACE Director 3 Version 6.0.42-B
  657. Class Alteon | embedded || load balancer
  658. TSeq(Class=TR%gcd=<6%IPID=RD)
  659. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  660. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  661. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  662. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  663. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  664. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  665. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  666. PU(Resp=N)
  667.  
  668. # Alteon AceSwitch 110 (software 4.0.37)
  669. # Centillion C100 ATM Switch OS Version 2.0.2.
  670. Fingerprint Alteon AceSwitch 110 or Cantillion C100 ATM Switch
  671. Class Alteon | embedded || switch
  672. Class Cantillion | embedded || switch
  673. TSeq(Class=TD%gcd=<9C8%SI=<1E)
  674. T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M)
  675. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  676. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  677. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  678. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  679. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  680. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  681. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  682.  
  683. # Alteon ACEswitch 184 Software Version 8.0.49
  684. Fingerprint Alteon ACEswitch 184 V. 8.0.49
  685. Class Alteon | embedded || switch
  686. TSeq(Class=RI%gcd=<34%SI=<C698A&>215%IPID=I%TS=U)
  687. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  688. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  689. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  690. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  691. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  692. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  693. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  694. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  695.  
  696. Fingerprint Amiga OS 3.5 (Miami TCP/IP Stack v3.1)
  697. Class Amiga | AmigaOS || general purpose
  698. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  699. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  700. T2(Resp=N)
  701. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  702. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  703. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  704. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  705. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  706. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  707.  
  708. Fingerprint AmigaOS 2.1 running AmiTCP4.3
  709. Class Amiga | AmigaOS || general purpose
  710. TSeq(Class=64K%TS=U)
  711. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
  712. T2(Resp=N)
  713. T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
  714. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  715. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  716. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  717. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  718. PU(DF=N%TOS=20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  719.  
  720. Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m
  721. Class Amiga | AmigaOS || general purpose
  722. TSeq(Class=TR%gcd=<6)
  723. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  724. T2(Resp=N)
  725. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  726. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  727. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  728. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  729. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  730. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  731.  
  732. Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0c
  733. Class Amiga | AmigaOS || general purpose
  734. TSeq(Class=TR%gcd=<6)
  735. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  736. T2(Resp=N)
  737. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  738. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  739. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  740. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  741. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  742. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  743.  
  744. Fingerprint AmigaOS AmiTCP/IP 4.3
  745. Class Amiga | AmigaOS || general purpose
  746. TSeq(Class=64K)
  747. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
  748. T2(Resp=N)
  749. T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
  750. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  751. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  752. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  753. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  754. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  755.  
  756. Fingerprint AmigaOS AmiTCP/IP Genesis 4.6
  757. Class Amiga | AmigaOS || general purpose
  758. TSeq(Class=64K)
  759. T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M)
  760. T2(Resp=N)
  761. T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=)
  762. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  763. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  764. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  765. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  766. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  767.  
  768. Fingerprint AmigaOS Miami 2.1-3.0
  769. Class Amiga | AmigaOS || general purpose
  770. TSeq(Class=TR)
  771. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  772. T2(Resp=N)
  773. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  774. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  775. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  776. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  777. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  778. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  779.  
  780. Fingerprint AmigaOS Miami 3.0
  781. Class Amiga | AmigaOS || general purpose
  782. TSeq(Class=TR)
  783. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  784. T2(Resp=N)
  785. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  786. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  787. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  788. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  789. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  790. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  791.  
  792. Fingerprint AmigaOS Miami 3.1-3.2
  793. Class Amiga | AmigaOS || general purpose
  794. TSeq(Class=TR)
  795. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  796. T2(Resp=N)
  797. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  798. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  799. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  800. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  801. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  802. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  803.  
  804. Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B
  805. Class Amiga | AmigaOS || general purpose
  806. TSeq(Class=TR)
  807. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  808. T2(Resp=N)
  809. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  810. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  811. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  812. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  813. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  814. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  815.  
  816. Fingerprint APC MasterSwitch Network Power Controller
  817. Class APC | embedded || power-device
  818. TSeq(Class=TR)
  819. T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  820. T2(Resp=N)
  821. T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  822. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  823. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  824. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  825. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  826. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  827.  
  828. Fingerprint APC Network management Card AP9616
  829. Class APC | embedded || power-device
  830. TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ)
  831. T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  832. T2(Resp=N)
  833. T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  834. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  835. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  836. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  837. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  838. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  839.  
  840. # APC AP9617  network management card inside Matrix 5000 UPS
  841. Fingerprint APC network-enabled UPS
  842. Class APC | embedded || power-device
  843. TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ)
  844. T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  845. T2(Resp=N)
  846. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  847. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  848. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  849. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  850. T7(Resp=N)
  851. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  852.  
  853. # APC UPS Network Management Card, Model AP9617
  854. Fingerprint APC UPS Network Management Card
  855. Class APC | embedded || power-device
  856. TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ)
  857. T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  858. T2(Resp=N)
  859. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  860. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  861. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  862. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  863. T7(Resp=N)
  864. PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  865.  
  866. # SmartUPS 3000RM Firmware: 92.14.I
  867. # APC PDU AOS v1.1.6
  868. Fingerprint APC UPS system
  869. Class APC | embedded || power-device
  870. TSeq(Class=TD%gcd=<F38C%SI=<DC%IPID=I)
  871. T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  872. T2(Resp=N)
  873. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  874. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  875. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  876. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  877. T7(Resp=N)
  878. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  879.  
  880. # American Power Conversion / Network Management Card AOS v2.5.3 / Symmetra LX 16000 RM / This is a network management interface on a high end UPS
  881. Fingerprint APC UPS System network management card (runs AOS v2.5.3)
  882. Class APC | embedded || power-device
  883. TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
  884. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  885. T2(Resp=N)
  886. T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  887. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  888. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  889. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  890. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  891. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  892.  
  893. # American Power Conversion Smart-UPS 3000 RM firmware revision 666.5.I
  894. # APC AOS 2.2.7 (on APC AP7901 network management card)
  895. # APC UPS - Symmetra 16000 UPS_IDEN
  896. # APC AP9617 SmartSlot UPS network management card
  897. # APC Network Management Card EX 10/100BaseT (AP9617)
  898. # APC Network Management Card AOS v2.2.7 (Rack PDU APP v2.2.0)
  899. # APC network mgmt card AP9617
  900. Fingerprint APC UPS System network management card (runs AOS)
  901. Class APC | embedded || power-device
  902. TSeq(Class=TD%gcd=<7A124%SI=<1E%IPID=I%TS=1000HZ)
  903. T1(DF=Y|N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  904. T2(Resp=N)
  905. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  906. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  907. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  908. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  909. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  910. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  911.  
  912. Fingerprint APC Web/SNMP UPS management card
  913. Class APC | embedded || power-device
  914. TSeq(Class=RI%gcd=<6%SI=<52FB700&>D46DF)
  915. T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  916. T2(Resp=N)
  917. T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  918. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  919. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  920. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  921. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  922. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  923.  
  924. Fingerprint Apollo Domain/OS SR10.3.5
  925. Class Apollo | Domain/OS || general purpose
  926. TSeq(Class=RI|TD%gcd=<E%SI=<898%IPID=I%TS=U)
  927. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  928. T2(Resp=N)
  929. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  930. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  931. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  932. T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  933. T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  934. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  935.  
  936. Fingerprint Apollo Domain/OS SR10.4
  937. Class Apollo | Domain/OS || general purpose
  938. TSeq(Class=TD|RI%gcd=<6%SI=<FF)
  939. T1(DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
  940. T2(Resp=N)
  941. T3(Resp=Y%DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
  942. T4(DF=N%W=239C%ACK=O%Flags=R%Ops=)
  943. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  944. T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
  945. T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  946. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  947.  
  948. Fingerprint Apple A/UX 3.1.1 SVR2 or OpenStep 4.2
  949. Class Apple | A/UX || general purpose
  950. TSeq(Class=64K)
  951. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  952. T2(Resp=N)
  953. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  954. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  955. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  956. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  957. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  958. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  959.  
  960. Fingerprint Apple Color LaserWriter 12/660 PS (Model No. M3036)
  961. Class Apple | embedded || printer
  962. T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  963. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  964. T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=AR%Ops=)
  965. T4(DF=N%W=C00%ACK=O%Flags=R%Ops=)
  966. T5(Resp=N)
  967. T6(DF=N%W=C00%ACK=O%Flags=R%Ops=)
  968. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  969. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  970.  
  971. # Actually it is not constant seq class -- it just seems that way
  972. # because it takes so long to increment
  973. Fingerprint Apple Color LaserWriter 600 Printer
  974. Class Apple | embedded || printer
  975. TSeq(Class=C)
  976. T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  977. T2(Resp=N)
  978. T3(Resp=Y%DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  979. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  980. T5(Resp=N)
  981. T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
  982. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  983. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  984.  
  985. Fingerprint Apple Color LaserWriter 600 Printer
  986. Class Apple | embedded || printer
  987. TSeq(Class=C)
  988. T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  989. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  990. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  991. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  992. T5(Resp=N)
  993. T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  994. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  995. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  996.  
  997. Fingerprint Apple LaserWriter 12/640 PS
  998. Class Apple | embedded || printer
  999. TSeq(Class=C%Val=85BD001%IPID=I%TS=U)
  1000. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  1001. T2(Resp=N)
  1002. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1003. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1004. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1005. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1006. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1007. PU(Resp=N)
  1008.  
  1009. Fingerprint Apple LaserWriter 16/600 PS, HP 6P, or HP 5 Printer
  1010. Class Apple | embedded || printer
  1011. TSeq(Class=C)
  1012. T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  1013. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1014. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1015. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1016. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1017. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1018. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1019. PU(Resp=N)
  1020.  
  1021. # The sequence prediction is never really true random, but sometimes it
  1022. # has two unique "tracks" which make it look random to nmap.  Here is a
  1023. # real example:  Sequence numbers: 5576001 25D001 5576001 25D001
  1024. Fingerprint Apple LaserWriter 8500 (PostScript version 3010.103)
  1025. Class Apple | embedded || printer
  1026. TSeq(Class=TR|C)
  1027. T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  1028. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1029. T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  1030. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1031. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1032. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1033. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1034. PU(Resp=N)
  1035.  
  1036. # Apple AirPort Extreme Base Station Firmware 5.1.1
  1037. Fingerprint Apple Airport Extreme Base Station (WAP) or ARRIS Cadant C3 CMTS Cable Modem
  1038. Class Apple | embedded || WAP
  1039. Class ARRIS | embedded || broadband router
  1040. TSeq(Class=RI%gcd=<6%SI=<94160&>15CB%IPID=I%TS=2HZ)
  1041. T1(DF=Y%W=2000|4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  1042. T2(Resp=N)
  1043. T3(Resp=Y%DF=Y%W=2000|4000%ACK=O%Flags=A%Ops=NNT)
  1044. T4(DF=N%W=2000|4000%ACK=O%Flags=R%Ops=)
  1045. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1046. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1047. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1048. PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1049.  
  1050. # Apple Airport Express (Wireless Router/Bridge) (Firmware v6.1)
  1051. # Apple AirPort Express (Apple Base Station V6.0)
  1052. # OKI Phaser B6300N laser printer
  1053. # Netgear 7000 Series Managed Switch (GSM7324) (strang ops)
  1054. # Westel Versalink 327W, Wireless DSL Modem/Router
  1055. Fingerprint Embedded device (Apple WAP, Dell bridge, OKI printer, Westel Broadband router)
  1056. Class Apple | embedded || WAP
  1057. Class Dell | embedded || storage-misc
  1058. Class Okidata | embedded || printer
  1059. Class Westel | embedded || broadband router
  1060. TSeq(Class=RI%gcd=<6%SI=<A9830&>1000%TS=2HZ)
  1061. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  1062. T2(Resp=N)
  1063. T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=AS%Ops=MNWNNT)
  1064. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  1065. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1066. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1067. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1068. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1069.  
  1070. # Mac OS X 1.1-1.2
  1071. Fingerprint Apple Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3
  1072. Class Apple | Mac OS X | 10.0.X | general purpose
  1073. TSeq(Class=RI%gcd=<5)
  1074. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  1075. T2(Resp=N)
  1076. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
  1077. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  1078. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1079. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1080. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1081. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1082.  
  1083. # Mac OS X Server 1.0 - 1.0-1 <-- should be 10.1.0?
  1084. Fingerprint Apple Mac OS X Server 1.0-1.0-1 (Rhapsody 5.3 - 5.4)
  1085. Class Apple | Mac OS X | 10.0.X | general purpose
  1086. TSeq(Class=RI%gcd=<5%SI=>BBB&<FFFF)
  1087. T1(W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1088. T2(Resp=N)
  1089. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  1090. T4(W=2000%ACK=O%Flags=R%Ops=)
  1091. T5(W=0%ACK=S++%Flags=AR%Ops=)
  1092. T6(W=0%ACK=O%Flags=R%Ops=)
  1093. T7(W=0%ACK=S%Flags=AR%Ops=)
  1094. PU(TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1095.  
  1096. Fingerprint Apple Mac OS X 10.1 - 10.1.4
  1097. Class Apple | Mac OS X | 10.1.X | general purpose
  1098. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1099. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1100. T2(Resp=N)
  1101. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1102. T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  1103. T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
  1104. T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  1105. T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  1106. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1107.  
  1108. Fingerprint Apple Mac OS X 10.1.4 (Darwin Kernel 5.4) on iMac
  1109. Class Apple | Mac OS X | 10.1.X | general purpose
  1110. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1111. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  1112. T2(Resp=N)
  1113. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  1114. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1115. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1116. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1117. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1118. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1119.  
  1120. Fingerprint Apple Mac OS X 10.1.5
  1121. Class Apple | Mac OS X | 10.1.X | general purpose
  1122. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  1123. T1(DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  1124. T2(Resp=N)
  1125. T3(Resp=Y%DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  1126. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1127. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1128. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1129. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1130. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1131.  
  1132. # Mac OS 10.2.6, Darwin kernel 6.6
  1133. Fingerprint Apple Mac OS X 10.1.5-10.2.8
  1134. Class Apple | Mac OS X | 10.1.X | general purpose
  1135. Class Apple | Mac OS X | 10.2.X | general purpose
  1136. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1137. T1(DF=Y|N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1138. T2(Resp=N)
  1139. T3(Resp=Y%DF=Y|N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1140. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1141. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1142. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1143. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1144. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1145.  
  1146. # Apple Mac OS X Server 1.2 (ppc) -- 1.2 == 10.1.2?
  1147. Fingerprint Apple Mac OS X Server 10.1.2 (ppc)
  1148. Class Apple | Mac OS X | 10.1.X | general purpose
  1149. TSeq(Class=RI%gcd=<6%SI=<199A9C&>4177)
  1150. T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1151. T2(Resp=N)
  1152. T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT)
  1153. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  1154. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1155. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1156. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1157. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1158.  
  1159. Fingerprint Apple Mac OS X 10.2.6
  1160. Class Apple | Mac OS X | 10.2.X | general purpose
  1161. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1162. T2(Resp=N)
  1163. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1164. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1165. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1166. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1167. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1168. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1169.  
  1170. Fingerprint Apple Mac OS X 10.2.6 (Jaguar)
  1171. Class Apple | Mac OS X | 10.2.X | general purpose
  1172. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1173. T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
  1174. T2(Resp=N)
  1175. T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
  1176. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1177. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1178. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1179. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1180. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1181.  
  1182. Fingerprint Apple Mac OS X 10.2.8 (Jaguar)
  1183. Class Apple | Mac OS X | 10.2.X | general purpose
  1184. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1185. T1(DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT)
  1186. T2(Resp=N)
  1187. T3(Resp=Y%DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT)
  1188. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1189. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1190. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1191. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1192. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1193.  
  1194. # Mac OS X Server 10.2.8 Darwin Kernel 6.8 Macintosh powerpc
  1195. Fingerprint Apple Mac OS X Server 10.2.8
  1196. Class Apple | Mac OS X | 10.2.X | general purpose
  1197. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1198. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
  1199. T2(Resp=N)
  1200. T3(Resp=N)
  1201. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1202. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1203. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1204. T7(Resp=N)
  1205. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1206.  
  1207. Fingerprint Apple Mac OS X 10.3.3 (Panther)
  1208. Class Apple | Mac OS X | 10.3.X | general purpose
  1209. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1210. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  1211. T2(Resp=N)
  1212. T3(Resp=N)
  1213. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1214. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1215. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1216. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1217. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1218.  
  1219. # Apple Mac OS 10.3.5 (Darwin Kernel Version 7.5.0)
  1220. # Mac OS 10.3.7 Server, Darwain, PPC. Kernel version 7.70. All relevant updates as of 2/2/05
  1221. Fingerprint Apple Mac OS X 10.3.5 or 10.3.7
  1222. Class Apple | Mac OS X | 10.3.X | general purpose
  1223. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1224. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  1225. T2(Resp=N)
  1226. T3(Resp=N)
  1227. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1228. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1229. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1230. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1231. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1232.  
  1233. # Darwin 7.7.0 Power Macintosh powerpc, OS X, version 10.3.7
  1234. # Apple Mac OS X 10.3.6 (7R28) -  (Darwin 7.6.0)
  1235. Fingerprint Apple Mac OS X 10.3.6 or 10.3.7
  1236. Class Apple | Mac OS X | 10.3.X | general purpose
  1237. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1238. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  1239. T2(Resp=N)
  1240. T3(Resp=N)
  1241. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1242. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1243. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1244. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1245. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1246.  
  1247. Fingerprint Apple Mac OS X 10.3.9
  1248. Class Apple | Mac OS X | 10.3.X | general purpose
  1249. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1250. T1(DF=Y%W=E34E%ACK=S++%Flags=AS%Ops=MNWNNT)
  1251. T2(Resp=N)
  1252. T3(Resp=N)
  1253. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1254. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1255. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1256. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1257. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1258.  
  1259. Fingerprint Apple Mac OS X 10.4.1 (Tiger)
  1260. Class Apple | Mac OS X | 10.3.X | general purpose
  1261. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1262. T1(DF=Y%W=FFFF%ACK=S++%Flags=A%Ops=NNT)
  1263. T2(Resp=N)
  1264. T3(Resp=N)
  1265. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1266. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1267. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1268. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1269. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1270.  
  1271. # Apple Mac OS X 10.3.8 (Panther); Darwin Kernel Version 7.8.0
  1272. # Apple Mac OS X 10.4 (Build: 8A428); Kernel: Darwin 8.0.0
  1273. Fingerprint Apple Mac OS X 10.3.8 or 10.4
  1274. Class Apple | Mac OS X | 10.4.X | general purpose
  1275. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1276. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  1277. T2(Resp=N)
  1278. T3(Resp=N)
  1279. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1280. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1281. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1282. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1283. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1284.  
  1285. # Apple Mac OS X 10.4.0 (Tiger) - Darwin Kernel Version 8.0.0
  1286. # Apple Macintosh PowerBook G4 15" Titanium, Mac OS X 10.4.0 (Tiger) build 8A428
  1287. # Mac OS X 10.4 Darwin 8.0.0 Darwin Kernel Version 8.0.0: Sat Mar 26 14:15:22 PST 2005;
  1288. # Fingerprint Apple Mac OS X 10.4.0 Build 8a428 Darwin Kernel Version 8.0.0. Power Macintosh powerpc Hardware is PB G4
  1289. # Darwin 8.1.0 Kernel Version 8.1.0 (Apple Mac OS 10.4.1 Tiger)
  1290. Fingerprint Apple Mac OS X 10.4.0 - 10.4.4 (Tiger)
  1291. Class Apple | Mac OS X | 10.4.X | general purpose
  1292. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1293. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  1294. T2(Resp=N)
  1295. T3(Resp=N)
  1296. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1297. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1298. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1299. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1300. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1301.  
  1302. Fingerprint Apple Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6
  1303. Class Apple | Mac OS | 7.X | general purpose
  1304. TSeq(Class=C|TD)
  1305. T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M)
  1306. T2(Resp=N)
  1307. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  1308. T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  1309. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  1310. T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  1311. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  1312. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1313.  
  1314. # Not really constant -- just slow incrementation
  1315. # This is an LCIII
  1316. Fingerprint Apple Mac OS 7.1
  1317. Class Apple | Mac OS | 7.X | general purpose
  1318. TSeq(Class=C)
  1319. T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M)
  1320. T2(Resp=N)
  1321. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  1322. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  1323. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1324. T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  1325. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1326. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1327.  
  1328. Fingerprint Apple Mac OS 7.5.5 - 9
  1329. Class Apple | Mac OS | 7.X | general purpose
  1330. Class Apple | Mac OS | 8.X | general purpose
  1331. Class Apple | Mac OS | 9.X | general purpose
  1332. TSeq(Class=64K)
  1333. T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1334. T2(Resp=N)
  1335. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1336. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1337. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1338. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1339. T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1340. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1341.  
  1342. Fingerprint Apple Mac OS 8 running on an LC 475
  1343. Class Apple | Mac OS | 8.X | general purpose
  1344. TSeq(Class=TR)
  1345. T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  1346. T2(Resp=N)
  1347. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  1348. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1349. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1350. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1351. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1352. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1353.  
  1354. Fingerprint Apple Mac OS 8.0
  1355. Class Apple | Mac OS | 8.X | general purpose
  1356. TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0)
  1357. T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1358. T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  1359. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1360. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1361. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1362. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1363. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1364. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1365.  
  1366. Fingerprint Apple Mac OS 8.1
  1367. Class Apple | Mac OS | 8.X | general purpose
  1368. TSeq(Class=64K)
  1369. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  1370. T2(Resp=N)
  1371. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  1372. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1373. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1374. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1375. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1376. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1377.  
  1378. Fingerprint Apple Mac OS 8.1
  1379. Class Apple | Mac OS | 8.X | general purpose
  1380. TSeq(Class=64K)
  1381. T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
  1382. T2(Resp=N)
  1383. T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
  1384. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1385. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1386. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1387. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1388. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1389.  
  1390. Fingerprint Apple Mac OS 8.1
  1391. Class Apple | Mac OS | 8.X | general purpose
  1392. TSeq(Class=64K)
  1393. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  1394. T2(Resp=N)
  1395. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  1396. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1397. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1398. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1399. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1400. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1401.  
  1402. Fingerprint Apple Mac OS 8.1 running on a PowerPC G3 (iMac)
  1403. Class Apple | Mac OS | 8.X | general purpose
  1404. TSeq(Class=64K)
  1405. T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1406. T2(Resp=N)
  1407. T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1408. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1409. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1410. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1411. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1412. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1413.  
  1414. Fingerprint Apple Mac OS 8.5
  1415. Class Apple | Mac OS | 8.X | general purpose
  1416. TSeq(Class=64K)
  1417. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1418. T2(Resp=N)
  1419. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL)
  1420. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1421. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1422. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1423. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1424.  
  1425. # on Macintosh GS server
  1426. Fingerprint Apple Mac OS 8.5.1 (Appleshare IP 6.0)
  1427. Class Apple | Mac OS | 8.X | general purpose
  1428. TSeq(Class=64K)
  1429. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1430. T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1431. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1432. T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1433. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1434. T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1435. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1436. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1437.  
  1438. Fingerprint Apple Mac OS 8.6
  1439. Class Apple | Mac OS | 8.X | general purpose
  1440. TSeq(Class=64K)
  1441. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  1442. T2(Resp=N)
  1443. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  1444. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  1445. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1446. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1447. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1448. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1449.  
  1450. # Mac OS 8.6 running WebStar http server
  1451. Fingerprint Apple Mac OS 8.6
  1452. Class Apple | Mac OS | 8.X | general purpose
  1453. TSeq(Class=64K%IPID=I%TS=U)
  1454. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1455. T2(Resp=N)
  1456. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1457. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1458. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1459. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1460. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1461. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  1462.  
  1463. Fingerprint Apple Mac OS 8.6
  1464. Class Apple | Mac OS | 8.X | general purpose
  1465. TSeq(Class=64K)
  1466. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1467. T2(Resp=N)
  1468. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1469. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1470. T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
  1471. T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
  1472. T7(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  1473. PU(Resp=N)
  1474.  
  1475. Fingerprint Apple Mac OS 8.6
  1476. Class Apple | Mac OS | 8.X | general purpose
  1477. TSeq(Class=64K%IPID=I%TS=U)
  1478. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1479. T2(Resp=N)
  1480. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1481. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1482. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1483. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1484. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1485. PU(Resp=N)
  1486.  
  1487. #  Mac OS 9 on a Power Macintosh 7200/75
  1488. # iMac running Mac OS 9.1
  1489. Fingerprint Apple Mac OS 9 - 9.1
  1490. Class Apple | Mac OS | 9.X | general purpose
  1491. TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D)
  1492. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1493. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1494. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1495. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1496. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1497. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1498. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1499. PU(Resp=N)
  1500.  
  1501. # HP-UX B.11.00
  1502. Fingerprint Apple Mac OS 9.04 or HP-UX B.11.00
  1503. Class Apple | Mac OS | 9.X | general purpose
  1504. Class HP | HP-UX | 11.X | general purpose
  1505. TSeq(Class=RI%gcd=<9%SI=>3FFF)
  1506. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1507. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1508. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1509. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1510. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1511. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1512. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1513. PU(DF=Y%TOS=0|A0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1514.  
  1515. Fingerprint Apple Mac OS 9.2.2
  1516. Class Apple | Mac OS | 9.X | general purpose
  1517. TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ)
  1518. T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
  1519. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1520. T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
  1521. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1522. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1523. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1524. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1525. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1526.  
  1527. Fingerprint Apple MacOS 9.2.2
  1528. Class Apple | Mac OS | 9.X | general purpose
  1529. TSeq(Class=RI%gcd=<6%SI=<32EA6&>111%IPID=I%TS=1000HZ)
  1530. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1531. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1532. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1533. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1534. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1535. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1536. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1537. PU(DF=Y%TOS=0|40%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1538.  
  1539. Fingerprint Apple Newton MessagePad 2100, Newton OS 2.1
  1540. Class Apple | Newton OS || PDA
  1541. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1542. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=)
  1543. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1544. T4(DF=N%W=1000%ACK=S%Flags=R%Ops=)
  1545. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1546. T6(DF=N%W=1000%ACK=S%Flags=R%Ops=)
  1547. T7(DF=N%W=1000%ACK=S%Flags=R%Ops=)
  1548. PU(Resp=N)
  1549.  
  1550. Fingerprint Arescom 800 series dsl router
  1551. Class Arescom | embedded || broadband router
  1552. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  1553. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  1554. T3(Resp=N)
  1555. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  1556. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  1557. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  1558. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  1559. PU(Resp=N)
  1560.  
  1561. Fingerprint Arescom NetDSL 1000NDS series ADSL router
  1562. Class Arescom | embedded || broadband router
  1563. TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
  1564. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  1565. T2(Resp=N)
  1566. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  1567. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  1568. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  1569. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  1570. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  1571. PU(Resp=N)
  1572.  
  1573. Fingerprint ARLAN BR2000E V5.0E Wireless Radio Bridge
  1574. Class Arlan | embedded || bridge
  1575. TSeq(Class=TR%gcd=<6)
  1576. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  1577. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  1578. T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  1579. T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  1580. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  1581. T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  1582. T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  1583. PU(Resp=N)
  1584.  
  1585. Fingerprint Asante FriendlyNet FR3004 Series Internet Hub
  1586. Class Asante | embedded || hub
  1587. TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U)
  1588. T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1589. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  1590. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1591. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  1592. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1593. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  1594. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1595. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1596.  
  1597. Fingerprint AsanteHub 2072 Ethernet hub
  1598. Class Asante | embedded || hub
  1599. TSeq(Class=C)
  1600. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1601. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1602. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1603. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1604. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1605. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1606. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1607. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1608.  
  1609. Fingerprint Asante 6524-2G GigE switch
  1610. Class Asante | embedded || switch
  1611. TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U)
  1612. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1613. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1614. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1615. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1616. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1617. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1618. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1619. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1620.  
  1621. Fingerprint Asante IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 ))
  1622. Class Asante | embedded || switch
  1623. TSeq(Class=C%Val=4090000)
  1624. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1625. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1626. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1627. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1628. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1629. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1630. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1631. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1632.  
  1633. Fingerprint Asante IntraSwitch 5324
  1634. Class Asante | embedded || switch
  1635. TSeq(Class=C%Val=80000)
  1636. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1637. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1638. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1639. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1640. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1641. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1642. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1643. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1644.  
  1645. # Asante IntraSwitch 62xx (6216M in this case) Firmware v2.05A (16-port managed switch)
  1646. Fingerprint Asante IntraSwitch 6216M firmware v2.05A
  1647. Class Asante | embedded || switch
  1648. TSeq(Class=TD%gcd=<C28C%SI=<1E%IPID=I%TS=U)
  1649. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1650. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1651. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1652. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1653. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1654. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1655. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1656. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1657.  
  1658. Fingerprint Ascend DSLPipe DSL-50S-CELL DSL router
  1659. Class Ascend | embedded || broadband router
  1660. TSeq(Class=RI%gcd=<6%SI=<671E2&>114%IPID=I%TS=U)
  1661. T1(DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
  1662. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1663. T3(Resp=Y%DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
  1664. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1665. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1666. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1667. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1668. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1669.  
  1670. Fingerprint Ascend Max 1800 50Ap8+ or 2024 router
  1671. Class Ascend | embedded || router
  1672. TSeq(Class=TD%gcd=388|710|A98%SI=<F)
  1673. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1674. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1675. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1676. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1677. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1678. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1679. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1680. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1681.  
  1682. Fingerprint Ascend P130 Router
  1683. Class Ascend | embedded || router
  1684. TSeq(Class=RI%gcd=<6%SI=>BBB&<BBBB)
  1685. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1686. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1687. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1688. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1689. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1690. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1691. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1692. PU(Resp=N)
  1693.  
  1694. Fingerprint Ascend P75 router
  1695. Class Ascend | embedded || router
  1696. TSeq(Class=RI%gcd=<6%SI=>500&<FFFF)
  1697. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1698. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1699. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1700. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1701. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1702. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1703. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1704. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1705.  
  1706. Fingerprint Ascend Pipeline 400/T1 (Software V 4.5B)
  1707. Class Ascend | embedded || router
  1708. TSeq(Class=TD%gcd=388|710|A98%SI=<FF)
  1709. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1710. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1711. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1712. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1713. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1714. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1715. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1716. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1717.  
  1718. Fingerprint Ascend Pipeline 50
  1719. Class Ascend | embedded || router
  1720. TSeq(Class=TD%gcd=<714%SI=<14)
  1721. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1722. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1723. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1724. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1725. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1726. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1727. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1728. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1729.  
  1730. Fingerprint Ascend Pipeline 50 rev 4.6C
  1731. Class Ascend | embedded || router
  1732. TSeq(Class=TD%gcd=388|710%SI=<5)
  1733. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1734. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1735. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1736. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1737. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1738. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1739. T7(Resp=N)
  1740. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1741.  
  1742. Fingerprint Ascend Pipeline 50 running 5.1A Firmware
  1743. Class Ascend | embedded || router
  1744. TSeq(Class=64K)
  1745. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1746. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1747. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1748. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1749. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1750. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1751. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1752. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1753.  
  1754. Fingerprint Ascend Pipeline P130 or 50
  1755. Class Ascend | embedded || router
  1756. TSeq(Class=TD%gcd=388|710|A98%SI=<BB)
  1757. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1758. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1759. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1760. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1761. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1762. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1763. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1764. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1765.  
  1766. Fingerprint Ascend GRF Router running Ascend Embedded/OS 2.1
  1767. Class Ascend | Embedded/OS || router
  1768. TSeq(Class=RI%gcd=<5%SI=>600)
  1769. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1770. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1771. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  1772. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1773. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1774. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1775. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1776. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1777.  
  1778. # Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash - I think meant TAOS
  1779. Fingerprint Ascend / Lucent MAX TNT terminal server
  1780. Class Ascend | TAOS || terminal server
  1781. TSeq(Class=RI%gcd=<6%SI=<14F46&>346)
  1782. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
  1783. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1784. T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
  1785. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1786. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1787. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1788. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1789. PU(Resp=N)
  1790.  
  1791. # Ascend Mac 6000 Terminal access server (dialup access server) Running TAOS 9.0.9
  1792. # Lucent (Acend) DSLMAX 20 revision 8.0.7
  1793. Fingerprint Ascend Mac 6000 Terminal access server
  1794. Class Ascend | TAOS || terminal server
  1795. TSeq(Class=RI%gcd=<6%SI=<919BA&>E5D%IPID=BI%TS=U)
  1796. T1(DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME)
  1797. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1798. T3(Resp=Y%DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME)
  1799. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1800. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1801. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1802. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1803. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1804.  
  1805. Fingerprint Ascend Max terminal server firmware 7.0.4
  1806. Class Ascend | TAOS || terminal server
  1807. TSeq(Class=RI%gcd=<6%SI=<14&>1000)
  1808. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  1809. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1810. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  1811. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1812. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1813. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1814. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1815. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1816.  
  1817. Fingerprint Ascend TNT OS +5.0Ap48+
  1818. Class Ascend | TAOS || terminal server
  1819. TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
  1820. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1821. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1822. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1823. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1824. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1825. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1826. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1827. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1828.  
  1829. Fingerprint Ascend/Lucent Max (HP,4000-6000) version 6.1.3 - 7.0.2+
  1830. Class Ascend | TAOS || terminal server
  1831. TSeq(Class=RI%gcd=<6%SI=>1000)
  1832. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  1833. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1834. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  1835. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1836. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1837. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1838. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1839. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1840.  
  1841. Fingerprint MiNT with MiNTnet 1.03 running on Atari TT
  1842. Class Atari | Atari || game console
  1843. TSeq(Class=TD%gcd=3E7%SI=0)
  1844. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  1845. T2(Resp=N)
  1846. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  1847. T4(Resp=N)
  1848. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1849. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1850. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1851. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1852.  
  1853. Fingerprint Atari Mega STE running JIS-68k 3.0
  1854. Class Atari | Atari || general purpose
  1855. TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86)
  1856. T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
  1857. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1858. T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
  1859. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1860. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1861. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1862. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1863. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1864.  
  1865. Fingerprint AtheOS ( www.atheos.cx )
  1866. Class AtheOS | AtheOS || general purpose
  1867. TSeq(Class=RI%gcd=<8%SI=<A78&>6)
  1868. T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1869. T2(Resp=N)
  1870. T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1871. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1872. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1873. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1874. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1875. PU(Resp=N)
  1876.  
  1877. Fingerprint AtheOS/Syllable 0.4.2
  1878. Class AtheOS | AtheOS || general purpose
  1879. TSeq(Class=RI%gcd=<A%SI=<1BDA%IPID=I%TS=U)
  1880. T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1881. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1882. T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1883. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1884. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1885. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1886. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1887. PU(Resp=N)
  1888.  
  1889. # Audio Codes MP-104 - VoIP Gateway FXO (version 4.0.282.350)
  1890. Fingerprint AudioCodes MP-104 VoIP Gateway FXO
  1891. Class AudioCodes | embedded || VoIP gateway
  1892. TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
  1893. T1(DF=N%W=20F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  1894. T2(Resp=N)
  1895. T3(Resp=Y%DF=N%W=20F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  1896. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1897. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1898. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1899. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1900. PU(Resp=N)
  1901.  
  1902. # AudioCodes MP-108 FXS (iptele gateway) version: 4.40.162.274
  1903. Fingerprint AudioCodes MP-108 VoIP Gateway FXS
  1904. Class AudioCodes | embedded || VoIP gateway
  1905. TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
  1906. T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  1907. T2(Resp=N)
  1908. T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  1909. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1910. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1911. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1912. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1913. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1914.  
  1915. Fingerprint Auspex Fileserver (AuspexOS 1.9.1/SunOS 4.1.4)
  1916. Class Auspex | AuspexOS || fileserver
  1917. TSeq(Class=64K)
  1918. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  1919. T2(Resp=N)
  1920. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  1921. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  1922. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1923. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1924. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1925. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1926.  
  1927. Fingerprint Avaya G3 PBX version 8.3
  1928. Class Avaya | embedded || PBX
  1929. TSeq(Class=RI%gcd=<6%SI=<652372&>89CC%IPID=I%TS=U)
  1930. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  1931. T2(Resp=N)
  1932. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  1933. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1934. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1935. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1936. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1937. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  1938.  
  1939. Fingerprint Avaya IP Office 403 PBX
  1940. Class Avaya | embedded || PBX
  1941. TSeq(Class=RI%gcd=<6%SI=<2B46872&>6EC4D%IPID=Z%TS=100HZ)
  1942. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  1943. T2(Resp=Y%DF=N%W=1111%ACK=S++%Flags=R%Ops=)
  1944. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  1945. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1946. T5(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
  1947. T6(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
  1948. T7(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
  1949. PU(Resp=N)
  1950.  
  1951. # Avaya TN2302 Prowler/Medpro H.323 gateway HW03/FW022
  1952. Fingerprint Avaya TN2302 Prowler/Medpro H.323 gateway
  1953. Class Avaya | embedded || telecom-misc
  1954. TSeq(Class=TD%gcd=<6%SI=<14%IPID=I)
  1955. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1956. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1957. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1958. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1959. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1960. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1961. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1962. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1963.  
  1964. Fingerprint Avocent net KVM switch
  1965. Class Avocent | embedded || specialized
  1966. TSeq(Class=TR|RI|i800%gcd=<2004%SI=<40D8%IPID=I%TS=1000HZ)
  1967. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1968. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1969. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1970. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1971. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1972. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1973. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1974. PU(Resp=N)
  1975.  
  1976. Fingerprint Avocent CPS 1610 serial port server
  1977. Class Avocent | embedded || terminal server
  1978. TSeq(Class=RI%gcd=<14004%SI=<10C2%IPID=I%TS=1000HZ)
  1979. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1980. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1981. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1982. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1983. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1984. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1985. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1986. PU(Resp=N)
  1987.  
  1988. Fingerprint Axent Raptor Firewall running on Windows NT
  1989. Class Axent | Windows | NT/2K/XP | firewall
  1990. TSeq(Class=TR)
  1991. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  1992. T2(Resp=N)
  1993. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  1994. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1995. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1996. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1997. T7(Resp=N)
  1998. PU(Resp=N)
  1999.  
  2000. # Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
  2001. Fingerprint AXIS or Meridian Data Network CD-ROM server
  2002. Class AXIS | embedded || fileserver
  2003. TSeq(Class=C)
  2004. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  2005. T2(Resp=N)
  2006. T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
  2007. T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
  2008. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2009. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2010. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2011. PU(Resp=N)
  2012.  
  2013. # AXIS NetEye Camera Server V1.20
  2014. # AXIS NPS 53X Printer Server V4.26 Jul 01 1995
  2015. # AXIS StorPoint CD-ROM server V 4.20
  2016. # AXIS Camera 200pV1.41
  2017. Fingerprint AXIS Stack -- CD-ROM server or print server or camera server
  2018. Class AXIS | embedded || fileserver
  2019. Class AXIS | embedded || print server
  2020. Class AXIS | embedded || webcam
  2021. TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5)
  2022. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  2023. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2024. T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
  2025. T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
  2026. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2027. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2028. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2029. PU(Resp=N)
  2030.  
  2031. # AXIS StorPoint CD E100 CD-ROM Server V5.32 Jan 19 2001
  2032. Fingerprint AXIS StorPoint CD E100 CD-ROM Server
  2033. Class AXIS | embedded || fileserver
  2034. TSeq(Class=TD%gcd=<80004%SI=<14%IPID=I%TS=U)
  2035. T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
  2036. T2(Resp=N)
  2037. T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
  2038. T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
  2039. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2040. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2041. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2042. PU(Resp=N)
  2043.  
  2044. # AXIS StorPoint CD E100 CD-ROM Server V5.20 Oct 27 1999
  2045. Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.20
  2046. Class AXIS | embedded || fileserver
  2047. TSeq(Class=C%Val=4B80000%IPID=I%TS=U)
  2048. T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
  2049. T2(Resp=N)
  2050. T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
  2051. T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
  2052. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2053. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2054. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2055. PU(Resp=N)
  2056.  
  2057. # AXIS StorPoint CD E100 CD-ROM Server V5.38 Jan 12 2004
  2058. Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.38
  2059. Class AXIS | embedded || fileserver
  2060. TSeq(Class=C%Val=30D40000%IPID=I%TS=U)
  2061. T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
  2062. T2(Resp=N)
  2063. T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
  2064. T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
  2065. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2066. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2067. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2068. PU(Resp=N)
  2069.  
  2070. Fingerprint AXIS 540 Ethernet Print Server ver 5.48
  2071. Class AXIS | embedded || print server
  2072. TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
  2073. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2074. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2075. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2076. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2077. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2078. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2079. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2080. PU(Resp=N)
  2081.  
  2082. Fingerprint AXIS 540 Print Server
  2083. Class AXIS | embedded || print server
  2084. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2085. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2086. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2087. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2088. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2089. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2090. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2091. PU(Resp=N)
  2092.  
  2093. # AXIS 540/542 print server v5.30 Jan 24 1997
  2094. Fingerprint AXIS 540/542 Print Server v5.30
  2095. Class AXIS | embedded || print server
  2096. TSeq(Class=C)
  2097. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2098. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2099. T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=)
  2100. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2101. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2102. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2103. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2104. PU(Resp=N)
  2105.  
  2106. Fingerprint AXIS Print Server firmware 7.0.2
  2107. Class AXIS | embedded || print server
  2108. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2109. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME)
  2110. T2(Resp=N)
  2111. T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=)
  2112. T4(DF=N%W=100%ACK=O%Flags=R%Ops=)
  2113. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2114. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2115. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2116. PU(Resp=N)
  2117.  
  2118. Fingerprint AXIS 200+ Web Camera running OS v1.42
  2119. Class AXIS | embedded || webcam
  2120. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME)
  2121. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2122. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2123. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2124. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2125. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2126. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2127.  
  2128. Fingerprint AXIS 2120 network camera
  2129. Class AXIS | embedded || webcam
  2130. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2131. T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
  2132. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
  2133. T3(Resp=Y%DF=N%W=3FE0%ACK=S++%Flags=ASF%Ops=ME)
  2134. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  2135. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2136. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  2137. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  2138. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2139.  
  2140. # AXIS 200+ Webcam running software version is 1.42
  2141. Fingerprint AXIS Neteye 200+ Webcam running software version 1.42
  2142. Class AXIS | embedded || webcam
  2143. TSeq(Class=TD|C%gcd=<80004%SI=<1E%Val=DFB80000%IPID=RD|I%TS=U)
  2144. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ME)
  2145. T2(Resp=N)
  2146. T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
  2147. T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
  2148. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2149. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2150. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2151. PU(Resp=N)
  2152.  
  2153. Fingerprint AXIS NetEye Camera Server V1.20
  2154. Class AXIS | embedded || webcam
  2155. TSeq(Class=C)
  2156. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  2157. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2158. T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
  2159. T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
  2160. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2161. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2162. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2163. PU(Resp=N)
  2164.  
  2165. # AXIS 540+/542+
  2166. # AXIS 5400 print server
  2167. Fingerprint AXIS Network Print Server
  2168. Class AXIS | Linux || print server
  2169. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  2170. T2(Resp=N)
  2171. T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=)
  2172. T4(DF=N%W=100%ACK=O%Flags=R%Ops=)
  2173. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2174. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2175. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2176. PU(Resp=N)
  2177.  
  2178. # The AXIS 2100 Network Camera Operating System, Linux/CRIS, is based on the Linux 2.0 kernel with non-MMU CPU patches from uClinux. The HTTP server used is based on Boa. The source code for the Linux/CRIS kernel, Boa and more is available at http://developer.axis.com/.
  2179. Fingerprint AXIS 2100 Network Camera running Linux/CRIS v2.32
  2180. Class AXIS | Linux || webcam
  2181. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2182. T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
  2183. T2(Resp=N)
  2184. T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
  2185. T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  2186. T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
  2187. T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  2188. T7(Resp=N)
  2189. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2190.  
  2191. Fingerprint Barix Exstreamer network MP3 player
  2192. Class Barix | embedded || media device
  2193. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2194. T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
  2195. T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2196. T3(Resp=Y%DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
  2197. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2198. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2199. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2200. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2201. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2202.  
  2203. # Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99)
  2204. # Bay Networks ASN Processor revision 9, SE100NM and SFNM modules
  2205. Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9
  2206. Class Bay Networks | embedded || router
  2207. T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW)
  2208. T2(Resp=N)
  2209. T3(Resp=N)
  2210. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2211. T5(Resp=N)
  2212. T6(Resp=N)
  2213. T7(Resp=N)
  2214. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2215.  
  2216. Fingerprint Bay Networks Instant Internet router
  2217. Class Bay Networks | embedded || router
  2218. TSeq(Class=TD%gcd=1000|2000|3000%SI=<BB)
  2219. T1(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
  2220. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2221. T3(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
  2222. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2223. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2224. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2225. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2226. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  2227.  
  2228. Fingerprint Bay Networks Instant Internet router
  2229. Class Bay Networks | embedded || router
  2230. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  2231. T1(Resp=N)
  2232. T2(Resp=N)
  2233. T3(Resp=N)
  2234. T4(Resp=N)
  2235. T5(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2236. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2237. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2238. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2239.  
  2240. Fingerprint Baystack Instant Internet 400 SoHo Router
  2241. Class Bay Networks | embedded || router
  2242. TSeq(Class=RI%gcd=<24%SI=<4D33C&>C46)
  2243. T1(Resp=N)
  2244. T2(Resp=N)
  2245. T3(Resp=N)
  2246. T4(Resp=N)
  2247. T5(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2248. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2249. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2250. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2251.  
  2252. Fingerprint Bay Networks BayStack 310T switch
  2253. Class Bay Networks | embedded || switch
  2254. TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=<F)
  2255. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2256. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2257. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2258. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2259. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2260. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2261. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2262. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2263.  
  2264. Fingerprint BayStack 28115/ADV Fast Ethernet Switch
  2265. Class Bay Networks | embedded || switch
  2266. TSeq(Class=TD%gcd=<6%SI=<FF)
  2267. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  2268. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2269. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2270. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2271. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2272. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2273. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2274. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2275.  
  2276. # Fingerprint BayStack 450-24T HW:RevL  FW:V1.47 SW:v3.1.0.22  ISVN:1
  2277. Fingerprint BayStack 450-24T switch
  2278. Class Bay Networks | embedded || switch
  2279. TSeq(Class=TD%gcd=<1F8%SI=<50%IPID=I%TS=U)
  2280. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2281. T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  2282. T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  2283. T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  2284. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2285. T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
  2286. T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  2287. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2288.  
  2289. # BayTech RPC4 with Network Module (Data Switch Series - F3.03 (C)2000 DS72C808 Bay Technical Associates DS72)
  2290. # BayTech rpc3-15NC Remote Power Control device
  2291. Fingerprint BayTech Remote Power Control RPC3-15NC or RPC4
  2292. Class BayTech | embedded || power-device
  2293. TSeq(Class=TD|RI%gcd=<C%SI=<4272&>95%IPID=I|RD%TS=U)
  2294. T1(Resp=N)
  2295. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=ARF%Ops=)
  2296. T3(Resp=N)
  2297. T4(DF=N%W=800|1000%ACK=S%Flags=ARF%Ops=)
  2298. T5(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=)
  2299. T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=)
  2300. T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  2301. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2302.  
  2303. Fingerprint BBIagent v1.8.1 software router
  2304. Class BBIagent | Linux | 2.4.X | software router
  2305. TSeq(Class=RI%gcd=<6%SI=<18C54&>3B8%IPID=I)
  2306. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  2307. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2308. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  2309. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2310. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2311. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2312. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2313. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2314.  
  2315. # Running on a BeBox 66Mhz
  2316. Fingerprint BeOS 4 - 4.5
  2317. Class Be | BeOS | 4.X | general purpose
  2318. TSeq(Class=TD%gcd=1%SI=0)
  2319. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  2320. T2(Resp=N)
  2321. T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  2322. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  2323. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2324. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2325. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2326. PU(Resp=N)
  2327.  
  2328. Fingerprint BeOS 5.0.4 (BeOS 5 Pro + BONE 7a)
  2329. Class Be | BeOS | 5.X | general purpose
  2330. TSeq(Class=TD%gcd=<6%SI=<C8%IPID=I%TS=U)
  2331. T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  2332. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2333. T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  2334. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2335. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2336. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2337. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2338. PU(Resp=N)
  2339.  
  2340. Fingerprint BeOS 5.03 x86 with the BONE network stack
  2341. Class Be | BeOS | 5.X | general purpose
  2342. TSeq(Class=RI%gcd=<6%SI=<141E&>1F%IPID=I%TS=U)
  2343. T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  2344. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2345. T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  2346. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2347. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2348. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2349. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2350. PU(Resp=N)
  2351.  
  2352. Fingerprint BeOS 5.1d0/DANO on x86
  2353. Class Be | BeOS | 5.X | general purpose
  2354. TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U)
  2355. T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  2356. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2357. T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  2358. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2359. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2360. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2361. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2362. PU(Resp=N)
  2363.  
  2364. Fingerprint BeOS R5.03 Personal Edition
  2365. Class Be | BeOS | 5.X | general purpose
  2366. TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U)
  2367. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  2368. T2(Resp=N)
  2369. T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  2370. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  2371. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2372. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2373. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2374. PU(Resp=N)
  2375.  
  2376. # IPC@CHIP (SC12) -@CHIP-RTOS version SC12 V1.10 Beta Test version MEDIUMBuild: Nov 26 2003
  2377. Fingerprint IPC@CHIP CHIP-RTOS version SC12
  2378. Class Beck-IPC | embedded || specialized
  2379. TSeq(Class=TD%gcd=<C354%SI=<28%IPID=I%TS=1000HZ)
  2380. T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  2381. T2(Resp=N)
  2382. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2383. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2384. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2385. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2386. T7(Resp=N)
  2387. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2388.  
  2389. # Belkin DSL/Cable Router running firmware v1.03.08
  2390. Fingerprint Belkin DSL/Cable Router
  2391. Class Belkin | embedded || broadband router
  2392. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  2393. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  2394. T2(Resp=N)
  2395. T3(Resp=N)
  2396. T4(Resp=N)
  2397. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2398. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2399. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2400. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2401.  
  2402. # Plan9 x86 (2004.11.06)
  2403. # Plan 9 4th edition on x86
  2404. Fingerprint Bell Labs Plan9 Fourth Edition
  2405. Class Bell Labs | Plan9 || general purpose
  2406. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2407. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MWN)
  2408. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2409. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MWN)
  2410. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2411. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2412. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2413. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2414. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  2415.  
  2416. Fingerprint Bell Labs Plan9 Fourth Edition (x86)
  2417. Class Bell Labs | Plan9 || general purpose
  2418. TSeq(Class=TR%gcd=<6)
  2419. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  2420. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2421. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  2422. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2423. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2424. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2425. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2426. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2427.  
  2428. Fingerprint Bell Labs Plan9 Second Edition
  2429. Class Bell Labs | Plan9 || general purpose
  2430. TSeq(Class=TR)
  2431. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  2432. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2433. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  2434. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2435. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2436. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2437. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2438. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2439.  
  2440. Fingerprint BenQ Wireless Lan Router AWL700
  2441. Class BenQ | embedded || WAP
  2442. TSeq(Class=TD%gcd=<34%SI=<14%IPID=I%TS=U)
  2443. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  2444. T2(Resp=N)
  2445. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  2446. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2447. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2448. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2449. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2450. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2451.  
  2452. # Billion ADSL Router BIPAC 711CE
  2453. Fingerprint Billion ADSL router
  2454. Class Billion | embedded || broadband router
  2455. TSeq(Class=RI%gcd=<6%SI=<1315F78&>306D3%IPID=Z)
  2456. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
  2457. T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  2458. T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  2459. T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  2460. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2461. T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  2462. T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  2463. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2464.  
  2465. # Billion BIPAC-741GE V2 ADSL Router/Modem - Firmware 4.55 (HW: Helium 210-80 ADSL GE-A v1.00)
  2466. Fingerprint Billion BIPAC-741GE V2 aDSL Router
  2467. Class Billion | embedded || broadband router
  2468. TSeq(Class=RI%gcd=<6%SI=<DF2A&>137%IPID=I%TS=U)
  2469. T1(DF=Y%W=1194%ACK=S++%Flags=AS%Ops=ME)
  2470. T2(Resp=Y%DF=Y%W=1194%ACK=O%Flags=R%Ops=)
  2471. T3(Resp=N)
  2472. T4(DF=Y%W=1194%ACK=O%Flags=R%Ops=)
  2473. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2474. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2475. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2476. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2477.  
  2478. # BIANCA/BRICK-XS version V.6.2 Rev. 5 from 2003/05/26 00:00:00
  2479. Fingerprint BinTEC BIANCA/BRIK-XS Broadband router V. 6.X
  2480. Class BinTec | embedded || broadband router
  2481. TSeq(Class=RI%gcd=<6%SI=<54E5C&>C09%IPID=I%TS=U)
  2482. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2483. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2484. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2485. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2486. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2487. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2488. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2489. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2490.  
  2491. # BINTEC-X4000 version V.7.1 Rev. 4 (Patch 3) IPSec
  2492. # BinTec BingoDSL Router Firmware version 7.1 Rev.1 Patch 11
  2493. Fingerprint BinTec BingoDSL/X4000 Router Firmware V. 7.1
  2494. Class BinTec | embedded || broadband router
  2495. TSeq(Class=RI%gcd=<8%SI=<240E&>1A%IPID=I%TS=U)
  2496. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2497. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2498. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2499. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2500. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2501. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2502. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2503. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2504.  
  2505. # XS SW Release 4.9.1 ISDN access router
  2506. # BinTec BIANCA XM OS version 4.93
  2507. Fingerprint BinTec XS/XM ISDN access router V. 4.9.1-4.9.3
  2508. Class BinTec | embedded || broadband router
  2509. TSeq(Class=RI%gcd=<6%SI=>FF&<FFF)
  2510. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2511. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2512. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2513. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2514. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2515. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2516. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2517. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=0%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2518.  
  2519. # VPN Access 25 version V.7.1 Rev. 12
  2520. Fingerprint VPN Access 25 version V. 7.1
  2521. Class BinTec | embedded || broadband router
  2522. TSeq(Class=TD%gcd=<6%SI=<1E%TS=U)
  2523. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=|M)
  2524. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2525. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2526. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2527. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2528. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2529. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2530. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2531.  
  2532. Fingerprint Blue Coat Security Proxy Appliance
  2533. Class Blue Coat | embedded || web proxy
  2534. TSeq(Class=RI%gcd=<6%SI=<A4704&>780%IPID=I%TS=2HZ)
  2535. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2536. T2(Resp=N)
  2537. T3(Resp=N)
  2538. T4(Resp=N)
  2539. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2540. T6(Resp=N)
  2541. T7(Resp=N)
  2542. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2543.  
  2544. # Blue Coat SG6000 Series - SGOS 3.2.2.1
  2545. Fingerprint Blue Coat ProxySG (SGOS 3.2.2.1)
  2546. Class Blue Coat | SGOS || web proxy
  2547. TSeq(Class=RI%gcd=<6%SI=<43F10C&>4CBD%TS=2HZ)
  2548. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2549. T2(Resp=N)
  2550. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2551. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2552. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2553. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2554. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2555. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2556.  
  2557. # Blue Coat SGOS 2.0.09 (Release ID: 20047)
  2558. # Blue Coat SGOS 3.0.1.0 (Release ID: 20069)
  2559. Fingerprint Blue Coat Secure Gateway
  2560. Class Blue Coat | SGOS || web proxy
  2561. TSeq(Class=RI%gcd=<6%SI=<15654E&>1CC9%IPID=I%TS=2HZ)
  2562. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT)
  2563. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2564. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT)
  2565. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2566. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2567. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2568. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2569. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2570.  
  2571. Fingerprint BlueCoat SG4
  2572. Class Blue Coat | SGOS || web proxy
  2573. T1(DF=N%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MENWNNT)
  2574. T2(Resp=N)
  2575. T3(Resp=N)
  2576. T4(Resp=N)
  2577. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2578. T6(Resp=N)
  2579. T7(Resp=N)
  2580. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2581.  
  2582. Fingerprint Borderware 5.0 Firewall
  2583. Class Borderware | embedded || firewall
  2584. TSeq(Class=TR|RI%gcd=<204%SI=<14)
  2585. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  2586. T2(Resp=N)
  2587. T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
  2588. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2589. T5(Resp=N)
  2590. T6(Resp=N)
  2591. T7(Resp=N)
  2592. PU(Resp=N)
  2593.  
  2594. Fingerprint Borderware 5.2 firewall
  2595. Class Borderware | embedded || firewall
  2596. TSeq(Class=TR%gcd=<6)
  2597. T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
  2598. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  2599. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  2600. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  2601. T5(Resp=N)
  2602. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  2603. T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  2604. PU(Resp=N)
  2605.  
  2606. Fingerprint Borderware 6.0.2 firewall
  2607. Class Borderware | embedded || firewall
  2608. TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C)
  2609. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2610. T2(Resp=N)
  2611. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2612. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2613. T5(Resp=N)
  2614. T6(Resp=N)
  2615. T7(Resp=N)
  2616. PU(Resp=N)
  2617.  
  2618. Fingerprint Bosch Security Systems's Divar Digital Video Recorder Version 2.00
  2619. Class Bosch | embedded || webcam
  2620. TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
  2621. T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  2622. T2(Resp=N)
  2623. T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  2624. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2625. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2626. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2627. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2628. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2629.  
  2630. Fingerprint BreezeCOM BreezeACCESS Wireless bridge
  2631. Class BreezeCOM | embedded || bridge
  2632. TSeq(Class=RI%gcd=<6%SI=<988&>4%IPID=I%TS=U)
  2633. T1(DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=)
  2634. T2(Resp=N)
  2635. T3(Resp=Y%DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=)
  2636. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2637. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2638. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2639. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2640. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2641.  
  2642. # http://www.brixnetworks.com/products/brix1000.html
  2643. Fingerprint Brix 1000 Verifier
  2644. Class Brix Networks | embedded || specialized
  2645. TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U)
  2646. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  2647. T2(Resp=N)
  2648. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  2649. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2650. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2651. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2652. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2653. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2654.  
  2655. # Brother Laser Printer HL 1230
  2656. Fingerprint Brother HL-1230 Printer
  2657. Class Brother | embedded || printer
  2658. TSeq(Class=TD%gcd=<DC004%SI=<14%IPID=I%TS=U)
  2659. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  2660. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2661. T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  2662. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2663. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2664. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2665. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2666. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2667.  
  2668. # Brother HL-2070N Printer Firmware Ver.1.03 (04.11.18)
  2669. Fingerprint Brother HL-2070N Printer
  2670. Class Brother | embedded || printer
  2671. TSeq(Class=RI%gcd=<6%SI=<1C67888&>48B5D%IPID=I%TS=U)
  2672. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME)
  2673. T2(Resp=N)
  2674. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME)
  2675. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2676. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2677. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2678. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2679. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  2680.  
  2681. Fingerprint BSDI BSD/OS 2.0 - 2.1
  2682. Class BSDI | BSD/OS | 2.X | general purpose
  2683. TSeq(Class=RI%gcd=<6%SI=>FFF)
  2684. T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  2685. T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2686. T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT)
  2687. T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=)
  2688. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2689. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2690. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2691. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2692.  
  2693. Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD)
  2694. Class BSDI | BSD/OS | 3.X | general purpose
  2695. TSeq(Class=RI%gcd=<6)
  2696. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2697. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2698. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  2699. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2700. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2701. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2702. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2703. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2704.  
  2705. Fingerprint BSDI BSD/OS 4.0-4.0.1
  2706. Class BSDI | BSD/OS | 4.X | general purpose
  2707. TSeq(Class=RI%gcd=<A%SI=<1974A&>16F)
  2708. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2709. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2710. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2711. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2712. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2713. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2714. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2715. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  2716.  
  2717. Fingerprint BSDI BSD/OS 4.0.1
  2718. Class BSDI | BSD/OS | 4.X | general purpose
  2719. TSeq(Class=RI%gcd=<6%SI=<F85E8&>27A9)
  2720. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2721. T2(Resp=N)
  2722. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2723. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2724. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2725. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2726. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2727. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  2728.  
  2729. Fingerprint BSDI BSD/OS 4.2
  2730. Class BSDI | BSD/OS | 4.X | general purpose
  2731. TSeq(Class=RI%gcd=<6%SI=<F3E94&>1A4F%IPID=I%TS=2HZ)
  2732. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  2733. T2(Resp=N)
  2734. T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  2735. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2736. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2737. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2738. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2739. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2740.  
  2741. Fingerprint Cabletron Smart Switch Router 8600
  2742. Class Cabletron | embedded || router
  2743. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2744. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2745. T3(Resp=N)
  2746. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2747. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2748. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2749. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2750. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  2751.  
  2752. Fingerprint Cabletron Systems SSR 8000 smart switch router System Software, Version 3.1.B.16
  2753. Class Cabletron | embedded || router
  2754. TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715)
  2755. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2756. T2(Resp=N)
  2757. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2758. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2759. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2760. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2761. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2762. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2763.  
  2764. # Cabletron SmartSwitch, Hardware Revision: 00R, Firmware Revision: 05.00.48, BOOTPROM Revision: 02.02.00
  2765. Fingerprint Cabletron SmartSwitch
  2766. Class Cabletron | embedded || switch
  2767. TSeq(Class=TD%gcd=<180004%SI=<1E%IPID=I%TS=U)
  2768. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2769. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2770. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2771. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2772. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2773. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2774. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2775. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2776.  
  2777. # Cabletron Switch model 6H202-24 Module Hardware Revision: 00A Module Firmware Revision: 05.05.11 Module BootPROM Revision: +03.06.04
  2778. Fingerprint Cabletron switch
  2779. Class Cabletron | embedded || switch
  2780. TSeq(Class=RI|TD%gcd=<404%SI=<263E%IPID=I%TS=U)
  2781. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2782. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2783. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2784. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2785. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2786. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2787. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2788. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2789.  
  2790. Fingerprint CacheFlow 6000 web proxy cache running CacheOS 4.1.05
  2791. Class CacheFlow | CacheOS || web proxy
  2792. TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U)
  2793. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  2794. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2795. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2796. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2797. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2798. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2799. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2800. PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  2801.  
  2802. # (rel. ID: 17908)
  2803. Fingerprint CacheFlow 6000 web proxy running Security Gateway 2.1.0
  2804. Class CacheFlow | CacheOS || web proxy
  2805. TSeq(Class=RI%gcd=<6%SI=<CB91C&>15C0%IPID=I%TS=2HZ)
  2806. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2807. T2(Resp=N)
  2808. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2809. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2810. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2811. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2812. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2813. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2814.  
  2815. Fingerprint Cacheflow 6x5 web proxy cache running CacheOS 3.1.19-4.1.05
  2816. Class CacheFlow | CacheOS || web proxy
  2817. TSeq(Class=RI%gcd=<6%SI=<CF3F0&>16F5%IPID=I%TS=2HZ)
  2818. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  2819. T2(Resp=N)
  2820. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  2821. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2822. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2823. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2824. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2825. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2826.  
  2827. # CacheFlow CacheOS (CacheFlow 500-5000 web cache) CFOS 2.1.08 - 2.2.1
  2828. Fingerprint CacheFlow CacheOS (web proxy cache) CFOS 2.1.08 - 2.2.1
  2829. Class CacheFlow | CacheOS || web proxy
  2830. TSeq(Class=RI%gcd=<5%SI=>BBBB&<FFFFF)
  2831. T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  2832. T2(Resp=N)
  2833. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
  2834. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  2835. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2836. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2837. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2838. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2839.  
  2840. Fingerprint CacheFlow CacheOS 3.1 on a model 6000 web proxy cache
  2841. Class CacheFlow | CacheOS || web proxy
  2842. TSeq(Class=RI%gcd=<6%SI=<6DE6416&>1C6E5%IPID=RPI%TS=2HZ)
  2843. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  2844. T2(Resp=N)
  2845. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  2846. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2847. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2848. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2849. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2850. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2851.  
  2852. Fingerprint CacheOS (CacheFlow 2000 proxy cache)
  2853. Class CacheFlow | CacheOS || web proxy
  2854. TSeq(Class=RI%gcd=<5%SI=>1111)
  2855. T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M)
  2856. T2(Resp=N)
  2857. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
  2858. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  2859. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2860. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2861. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2862. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2863.  
  2864. Fingerprint Canon GP 160 PF printer
  2865. Class Canon | embedded || printer
  2866. TSeq(Class=TD%gcd=<C04%SI=<1E%IPID=I%TS=U)
  2867. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  2868. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  2869. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  2870. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  2871. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2872. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  2873. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  2874. PU(Resp=N)
  2875.  
  2876. Fingerprint Canon iR 2200 printer
  2877. Class Canon | embedded || printer
  2878. TSeq(Class=64K%IPID=I%TS=U)
  2879. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2880. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  2881. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  2882. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  2883. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2884. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  2885. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  2886. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2887.  
  2888. # Canon Image Runner C3200
  2889. Fingerprint Canon iR C3200 printer
  2890. Class Canon | embedded || printer
  2891. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  2892. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2893. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  2894. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  2895. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2896. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2897. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2898. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2899.  
  2900. # Canon imageRunner iR2270 printer
  2901. Fingerprint Canon iR2270 printer
  2902. Class Canon | embedded || printer
  2903. TSeq(Class=RI%gcd=<6%SI=<977D4&>5EC%IPID=I%TS=2HZ)
  2904. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2905. T2(Resp=N)
  2906. T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT)
  2907. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2908. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2909. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2910. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2911. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2912.  
  2913. Fingerprint Canon iR6000 printer
  2914. Class Canon | embedded || printer
  2915. TSeq(Class=64K%IPID=I%TS=U)
  2916. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
  2917. T2(Resp=N)
  2918. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  2919. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2920. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2921. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2922. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2923. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2924.  
  2925. Fingerprint Canon iR7200 Printer
  2926. Class Canon | embedded || printer
  2927. TSeq(Class=64K%IPID=I%TS=U)
  2928. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2929. T2(Resp=N)
  2930. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  2931. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2932. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2933. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2934. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2935. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2936.  
  2937. Fingerprint Canon photocopier/fax/scanner/printer GP30F
  2938. Class Canon | embedded || printer
  2939. TSeq(Class=TD%gcd=600%SI=0)
  2940. T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  2941. T2(Resp=N)
  2942. T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=)
  2943. T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=)
  2944. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2945. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2946. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2947. PU(Resp=N)
  2948.  
  2949. # Canon inkjet printer iP4000R with Wireless interface
  2950. Fingerprint Canon Pixmar IP4000R printer
  2951. Class Canon | embedded || printer
  2952. TSeq(Class=TD%gcd=<20004%SI=<1E%IPID=I%TS=U)
  2953. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  2954. T2(Resp=N)
  2955. T3(Resp=Y%DF=N%W=2000%ACK=S++|O%Flags=AS|A%Ops=M|)
  2956. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  2957. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2958. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2959. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2960. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2961.  
  2962. Fingerprint Capellix 3000 Modular SAN Switch
  2963. Class Capellix | embedded || storage-misc
  2964. TSeq(Class=64K%IPID=I%TS=U)
  2965. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2966. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  2967. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  2968. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  2969. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2970. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2971. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2972. PU(Resp=N)
  2973.  
  2974. Fingerprint CastleNet AR502/GlobespanVirata GS8100 (same thing) DSL router
  2975. Class CastleNet | embedded || broadband router
  2976. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2977. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  2978. T2(Resp=N)
  2979. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  2980. T4(Resp=N)
  2981. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  2982. T6(Resp=N)
  2983. T7(Resp=N)
  2984. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2985.  
  2986. # http://www.cayman.com/
  2987. Fingerprint Cayman 2E DSL/CABLE router
  2988. Class Cayman | embedded || broadband router
  2989. TSeq(Class=TR%gcd=<6)
  2990. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  2991. T2(Resp=N)
  2992. T3(Resp=N)
  2993. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2994. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2995. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2996. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2997. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2998.  
  2999. Fingerprint Cayman 3000 DSL Router
  3000. Class Cayman | embedded || broadband router
  3001. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  3002. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3003. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  3004. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3005. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3006. T6(Resp=N)
  3007. T7(Resp=N)
  3008. PU(Resp=N)
  3009.  
  3010. Fingerprint Netopia Cayman 3346 DSL router
  3011. Class Cayman | embedded || broadband router
  3012. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3013. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3014. T2(Resp=N)
  3015. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3016. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3017. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3018. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3019. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3020. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3021.  
  3022. Fingerprint Chase IOLan Terminal Server
  3023. Class Chase | embedded || terminal server
  3024. T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3025. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3026. T3(Resp=N)
  3027. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3028. T5(Resp=N)
  3029. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3030. T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  3031. PU(Resp=N)
  3032.  
  3033. #  Chase/Perle IOLAN Terminal Server v3.5.02 CDi
  3034. Fingerprint Chase/Perle IOLAN Terminal Server
  3035. Class Chase | embedded || terminal server
  3036. TSeq(Class=TD%gcd=<84%SI=<1E)
  3037. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=)
  3038. T2(Resp=N)
  3039. T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
  3040. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3041. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3042. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3043. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3044. PU(Resp=N)
  3045.  
  3046. # These boxes give goofy PU RIPTL results (like 3549 and 4801) so I removed
  3047. # that test
  3048. Fingerprint Chase/Perle IOLAN terminal server
  3049. Class Chase | embedded || terminal server
  3050. TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U)
  3051. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=|M)
  3052. T2(Resp=N)
  3053. T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
  3054. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3055. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3056. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3057. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3058. PU(DF=N%TOS=0%IPLEN=38%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3059.  
  3060. # Nokia IPSO 3.2 Running Checkpoint Firewall-1
  3061. # IPSO 3.5-FCS8 releng 1020  Running Checkpoint FW-1 NG FP2
  3062. Fingerprint Nokia IPSO 3.2-3.5 Running Checkpoint Firewall-1 or NG FP2
  3063. Class Checkpoint | IPSO || firewall
  3064. TSeq(Class=RI%gcd=<6%SI=<E4656&>2476)
  3065. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  3066. T2(Resp=N)
  3067. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  3068. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  3069. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3070. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3071. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3072. PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)
  3073.  
  3074. # Nokia IPSO 3.2-3.2.1 releng 783-849
  3075. # IPSO 3.4-FCS4A releng 767  Running CheckPoint 4.1 SP6
  3076. # Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based)
  3077. # Nokia IPSO 4.3.1-FCS5
  3078. Fingerprint Nokia IPSO 3.2-4.3.1-FCS5 Running checkpoint FW1
  3079. Class Checkpoint | IPSO || firewall
  3080. TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319)
  3081. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  3082. T2(Resp=N)
  3083. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  3084. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  3085. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3086. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3087. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3088. PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  3089.  
  3090. # Nokia IPSO 3.6 FCS 6 releng 1061  01.21.2003-230310 i386 w/ CheckPoint FW-1 NG FP 2, SSL & DNS hotfix and SmartDefense Supplemental
  3091. Fingerprint Nokia IPSO 3.6 running CheckPoint FW-1 NG FP2
  3092. Class Checkpoint | IPSO || firewall
  3093. TSeq(Class=RI%gcd=<6%SI=<7A148&>A01%IPID=I%TS=2HZ)
  3094. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3095. T2(Resp=N)
  3096. T3(Resp=N)
  3097. T4(Resp=N)
  3098. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3099. T6(Resp=N)
  3100. T7(Resp=N)
  3101. PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3102.  
  3103. Fingerprint Checkpoint Firewall-1 NG on Sun Solaris 8
  3104. Class Checkpoint | Solaris | 8 | firewall
  3105. TSeq(Class=RI%gcd=<6%SI=<6C82C&>E51%IPID=I%TS=100HZ)
  3106. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  3107. T2(Resp=N)
  3108. T3(Resp=N)
  3109. T4(Resp=N)
  3110. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3111. T6(Resp=N)
  3112. T7(Resp=N)
  3113. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3114.  
  3115. Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build)
  3116. Class Checkpoint | Windows | NT/2K/XP | firewall
  3117. TSeq(Class=RI%gcd=<6%SI=<18358&>3CB)
  3118. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  3119. T2(Resp=N)
  3120. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  3121. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  3122. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3123. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3124. T7(Resp=N)
  3125. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3126.  
  3127. Fingerprint Checkpoint Firewall-1 on Windows NT 4.0 Server SP4-SP5
  3128. Class Checkpoint | Windows | NT/2K/XP | firewall
  3129. TSeq(Class=TD%gcd=<8%SI=<154)
  3130. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  3131. T2(Resp=N)
  3132. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  3133. T4(Resp=N)
  3134. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3135. T6(Resp=N)
  3136. T7(Resp=N)
  3137. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  3138.  
  3139. # Checkpoint Firewall-1/VPN-1 SecurePlatform NG, running FeaturePack 3
  3140. Fingerprint Checkpoint SecurePlatform NG FP3
  3141. Class Checkpoint | Windows | NT/2K/XP | firewall
  3142. TSeq(Class=RI%gcd=<6%SI=<1C6F042&>48C8B%IPID=Z%TS=U)
  3143. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  3144. T2(Resp=N)
  3145. T3(Resp=N)
  3146. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  3147. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  3148. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  3149. T7(Resp=N)
  3150. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3151.  
  3152. Fingerprint Cisco CacheOS (1.1.0)
  3153. Class Cisco | CacheOS || web proxy
  3154. TSeq(Class=64K)
  3155. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  3156. T2(Resp=N)
  3157. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  3158. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  3159. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3160. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3161. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3162. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3163.  
  3164. Fingerprint Cisco 675 DSL router -- cbos 2.1
  3165. Class Cisco | CBOS || broadband router
  3166. T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M)
  3167. T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  3168. T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
  3169. T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
  3170. T5(Resp=N)
  3171. T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
  3172. T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  3173. PU(Resp=N)
  3174.  
  3175. Fingerprint Cisco ACNS 5.1 Content Engine
  3176. Class Cisco | Content Networking System || web proxy
  3177. TSeq(Class=RI%gcd=<6%SI=<BFC80E&>1EAE1%IPID=I%TS=U)
  3178. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  3179. T2(Resp=N)
  3180. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  3181. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3182. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3183. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3184. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3185. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3186.  
  3187. Fingerprint Cisco Content Engine 505 Software V. 4.2.1
  3188. Class Cisco | Content Networking System || web proxy
  3189. TSeq(Class=RI%gcd=<6%SI=<2D75904&>5AE06%IPID=I%TS=U)
  3190. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  3191. T2(Resp=N)
  3192. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  3193. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3194. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3195. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3196. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3197. PU(DF=N%TOS=C0|CC%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3198.  
  3199. # running Application and Content Networking System Software 4.2.3
  3200. # Fingerprint Cisco Content Engine 560 Software V. 4.2.3
  3201. Fingerprint Cisco Content Engine 560 running Content Networking System V. 4.2.3
  3202. Class Cisco | Content Networking System || web proxy
  3203. TSeq(Class=RI%gcd=<6%SI=<19440B6&>40ACE%IPID=I%TS=U)
  3204. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  3205. T2(Resp=N)
  3206. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  3207. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3208. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3209. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3210. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3211. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3212.  
  3213. # Application and Content Networking System Software Release 5.3.1 (build b5 Mar 17 2005)
  3214. Fingerprint Cisco Content Engine ACNSS V5.2.1 or V5.3.1
  3215. Class Cisco | Content Networking System || web proxy
  3216. TSeq(Class=RI%gcd=<6%SI=<1A91BDA&>44018%IPID=Z%TS=U)
  3217. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  3218. T2(Resp=N)
  3219. T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  3220. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  3221. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  3222. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  3223. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  3224. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3225.  
  3226. Fingerprint Cisco Accesspoint 1200
  3227. Class Cisco | embedded || bridge
  3228. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3229. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3230. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  3231. T3(Resp=Y%DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
  3232. T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  3233. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3234. T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
  3235. T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
  3236. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3237.  
  3238. # Cisco AIR-WGB340 V8.38 Workgroup Bridge 340
  3239. Fingerprint Cisco AIR-WGB340 V8.38 Wireless workgroup bridge 340
  3240. Class Cisco | embedded || bridge
  3241. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3242. T1(DF=N%W=1F4|1000%ACK=S++%Flags=AR|AS%Ops=)
  3243. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  3244. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  3245. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  3246. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  3247. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  3248. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  3249. PU(Resp=N)
  3250.  
  3251. Fingerprint Cisco WGB350 Wireless WorkGroup Bridge
  3252. Class Cisco | embedded || bridge
  3253. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3254. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  3255. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  3256. T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  3257. T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  3258. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  3259. T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  3260. T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  3261. PU(DF=N%TOS=0%IPLEN=5C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3262.  
  3263. Fingerprint Cisco 760 Series ISDN router (non IOS) or IBM Stackable Hub
  3264. Class Cisco | embedded || broadband router
  3265. Class IBM | embedded || hub
  3266. TSeq(Class=TD|i800%gcd=<14004%SI=<14)
  3267. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3268. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3269. T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M)
  3270. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3271. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3272. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3273. T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=)
  3274. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3275.  
  3276. Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1)
  3277. Class Cisco | embedded || broadband router
  3278. TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U)
  3279. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3280. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3281. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3282. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3283. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3284. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3285. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3286. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3287.  
  3288. Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router
  3289. Class Cisco | embedded || broadband router
  3290. TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=<F)
  3291. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3292. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3293. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3294. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3295. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3296. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3297. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3298. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3299.  
  3300. Fingerprint Cisco 766 non-IOS software 4.2(3.5)
  3301. Class Cisco | embedded || broadband router
  3302. TSeq(Class=TD%gcd=82000%SI=<F)
  3303. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3304. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3305. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  3306. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3307. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3308. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3309. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3310. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3311.  
  3312. Fingerprint Cisco Soho 97 router running IOS 12.3(8)
  3313. Class Cisco | embedded || broadband router
  3314. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3315. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3316. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
  3317. T3(Resp=N)
  3318. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3319. T5(DF=N%W=0%ACK=S++%Flags=AR|BAR%Ops=)
  3320. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3321. T7(DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
  3322. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3323.  
  3324. Fingerprint Cisco 3000 Series VPN Concentrator
  3325. Class Cisco | embedded || encryption accelerator
  3326. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  3327. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3328. T2(Resp=N)
  3329. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3330. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3331. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3332. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3333. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3334. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  3335.  
  3336. # Cisco VPN 3005 running 4.1.2   
  3337. # Cisco VPN Series 3000 Concentrator running OS version 4.1.2
  3338. # Cisco VPN Concentrator running IOS 4.1.7
  3339. Fingerprint Cisco 3000 Series VPN concentrator (OS ver 4.1.x)
  3340. Class Cisco | embedded || encryption accelerator
  3341. TSeq(Class=RI%gcd=<6%SI=<306F34E&>29F4D%IPID=I%TS=2HZ)
  3342. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3343. T2(Resp=N)
  3344. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3345. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3346. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3347. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3348. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3349. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3350.  
  3351. # 3Com 4924 gigabit switch ver 2.04
  3352. # Cisco VPN 3000 3.5
  3353. Fingerprint Cisco VPN 3000 or 3Com 4924 GigE Switch
  3354. Class Cisco | embedded || encryption accelerator
  3355. Class 3Com | embedded || switch
  3356. TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ)
  3357. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3358. T2(Resp=N)
  3359. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  3360. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3361. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3362. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3363. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3364. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3365.  
  3366. Fingerprint Cisco CSS 11501 Content Services Switch
  3367. Class Cisco | embedded || load balancer
  3368. TSeq(Class=TR%gcd=<6%IPID=I)
  3369. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  3370. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  3371. T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  3372. T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3373. T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  3374. T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  3375. T7(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3376. PU(Resp=N)
  3377.  
  3378. Fingerprint Cisco CSS 11501 Content Services Switch
  3379. Class Cisco | embedded || load balancer
  3380. TSeq(Class=RI%gcd=<6%SI=<159FA&>235%IPID=I%TS=U)
  3381. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  3382. T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
  3383. T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3384. T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  3385. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3386. T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  3387. T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  3388. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  3389.  
  3390. Fingerprint Cisco Local Director 420 version 2.1.1
  3391. Class Cisco | embedded || load balancer
  3392. TSeq(Class=C)
  3393. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3394. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL)
  3395. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3396. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  3397. T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL)
  3398. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  3399. T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL)
  3400. PU(Resp=N)
  3401.  
  3402. # The "True Random" is bogus, it is because of sequences
  3403. # from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869
  3404. # Cisco Localdirector 430, running OS 2.1
  3405. Fingerprint Cisco Localdirector load balancer
  3406. Class Cisco | embedded || load balancer
  3407. TSeq(Class=TR|C)
  3408. T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3409. T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3410. T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL)
  3411. T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
  3412. T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3413. T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
  3414. T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3415. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3416.  
  3417. # LocalDirector 430 Version 4.2.4
  3418. Fingerprint Cisco LocalDirector load balancer
  3419. Class Cisco | embedded || load balancer
  3420. TSeq(Class=RI%gcd=<6%SI=<2F240C&>789A%IPID=BI%TS=U)
  3421. T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  3422. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  3423. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  3424. T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  3425. T5(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  3426. T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  3427. T7(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  3428. PU(Resp=N)
  3429.  
  3430. Fingerprint Cisco Router C2600 running IOS 12.2(2)T
  3431. Class Cisco | embedded || router
  3432. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3433. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3434. T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  3435. T3(Resp=Y%DF=N%W=C00|800|400%ACK=S++%Flags=AR%Ops=WNMETL)
  3436. T4(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  3437. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3438. T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3439. T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  3440. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3441.  
  3442. Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4)
  3443. Class Cisco | embedded || router
  3444. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3445. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3446. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3447. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3448. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3449. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3450. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3451. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3452.  
  3453. # Cisco 1548M 10/100 Managed Switch (Firmware Version: v1.03.02)
  3454. Fingerprint Cisco 1548M managed switch
  3455. Class Cisco | embedded || switch
  3456. TSeq(Class=64K%IPID=I%TS=U)
  3457. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3458. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  3459. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  3460. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3461. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3462. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3463. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3464. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  3465.  
  3466. Fingerprint Cisco Catalyst 1900 switch, Bay networks 350-450 switch,  or Netopia DSL/ISDN router
  3467. Class Cisco | embedded || switch
  3468. Class Bay Networks | embedded || switch
  3469. Class Netopia | embedded || broadband router
  3470. TSeq(Class=TD%gcd=<6000%SI=<1E)
  3471. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  3472. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3473. T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  3474. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3475. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3476. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3477. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3478. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3479.  
  3480. Fingerprint Cisco Catalyst 2820 switch Management Console
  3481. Class Cisco | embedded || switch
  3482. TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U)
  3483. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  3484. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3485. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  3486. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3487. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3488. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3489. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3490. PU(Resp=N|Y)
  3491.  
  3492. # Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5)
  3493. # Cisco Catalyst 5500 with OS Version 6.3(5)
  3494. # Alcatel OmniSwitch/Router! Version 4.3.1 GA
  3495. Fingerprint Cisco Catalyst 5500/6500 or Alcatel OmniSwitch/Router
  3496. Class Cisco | embedded || switch
  3497. Class Alcatel | embedded || switch
  3498. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3499. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3500. T2(Resp=N)
  3501. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  3502. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3503. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3504. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3505. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3506. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3507.  
  3508. # Cisco 6509 Cisco Internetwork Operating System Software IOS Version 12.1(23)E
  3509. Fingerprint Cisco Catalyst 6509 switch running IOS Version 12.1(23)E
  3510. Class Cisco | embedded || switch
  3511. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3512. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL|MENN)
  3513. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3514. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MNW|MW|ML)
  3515. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3516. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3517. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3518. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3519. PU(Resp=N)
  3520.  
  3521. Fingerprint Cisco Catalyst switch
  3522. Class Cisco | embedded || switch
  3523. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3524. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3525. T2(Resp=N)
  3526. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3527. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3528. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3529. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3530. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3531. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3532.  
  3533. # LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or
  3534. # Trancell WebRamp router or Xylan OmniSwitch 3.2.X.X - 3.4.X.X
  3535. # Epson Stylus Color 1520C with 100BTX-NIC from Epson
  3536. # Cisco 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX
  3537. # SonicWall firewall appliance 10meg firmware 3.3.1
  3538. Fingerprint Router/Switch/Printer/Firewall (LanPlex 2500/Cisco Catalyst 5505/Cisco 6509/Trancell Webramp/Xylan OmniSwitch)/Epson Stylus (100BTX-NIC HP Secure Web Console, SonicWall firewall appliance 3.3.1)
  3539. Class Cisco | embedded || switch
  3540. Class Xylan | embedded || switch
  3541. Class Epson | embedded || printer
  3542. Class SonicWall | SonicOS || firewall
  3543. Class Trancell | embedded || router
  3544. TSeq(Class=64K)
  3545. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3546. T2(Resp=N)
  3547. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  3548. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3549. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3550. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3551. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3552. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3553.  
  3554. Fingerprint Cisco AS5200 terminal server
  3555. Class Cisco | embedded || terminal server
  3556. TSeq(Class=RI%gcd=<6%SI=>FFF)
  3557. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3558. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3559. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3560. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3561. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3562. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3563. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3564. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3565.  
  3566. # A Cisco ATA 186 is a little box that allows a standard POTS
  3567. # telephone to be used as a voice-over-IP phone.  There is a
  3568. # variation, the ATA 188 that has a pass-through port, much like the
  3569. # Cisco 7960 phone.
  3570. Fingerprint Cisco ATA 186 POTS<->VoIP phone gateway device
  3571. Class Cisco | embedded || VoIP adapter
  3572. TSeq(Class=TD%gcd=<A0000%SI=<1E%IPID=I%TS=U)
  3573. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  3574. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=ARF%Ops=)
  3575. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  3576. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  3577. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  3578. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  3579. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  3580. PU(Resp=N)
  3581.  
  3582. Fingerprint Cisco ATA 186 POTS<->VoIP phone gateway device
  3583. Class Cisco | embedded || VoIP adapter
  3584. T1(Resp=N)
  3585. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3586. T3(Resp=N)
  3587. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3588. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3589. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3590. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3591. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3592.  
  3593. Fingerprint Cisco 7960 SIP Phone running OS 4.2
  3594. Class Cisco | embedded || VoIP phone
  3595. TSeq(Class=TD%gcd=<2A004%SI=<28%IPID=I%TS=U)
  3596. T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M)
  3597. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3598. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3599. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3600. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3601. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3602. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3603. PU(Resp=N)
  3604.  
  3605. Fingerprint Cisco IP phone (POS3-04-3-00, PC030301)
  3606. Class Cisco | embedded || VoIP phone
  3607. TSeq(Class=TD%gcd=<C004%SI=<14%IPID=I%TS=U)
  3608. T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M)
  3609. T2(Resp=N)
  3610. T3(Resp=Y%DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
  3611. T4(DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
  3612. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3613. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3614. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3615. PU(Resp=N)
  3616.  
  3617. Fingerprint Cisco IP Phone 7910 or 7940 Firmware 3.1
  3618. Class Cisco | embedded || VoIP phone
  3619. TSeq(Class=TD%gcd=<1E004%SI=<1E%IPID=I%TS=U)
  3620. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  3621. T2(Resp=N)
  3622. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  3623. T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
  3624. T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3625. T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
  3626. T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3627. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3628.  
  3629. # Cisco IP Phone - Model NumberCP-7940G
  3630. # Cisco IP Phone 7940 Series CP-7940G
  3631. Fingerprint Cisco IP Phone 7940
  3632. Class Cisco | embedded || VoIP phone
  3633. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3634. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  3635. T2(Resp=N)
  3636. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  3637. T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
  3638. T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3639. T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
  3640. T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3641. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3642.  
  3643. Fingerprint Cisco IP Phone 7960
  3644. Class Cisco | embedded || VoIP phone
  3645. TSeq(Class=TD%gcd=<2A004%SI=<1E%IPID=I%TS=U)
  3646. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  3647. T2(Resp=Y%DF=N%W=578%ACK=S%Flags=R%Ops=)
  3648. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3649. T4(DF=N%W=578%ACK=S%Flags=R%Ops=)
  3650. T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3651. T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
  3652. T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3653. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3654.  
  3655. # Cisco IP Phone CP-7970G
  3656. # Cisco IP Phone 7970G running firmware 6.0.3sr1
  3657. Fingerprint Cisco IP Phone 7970G
  3658. Class Cisco | embedded || VoIP phone
  3659. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3660. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  3661. T2(Resp=N)
  3662. T3(Resp=N)
  3663. T4(DF=N%W=2000%ACK=S%Flags=AR%Ops=)
  3664. T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  3665. T6(DF=N%W=2000%ACK=S%Flags=AR%Ops=)
  3666. T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  3667. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3668.  
  3669. # Cisco ATA 186 (analog telephone adaptor (VoIP)) firmware Rev. B0
  3670. # Cisco (Komodo) ATA-186 Version: v2.16 ata18x (Build 030401a)
  3671. # Cisco ATA 186 or 7905 VoIP Phone
  3672. # Cisco IP Phone 7905 Software Version 1.02.00
  3673. # Cisco IP Phone 7912 - Software Version 1.02.02(031217B) - Product ID CP-7912G
  3674. # Cisco VoIP Phone (commonly used by Vonage)
  3675. # Cisco CP-7912G IP Phone
  3676. Fingerprint Cisco VoIP Phone 7905/7912 or ATA 186 Analog Telephone Adapter
  3677. Class Cisco | embedded || VoIP phone
  3678. Class Cisco | embedded || VoIP adapter
  3679. TSeq(Class=TD%gcd=<28004%SI=<1E%IPID=I%TS=U)
  3680. T1(DF=N%W=578|3E80%ACK=S++%Flags=AS%Ops=M)
  3681. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3682. T3(Resp=Y%DF=N%W=578|3E80%ACK=S++%Flags=AS%Ops=M)
  3683. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3684. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3685. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3686. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3687. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3688.  
  3689. Fingerprint Cisco Cache Engine Web Proxy
  3690. Class Cisco | embedded || web proxy
  3691. TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
  3692. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNW)
  3693. T2(Resp=N)
  3694. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
  3695. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  3696. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3697. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3698. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3699. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3700.  
  3701. # Cisco 2501, 2504, 4500
  3702. Fingerprint Cisco 2501/2504/4500 router with IOS Version 10.3(15) - 11.1(20)
  3703. Class Cisco | IOS | 10.X | router
  3704. Class Cisco | IOS | 11.X | router
  3705. TSeq(Class=RI|TD%gcd=<6%SI=<2000)
  3706. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3707. T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3708. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3709. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3710. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3711. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3712. T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3713. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3714.  
  3715. Fingerprint Cisco 1600/3640/7513 Router (IOS 11.2(14)P)
  3716. Class Cisco | IOS | 11.X | router
  3717. TSeq(Class=RI%gcd=<6%SI=<11170)
  3718. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3719. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  3720. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3721. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3722. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3723. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3724. T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  3725. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3726.  
  3727. # DECBrouter90T1 Runs Cisco IOS 10.2(5)
  3728. # Cisco 1601, IOS 11.0
  3729. Fingerprint Cisco 1601 (IOS 11.0) or DECbrouter90T1 (Runs Cisco IOS 10.2(5))
  3730. Class Cisco | IOS | 11.X | router
  3731. Class DEC | IOS | 10.X | router
  3732. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3733. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3734. T3(Resp=N)
  3735. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3736. T5(Resp=N)
  3737. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3738. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3739. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3740.  
  3741. Fingerprint Cisco 4500 router running IOS 11.2(2)
  3742. Class Cisco | IOS | 11.X | router
  3743. T1(DF=N%W=860%ACK=S++|O%Flags=AS|A%Ops=M|)
  3744. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3745. T3(Resp=N)
  3746. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3747. T5(Resp=N)
  3748. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3749. T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3750. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  3751.  
  3752. Fingerprint Cisco 4500-M router running IOS 11.3(6) IP Plus
  3753. Class Cisco | IOS | 11.X | router
  3754. TSeq(Class=RI|TD%gcd=1%SI=<FFF)
  3755. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  3756. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3757. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  3758. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3759. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3760. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3761. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3762. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3763.  
  3764. Fingerprint Cisco 7206 router (IOS 11.1(17)
  3765. Class Cisco | IOS | 11.X | router
  3766. TSeq(Class=RI%gcd=<6%SI=>666)
  3767. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3768. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3769. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3770. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3771. T5(Resp=N)
  3772. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3773. T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  3774. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3775.  
  3776. Fingerprint Cisco 7206 running IOS 11.1(24)
  3777. Class Cisco | IOS | 11.X | router
  3778. TSeq(Class=RI%gcd=<5%SI=<CCCC&>CC)
  3779. T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3780. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3781. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3782. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3783. T5(Resp=N)
  3784. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3785. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3786. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3787.  
  3788. Fingerprint Cisco IOS 11.3 - 12.0(11)
  3789. Class Cisco | IOS | 11.X | router
  3790. Class Cisco | IOS | 12.X | router
  3791. TSeq(Class=TD|RI%gcd=<6)
  3792. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3793. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3794. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3795. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3796. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3797. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3798. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3799. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3800.  
  3801. Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T
  3802. Class Cisco | IOS | 11.X | router
  3803. TSeq(Class=RI%gcd=<4%SI=<999&>CC)
  3804. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3805. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3806. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3807. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3808. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3809. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3810. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3811. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3812.  
  3813. # 25XX/45XX router, 29XX switch, RSP2 processor
  3814. Fingerprint Cisco Router/Switch with IOS 11.2
  3815. Class Cisco | IOS | 11.X | router
  3816. Class Cisco | IOS | 11.X | switch
  3817. TSeq(Class=RI%gcd=<6%SI=<18000)
  3818. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3819. T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3820. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3821. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3822. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3823. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3824. T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3825. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3826.  
  3827. # Cisco 3640 router IOS 11.1(7)AX [KUONG(7)AX]
  3828. # Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6
  3829. Fingerprint Cisco switch/router with IOS 11.1(7)-11.2(8.10)
  3830. Class Cisco | IOS | 11.X | router
  3831. Class Cisco | IOS | 11.X | switch
  3832. TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
  3833. T1(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3834. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3835. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3836. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3837. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3838. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3839. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3840. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3841.  
  3842. Fingerprint Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1)
  3843. Class Cisco | IOS | 11.X | terminal server
  3844. TSeq(Class=RI%gcd=<6%SI=>BBB)
  3845. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3846. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3847. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3848. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3849. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3850. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3851. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3852. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3853.  
  3854. Fingerprint Cisco 827 ADSL router running IOS 112.2(11)
  3855. Class Cisco | IOS | 12.X | broadband router
  3856. TSeq(Class=RI%gcd=<6%SI=<1B1F2&>24E%IPID=Z%TS=U)
  3857. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3858. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3859. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3860. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3861. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3862. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3863. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3864. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  3865.  
  3866. Fingerprint Cisco 827 ADSL router running IOS 12.1(1)XB1
  3867. Class Cisco | IOS | 12.X | broadband router
  3868. TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U)
  3869. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3870. T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3871. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3872. T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3873. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3874. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3875. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3876. PU(Resp=N)
  3877.  
  3878. Fingerprint Cisco 1601 router running IOS 12.0(8)
  3879. Class Cisco | IOS | 12.X | router
  3880. TSeq(Class=RI%gcd=<6%SI=<B4DC&>8A%IPID=Z%TS=U)
  3881. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3882. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3883. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3884. T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3885. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3886. T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3887. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3888. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3889.  
  3890. Fingerprint Cisco 1601R router running IOS 12.1(5)
  3891. Class Cisco | IOS | 12.X | router
  3892. TSeq(Class=TD%gcd=<6%SI=<32%IPID=Z%TS=U)
  3893. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3894. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3895. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3896. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3897. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3898. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3899. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3900. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3901.  
  3902. # Cisco 1721 Router running IOS 12.3(10)
  3903. Fingerprint Cisco 1721 router running IOS 12.3(10)
  3904. Class Cisco | IOS | 12.X | router
  3905. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3906. T1(DF=N%W=1020%ACK=O|S++%Flags=A|AS%Ops=|ME)
  3907. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3908. T3(Resp=N)
  3909. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3910. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3911. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3912. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3913. PU(Resp=N)
  3914.  
  3915. Fingerprint Cisco 2514 router running IOS 12.0(21)
  3916. Class Cisco | IOS | 12.X | router
  3917. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3918. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3919. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3920. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3921. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3922. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3923. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3924. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3925. PU(Resp=N)
  3926.  
  3927. # CISCO 2600 router running IOS 12.2(3)
  3928. Fingerprint Cisco 2600 router running IOS 12.2(3)
  3929. Class Cisco | IOS | 12.X | router
  3930. TSeq(Class=TD|RI%gcd=<8%SI=<F302&>249%IPID=Z%TS=U)
  3931. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3932. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3933. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3934. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3935. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3936. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3937. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3938. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3939.  
  3940. # CISCO 2610 router running IOS 12.2(21a)
  3941. Fingerprint Cisco 2610 router running IOS 12.2(21a)
  3942. Class Cisco | IOS | 12.X | router
  3943. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3944. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3945. T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3946. T3(Resp=Y%DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  3947. T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  3948. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3949. T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  3950. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3951. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  3952.  
  3953. # Cisco 2611 router running IOS 12.0(7)T
  3954. Fingerprint Cisco 2611 router running IOS 12.0(7)T
  3955. Class Cisco | IOS | 12.X | router
  3956. TSeq(Class=RI%gcd=<6%SI=<C8546&>49%IPID=Z%TS=U)
  3957. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3958. T2(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  3959. T3(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3960. T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3961. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3962. T6(DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  3963. T7(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  3964. PU(Resp=N)
  3965.  
  3966. # Cisco 2611 router running IOS 12.2(7a)
  3967. Fingerprint Cisco 2611 router running IOS 12.2(7a)
  3968. Class Cisco | IOS | 12.X | router
  3969. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3970. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3971. T2(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  3972. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3973. T4(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  3974. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3975. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3976. T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  3977. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3978.  
  3979. # IOS (tm) 1600 Software (C1600-K8OSY-M), Version 12.2(15)T9
  3980. # Cisco 2620 Router /w IOS 12.2(15)T14
  3981. Fingerprint Cisco 2620 router running IOS 12.2(15)
  3982. Class Cisco | IOS | 12.X | router
  3983. TSeq(Class=RI%gcd=<6%SI=<1938568&>4088D%IPID=Z%TS=100HZ)
  3984. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  3985. T2(Resp=N)
  3986. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  3987. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  3988. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3989. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3990. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3991. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3992.  
  3993. # Cisco 2620 router running IK903S3-M ios ver 12.3(5)
  3994. Fingerprint Cisco 2620 router running IOS 12.3(5)
  3995. Class Cisco | IOS | 12.X | router
  3996. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3997. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3998. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3999. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4000. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4001. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4002. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4003. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4004. PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4005.  
  4006. Fingerprint Cisco 2620 running IOS 12.2(19a)
  4007. Class Cisco | IOS | 12.X | router
  4008. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4009. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4010. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4011. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4012. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4013. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4014. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4015. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4016. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4017.  
  4018. # Cisco 3660, IOS 12.0(6r)T
  4019. Fingerprint Cisco 3660 running IOS 12.0(6r)T
  4020. Class Cisco | IOS | 12.X | router
  4021. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4022. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEM)
  4023. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4024. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4025. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4026. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4027. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4028. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4029. PU(Resp=N)
  4030.  
  4031. # cisco 3725 IOS (tm) 3700 Software (C3725-IS-M), Version 12.3(6c), RELEASE SOFTWARE (fc1)
  4032. Fingerprint Cisco 3725 router running IOS 12.3(6c)
  4033. Class Cisco | IOS | 12.X | router
  4034. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4035. T1(DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
  4036. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4037. T3(Resp=N)
  4038. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4039. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4040. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4041. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4042. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4043.  
  4044. # Cisco 3745 Router running IOS version 12.2(15)T13
  4045. Fingerprint Cisco 3745 Router running IOS 12.2(15)T13
  4046. Class Cisco | IOS | 12.X | router
  4047. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4048. T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4049. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4050. T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4051. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4052. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4053. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4054. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4055. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  4056.  
  4057. # Cisco 4000 series, IOS 4500 Software (C4500-P-m), Version 12.0(10.3)S
  4058. Fingerprint Cisco 4000 Series running IOS 12.0(10.3)
  4059. Class Cisco | IOS | 12.X | router
  4060. TSeq(Class=RI|TD%gcd=<6%SI=<F50%IPID=Z%TS=U)
  4061. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
  4062. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4063. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  4064. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4065. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4066. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4067. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4068. PU(Resp=N)
  4069.  
  4070. Fingerprint Cisco 7200 router running IOS 12.1(14)E6
  4071. Class Cisco | IOS | 12.X | router
  4072. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4073. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4074. T2(Resp=N)
  4075. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4076. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4077. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4078. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4079. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4080. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4081.  
  4082. # Cisco 7200 running IOS 12.4(1a)
  4083. Fingerprint Cisco 7200 router running IOS 12.4(1a)
  4084. Class Cisco | IOS | 12.X | router
  4085. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4086. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4087. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4088. T3(Resp=N)
  4089. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4090. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4091. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4092. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4093. PU(DF=N%TOS=B8%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4094.  
  4095. # Cisco 7204 IOS (tm) 7200 Software (C7200-IS-M), Version 12.1(19), RELEASE SOFTWARE (fc1)
  4096. Fingerprint Cisco 7204 router running IOS 12.1(19)
  4097. Class Cisco | IOS | 12.X | router
  4098. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4099. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4100. T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4101. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4102. T4(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
  4103. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4104. T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
  4105. T7(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=)
  4106. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4107.  
  4108. # Cisco 7206 router running IOS Version 12.2(13)T8
  4109. Fingerprint Cisco 7206 router running IOS 12.2(13)T8
  4110. Class Cisco | IOS | 12.X | router
  4111. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4112. T1(DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
  4113. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4114. T3(Resp=Y%DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
  4115. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4116. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4117. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4118. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4119. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4120.  
  4121. # IOS (tm) C800 Software (C800-Y6-MW), Version 12.0(7)T,  RELEASE SOFTWARE (fc2)
  4122. Fingerprint Cisco 800 Series Broadband Routers running IOS 12.0(7)T
  4123. Class Cisco | IOS | 12.X | router
  4124. TSeq(Class=TD|RI%gcd=<8%SI=<1399EE&>3219%IPID=Z%TS=U)
  4125. T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM)
  4126. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4127. T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM)
  4128. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4129. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4130. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4131. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4132. PU(Resp=N)
  4133.  
  4134. # Cisco 837 router running IOS 12.3(11)T
  4135. # Cisco 2811 router running IOS 12.3(8r)T7
  4136. Fingerprint Cisco 837 router running IOS 12.3(11)T or Cisco 2811 router running IOS 12.3(8r)T7
  4137. Class Cisco | IOS | 12.X | router
  4138. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4139. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4140. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4141. T3(Resp=N)
  4142. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4143. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4144. T6(DF=N%W=0%ACK=O%Flags=R|BR%Ops=)
  4145. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4146. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4147.  
  4148. # Cisco 837 Router IOS version 12.3T(8)
  4149. Fingerprint Cisco 837 router running IOS 12.3(8)T
  4150. Class Cisco | IOS | 12.X | router
  4151. TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
  4152. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4153. T2(Resp=N)
  4154. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4155. T4(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
  4156. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4157. T6(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=)
  4158. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
  4159. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4160.  
  4161. # Cisco AS5350, IOS 12.2(2)XB6
  4162. Fingerprint Cisco AS5350 running IOS 12.2(2)XB6
  4163. Class Cisco | IOS | 12.X | router
  4164. TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
  4165. T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MEML|MEMWL)
  4166. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4167. T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MML|MMWL)
  4168. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4169. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4170. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4171. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4172. PU(Resp=N)
  4173.  
  4174. Fingerprint Cisco IOS 12.0(3.3)S (perhaps a 7200 router)
  4175. Class Cisco | IOS | 12.X | router
  4176. TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
  4177. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  4178. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4179. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  4180. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4181. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4182. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4183. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4184. PU(Resp=N)
  4185.  
  4186. # Cisco IOS 12.0(16a) Service Provider feature set
  4187. # Cisco WS-C3508G-XL running 12.0(5)WC3
  4188. Fingerprint Cisco IOS 12.0(5)WC3 - 12.0(16a)
  4189. Class Cisco | IOS | 12.X | router
  4190. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4191. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4192. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4193. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4194. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4195. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4196. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4197. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4198. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4199.  
  4200. # Cisco 1700 running IOS 12.0(7)T
  4201. Fingerprint Cisco IOS 12.0(7)T (on a 1700 router)
  4202. Class Cisco | IOS | 12.X | router
  4203. TSeq(Class=RI%gcd=<6%SI=<7A6C&>D%IPID=Z%TS=U)
  4204. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4205. T2(Resp=N)
  4206. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4207. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4208. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4209. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4210. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4211. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4212.  
  4213. Fingerprint Cisco IOS 12.1(4) on a 2600 router
  4214. Class Cisco | IOS | 12.X | router
  4215. TSeq(Class=RI%gcd=<A%SI=<9772&>3A%IPID=Z%TS=U)
  4216. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4217. T2(Resp=N)
  4218. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4219. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4220. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4221. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4222. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4223. PU(Resp=N)
  4224.  
  4225. # Cisco 7507 running 12.2(8)T5
  4226. Fingerprint Cisco IOS 12.2(8)T5 on a 7507 router
  4227. Class Cisco | IOS | 12.X | router
  4228. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4229. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4230. T2(Resp=N)
  4231. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4232. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4233. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4234. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4235. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4236. PU(Resp=N)
  4237.  
  4238. # Cisco 1720 router running 12.2.8T4 with IP/FW/PLUS/3DES feature set
  4239. # Cisco 801 router running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1)
  4240. # Cisco Aironet 1100/1200/1400 access point running IOS 12.2.15
  4241. Fingerprint Cisco router or WAP running IOS 12.2
  4242. Class Cisco | IOS | 12.X | router
  4243. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4244. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4245. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4246. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4247. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4248. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4249. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4250. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4251. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4252.  
  4253. # Cisco 12008 running IOS 12.0(18.6)S1
  4254. # Cisco 7206VXR running IOS 12.0(18)S
  4255. Fingerprint Cisco router running IOS 12.0(18)S or 12.0(18)S1
  4256. Class Cisco | IOS | 12.X | router
  4257. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4258. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
  4259. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4260. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  4261. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4262. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4263. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4264. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4265. PU(Resp=N)
  4266.  
  4267. # Cisco 800 running 12.1(5)
  4268. # Cisco 2620 router running IOS 12.1(6)
  4269. Fingerprint Cisco router running IOS 12.1
  4270. Class Cisco | IOS | 12.X | router
  4271. TSeq(Class=RI%gcd=<6%SI=<ABC2&>78%IPID=Z%TS=U)
  4272. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4273. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4274. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4275. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4276. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4277. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4278. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4279. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  4280.  
  4281. # Cisco 3620 running IOS 12.2.1
  4282. # IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1)
  4283. Fingerprint Cisco router running IOS 12.1(5)-12.2(7a)
  4284. Class Cisco | IOS | 12.X | router
  4285. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4286. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4287. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4288. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4289. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4290. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4291. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4292. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4293. PU(Resp=N)
  4294.  
  4295. # Cisco 2620, IOS 12.2(6r)
  4296. # Found on Cisco 1720/1750/2611/3640/AS5300 routers
  4297. Fingerprint Cisco router running IOS 12.1.5-12.2.13a
  4298. Class Cisco | IOS | 12.X | router
  4299. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4300. T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4301. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4302. T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M)
  4303. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4304. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4305. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4306. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4307. PU(DF=N%TOS=20|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4308.  
  4309. # Cisco WS-C4006
  4310. # Cisco 7120-4T1 ISO 12.2
  4311. # CISCO 2950C
  4312. # Cisco 3600
  4313. Fingerprint Cisco router running IOS 12.2
  4314. Class Cisco | IOS | 12.X | router
  4315. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4316. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4317. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4318. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4319. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4320. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4321. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4322. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4323. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4324.  
  4325. # Cisco 2621 running IOS 12.2.8T
  4326. # Cisco SOHO 77 running IOS 12.2(8)T
  4327. Fingerprint Cisco router running IOS 12.2(8)T
  4328. Class Cisco | IOS | 12.X | router
  4329. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4330. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4331. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4332. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4333. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4334. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4335. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4336. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4337. PU(Resp=N)
  4338.  
  4339. # Cisco IOS Software, C1700 Software (C1700-ADVSECURITYK9-M), Version 12.3(11)T3, RELEASE SOFTWARE (fc4)
  4340. Fingerprint Cisco router running IOS 12.3(11)
  4341. Class Cisco | IOS | 12.X | router
  4342. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4343. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4344. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
  4345. T3(Resp=N)
  4346. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4347. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4348. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4349. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4350. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  4351.  
  4352. # Cisco Router (1760) - IOS (tm) C1700 Software, Version 12.3(6)
  4353. # IOS (tm) 3700 Software (C3745-IS-M), Version 12.3(6), RELEASE SOFTWARE (fc3) 
  4354. # Cisco 837 router running IOS 12.3.8T3
  4355. # CISCO C827 (MPC855T) processor (revision 0x501) with 23552K/1024K bytes of memory.
  4356. # Cisco 2611XM router running IOS 12.3(10)
  4357. # Cisco 2921XM router running IOS 12.3(6a)
  4358. # Cisco 7206VXR running IOS 12.3(6b)
  4359. # Cisco 831 running IOS Version 12.3(8)T3
  4360. # Cisco 3825 Router, IOS 12.3(11)T3 (C3825-ADVSECURITYK9-M, Version 12.3(11)T3, RELEASE SOFTWARE+(fc4))
  4361. Fingerprint Cisco router running IOS 12.3(6) - 12.3(11)
  4362. Class Cisco | IOS | 12.X | router
  4363. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4364. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4365. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
  4366. T3(Resp=N)
  4367. T4(DF=N%W=0%ACK=O%Flags=R|BR%Ops=)
  4368. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4369. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4370. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4371. PU(DF=N%TOS=0|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4372.  
  4373. # Cisco 5200 router IOS v12.0(15)
  4374. # Cisco 2924C
  4375. Fingerprint Cisco router running IOS v12.0(15)
  4376. Class Cisco | IOS | 12.X | router
  4377. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4378. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4379. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4380. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4381. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4382. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4383. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4384. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4385. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4386.  
  4387. # IOS (tm) SOHO91 Software (SOHO91-K9OY6-M), Version 12.3(2)XC, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) (Cisco SOHO 91 Secure router)
  4388. Fingerprint Cisco SOHO 91 secure router running IOS 12.3
  4389. Class Cisco | IOS | 12.X | router
  4390. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4391. T1(DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME)
  4392. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4393. T3(Resp=Y%DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME)
  4394. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4395. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4396. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4397. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4398. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4399.  
  4400. # Cisco Lightstream 1010 ATM Switch running IOS (tm) LS1010 WA4-5 Software (LS1010-WP-M), Version 12.1(23)E, RELEASE SOFTWARE (fc2)
  4401. # Cisco 6500 switch running IOS 12.1(23)E
  4402. Fingerprint Cisco switch running IOS 12.1(23)E
  4403. Class Cisco | IOS | 12.X | router
  4404. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4405. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL)
  4406. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4407. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ML)
  4408. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4409. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4410. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4411. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4412. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4413.  
  4414. # router Cisco 3640, IOS 12.2(23a)
  4415. Fingerprint router Cisco 3640 running IOS 12.2(23a)
  4416. Class Cisco | IOS | 12.X | router
  4417. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4418. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  4419. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4420. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  4421. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4422. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4423. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4424. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4425. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4426.  
  4427. Fingerprint Cisco catalyst 2924 running IOS 12.0(5)WC5
  4428. Class Cisco | IOS | 12.X | switch
  4429. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4430. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4431. T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  4432. T3(Resp=Y%DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  4433. T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  4434. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4435. T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  4436. T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  4437. PU(Resp=N)
  4438.  
  4439. # Cisco Catalyst 2924XL-EN running IOS 12.0(5)WC8
  4440. Fingerprint Cisco Catalyst 2924XL switch running IOS 12.0(5)
  4441. Class Cisco | IOS | 12.X | switch
  4442. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4443. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  4444. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4445. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  4446. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4447. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4448. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4449. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4450. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4451.  
  4452. Fingerprint Cisco Catalyst 2950 switch running IOS 12.0(5.3)WC(1)
  4453. Class Cisco | IOS | 12.X | switch
  4454. TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
  4455. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4456. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4457. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4458. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4459. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4460. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4461. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4462. PU(Resp=N)
  4463.  
  4464. # Cisco Catalyst 2950 switch,  IOS 12.1(9)EA1
  4465. Fingerprint Cisco Catalyst 2950 switch running IOS 12.1(9)EA1 or IOS 12.1(22)EA2
  4466. Class Cisco | IOS | 12.X | switch
  4467. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4468. T1(DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MEM)
  4469. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4470. T3(Resp=Y%DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  4471. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4472. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4473. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4474. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4475. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4476.  
  4477. Fingerprint Cisco IOS 12.0(5)WC5a on a catalyst 2900XL switch
  4478. Class Cisco | IOS | 12.X | switch
  4479. TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
  4480. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
  4481. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4482. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
  4483. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4484. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4485. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4486. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4487. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4488.  
  4489. Fingerprint Cisco 1200 access point (WAP) running IOS 12.2(8)
  4490. Class Cisco | IOS | 12.X | WAP
  4491. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4492. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4493. T2(Resp=N)
  4494. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4495. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4496. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4497. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4498. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4499. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4500.  
  4501. # Cisco AP1220 IOS 12.2(11)JA1
  4502. Fingerprint Cisco AP1220 WAP running IOS 12.2(11)
  4503. Class Cisco | IOS | 12.X | WAP
  4504. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  4505. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4506. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4507. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4508. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4509. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4510. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4511. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4512. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4513.  
  4514. Fingerprint Cisco CPA2500 (68030) or 2511 router
  4515. Class Cisco | IOS || router
  4516. TSeq(Class=RI%gcd=<6%SI=>FFF)
  4517. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  4518. T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  4519. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  4520. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4521. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4522. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4523. T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  4524. PU(Resp=N)
  4525.  
  4526. Fingerprint Cisco uBR 7223 router
  4527. Class Cisco | IOS || router
  4528. TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
  4529. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  4530. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4531. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  4532. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4533. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4534. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4535. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4536. PU(Resp=N)
  4537.  
  4538. Fingerprint Cisco Catalyst 4006 Switch running NmpSW 7.4(2)
  4539. Class Cisco | NmpSW || switch
  4540. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4541. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4542. T2(Resp=N)
  4543. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4544. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  4545. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4546. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4547. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4548. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4549.  
  4550. Fingerprint Cisco PIX 4.2(2) Internal Interface
  4551. Class Cisco | PIX | 4.X | firewall
  4552. TSeq(Class=C)
  4553. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4554. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
  4555. T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL)
  4556. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4557. T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
  4558. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4559. T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
  4560. PU(Resp=N)
  4561.  
  4562. Fingerprint Cisco PIX 515 firewall running software 4.4(5)
  4563. Class Cisco | PIX | 4.X | firewall
  4564. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  4565. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4566. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4567. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4568. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4569. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  4570. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4571. T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4572. PU(Resp=N)
  4573.  
  4574. Fingerprint Cisco PIX Firewall running PIX 4.1(5)
  4575. Class Cisco | PIX | 4.X | firewall
  4576. TSeq(Class=C%Val=211E005F)
  4577. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4578. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
  4579. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4580. T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4581. T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
  4582. T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4583. T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
  4584. PU(Resp=N)
  4585.  
  4586. Fingerprint Cisco Pix Firewall running PIX 4.1.6
  4587. Class Cisco | PIX | 4.X | firewall
  4588. TSeq(Class=C%Val=71F60191%IPID=BI%TS=U)
  4589. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4590. T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=R%Ops=WNMETL)
  4591. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4592. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  4593. T5(DF=N%W=800|1000%ACK=S%Flags=RS%Ops=WNMETL)
  4594. T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
  4595. T7(DF=N%W=C00|400%ACK=S%Flags=UPRF%Ops=WNMETL)
  4596. PU(Resp=N)
  4597.  
  4598. Fingerprint Cisco PIX v4.2 Firewall
  4599. Class Cisco | PIX | 4.X | firewall
  4600. TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03)
  4601. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  4602. T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL)
  4603. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  4604. T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
  4605. T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL)
  4606. T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
  4607. T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL)
  4608. PU(Resp=N)
  4609.  
  4610. # Cisco PIX running IOS 6.1(1) - Internal interface
  4611. # Cisco PIX 520 firewall running PixOS 6.1(3)
  4612. # Secure PIX Firewall Version 5.2(2)
  4613. Fingerprint Cisco PIX Firewall (PixOS 5.2 - 6.1)
  4614. Class Cisco | PIX | 5.X | firewall
  4615. Class Cisco | PIX | 6.X | firewall
  4616. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4617. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4618. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  4619. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR|AS%Ops=WNMETL|M)
  4620. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  4621. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  4622. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  4623. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4624. PU(Resp=N)
  4625.  
  4626. Fingerprint Cisco Secure PIX Firewall Version 5.0(2)
  4627. Class Cisco | PIX | 5.X | firewall
  4628. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4629. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  4630. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4631. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  4632. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  4633. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  4634. T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4635. PU(Resp=N)
  4636.  
  4637. # Cisco 535 IOS 6.2 PIX running in failover mode... ie.. idle
  4638. # PIX 506 running PIX IOS 6.2
  4639. Fingerprint Cisco Firewall (PIX 6.1.4 - 6.2.2)
  4640. Class Cisco | PIX | 6.X | firewall
  4641. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4642. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4643. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  4644. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4645. T4(Resp=N)
  4646. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  4647. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  4648. T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4649. PU(Resp=N)
  4650.  
  4651. Fingerprint Cisco PIX 501 firewall running PIX 6.1(1)
  4652. Class Cisco | PIX | 6.X | firewall
  4653. TSeq(Class=TR%IPID=I%TS=U)
  4654. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4655. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  4656. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4657. T4(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  4658. T5(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  4659. T6(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  4660. T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4661. PU(Resp=N)
  4662.  
  4663. Fingerprint Cisco PIX 515 or 525 Firewall running 6.1(4) - 6.2(1)
  4664. Class Cisco | PIX | 6.X | firewall
  4665. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4666. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4667. T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  4668. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4669. T4(Resp=N)
  4670. T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  4671. T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  4672. T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4673. PU(Resp=N)
  4674.  
  4675. # Cisco PIX 501 Firewall running IOS 6.3(1)
  4676. # Cisco PIX Firewall IOS version 6.22
  4677. # Cisco PIX 515 version 6.3(1)
  4678. # Cisco PIX 501 Firewall running PIXOS 6.3.3
  4679. Fingerprint Cisco PIX Firewall running PIX 6.2 - 6.3.3
  4680. Class Cisco | PIX | 6.X | firewall
  4681. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4682. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4683. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  4684. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4685. T4(Resp=N)
  4686. T5(DF=N%W=400||800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  4687. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  4688. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4689. PU(Resp=N)
  4690.  
  4691. Fingerprint Cisco PIX Firewall Version 6.1(2)
  4692. Class Cisco | PIX | 6.X | firewall
  4693. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4694. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4695. T2(Resp=N)
  4696. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4697. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4698. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  4699. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  4700. T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4701. PU(Resp=N)
  4702.  
  4703. Fingerprint Cisco PIX Firewall Version 6.2(1)
  4704. Class Cisco | PIX | 6.X | firewall
  4705. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4706. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4707. T2(Resp=N)
  4708. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4709. T4(Resp=N)
  4710. T5(Resp=N)
  4711. T6(Resp=N)
  4712. T7(Resp=N)
  4713. PU(Resp=N)
  4714.  
  4715. Fingerprint Cisco PIX Firewall Version 6.2(2) - 6.3
  4716. Class Cisco | PIX | 6.X | firewall
  4717. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4718. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4719. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  4720. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4721. T4(Resp=N)
  4722. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  4723. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  4724. T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4725. PU(Resp=N)
  4726.  
  4727. Fingerprint Cisco PIX 506 Firewall
  4728. Class Cisco | PIX || firewall
  4729. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4730. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  4731. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  4732. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4733. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  4734. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  4735. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  4736. T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  4737. PU(Resp=N)
  4738.  
  4739. # Sun Remote System Console version 1.12
  4740. # Brocade Fibre Switch, Firmware 2.6.0
  4741. # Cisco Aironet 340 WAP running v 12.03T of the firmware (and VxWorks OS)
  4742. Fingerprint Cisco Aironet WAP, Brocade Fibre Switch, or Sun Remote System Console
  4743. Class Cisco | vxworks || WAP
  4744. Class Brocade | embedded || switch
  4745. Class Sun | embedded || remote management
  4746. TSeq(Class=64K%IPID=I%TS=U)
  4747. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  4748. T2(Resp=N)
  4749. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  4750. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  4751. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4752. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4753. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4754. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4755.  
  4756. # Clipcomm CP-100 v1.1.39 (040820)
  4757. Fingerprint Clipcomm CP-100 VoIP phone
  4758. Class Clipcomm | embedded || VoIP phone
  4759. TSeq(Class=TD%gcd=<9B4%SI=<1E%IPID=I%TS=U)
  4760. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM)
  4761. T2(Resp=N)
  4762. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM)
  4763. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4764. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4765. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4766. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4767. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4768.  
  4769. Fingerprint Cnet CNIG904B Internet Broadband Gateway firmware version 1.11
  4770. Class Cnet | embedded || broadband router
  4771. TSeq(Class=TD%gcd=<F4%SI=<1D6%IPID=Z%TS=U)
  4772. T1(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  4773. T2(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
  4774. T3(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  4775. T4(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
  4776. T5(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  4777. T6(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
  4778. T7(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  4779. PU(Resp=N)
  4780.  
  4781. # CNT UltraNet EDGE (SAN Router) softwareversion 1.4.1.2
  4782. Fingerprint CNT UltraNet EDGE (SAN Router) V. 1.4.1.2
  4783. Class CNT | embedded || storage-misc
  4784. TSeq(Class=TD%gcd=<61AC%SI=<1E%IPID=I%TS=U)
  4785. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  4786. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4787. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  4788. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4789. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4790. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4791. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4792. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4793.  
  4794. Fingerprint Cobalt Linux 4.0 (Fargo) Kernel 2.0.34C52_SK on MIPS or TEAMInternet Series 100 WebSense
  4795. Class Cobalt | Linux | 2.0.X | general purpose
  4796. TSeq(Class=TR%gcd=<6)
  4797. T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  4798. T2(Resp=N)
  4799. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  4800. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4801. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4802. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4803. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4804. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  4805.  
  4806. Fingerprint Commodore 64 with TFE Ethernet Card (Contiki)
  4807. Class Commodore | embedded || game console
  4808. TSeq(Class=TD%gcd=<18%SI=<1E%IPID=RD|I%TS=U)
  4809. T1(DF=N%W=F4%ACK=S++%Flags=AS%Ops=M)
  4810. T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4811. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4812. T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4813. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4814. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4815. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4816. PU(Resp=N)
  4817.  
  4818. Fingerprint Commodore 64 with TFE Ethernet Card (uIP TCP/IP stack)
  4819. Class Commodore | embedded || game console
  4820. TSeq(Class=C%Val=FFFFFFFF%IPID=RD%TS=U)
  4821. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=)
  4822. T2(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=APF%Ops=)
  4823. T3(Resp=Y%DF=N%W=16D0|1CA%ACK=O%Flags=APF%Ops=)
  4824. T4(DF=N%W=16D0|5B4%ACK=O%Flags=APF%Ops=)
  4825. T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  4826. T6(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  4827. T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  4828. PU(Resp=N)
  4829.  
  4830. Fingerprint Compaq Inside Management Board
  4831. Class Compaq | embedded || remote management
  4832. TSeq(Class=64K%IPID=I%TS=2HZ)
  4833. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  4834. T2(Resp=N)
  4835. T3(Resp=N)
  4836. T4(Resp=N)
  4837. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4838. T6(Resp=N)
  4839. T7(Resp=N)
  4840. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4841.  
  4842. Fingerprint Compaq Integrated Lights Out remote configuration Board
  4843. Class Compaq | embedded || remote management
  4844. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  4845. T1(DF=N%W=800%ACK=O%Flags=R%Ops=)
  4846. T2(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
  4847. T3(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
  4848. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  4849. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  4850. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  4851. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  4852. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4853.  
  4854. # ProLiant DL580 Integrated Lights-Out remote configuration board V1.06 14.5.2002
  4855. Fingerprint Compaq ProLiant DL580 Integrated Lights-Out remote configuration board V1.06
  4856. Class Compaq | embedded || remote management
  4857. TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U)
  4858. T1(DF=N%W=400%ACK=O%Flags=R%Ops=)
  4859. T2(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
  4860. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
  4861. T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
  4862. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  4863. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  4864. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  4865. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4866.  
  4867. # Compaq iPAQ Connection Point (WAP) model CP-2W Rev1.00
  4868. # NetGear MR814 WAP
  4869. Fingerprint WAP: Compaq iPAQ Connection Point or Netgear MR814
  4870. Class Compaq | embedded || WAP
  4871. Class Netgear | embedded || WAP
  4872. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  4873. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4874. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  4875. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4876. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4877. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4878. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4879. PU(Resp=N)
  4880.  
  4881. Fingerprint Compaq Tru64 UNIX (formerly DIGITAL UNIX) 4.0e
  4882. Class Compaq | Tru64 UNIX | 4.X | general purpose
  4883. TSeq(Class=C)
  4884. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4885. T2(Resp=N)
  4886. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  4887. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4888. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4889. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4890. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4891. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4892.  
  4893. Fingerprint Compaq Tru64 UNIX 4.0e
  4894. Class Compaq | Tru64 UNIX | 4.X | general purpose
  4895. TSeq(Class=RI%gcd=<6%SI=<7BE80&>DAF%IPID=I%TS=U)
  4896. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  4897. T2(Resp=N)
  4898. T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=)
  4899. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4900. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4901. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4902. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4903. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4904.  
  4905. # OSF1 V4.0 1530 alpha
  4906. # Tru64 4.0F (Alpha), Patch Kit 8, Kernel Build 1229
  4907. Fingerprint Tru64 UNIX 4.0f - 4.0g
  4908. Class Compaq | Tru64 UNIX | 4.X | general purpose
  4909. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4910. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4911. T2(Resp=N)
  4912. T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4913. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4914. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4915. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4916. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4917. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4918.  
  4919. # Compaq Tru64 UNIX 5.0 on AlphaServer
  4920. # DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A on a DEC 4000 Model 610 running OpenVMS V7.2
  4921. Fingerprint Compaq Tru64 UNIX 5.0 or DEC OpenVMS 7.2
  4922. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4923. Class DEC | OpenVMS | 7.X | general purpose
  4924. TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C)
  4925. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4926. T2(Resp=N)
  4927. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
  4928. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4929. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4930. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4931. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4932. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4933.  
  4934. Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
  4935. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4936. TSeq(Class=TR%gcd=<6%TS=U)
  4937. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4938. T2(Resp=N)
  4939. T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4940. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4941. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4942. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4943. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4944. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4945.  
  4946. Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
  4947. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4948. TSeq(Class=TR%gcd=<6%TS=U)
  4949. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4950. T2(Resp=N)
  4951. T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4952. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4953. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4954. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4955. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4956. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4957.  
  4958. Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
  4959. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4960. TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U)
  4961. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4962. T2(Resp=N)
  4963. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  4964. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4965. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4966. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4967. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4968. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4969.  
  4970. Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
  4971. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4972. TSeq(Class=TR%gcd=<6%TS=U)
  4973. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4974. T2(Resp=N)
  4975. T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4976. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4977. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4978. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4979. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4980. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4981.  
  4982. # Compaq Tru64 UNIX V5.1B (Rev. 2650)
  4983. Fingerprint Compaq Tru64 UNIX V5.1B
  4984. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4985. TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
  4986. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  4987. T2(Resp=N)
  4988. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  4989. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4990. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4991. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4992. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4993. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4994.  
  4995. # HP Tru64 UNIX v5.1B: OSF1 V5.1 2650 alpha
  4996. Fingerprint HP Tru64 UNIX v5.1B
  4997. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4998. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4999. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  5000. T2(Resp=N)
  5001. T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  5002. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5003. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5004. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5005. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5006. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5007.  
  5008. Fingerprint OSF1 5.0 Rev. 910 (AKA Compaq/DIGITAL Tru64 UNIX)
  5009. Class Compaq | Tru64 UNIX | 5.X | general purpose
  5010. TSeq(Class=RI%gcd=<6%SI=<E88&>11)
  5011. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  5012. T2(Resp=N)
  5013. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
  5014. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5015. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5016. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5017. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5018. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5019.  
  5020. Fingerprint Compaq T1010 Thin Client Windows CE 2.12
  5021. Class Compaq | Windows | PocketPC/CE | terminal
  5022. TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI%TS=U)
  5023. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  5024. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5025. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  5026. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  5027. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5028. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  5029. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5030. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5031.  
  5032. Fingerprint Compatible Systems ISDN/leased-line/dialup Microrouter 2220R w/ firmware v4.5
  5033. Class Compatible Systems | embedded || broadband router
  5034. TSeq(Class=TD%gcd=388|710|A98%SI=<14)
  5035. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  5036. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5037. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  5038. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5039. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5040. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5041. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5042. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5043.  
  5044. Fingerprint Compatible Systems ISDN/leased-line/dialup MicroRouter 900i v3.0.9
  5045. Class Compatible Systems | embedded || broadband router
  5046. TSeq(Class=TD%gcd=388|710|A98%SI=<F)
  5047. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  5048. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5049. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  5050. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5051. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5052. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5053. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5054. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5055.  
  5056. # Tested against: 3 RISC Routers (2600i, 2800, and 3500R) all running
  5057. # firmware 4.5 and two IntraPorts running 4.4.02.  I'm told this also
  5058. # applies to firmware 4.2 on RISC routers, but I have not checked.
  5059. Fingerprint Compatible Systems (RISC Router, IntraPort)
  5060. Class Compatible Systems | embedded || router
  5061. TSeq(Class=TD%gcd=388|710|A98%SI=<6)
  5062. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  5063. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5064. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  5065. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  5066. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5067. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  5068. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5069. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5070.  
  5071. # Compex CGX3224 Switch, Firmware version CGX1.53
  5072. Fingerprint Compex CGX3224 Switch
  5073. Class Compex | embedded || switch
  5074. TSeq(Class=64K%IPID=I%TS=U)
  5075. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  5076. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5077. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  5078. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5079. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5080. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5081. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5082. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5083.  
  5084. Fingerprint CompUSA Broadband Router
  5085. Class CompUSA | embedded || broadband router
  5086. TSeq(Class=RI|TR%gcd=<6%SI=<7FCAA42%IPID=I%TS=U)
  5087. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  5088. T2(Resp=N)
  5089. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  5090. T4(DF=N%W=101F%ACK=O%Flags=R%Ops=)
  5091. T5(DF=N%W=101F%ACK=S++%Flags=AR%Ops=)
  5092. T6(DF=N%W=101F%ACK=O%Flags=R%Ops=)
  5093. T7(DF=N%W=101F%ACK=S++%Flags=AR%Ops=)
  5094. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5095.  
  5096. Fingerprint Computone Power Rack IntelliServer terminal server Release 1.5.4d
  5097. Class Computone | embedded || terminal server
  5098. TSeq(Class=TD%gcd=40%SI=0)
  5099. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  5100. T2(Resp=N)
  5101. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
  5102. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5103. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5104. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5105. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5106. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5107.  
  5108. # Conexant ADSL Router Firmware 2.33a (FreeBSD)
  5109. Fingerprint Conexant ADSL Router
  5110. Class Conexant | embedded || broadband router
  5111. TSeq(Class=RI%gcd=<6%SI=<1B50D00&>45EAE%IPID=Z%TS=100HZ)
  5112. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  5113. T2(Resp=N)
  5114. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  5115. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5116. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5117. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5118. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5119. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5120.  
  5121. # Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B) with Conexant-Hasbani CX82xxx_4.1.0.9 firmware running on VxWorks 5.4.2 OS
  5122. Fingerprint Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B)
  5123. Class Conexant | embedded || broadband router
  5124. TSeq(Class=64K%IPID=I%TS=2HZ)
  5125. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5126. T2(Resp=N)
  5127. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  5128. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5129. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5130. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5131. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5132. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5133.  
  5134. # Contiki 1.2-devel0 on Ethernut (Atmel AVR ATmega128 with RTL8019as Ethernet chip)
  5135. # uIP 0.9 running on a Atmel ATmega16 using a Packet Whacker for ethernet connectivity
  5136. Fingerprint Contiki 1.2-devel0 embedded OS on Ethernut card or uIP 0.9 TCP/IP stack
  5137. Class Contiki | Contiki || specialized
  5138. Class uIP | uIP || specialized
  5139. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  5140. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5141. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5142. T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5143. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5144. T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5145. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5146. PU(Resp=N)
  5147.  
  5148. Fingerprint Convex OS Release 10.1
  5149. Class Convex | ConvexOS || general purpose
  5150. TSeq(Class=64K)
  5151. T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=)
  5152. T2(Resp=N)
  5153. T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=)
  5154. T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=)
  5155. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5156. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5157. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5158. PU(Resp=N)
  5159.  
  5160. Fingerprint Convex SPP-UX 5.2.1
  5161. Class Convex | SPP-UX || general purpose
  5162. TSeq(Class=64K)
  5163. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  5164. T2(Resp=N)
  5165. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  5166. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5167. T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=)
  5168. T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=)
  5169. T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=)
  5170. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5171.  
  5172. Fingerprint SPP-UX 5.x on a Convex SPP-1600
  5173. Class Convex | SPP-UX || general purpose
  5174. TSeq(Class=C)
  5175. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  5176. T2(Resp=N)
  5177. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  5178. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5179. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  5180. T6(DF=N%W=C00%ACK=S%Flags=R%Ops=)
  5181. T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  5182. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5183.  
  5184. # HP j4813A ProCurve Switch 2524
  5185. # Copper Mountain Networks DSL Concentrator
  5186. # Compaq Remote Insight Lights-Out remote console card
  5187. # 3Com Home Wireless Gateway 3CRWE50194-E1, firmware 1.14
  5188. # TrueTime NTS-200 GPS Network Time Server
  5189. # Compaq Lights Out Edition firmware v2.41
  5190. # 3Com NBX 25 (Phone System) Version: R1_0_3
  5191. Fingerprint Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com NBX 25 phone system or Home Wireless Gateway, or TrueTime NTP clock
  5192. Class Copper Mountain | embedded || terminal server
  5193. Class 3Com | embedded || WAP
  5194. Class 3Com | embedded || telecom-misc
  5195. Class TrueTime | embedded || specialized
  5196. Class Compaq | embedded || remote management
  5197. TSeq(Class=64K%IPID=I%TS=U)
  5198. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  5199. T2(Resp=N)
  5200. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  5201. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5202. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5203. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5204. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5205. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5206.  
  5207. # Corega BAR SW-4P  [Part number:CG-BARSW4P]
  5208. Fingerprint Corega BAR SW-4P Broadband Access Router
  5209. Class Corega | embedded || broadband router
  5210. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  5211. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5212. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5213. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5214. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5215. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5216. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5217. PU(Resp=N)
  5218.  
  5219. Fingerprint UNICOS 10.0.0 on Cray 90
  5220. Class Cray | UNICOS | 10.X | general purpose
  5221. TSeq(Class=RI%gcd=<F%SI=<22222&>2222)
  5222. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL)
  5223. T2(Resp=N)
  5224. T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT)
  5225. T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5226. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5227. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5228. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5229. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5230.  
  5231. Fingerprint Cray UNICOS/mk 8.6
  5232. Class Cray | UNICOS | 8.X | general purpose
  5233. TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1)
  5234. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5235. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5236. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5237. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5238. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5239. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5240. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5241. PU(Resp=N)
  5242.  
  5243. Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1
  5244. Class Cray | UNICOS || general purpose
  5245. TSeq(Class=RI%gcd=<6)
  5246. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL)
  5247. T2(Resp=N)
  5248. T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT)
  5249. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  5250. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5251. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5252. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5253. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5254.  
  5255. Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2
  5256. Class Cray | UNICOS || general purpose
  5257. TSeq(Class=RI%gcd=<6%SI=>F)
  5258. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL)
  5259. T2(Resp=N)
  5260. T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT)
  5261. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5262. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5263. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5264. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5265. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5266.  
  5267. # Unisys LX/NX MCP 46.1/HMP 5.0 on an Unisys LX5120
  5268. Fingerprint Cray Unisys LX/NX MCP 46.1/HMP 5.0 on LX5120
  5269. Class Cray | Unisys || general purpose
  5270. TSeq(Class=RI%gcd=<6%SI=<7868FCE&>CF0B8%IPID=I%TS=U)
  5271. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  5272. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5273. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  5274. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5275. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5276. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5277. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5278. PU(Resp=N)
  5279.  
  5280. Fingerprint Cyberguard 4.0 firewall
  5281. Class Cyberguard | embedded || firewall
  5282. TSeq(Class=RI%gcd=<6%SI=>FFFF)
  5283. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  5284. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5285. T3(DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5286. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5287. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5288. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5289. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5290. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5291.  
  5292. # Cyberguard Firewall 5.2 on Firestar 500 (proprietary Unixware version)
  5293. Fingerprint Cyberguard Firewall 5.2
  5294. Class Cyberguard | embedded || firewall
  5295. TSeq(Class=RI%gcd=<6%SI=<5FE3BC&>A86A%IPID=RD%TS=U)
  5296. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  5297. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5298. T3(Resp=N)
  5299. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5300. T5(DF=N%W=0%ACK=O|S++%Flags=R|AR%Ops=)
  5301. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5302. T7(Resp=N)
  5303. PU(Resp=N)
  5304.  
  5305. Fingerprint Cyclades PathRouter
  5306. Class Cyclades | Cyras || router
  5307. TSeq(Class=TD|RI%gcd=<618708%SI=<EEE47C)
  5308. T1(DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
  5309. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5310. T3(Resp=Y%DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
  5311. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5312. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5313. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5314. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5315. PU(Resp=N)
  5316.  
  5317. Fingerprint Cyclades PathRouter/PC
  5318. Class Cyclades | Cyras || router
  5319. TSeq(Class=RI|TD%gcd=<618708%SI=<1F343)
  5320. T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  5321. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5322. T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  5323. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5324. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5325. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5326. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5327. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5328.  
  5329. Fingerprint Cyclades PathRAS Remote Access Server v1.1.7
  5330. Class Cyclades | Cyras || terminal server
  5331. TSeq(Class=RI%gcd=<6%SI=>BBBBB)
  5332. T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  5333. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5334. T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  5335. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5336. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5337. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5338. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5339. PU(Resp=N)
  5340.  
  5341. Fingerprint Cyclades PathRouter V 1.2.4
  5342. Class Cyclades | Cyros || router
  5343. TSeq(Class=RI%gcd=<6%SI=>BBBBB)
  5344. T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
  5345. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5346. T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
  5347. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5348. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5349. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  5350. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5351. PU(Resp=N)
  5352.  
  5353. Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12
  5354. Class Cyclades | Cyros || terminal server
  5355. TSeq(Class=TD%gcd=30C382%SI=<BB)
  5356. T1(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  5357. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5358. T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  5359. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  5360. T5(Resp=Y%DF=N%W=218|0%ACK=S|S++%Flags=AR%Ops=|M)
  5361. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  5362. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5363. PU(Resp=N)
  5364.  
  5365. # D-Link Internetwork Operating System Software 2630 Series Software, Version 1.3.1J (FULL), RELEASE SOFTWARE
  5366. Fingerprint D-Link 2630 Broadband router
  5367. Class D-Link | embedded || broadband router
  5368. TSeq(Class=TD%gcd=<2DC04%SI=<1E%IPID=I%TS=U)
  5369. T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=M)
  5370. T2(Resp=N)
  5371. T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=M)
  5372. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5373. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5374. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5375. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5376. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5377.  
  5378. # D-Link DI-713P Wireless router (firmware 2.60 build 6a)
  5379. # 704P Ethernet Broadband Gateway
  5380. Fingerprint D-Link 704P Broadband Gateway or DI-713P WAP
  5381. Class D-Link | embedded || broadband router
  5382. TSeq(Class=RI|TD%gcd=<68%SI=<3A2%IPID=I|BI%TS=U)
  5383. T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  5384. T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
  5385. T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  5386. T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
  5387. T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  5388. T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
  5389. T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  5390. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5391.  
  5392. Fingerprint D-Link DI-604 Broadband router
  5393. Class D-Link | embedded || broadband router
  5394. TSeq(Class=RI%gcd=<68%SI=<13A6&>16%IPID=BI%TS=U)
  5395. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  5396. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5397. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5398. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5399. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5400. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5401. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5402. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5403.  
  5404. # D-Link DI-604 Ethernet Broadband Router with firmware V3.01
  5405. # D-link 4 port Ethernet Broadband Router DI-604 H/W Ver.:D1 F/W Ver.:3.01
  5406. Fingerprint D-Link DI-604 Ethernet Broadband Router
  5407. Class D-Link | embedded || broadband router
  5408. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
  5409. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5410. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5411. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5412. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5413. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5414. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5415. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5416. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5417.  
  5418. Fingerprint D-Link DI-604 Ethernet router
  5419. Class D-Link | embedded || broadband router
  5420. TSeq(Class=TD%gcd=<2C0%SI=<14%IPID=BI%TS=U)
  5421. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  5422. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  5423. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  5424. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  5425. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  5426. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  5427. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  5428. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5429.  
  5430. Fingerprint D-Link DI-701, Version 2.22
  5431. Class D-Link | embedded || broadband router
  5432. TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1)
  5433. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5434. T2(Resp=N)
  5435. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5436. T4(Resp=N)
  5437. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  5438. T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  5439. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  5440. PU(Resp=N)
  5441.  
  5442. Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9
  5443. Class D-Link | embedded || broadband router
  5444. TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U)
  5445. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  5446. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  5447. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  5448. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  5449. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  5450. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  5451. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  5452. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5453.  
  5454. # D-Link DI-704P Cable/DSL Residential Gateway firmware version 2.57 build 3
  5455. Fingerprint D-Link DI-704P Cable/DSL Residential Gateway
  5456. Class D-Link | embedded || broadband router
  5457. TSeq(Class=RI%gcd=<68%SI=<1338&>13%IPID=I%TS=U)
  5458. T1(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=)
  5459. T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=)
  5460. T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
  5461. T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=)
  5462. T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
  5463. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  5464. T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
  5465. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5466.  
  5467. # D-Link DI-804 Cable/DSL Residential Gateway (with firmware v2.00B7)
  5468. # DI-804 Broadband Router with Firmware 2.01
  5469. Fingerprint D-Link DI-804 Cable/DSL Residential Gateway
  5470. Class D-Link | embedded || broadband router
  5471. TSeq(Class=TD|TR%gcd=<10%SI=<3C%IPID=I%TS=U)
  5472. T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  5473. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5474. T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  5475. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5476. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5477. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5478. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5479. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5480.  
  5481. # D-Link DI-804HV 4-Port Broadband VPN Router
  5482. # US-Robotics Wireless Router : Revision Number : Model#8022, Version V4.2, CheckSum# B719
  5483. Fingerprint D-Link DI-804HV VPN Router or US-Robotics 8022 WAP or DI-714P+ Wireless router
  5484. Class D-Link | embedded || broadband router
  5485. Class US Robotics | embedded || WAP
  5486. TSeq(Class=TD%gcd=<3EC%SI=<1E%IPID=I%TS=U)
  5487. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5488. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5489. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5490. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5491. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5492. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5493. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5494. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5495.  
  5496. # D-Link DSL-300G+ version 7.1.0.30 AnnexA  (Oct 18 2002) R2.05.b4t9uk
  5497. Fingerprint D-Link DSL-300G+ DSL modem
  5498. Class D-Link | embedded || broadband router
  5499. TSeq(Class=TD%gcd=<1731C%SI=<14%IPID=I%TS=U)
  5500. T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  5501. T2(Resp=N)
  5502. T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  5503. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  5504. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5505. T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  5506. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5507. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5508.  
  5509. Fingerprint D-Link DSL-500 DSL modem
  5510. Class D-Link | embedded || broadband router
  5511. TSeq(Class=TD%gcd=<1FBD4%SI=<14%IPID=I%TS=U)
  5512. T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  5513. T2(Resp=N)
  5514. T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  5515. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  5516. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5517. T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5518. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5519. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5520.  
  5521. Fingerprint D-Link DSL-500 DSL modem
  5522. Class D-Link | embedded || broadband router
  5523. TSeq(Class=TD%gcd=<EA64%SI=<14%IPID=I%TS=U)
  5524. T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  5525. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5526. T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  5527. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  5528. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5529. T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  5530. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5531. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5532.  
  5533. # D-Link Systems DI-713P Wireless Gateway with firmware 2.60 build 6a
  5534. Fingerprint D-Link Systems DI-713P Wireless Gateway
  5535. Class D-Link | embedded || broadband router
  5536. TSeq(Class=RI%gcd=<CC%SI=<9EC&>2%IPID=BI%TS=U)
  5537. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  5538. T2(Resp=Y%DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=)
  5539. T3(Resp=Y%DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  5540. T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)
  5541. T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
  5542. T6(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=)
  5543. T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
  5544. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5545.  
  5546. # D-Link DI-714P+, Firmware V1.33
  5547. # D-Link 4-port Broadband VPN Router DI-804HV
  5548. Fingerprint D-Link VPN Router DI-714P+/DI-804HV
  5549. Class D-Link | embedded || broadband router
  5550. TSeq(Class=TD%gcd=<3EC%SI=<6E%IPID=I%TS=U)
  5551. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  5552. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5553. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5554. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5555. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5556. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5557. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5558. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5559.  
  5560. # DI-701 Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30
  5561. Fingerprint DI-701 Residential Gateway or KA9Q NOS - KO4KS-TNOS v. 2.30
  5562. Class D-Link | embedded || broadband router
  5563. TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00)
  5564. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  5565. T2(Resp=N)
  5566. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  5567. T4(Resp=N)
  5568. T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  5569. T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  5570. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  5571. PU(Resp=N)
  5572.  
  5573. # D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled
  5574. # Date: Oct 14 1997, Time: 09:35:04  (claims software version 2.04B3,
  5575. # boot PROM version 2.21)
  5576. Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21
  5577. Class D-Link | embedded || hub
  5578. TSeq(Class=TD%gcd=1388%SI=0)
  5579. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  5580. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5581. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5582. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5583. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5584. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5585. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5586. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5587.  
  5588. # D-Link Print Server Model DP-101P+
  5589. Fingerprint D-Link Print Server
  5590. Class D-Link | embedded || print server
  5591. TSeq(Class=TD%gcd=<374%SI=<1E)
  5592. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  5593. T2(Resp=N)
  5594. T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M)
  5595. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5596. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5597. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5598. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5599. PU(Resp=N)
  5600.  
  5601. Fingerprint D-Link VoIP Gateway GS-104SH
  5602. Class D-Link | embedded || telecom-misc
  5603. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5604. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME)
  5605. T2(Resp=N)
  5606. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME)
  5607. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  5608. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  5609. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  5610. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  5611. PU(Resp=N)
  5612.  
  5613. # D-Link DI-604 Ethernet router using firmware 1.62 build 2
  5614. # DI-707P router
  5615. # Sitecom - Broadband Home Station - Firmware R1.96c
  5616. # SMC Barricade Broadband Router with firmware R1.96h2 - internal interface
  5617. Fingerprint Broadband router or WAP: D-Link DI-series, Sitecom BHS WAP, or SMC Barricade
  5618. Class D-Link | embedded || WAP
  5619. TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=BI%TS=U)
  5620. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5621. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5622. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5623. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5624. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5625. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5626. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5627. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5628.  
  5629. # D-Link DI-713P - Firmware version 2.60 build 2
  5630. Fingerprint D-Link DI-713P WAP
  5631. Class D-Link | embedded || WAP
  5632. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  5633. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5634. T2(Resp=N)
  5635. T3(Resp=N)
  5636. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5637. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5638. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5639. T7(Resp=N)
  5640. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5641.  
  5642. Fingerprint D-Link DI-713P Wireless Gateway (2.57 build 3a)
  5643. Class D-Link | embedded || WAP
  5644. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5645. T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
  5646. T2(Resp=N)
  5647. T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
  5648. T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  5649. T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
  5650. T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  5651. T7(Resp=N)
  5652. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5653.  
  5654. # D-Link DI-774 - Firmware Version: 2.27
  5655. Fingerprint D-Link DI-774 WAP
  5656. Class D-Link | embedded || WAP
  5657. TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
  5658. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  5659. T2(Resp=N)
  5660. T3(Resp=N)
  5661. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5662. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5663. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5664. T7(Resp=N)
  5665. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5666.  
  5667. Fingerprint D-Link DWL-5000AP WAP/BSP 1.3
  5668. Class D-Link | embedded || WAP
  5669. TSeq(Class=64K%IPID=I%TS=U)
  5670. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNW)
  5671. T2(Resp=N)
  5672. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5673. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5674. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5675. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5676. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5677. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5678.  
  5679. # SMC Barricade Wireless Broadband Router (firmware R1.93e)
  5680. # D-Link DL-707 Cable/DSL Router
  5681. # USR8022 Wireless Cable/DSL Router with firmware V3.1
  5682. # Tonze IP-W314E  22 Mbps Wireless All-In-One Broadband Router
  5683. Fingerprint D-Link, SMC, Tonze, or US Robotics Wireless Broadband router
  5684. Class D-Link | embedded || WAP
  5685. TSeq(Class=TD%gcd=<130%SI=<1E%IPID=RD|I%TS=U)
  5686. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5687. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5688. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5689. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5690. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5691. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  5692. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  5693. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5694.  
  5695. # D-Link Wireless Access Point (WAP) DRC-1000AP - v3.2.28
  5696. # 3Com 11Mpbs Wireless LAN Access Point 2000 (Firmware 1.2)
  5697. Fingerprint Wireless access point (WAP): D-Link DRC-1000AP or 3Com Access Point 2000
  5698. Class D-Link | embedded || WAP
  5699. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5700. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  5701. T2(Resp=N)
  5702. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  5703. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5704. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5705. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5706. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5707. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5708.  
  5709. Fingerprint D-Link DCS-1000 webcam with firmware 1.06
  5710. Class D-Link | embedded || webcam
  5711. TSeq(Class=TD%gcd=<E0%SI=<14%IPID=I%TS=U)
  5712. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  5713. T2(Resp=N)
  5714. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=ASF%Ops=M)
  5715. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5716. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5717. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5718. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5719. PU(Resp=N)
  5720.  
  5721. Fingerprint D-Link dcs-5300w Wireless WebCam
  5722. Class D-Link | embedded || webcam
  5723. TSeq(Class=TD%gcd=<18%SI=<64%IPID=I%TS=U)
  5724. T1(Resp=N)
  5725. T2(Resp=N)
  5726. T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=)
  5727. T4(Resp=N)
  5728. T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
  5729. T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=)
  5730. T7(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=)
  5731. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5732.  
  5733. # Dlink DVC-1100 Wireless Broadband VideoPhone (Application Version 4.0.0.155, Boot Loader Version 2.0.0.2, App Loader Version 1.0.300.102)
  5734. Fingerprint D-Link DVC-1000 Wireless Broadband VideoPhone
  5735. Class D-Link | embedded || webcam
  5736. TSeq(Class=64K%IPID=I%TS=U)
  5737. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  5738. T2(Resp=N)
  5739. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
  5740. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5741. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5742. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5743. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5744. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5745.  
  5746. Fingerprint AOS/VS on a Data General mainframe
  5747. Class Data General | AOS/VS || general purpose
  5748. TSeq(Class=TD%gcd=32|64|96%SI=1)
  5749. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  5750. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5751. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  5752. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5753. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5754. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5755. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5756. PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  5757.  
  5758. Fingerprint AOS/VS or VSII
  5759. Class Data General | AOS/VS || general purpose
  5760. TSeq(Class=TD%gcd=40|80|C0%SI=0)
  5761. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  5762. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5763. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5764. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5765. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5766. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5767. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5768. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5769.  
  5770. Fingerprint Data General DG/UX Release R4.11MU02
  5771. Class Data General | DG/UX || general purpose
  5772. TSeq(Class=TD%gcd=10000|20000|30000%SI=<F)
  5773. T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
  5774. T2(Resp=N)
  5775. T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
  5776. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  5777. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5778. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5779. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5780. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5781.  
  5782. Fingerprint Data General DG/UX Release R4.20MU02
  5783. Class Data General | DG/UX || general purpose
  5784. TSeq(Class=TD%gcd=<20004%SI=<1E)
  5785. T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
  5786. T2(Resp=N)
  5787. T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
  5788. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  5789. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5790. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5791. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5792. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5793.  
  5794. # DG/UX DataGeneral_Server R4.20MU04 generic AViiON Pentium Pro
  5795. Fingerprint Data General DG/UX Release R4.20MU04
  5796. Class Data General | DG/UX || general purpose
  5797. TSeq(Class=RI%gcd=<6%SI=<32CBC&>281)
  5798. T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
  5799. T2(Resp=N)
  5800. T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
  5801. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  5802. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5803. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5804. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5805. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5806.  
  5807. Fingerprint Data General DG/UX Release R4.20MU06
  5808. Class Data General | DG/UX || general purpose
  5809. TSeq(Class=RI%gcd=<6%SI=<E21EE&>779%IPID=I%TS=U)
  5810. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
  5811. T2(Resp=N)
  5812. T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=)
  5813. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  5814. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5815. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5816. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5817. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5818.  
  5819. Fingerprint 4.3BSD-tahoe on a MicroVax III
  5820. Class DEC | BSD-misc || general purpose
  5821. TSeq(Class=64K%IPID=I%TS=U)
  5822. T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=)
  5823. T2(Resp=N)
  5824. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5825. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5826. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5827. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5828. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5829. PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5830.  
  5831. Fingerprint DEC OSF/1 V1.3A - 2.0
  5832. Class DEC | DIGITAL UNIX | 1.X | general purpose
  5833. Class DEC | DIGITAL UNIX | 2.X | general purpose
  5834. TSeq(Class=64K)
  5835. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  5836. T2(Resp=N)
  5837. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
  5838. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5839. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5840. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5841. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5842. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5843.  
  5844. Fingerprint DIGITAL UNIX OSF1 V 3.0,3.2,3.2C
  5845. Class DEC | DIGITAL UNIX | 3.X | general purpose
  5846. TSeq(Class=64K)
  5847. T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW)
  5848. T2(Resp=N)
  5849. T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=)
  5850. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5851. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5852. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5853. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5854. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5855.  
  5856. Fingerprint DEC DIGITAL UNIX OSF1 V 4.0-4.0F
  5857. Class DEC | DIGITAL UNIX | 4.X | general purpose
  5858. TSeq(Class=C|RI%gcd=<6)
  5859. T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW)
  5860. T2(Resp=N)
  5861. T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=)
  5862. T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=)
  5863. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5864. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5865. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5866. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  5867.  
  5868. Fingerprint DIGITAL UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F
  5869. Class DEC | DIGITAL UNIX | 4.X | general purpose
  5870. TSeq(Class=RI|TD|64K%gcd=<6)  # Boy, OSF1 comes in all colors!
  5871. T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW)
  5872. T2(Resp=N)
  5873. T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=)
  5874. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5875. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5876. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5877. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5878. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5879.  
  5880. Fingerprint DEC OSF1 (AKA Compaq/DIGITAL Tru64 UNIX) Version 5.0.0
  5881. Class DEC | DIGITAL UNIX | 5.X | general purpose
  5882. TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U)
  5883. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  5884. T2(Resp=N)
  5885. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
  5886. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5887. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5888. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5889. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5890. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5891.  
  5892. Fingerprint OSF/1 (AKA Compaq/DIGITAL Tru64 UNIX) 5.60
  5893. Class DEC | DIGITAL UNIX | 5.X | general purpose
  5894. TSeq(Class=64K)
  5895. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW)
  5896. T2(Resp=N)
  5897. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  5898. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5899. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5900. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5901. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5902. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5903.  
  5904. Fingerprint DECNIS 600 V4.1.3B multiprotocol bridge/router
  5905. Class DEC | embedded || router
  5906. TSeq(Class=TD%gcd=30D4|C35%SI=<F)
  5907. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  5908. T2(Resp=N)
  5909. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  5910. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5911. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5912. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5913. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5914. PU(Resp=N)
  5915.  
  5916. # DECserver 700-16, Network Access SW V2.2
  5917. Fingerprint DECserver 700-16 terminal server, Network Access SW V2.2
  5918. Class DEC | embedded || terminal server
  5919. TSeq(Class=64K)
  5920. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  5921. T2(Resp=N)
  5922. T3(Resp=Y%DF=N%W=600%ACK=S++|O%Flags=AR|A%Ops=)
  5923. T4(DF=N%W=600%ACK=O%Flags=R%Ops=)
  5924. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5925. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5926. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5927. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5928.  
  5929. Fingerprint DEC OpenVMS 6.1
  5930. Class DEC | OpenVMS | 6.X | general purpose
  5931. TSeq(Class=64K)
  5932. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|MWN)
  5933. T2(Resp=N)
  5934. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5935. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5936. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5937. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5938. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5939. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5940.  
  5941. Fingerprint DEC OpenVMS 6.2
  5942. Class DEC | OpenVMS | 6.X | general purpose
  5943. TSeq(Class=TR)
  5944. T1(Resp=Y%DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  5945. T2(Resp=N)
  5946. T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  5947. T4(Resp=Y%DF=N%W=2200%ACK=O%Flags=R%Ops=)
  5948. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5949. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5950. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5951. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5952.  
  5953. Fingerprint DEC OpenVMS 6.2
  5954. Class DEC | OpenVMS | 6.X | general purpose
  5955. TSeq(Class=RI%gcd=<6%SI=<4D8%IPID=BI%TS=U)
  5956. T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
  5957. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  5958. T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=AS%Ops=MWL)
  5959. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5960. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5961. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5962. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5963. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5964.  
  5965. # DIGITAL TCP/IP Services for OpenVMS Alpha Version V4.2 - ECO 4 on a AlphaServer 8400 5/625 running OpenVMS V6.2-1H3
  5966. Fingerprint DEC OpenVMS 6.2
  5967. Class DEC | OpenVMS | 6.X | general purpose
  5968. TSeq(Class=64K%IPID=I%TS=U)
  5969. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MWN)
  5970. T2(Resp=N)
  5971. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  5972. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5973. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5974. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5975. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5976. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5977.  
  5978. Fingerprint DEC OpenVMS 6.2 - 7.2-1 on VAX or AXP
  5979. Class DEC | OpenVMS | 6.X | general purpose
  5980. Class DEC | OpenVMS | 7.X | general purpose
  5981. TSeq(Class=TR%gcd=<6)
  5982. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  5983. T2(Resp=N)
  5984. T3(Resp=Y%DF=Y|N%W=1800%ACK=O%Flags=A%Ops=NNT)
  5985. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  5986. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5987. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5988. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5989. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5990.  
  5991. Fingerprint DEC OpenVMS 6.2/Alpha
  5992. Class DEC | OpenVMS | 6.X | general purpose
  5993. TSeq(Class=TR%gcd=<6)
  5994. T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  5995. T2(Resp=N)
  5996. T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  5997. T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  5998. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5999. T6(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  6000. T7(Resp=N)
  6001. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%UCK=0%ULEN=134%DAT=E)
  6002.  
  6003. Fingerprint DEC OpenVMS Alpha 6.2 running DIGITAL TCP/IP Services (UCX) v4.0
  6004. Class DEC | OpenVMS | 6.X | general purpose
  6005. TSeq(Class=64K)
  6006. T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
  6007. T2(Resp=N)
  6008. T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
  6009. T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
  6010. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6011. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6012. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6013. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6014.  
  6015. Fingerprint DEC OpenVMS AXP 6.2 running Attachmate Pathway 3.1 TCP stack
  6016. Class DEC | OpenVMS | 6.X | general purpose
  6017. TSeq(Class=i800|64K)
  6018. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  6019. T2(Resp=N)
  6020. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=)
  6021. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6022. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6023. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6024. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6025. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6026.  
  6027. Fingerprint DEC OpenVMS V6.1 on VAX 4000-105A
  6028. Class DEC | OpenVMS | 6.X | general purpose
  6029. TSeq(Class=64K)
  6030. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  6031. T2(Resp=N)
  6032. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=)
  6033. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  6034. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6035. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6036. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6037. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6038.  
  6039. Fingerprint DEC OpenVMS 7.1
  6040. Class DEC | OpenVMS | 7.X | general purpose
  6041. TSeq(Class=TR)
  6042. T1(DF=N%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  6043. T2(Resp=N)
  6044. T3(Resp=Y%DF=N%W=2200%ACK=O%Flags=A%Ops=NNT)
  6045. T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  6046. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6047. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6048. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6049. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6050.  
  6051. Fingerprint DEC OpenVMS 7.1 ALPHA
  6052. Class DEC | OpenVMS | 7.X | general purpose
  6053. TSeq(Class=RI%gcd=<6%SI=<8A840&>1009%IPID=I%TS=U)
  6054. T1(DF=N%W=7E4A%ACK=S++%Flags=AS%Ops=MNW)
  6055. T2(Resp=N)
  6056. T3(Resp=Y%DF=N%W=7E4A%ACK=O%Flags=A%Ops=)
  6057. T4(DF=N%W=7E00%ACK=O%Flags=R%Ops=)
  6058. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6059. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6060. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6061. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6062.  
  6063. Fingerprint DEC OpenVMS 7.1 Alpha running DIGITAL's UCX v4.1ECO2 TCP/IP package
  6064. Class DEC | OpenVMS | 7.X | general purpose
  6065. TSeq(Class=64K)
  6066. T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
  6067. T2(Resp=N)
  6068. T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
  6069. T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
  6070. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6071. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6072. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6073. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6074.  
  6075. Fingerprint DEC OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package
  6076. Class DEC | OpenVMS | 7.X | general purpose
  6077. TSeq(Class=RI|TD%gcd=<6%SI=<BBBB)
  6078. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MWL)
  6079. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  6080. T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MWL)
  6081. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  6082. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  6083. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  6084. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  6085. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6086.  
  6087. # DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A - ECO 1 on a AlphaServer DS20 500 MHz running OpenVMS V7.2-1
  6088. Fingerprint DEC OpenVMS 7.2
  6089. Class DEC | OpenVMS | 7.X | general purpose
  6090. TSeq(Class=RI%gcd=<8%SI=<527E2&>543%IPID=I%TS=U)
  6091. T1(DF=N%W=C3A5%ACK=S++%Flags=AS%Ops=MNW)
  6092. T2(Resp=N)
  6093. T3(Resp=Y%DF=N%W=C3A5%ACK=O%Flags=A%Ops=)
  6094. T4(DF=N%W=C350%ACK=O%Flags=R%Ops=)
  6095. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6096. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6097. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6098. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6099.  
  6100. Fingerprint DEC OpenVMS 7.2
  6101. Class DEC | OpenVMS | 7.X | general purpose
  6102. TSeq(Class=RI%gcd=<44%SI=<2670&>3B%IPID=I%TS=U)
  6103. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  6104. T2(Resp=N)
  6105. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  6106. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6107. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6108. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6109. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6110. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6111.  
  6112. # Digital OpenVMS Alpha 7.2
  6113. Fingerprint DEC OpenVMS 7.2 Alpha
  6114. Class DEC | OpenVMS | 7.X | general purpose
  6115. TSeq(Class=64K%IPID=I%TS=U)
  6116. T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW)
  6117. T2(Resp=N)
  6118. T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
  6119. T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
  6120. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6121. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6122. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6123. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6124.  
  6125. # The OS was running on a GS1280 Alpha server
  6126. Fingerprint DEC OpenVMS 7.3
  6127. Class DEC | OpenVMS | 7.X | general purpose
  6128. TSeq(Class=TR%gcd=<6%TS=U)
  6129. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M)
  6130. T2(Resp=N)
  6131. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  6132. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6133. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6134. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6135. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6136. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6137.  
  6138. # OpenVMS 7.3 with TCP/IP 5.3
  6139. Fingerprint DEC OpenVMS 7.3 (Alpha) TCP/IP 5.3
  6140. Class DEC | OpenVMS | 7.X | general purpose
  6141. TSeq(Class=TR%gcd=<6%TS=U)
  6142. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  6143. T2(Resp=N)
  6144. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  6145. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6146. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6147. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6148. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6149. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  6150.  
  6151. Fingerprint DEC OpenVMS 7.3 (Compaq TCP/IP 5.3)
  6152. Class DEC | OpenVMS | 7.X | general purpose
  6153. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6154. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  6155. T2(Resp=N)
  6156. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  6157. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6158. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6159. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6160. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6161. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6162.  
  6163. Fingerprint DEC OpenVMS 7.3-1
  6164. Class DEC | OpenVMS | 7.X | general purpose
  6165. TSeq(Class=RI%gcd=<6%SI=<56E82&>B37%IPID=I%TS=U)
  6166. T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW)
  6167. T2(Resp=N)
  6168. T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
  6169. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6170. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6171. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6172. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6173. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6174.  
  6175. Fingerprint DEC OpenVMS Alpha 7.2-3
  6176. Class DEC | OpenVMS | 7.X | general purpose
  6177. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6178. T1(DF=N%W=C6C%ACK=S++|O%Flags=AS%Ops=MNW)
  6179. T2(Resp=N)
  6180. T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
  6181. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6182. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6183. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6184. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6185. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6186.  
  6187. Fingerprint DEC OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2
  6188. Class DEC | OpenVMS | 7.X | general purpose
  6189. TSeq(Class=64K)
  6190. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN)
  6191. T2(Resp=N)
  6192. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6193. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6194. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6195. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6196. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6197. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6198.  
  6199. Fingerprint DEC OpenVMS V7.1 on VAX 6000-530
  6200. Class DEC | OpenVMS | 7.X | general purpose
  6201. TSeq(Class=64K%gcd=<6%SI=<14)
  6202. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=)
  6203. T2(Resp=N)
  6204. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  6205. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  6206. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6207. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6208. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6209. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6210.  
  6211. Fingerprint DEC OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package
  6212. Class DEC | OpenVMS | 7.X | general purpose
  6213. T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
  6214. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  6215. T3(Resp=N)
  6216. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  6217. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  6218. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  6219. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  6220. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6221.  
  6222. # DEC VAXVMS TCPIP V5.1-15  Full LP Installed
  6223. Fingerprint DEC OpenVMS v7.3 on VAXStation 4000/60
  6224. Class DEC | OpenVMS | 7.X | general purpose
  6225. TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U)
  6226. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  6227. T2(Resp=N)
  6228. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  6229. T4(Resp=N)
  6230. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6231. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6232. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6233. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6234.  
  6235. Fingerprint DEC OpenVMS VAX V7.3, Process Software MultiNet V5.0
  6236. Class DEC | OpenVMS | 7.X | general purpose
  6237. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  6238. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  6239. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6240. T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  6241. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6242. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6243. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6244. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6245. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6246.  
  6247. Fingerprint DEC OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4
  6248. Class DEC | OpenVMS | 7.X | general purpose
  6249. TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U)
  6250. T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL)
  6251. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  6252. T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL)
  6253. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  6254. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  6255. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  6256. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  6257. PU(Resp=N)
  6258.  
  6259. Fingerprint DEC VMS MultiNet V4.2(16)/ OpenVMS V7.1-2
  6260. Class DEC | OpenVMS | 7.X | general purpose
  6261. TSeq(Class=TR%gcd=<6)
  6262. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  6263. T2(Resp=N)
  6264. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
  6265. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  6266. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6267. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6268. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6269. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6270.  
  6271. Fingerprint DEC VMS MultiNet V4.4 / OpenVMS V7.1
  6272. Class DEC | OpenVMS | 7.X | general purpose
  6273. TSeq(Class=TR%gcd=<6%TS=2HZ)
  6274. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  6275. T2(Resp=N)
  6276. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
  6277. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  6278. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6279. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6280. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6281. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6282.  
  6283. Fingerprint DEC TOPS-20 Monitor 7(102540)-1,TD-1
  6284. Class DEC | TOPS-20 || general purpose
  6285. TSeq(Class=TD%gcd=30000|60000|90000%SI=<BB)
  6286. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  6287. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6288. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6289. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6290. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6291. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6292. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6293. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6294.  
  6295. Fingerprint DEC TOPS-20 Monitor 7(21733),KL-10 (DEC 2065)
  6296. Class DEC | TOPS-20 || general purpose
  6297. TSeq(Class=TD%gcd=<60004%SI=<1E%TS=U)
  6298. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  6299. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  6300. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  6301. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  6302. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6303. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  6304. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  6305. PU(Resp=N)
  6306.  
  6307. Fingerprint DEC Ultrix 4.1
  6308. Class DEC | Ultrix || general purpose
  6309. TSeq(Class=64K)
  6310. T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=)
  6311. T2(Resp=N)
  6312. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  6313. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  6314. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6315. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6316. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6317. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6318.  
  6319. Fingerprint DEC Ultrix 4.2 - 4.5
  6320. Class DEC | Ultrix || general purpose
  6321. TSeq(Class=64K)
  6322. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=|M)
  6323. T2(Resp=N)
  6324. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  6325. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  6326. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6327. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6328. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6329. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6330.  
  6331. Fingerprint DEC OpenVMS 7.3-1 w/Multinet 4.4
  6332. Class DEC | VMS || general purpose
  6333. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  6334. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  6335. T2(Resp=N)
  6336. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
  6337. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  6338. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6339. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6340. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6341. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6342.  
  6343. Fingerprint DEC VAX 7000-610 or 4200/SPX OR 6000-430
  6344. Class DEC | VMS || general purpose
  6345. TSeq(Class=64K)
  6346. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  6347. T2(Resp=N)
  6348. T3(Resp=Y%DF=N%W=1800%ACK=O%Flags=A%Ops=)
  6349. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  6350. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6351. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6352. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6353. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6354.  
  6355. Fingerprint DEC VAX/VMS 5.3 on a MicroVAX II
  6356. Class DEC | VMS || general purpose
  6357. TSeq(Class=64K)
  6358. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6359. T2(Resp=N)
  6360. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6361. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6362. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6363. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6364. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6365. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6366.  
  6367. # VMS 5.5-2 on VAX (VaxStation 4)
  6368. Fingerprint DEC VAX/VMS 5.5-2
  6369. Class DEC | VMS || general purpose
  6370. TSeq(Class=64K%IPID=I%TS=U)
  6371. T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=M)
  6372. T2(Resp=N)
  6373. T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
  6374. T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
  6375. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6376. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6377. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6378. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6379.  
  6380. Fingerprint DEC VAX/VMS v5.5, CMU-TEK TCP/IP stack
  6381. Class DEC | VMS || general purpose
  6382. TSeq(Class=RI%gcd=<6%SI=>BBBBB)
  6383. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  6384. T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=)
  6385. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  6386. T4(DF=N%W=64%ACK=O%Flags=AR%Ops=)
  6387. T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
  6388. T6(DF=N%W=64%ACK=O%Flags=AR%Ops=)
  6389. T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
  6390. PU(Resp=N)
  6391.  
  6392. Fingerprint DEC VMS MultiNet V4.1(16)
  6393. Class DEC | VMS || general purpose
  6394. TSeq(Class=TR%gcd=<6)
  6395. T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  6396. T2(Resp=N)
  6397. T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  6398. T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  6399. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6400. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6401. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6402. PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6403.  
  6404. # dell 5100 printer
  6405. # Dell 3100cn printer, OEM of Xerox DocuPrint C525A
  6406. Fingerprint Dell 3100cn/5100cn printer
  6407. Class Dell | embedded || printer
  6408. TSeq(Class=64K%IPID=I%TS=U)
  6409. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  6410. T2(Resp=N)
  6411. T3(Resp=Y%DF=N%W=3000%ACK=S++|O%Flags=AR|A%Ops=)
  6412. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  6413. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6414. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6415. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6416. PU(DF=N%TOS=0%IPLEN=38%RIPTL=4E4%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6417.  
  6418. # Dell Remote Access Card III/XT
  6419. # Dell Remote Access Card 4/I (DRAC4)
  6420. # Drac III/XT Administation Card for Dell PowerEdge
  6421. # Dell Remote Access Controller 4/I (DRAC 4/I) Version 1.20 (Build 03.15)
  6422. Fingerprint Dell Remote Access Controller III/XT or 4/I
  6423. Class Dell | embedded || remote management
  6424. TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U)
  6425. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6426. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6427. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6428. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6429. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6430. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6431. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6432. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6433.  
  6434. Fingerprint Dell Powervault 132T Automated Tape Library
  6435. Class Dell | embedded || storage-misc
  6436. TSeq(Class=64K%IPID=I%TS=U)
  6437. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
  6438. T2(Resp=N)
  6439. T3(Resp=N)
  6440. T4(Resp=N)
  6441. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6442. T6(Resp=N)
  6443. T7(Resp=N)
  6444. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6445.  
  6446. # Dell PowerVault 132T Library (Firmware 103D.GY001)
  6447. Fingerprint Dell Powervault 132T Automated Tape Library
  6448. Class Dell | embedded || storage-misc
  6449. TSeq(Class=64K%IPID=I%TS=U)
  6450. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
  6451. T2(Resp=N)
  6452. T3(Resp=Y%DF=N%W=578%ACK=O%Flags=A%Ops=)
  6453. T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
  6454. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6455. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6456. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6457. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6458.  
  6459. Fingerprint Dell Tape Library MSL6030
  6460. Class Dell | embedded || storage-misc
  6461. TSeq(Class=TD%gcd=<2004%SI=<1D6%IPID=I%TS=1000HZ)
  6462. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  6463. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6464. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  6465. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6466. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6467. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6468. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6469. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6470.  
  6471. # Dell PowerConnect 3324 Switch
  6472. # Dell PowerConnect 3348 Switch, Software Version 1.2.0.6 Boot Version 1.0.0.13
  6473. # Dell 3324 PowerConnect Switch with firmware version 1.1.0.42
  6474. Fingerprint Dell PowerConnect Switch 3324 or 3348
  6475. Class Dell | embedded || switch
  6476. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6477. T1(DF=N%W=200|800%ACK=S++%Flags=AS%Ops=)
  6478. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6479. T3(Resp=Y%DF=N%W=200|800%ACK=S++%Flags=AS%Ops=)
  6480. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6481. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6482. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6483. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6484. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6485.  
  6486. # Dell PowerConnect 5324 24 Port Gigabit Switch
  6487. Fingerprint Dell PowerConnect Switch 5324
  6488. Class Dell | embedded || switch
  6489. TSeq(Class=TD%gcd=<2C%SI=<1E%IPID=I%TS=U)
  6490. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=)
  6491. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6492. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=)
  6493. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6494. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6495. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6496. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6497. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6498.  
  6499. # Dell PowerConnect Switch running SW V.1.0.0.52
  6500. Fingerprint Dell PowerConnect Switch running SW V.1.0.0.52
  6501. Class Dell | embedded || switch
  6502. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6503. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=)
  6504. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6505. T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=)
  6506. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6507. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6508. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6509. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6510. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6511.  
  6512. Fingerprint Digital Link DL2001 CSU/DSU Management Access Processor
  6513. Class Digital Link | embedded || CSUDSU
  6514. TSeq(Class=TD%gcd=<2780%SI=<14)
  6515. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6516. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6517. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6518. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6519. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6520. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6521. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6522. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6523.  
  6524. Fingerprint Digital Networks VNswitch 900
  6525. Class Digital Networks | embedded || switch
  6526. TSeq(Class=TD%gcd=<4%SI=<4)
  6527. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
  6528. T2(Resp=N)
  6529. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6530. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6531. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6532. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6533. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6534. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6535.  
  6536. Fingerprint Digitel NetRouter NR3000
  6537. Class Digitel | embedded || router
  6538. TSeq(Class=RI%gcd=<2004%SI=<10CC&>16)
  6539. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  6540. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6541. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  6542. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6543. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6544. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6545. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6546. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  6547.  
  6548. Fingerprint Digitel NetRouter NR3100
  6549. Class Digitel | embedded || router
  6550. TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U)
  6551. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  6552. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6553. T3(Resp=N)
  6554. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6555. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6556. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6557. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6558. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6559.  
  6560. Fingerprint Draytek Vigor 2000 ISDN router
  6561. Class Draytek | embedded || broadband router
  6562. T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  6563. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6564. T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  6565. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6566. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6567. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6568. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6569. PU(Resp=N)
  6570.  
  6571. Fingerprint Draytek Vigor 2200e DSL router v2.1a
  6572. Class Draytek | embedded || broadband router
  6573. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6574. T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
  6575. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6576. T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
  6577. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6578. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6579. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6580. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6581. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6582.  
  6583. Fingerprint Draytek Vigor 2200e DSL router v2.1b
  6584. Class Draytek | embedded || broadband router
  6585. TSeq(Class=RI%gcd=<6%SI=<2D38FC2&>72E8A%IPID=Z%TS=100HZ)
  6586. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  6587. T2(Resp=N)
  6588. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  6589. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6590. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6591. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6592. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6593. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  6594.  
  6595. # Software version VIK-1.35.020320j -- www.easytel.fi
  6596. Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router
  6597. Class Easytel | embedded || broadband router
  6598. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6599. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  6600. T2(Resp=N)
  6601. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  6602. T4(Resp=N)
  6603. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  6604. T6(Resp=N)
  6605. T7(Resp=N)
  6606. PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6607.  
  6608. Fingerprint Edimax BR-6004 Broadband router
  6609. Class Edimax | embedded || broadband router
  6610. TSeq(Class=i800%IPID=I%TS=2HZ)
  6611. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  6612. T2(Resp=N)
  6613. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  6614. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  6615. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6616. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6617. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6618.  
  6619. Fingerprint Edimax PS-1001 Print Server model
  6620. Class Edimax | embedded || print server
  6621. TSeq(Class=TD%gcd=<1C004%SI=<244%IPID=I%TS=U)
  6622. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  6623. T2(Resp=N)
  6624. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  6625. T4(Resp=N)
  6626. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6627. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6628. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6629. PU(Resp=N)
  6630.  
  6631. Fingerprint Edimax PS-901 Print Server model 1P/13E-9.5.12
  6632. Class Edimax | embedded || print server
  6633. TSeq(Class=RI%gcd=<2004%SI=<12D4&>1C%IPID=I%TS=U)
  6634. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  6635. T2(Resp=N)
  6636. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  6637. T4(Resp=N)
  6638. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6639. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6640. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6641. PU(Resp=N)
  6642.  
  6643. Fingerprint Efficient Networks/SpeedStream DSL router
  6644. Class Efficient Networks | embedded || broadband router
  6645. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6646. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  6647. T2(Resp=N)
  6648. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  6649. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6650. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6651. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6652. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6653. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6654.  
  6655. Fingerprint Eicon Diva1830 ISDN router running 1.5 firmware
  6656. Class Eicon | embedded || broadband router
  6657. TSeq(Class=TD%gcd=<20004%SI=<14%IPID=I%TS=U)
  6658. T1(DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
  6659. T2(Resp=Y%DF=N%W=1%ACK=S%Flags=AR%Ops=)
  6660. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
  6661. T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
  6662. T5(DF=N%W=1%ACK=S++%Flags=AR%Ops=)
  6663. T6(DF=N%W=1%ACK=O%Flags=R%Ops=)
  6664. T7(DF=N%W=1%ACK=S%Flags=AR%Ops=)
  6665. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6666.  
  6667. # ELSA LANCOM 1100 Office, Firmware 2.50.0005 / 15.11.2001
  6668. Fingerprint ELSA LANCOM 1100 office router
  6669. Class Elsa | embedded || broadband router
  6670. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6671. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
  6672. T2(Resp=N)
  6673. T3(Resp=N)
  6674. T4(Resp=N)
  6675. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6676. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6677. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6678. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  6679.  
  6680. Fingerprint ELSA LANCOM DSL I-10 Office router
  6681. Class Elsa | embedded || broadband router
  6682. TSeq(Class=TR%gcd=<6%IPID=I)
  6683. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=WNMETL)
  6684. T2(Resp=N)
  6685. T3(Resp=N)
  6686. T4(Resp=N)
  6687. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6688. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6689. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6690. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6691.  
  6692. # ELSA LANCOM Wireless L-11 3.42.0021 / 24.06.2004
  6693. # Lancom (Elsa) DSL I-10 Office Firmware 3.2
  6694. Fingerprint ELSA LANCOM DSL I-10 Office router or Wireless L-11
  6695. Class Elsa | embedded || broadband router
  6696. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6697. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
  6698. T2(Resp=N)
  6699. T3(Resp=N)
  6700. T4(Resp=N)
  6701. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6702. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6703. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6704. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6705.  
  6706. # LANCOM DSL/10 Office DSL router with firmware v3.22
  6707. Fingerprint ELSA LANCOM DSL/10 Office DSL router
  6708. Class Elsa | embedded || broadband router
  6709. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6710. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
  6711. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6712. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6713. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6714. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6715. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6716. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6717. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6718.  
  6719. # ELSA LANCOM DSL/10 Office router 2.62.0002
  6720. Fingerprint ELSA LANCOM DSL/10 office router
  6721. Class Elsa | embedded || broadband router
  6722. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6723. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=M)
  6724. T2(Resp=N)
  6725. T3(Resp=N)
  6726. T4(Resp=N)
  6727. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6728. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6729. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6730. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  6731.  
  6732. Fingerprint ELSA LANCOM DSL/10 office router
  6733. Class Elsa | embedded || broadband router
  6734. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6735. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6736. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6737. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6738. T5(Resp=N)
  6739. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6740. T7(Resp=N)
  6741. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6742.  
  6743. # ELSA LANCOM DSL/I-1611 Office 2.70.0025 / 06.08.2002 http://www.lancom-systems.de/
  6744. # ELSA LANCOM DSL/I-1611 Office 2.50.0005 / 15.11.2001
  6745. Fingerprint ELSA LANCOM DSL/I-1611 Office router
  6746. Class Elsa | embedded || broadband router
  6747. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6748. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
  6749. T2(Resp=N)
  6750. T3(Resp=N)
  6751. T4(Resp=N)
  6752. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6753. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6754. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6755. PU(Resp=N)
  6756.  
  6757. Fingerprint EMC DART running on a Data Mover fileserver. Version T4.1.8.1
  6758. Class EMC | DART || fileserver
  6759. TSeq(Class=64K%IPID=I%TS=2HZ)
  6760. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6761. T2(Resp=N)
  6762. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  6763. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6764. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6765. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6766. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6767. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  6768.  
  6769. Fingerprint EMC IP4700 Filer
  6770. Class EMC | DART || fileserver
  6771. TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ)
  6772. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  6773. T2(Resp=N)
  6774. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  6775. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6776. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6777. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6778. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6779. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6780.  
  6781. # Enterasys XSR-1805 Software Version 6.0.0.0, Built Sep 14 2003, 11:09:28
  6782. Fingerprint Enterasys XSR-1805 Security Route
  6783. Class Enterasys | embedded || firewall
  6784. TSeq(Class=RI%gcd=<6%SI=<55280&>B75%IPID=I%TS=2HZ)
  6785. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6786. T2(Resp=N)
  6787. T3(Resp=N)
  6788. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6789. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6790. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6791. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6792. PU(Resp=N)
  6793.  
  6794. # Enterasys XP-2400 switch running Enterasys E9.0.0.0
  6795. # Cabletron Smartswitch 6000 running Enterasys E8.2.0.0
  6796. Fingerprint Enterasys/Cabletron switch running Enterasys E8.2.0.0 - E9.0.0.0
  6797. Class Enterasys | embedded || switch
  6798. TSeq(Class=RI%gcd=<6%SI=<7A31E&>10AD%IPID=I%TS=2HZ)
  6799. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6800. T2(Resp=N)
  6801. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6802. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  6803. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6804. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6805. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6806. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6807.  
  6808. Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98
  6809. Class Epson | embedded || printer
  6810. TSeq(Class=TR)
  6811. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  6812. T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6813. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=)
  6814. T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6815. T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6816. T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6817. T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6818. PU(Resp=N)
  6819.  
  6820. Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20
  6821. Class Epson | embedded || printer
  6822. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  6823. T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6824. T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
  6825. T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6826. T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6827. T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6828. T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  6829. PU(Resp=N)
  6830.  
  6831. # Ericsson Congo router running software version 9.9.34
  6832. Fingerprint Ericsson Congo router
  6833. Class Ericsson | embedded || broadband router
  6834. TSeq(Class=64K%IPID=I%TS=U)
  6835. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6836. T2(Resp=N)
  6837. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6838. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6839. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6840. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6841. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6842. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  6843.  
  6844. Fingerprint Ericsson HM220dp ADSL modem/router
  6845. Class Ericsson | embedded || broadband router
  6846. TSeq(Class=TD%gcd=<50000%SI=<1E%IPID=I%TS=U)
  6847. T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  6848. T2(Resp=N)
  6849. T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  6850. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  6851. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6852. T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  6853. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6854. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6855.  
  6856. # Ericsson Tigris Access Server V. 12.1.15 with 10.2 ISDN code
  6857. # Integrated Access Platform, Software Version  = 12.1.1.22 (ISDN Software Version 10.1)
  6858. Fingerprint Ericsson Tigris Access Server Software V. 12.1.*
  6859. Class Ericsson | embedded || terminal server
  6860. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6861. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  6862. T2(Resp=N)
  6863. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  6864. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6865. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6866. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6867. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6868. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6869.  
  6870. Fingerprint Exabyte X80 tape backup robot
  6871. Class Exabyte | embedded || storage-misc
  6872. TSeq(Class=TD%gcd=<6004%SI=<14%IPID=I%TS=U)
  6873. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  6874. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6875. T3(Resp=Y%DF=N%W=16D0|0%ACK=S++|O%Flags=AS|AR%Ops=M|)
  6876. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6877. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6878. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6879. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6880. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6881.  
  6882. Fingerprint Extreme Gigabit switch (unknown version)
  6883. Class Extreme Networks | embedded || switch
  6884. TSeq(Class=64K)
  6885. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6886. T2(Resp=N)
  6887. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6888. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6889. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6890. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6891. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6892. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6893.  
  6894. Fingerprint Extreme Networks Black Diamond switch
  6895. Class Extreme Networks | embedded || switch
  6896. TSeq(Class=64K%gcd=<6%SI=<14)
  6897. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  6898. T2(Resp=N)
  6899. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6900. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6901. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6902. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6903. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6904. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6905.  
  6906. Fingerprint Extreme Networks Alpine 3804 Switch running Extremeware 6.2.1
  6907. Class Extreme Networks | Extremeware || switch
  6908. TSeq(Class=RI%gcd=<6%SI=<1598C&>223)
  6909. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6910. T2(Resp=N)
  6911. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6912. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6913. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6914. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6915. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6916. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6917.  
  6918. # Extremeware Version 6.2.2 (Build 68) by Release_Master 01/15/03 16:58:48
  6919. Fingerprint Extremeware 6.2.2
  6920. Class Extreme Networks | Extremeware || switch
  6921. TSeq(Class=RI%gcd=<6%SI=<2F062&>36C%IPID=I%TS=U)
  6922. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  6923. T2(Resp=N)
  6924. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  6925. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  6926. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6927. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6928. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6929. PU(DF=Y%TOS=C0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6930.  
  6931. Fingerprint F5 Labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86)
  6932. Class F5 Labs | BSDI || load balancer
  6933. TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4)
  6934. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  6935. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6936. T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT)
  6937. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6938. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6939. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6940. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6941. PU(Resp=N)
  6942.  
  6943. # F5 labs BIG-IP Load balancer.  BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386
  6944. # F5 BIG-IP 540 loadbalancer.
  6945. Fingerprint F5 Labs BIG-IP Load balancer Kernel 4.1.1PTF-03 (x86)
  6946. Class F5 Labs | embedded || load balancer
  6947. TSeq(Class=TR%gcd=<6)
  6948. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  6949. T2(Resp=N)
  6950. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  6951. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6952. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6953. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6954. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6955. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  6956.  
  6957. Fingerprint F5 Labs BIG-IP load balancer kernel 4.2PTF-05a (x86)
  6958. Class F5 Labs | embedded || load balancer
  6959. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  6960. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  6961. T2(Resp=N)
  6962. T3(Resp=N)
  6963. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6964. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6965. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6966. T7(Resp=N)
  6967. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  6968.  
  6969. Fingerprint FastComm FRAD (Frame Relay Access Device) F9200-DS-DNI -- Ver. 4.2.3A
  6970. Class FastComm | embedded || specialized
  6971. TSeq(Class=TD|RI%gcd=<8%SI=<1E)
  6972. T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=)
  6973. T2(Resp=N)
  6974. T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=)
  6975. T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=)
  6976. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6977. T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=)
  6978. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6979. PU(Resp=N)
  6980.  
  6981. # Fiber Line Wireless Broadband DSL Router, type: 802.11g, hardware release: R1.03SRM firmware version: V1.96.1g
  6982. Fingerprint FiberLine Wireless DSL router
  6983. Class FiberLine | embedded || broadband router
  6984. TSeq(Class=RI%gcd=<6%SI=<23C9F22&>5B99B%IPID=Z%TS=1000HZ)
  6985. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  6986. T2(Resp=N)
  6987. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  6988. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6989. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6990. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6991. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6992. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  6993.  
  6994. Fingerprint FiberLine WL-1200R1 (also known as InterEpoch IWE-1200A-1) Wireless Broadband Router (WAP)
  6995. Class FiberLine | embedded || WAP
  6996. TSeq(Class=TD%gcd=<8%SI=<14%IPID=I%TS=U)
  6997. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
  6998. T2(Resp=N)
  6999. T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
  7000. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7001. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7002. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7003. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7004. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7005.  
  7006. # FlowPoint 144 or 22XX DSL Router v3.0.8
  7007. # SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready
  7008. Fingerprint DSL Router: FlowPoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1
  7009. Class FlowPoint | embedded || broadband router
  7010. Class SpeedStream | embedded || broadband router
  7011. TSeq(Class=TR%gcd=<6)
  7012. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7013. T2(Resp=N)
  7014. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7015. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7016. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7017. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7018. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7019. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E)
  7020.  
  7021. Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router
  7022. Class FlowPoint | embedded || broadband router
  7023. Class ASCOM | embedded || broadband router
  7024. TSeq(Class=TD%gcd=<6%SI=<FF)
  7025. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7026. T2(Resp=N)
  7027. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7028. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7029. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7030. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7031. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7032. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7033.  
  7034. Fingerprint Fore ForeThought 7.1.0 ATM switch
  7035. Class Fore | embedded || switch
  7036. TSeq(Class=64K%IPID=I%TS=U)
  7037. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  7038. T2(Resp=N)
  7039. T3(Resp=N)
  7040. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  7041. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7042. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7043. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7044. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7045.  
  7046. # Fore ATM BX200 (S_ForeThought_ATM_8.3.0.N) GA-Update (1.133285)
  7047. Fingerprint Fore ForeThought 8.3.0.N ATM BX200 switch
  7048. Class Fore | embedded || switch
  7049. TSeq(Class=RI%gcd=<3EC%SI=<2F9B8&>5BD%IPID=I%TS=U)
  7050. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  7051. T2(Resp=N)
  7052. T3(Resp=N)
  7053. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  7054. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7055. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7056. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7057. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7058.  
  7059. # Fortigate-50A running FortiOS V2.80,build393,050405
  7060. Fingerprint Fortinet firewall Fortigate 50A (FortiOS V2.80)
  7061. Class Fortinet | embedded || firewall
  7062. TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ)
  7063. T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
  7064. T2(Resp=N)
  7065. T3(Resp=N)
  7066. T4(Resp=N)
  7067. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7068. T6(Resp=N)
  7069. T7(DF=Y%W=16D0%ACK=O%Flags=AS%Ops=M)
  7070. PU(Resp=N)
  7071.  
  7072. # Fortinet Fortigate-60 firewall version 2.80,build430,050609
  7073. Fingerprint Fortinet firewall Fortigate 60
  7074. Class Fortinet | embedded || firewall
  7075. TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ)
  7076. T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
  7077. T2(Resp=N)
  7078. T3(Resp=N)
  7079. T4(Resp=N)
  7080. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7081. T6(Resp=N)
  7082. T7(Resp=N)
  7083. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7084.  
  7085. Fingerprint Foundry FastIron Edge Switch (load balancer) 2402
  7086. Class Foundry | embedded || load balancer
  7087. TSeq(Class=RI%gcd=<6%SI=<3E418&>988%IPID=RD%TS=U)
  7088. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  7089. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7090. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7091. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7092. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7093. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7094. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7095. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7096.  
  7097. # Foundry 1500 OS Ver 7.2.06T51
  7098. # Foundry ServerIron XL 16 Port 7.3.06T12
  7099. Fingerprint Foundry Load Balancer OS Ver 7.2.X - 7.3.X
  7100. Class Foundry | embedded || load balancer
  7101. TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U)
  7102. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  7103. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7104. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7105. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7106. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7107. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7108. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7109. PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  7110.  
  7111. Fingerprint Foundry Networks Biglron 8000 load balancer
  7112. Class Foundry | embedded || load balancer
  7113. TSeq(Class=RI%gcd=<6%SI=<4C464&>294%IPID=I%TS=U)
  7114. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  7115. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7116. T3(Resp=N)
  7117. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7118. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7119. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7120. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7121. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7122.  
  7123. Fingerprint Foundry FastIronII 4000 load balancer running 06.6.34T43
  7124. Class Foundry | IronWare || load balancer
  7125. TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U)
  7126. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  7127. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7128. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7129. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7130. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7131. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7132. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7133. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7134.  
  7135. Fingerprint Foundry NetIron load balancer OS Ver. 7.1.23T13
  7136. Class Foundry | IronWare || load balancer
  7137. TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U)
  7138. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  7139. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7140. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7141. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7142. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7143. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7144. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7145. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7146.  
  7147. Fingerprint Foundry Networks, Inc. Router/Load balancer, IronWare Version 06.5.12T43
  7148. Class Foundry | IronWare || load balancer
  7149. TSeq(Class=C)
  7150. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  7151. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  7152. T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  7153. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  7154. T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  7155. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  7156. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  7157. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7158.  
  7159. Fingerprint Foundry ServerIron XL load balancing IP Switch Version 06.0.00T12
  7160. Class Foundry | IronWare || load balancer
  7161. TSeq(Class=C)
  7162. T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M)
  7163. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  7164. T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  7165. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  7166. T5(Resp=N)
  7167. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  7168. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  7169. PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  7170.  
  7171. Fingerprint FreeBSD 2.1.0 - 2.1.5
  7172. Class FreeBSD | FreeBSD | 2.X | general purpose
  7173. TSeq(Class=64K)
  7174. T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
  7175. T2(Resp=N)
  7176. T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
  7177. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7178. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7179. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7180. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7181. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7182.  
  7183. Fingerprint FreeBSD 2.2.1 - 4.1
  7184. Class FreeBSD | FreeBSD | 2.X | general purpose
  7185. Class FreeBSD | FreeBSD | 3.X | general purpose
  7186. Class FreeBSD | FreeBSD | 4.X | general purpose
  7187. TSeq(Class=RI%gcd=<8%SI=<38E50&>906)
  7188. T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  7189. T2(Resp=N)
  7190. T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M)
  7191. T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
  7192. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7193. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7194. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7195. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E)
  7196.  
  7197. Fingerprint FreeBSD 2.2.1-STABLE
  7198. Class FreeBSD | FreeBSD | 2.X | general purpose
  7199. TSeq(Class=RI%gcd=<8%SI=<74A54&>1295)
  7200. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7201. T2(Resp=N)
  7202. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7203. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7204. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7205. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7206. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7207. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  7208.  
  7209. Fingerprint FreeBSD 3.2-4.0
  7210. Class FreeBSD | FreeBSD | 3.X | general purpose
  7211. Class FreeBSD | FreeBSD | 4.X | general purpose
  7212. TSeq(Class=RI%gcd=<6%SI=<92D42&>1769)
  7213. T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M)
  7214. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7215. T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  7216. T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
  7217. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7218. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7219. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7220. PU(Resp=N)
  7221.  
  7222. Fingerprint FreeBSD 3.4-RELEASE
  7223. Class FreeBSD | FreeBSD | 3.X | general purpose
  7224. TSeq(Class=RI%gcd=<6%SI=<58AD4&>3BB)
  7225. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7226. T2(Resp=N)
  7227. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7228. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7229. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7230. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7231. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7232. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7233.  
  7234. # DragonFly 1.1-Stable #0: Sun Nov 14 17:22:45 CET 2004
  7235. # DragonFly 1.1-CURRENT (i386) build on 2004/12/03
  7236. Fingerprint DragonFly 1.1-Stable (FreeBSD-4 fork)
  7237. Class FreeBSD | FreeBSD | 4.x | general purpose
  7238. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  7239. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7240. T2(Resp=N)
  7241. T3(Resp=N)
  7242. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7243. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7244. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7245. T7(Resp=N)
  7246. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7247.  
  7248. Fingerprint FreeBSD 4.0-20000208-CURRENT
  7249. Class FreeBSD | FreeBSD | 4.X | general purpose
  7250. TSeq(Class=RI%gcd=<6%SI=<63074&>FC4)
  7251. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  7252. T2(Resp=N)
  7253. T3(Resp=N)
  7254. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7255. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7256. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7257. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7258. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7259.  
  7260. Fingerprint FreeBSD 4.1.1 - 4.3 (x86)
  7261. Class FreeBSD | FreeBSD | 4.X | general purpose
  7262. TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U)
  7263. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7264. T2(Resp=N)
  7265. T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7266. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7267. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7268. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7269. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7270. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7271.  
  7272. # FreeBSD 4.10-STABLE  i386
  7273. Fingerprint FreeBSD 4.10-STABLE
  7274. Class FreeBSD | FreeBSD | 4.X | general purpose
  7275. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  7276. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7277. T2(Resp=N)
  7278. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7279. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7280. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7281. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7282. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7283. PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7284.  
  7285. # FreeBSD 4.3-RC
  7286. # FreeBSD 4.2-RELEASE i386
  7287. Fingerprint FreeBSD 4.2 - 4.3-RC (X86)
  7288. Class FreeBSD | FreeBSD | 4.X | general purpose
  7289. TSeq(Class=RI%gcd=<6%SI=<B23B8&>CD3%IPID=I%TS=100HZ)
  7290. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  7291. T2(Resp=N)
  7292. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  7293. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7294. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7295. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7296. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7297. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7298.  
  7299. Fingerprint FreeBSD 4.3 - 4.4-RELEASE
  7300. Class FreeBSD | FreeBSD | 4.X | general purpose
  7301. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7302. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7303. T2(Resp=N)
  7304. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7305. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7306. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7307. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7308. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7309. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  7310.  
  7311. Fingerprint FreeBSD 4.3 - 4.4PRERELEASE
  7312. Class FreeBSD | FreeBSD | 4.X | general purpose
  7313. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7314. T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  7315. T2(Resp=N)
  7316. T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  7317. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7318. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7319. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7320. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7321. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  7322.  
  7323. Fingerprint FreeBSD 4.4 for i386 (IA-32)
  7324. Class FreeBSD | FreeBSD | 4.X | general purpose
  7325. TSeq(Class=TR%gcd=<6)
  7326. T1(DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  7327. T2(Resp=N)
  7328. T3(Resp=Y%DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  7329. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7330. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7331. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7332. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7333. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7334.  
  7335. Fingerprint FreeBSD 4.4-5 or Apple Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13)
  7336. Class FreeBSD | FreeBSD | 4.X | general purpose
  7337. Class Apple | Mac OS X | 10.0.X | general purpose
  7338. TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ)
  7339. T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  7340. T2(Resp=N)
  7341. T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  7342. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7343. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7344. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7345. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7346. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7347.  
  7348. # FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002
  7349. Fingerprint FreeBSD 4.4-STABLE
  7350. Class FreeBSD | FreeBSD | 4.X | general purpose
  7351. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  7352. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7353. T2(Resp=N)
  7354. T3(Resp=N)
  7355. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7356. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7357. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7358. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7359. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7360.  
  7361. # FreeBSD 4.5-RELEASE (or -STABLE) (x86)
  7362. # FreeBSD 4.6-RC
  7363. Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) through 4.6-RC (x86)
  7364. Class FreeBSD | FreeBSD | 4.X | general purpose
  7365. TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
  7366. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7367. T2(Resp=N)
  7368. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7369. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7370. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7371. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7372. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7373. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7374.  
  7375. Fingerprint FreeBSD 4.6
  7376. Class FreeBSD | FreeBSD | 4.X | general purpose
  7377. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  7378. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7379. T2(Resp=N)
  7380. T3(Resp=N)
  7381. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7382. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7383. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7384. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7385. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7386.  
  7387. # FreeBSD 4.6-RELEASE FreeBSD 4.6-RELEASE #0 i386
  7388. Fingerprint FreeBSD 4.6
  7389. Class FreeBSD | FreeBSD | 4.X | general purpose
  7390. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7391. T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7392. T2(Resp=N)
  7393. T3(Resp=N)
  7394. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7395. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7396. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7397. T7(Resp=N)
  7398. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7399.  
  7400. Fingerprint FreeBSD 4.6
  7401. Class FreeBSD | FreeBSD | 4.X | general purpose
  7402. TSeq(Class=RI%gcd=<6%SI=<8AAA2&>96A%IPID=I%TS=U)
  7403. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7404. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  7405. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  7406. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  7407. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7408. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  7409. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  7410. PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7411.  
  7412. # 4.6-RELEASE
  7413. # 4.6-STABLE
  7414. # 4.6.2-RELEASE-p6
  7415. Fingerprint FreeBSD 4.6 through 4.6.2 (July 2002) (x86)
  7416. Class FreeBSD | FreeBSD | 4.X | general purpose
  7417. TSeq(Class=TR%IPID=I%TS=100HZ)
  7418. T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7419. T2(Resp=N)
  7420. T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7421. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7422. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7423. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7424. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7425. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7426.  
  7427. Fingerprint FreeBSD 4.6-RC on Alpha
  7428. Class FreeBSD | FreeBSD | 4.X | general purpose
  7429. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  7430. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7431. T2(Resp=N)
  7432. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7433. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7434. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7435. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7436. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7437. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7438.  
  7439. Fingerprint FreeBSD 4.6.2-RELEASE
  7440. Class FreeBSD | FreeBSD | 4.X | general purpose
  7441. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  7442. T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7443. T2(Resp=N)
  7444. T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7445. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7446. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7447. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7448. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7449. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7450.  
  7451. # FreeBSD 4.8-RELEASE
  7452. # 4.7-STABLE FreeBSD 4.7-STABLE #0: Tue Nov 19 16:13:55 2002
  7453. Fingerprint FreeBSD 4.6.2-RELEASE - 4.8-RELEASE
  7454. Class FreeBSD | FreeBSD | 4.X | general purpose
  7455. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7456. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7457. T2(Resp=N)
  7458. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7459. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7460. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7461. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7462. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7463. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7464.  
  7465. # FreeBSD 4.7-RELEASE
  7466. # FreeBSD 4.8-RELEASE-p13
  7467. Fingerprint FreeBSD 4.7 - 4.8-RELEASE
  7468. Class FreeBSD | FreeBSD | 4.X | general purpose
  7469. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7470. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7471. T2(Resp=N)
  7472. T3(Resp=N)
  7473. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7474. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7475. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7476. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7477. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7478.  
  7479. # FreeBSD 4.7-RELEASE-p3 FreeBSD 4.7-RELEASE-p3 #0: Wed Jan 8 21:31:21 CET 2003 i386
  7480. Fingerprint FreeBSD 4.7-RELEASE
  7481. Class FreeBSD | FreeBSD | 4.X | general purpose
  7482. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  7483. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7484. T2(Resp=N)
  7485. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7486. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7487. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7488. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7489. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7490. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7491.  
  7492. Fingerprint FreeBSD 4.7-RELEASE through 4.8-RELEASE (x86)
  7493. Class FreeBSD | FreeBSD | 4.X | general purpose
  7494. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7495. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
  7496. T2(Resp=N)
  7497. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
  7498. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7499. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7500. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7501. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7502. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7503.  
  7504. # FreeBSD 4.7-RELEASE-p3 on i386
  7505. Fingerprint FreeBSD 4.7-RELEASE-p3
  7506. Class FreeBSD | FreeBSD | 4.X | general purpose
  7507. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7508. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7509. T2(Resp=N)
  7510. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7511. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7512. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7513. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7514. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7515. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7516.  
  7517. # FreeBSD 4.7-STABLE (Jan 2003)
  7518. Fingerprint FreeBSD 4.7-STABLE
  7519. Class FreeBSD | FreeBSD | 4.X | general purpose
  7520. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  7521. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
  7522. T2(Resp=N)
  7523. T3(Resp=N)
  7524. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7525. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7526. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7527. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7528. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7529.  
  7530. # FreeBSD 4.9-PRERELEASE alpha
  7531. # FreeBSD 4.8-RELEASE on DEC Alpha
  7532. # FreeBSD 4.9-STABLE (platform unspecified)
  7533. Fingerprint FreeBSD 4.8-RELEASE through 4.9-STABLE
  7534. Class FreeBSD | FreeBSD | 4.X | general purpose
  7535. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  7536. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7537. T2(Resp=N)
  7538. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7539. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7540. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7541. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7542. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7543. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7544.  
  7545. # FreeBSD 4.8-STABLE (June 2003)
  7546. Fingerprint FreeBSD 4.8-STABLE
  7547. Class FreeBSD | FreeBSD | 4.X | general purpose
  7548. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|1000HZ)
  7549. T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  7550. T2(Resp=N)
  7551. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7552. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7553. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7554. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7555. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7556. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7557.  
  7558. # FreeBSD 4.8-STABLE (June 2003)
  7559. Fingerprint FreeBSD 4.8-STABLE
  7560. Class FreeBSD | FreeBSD | 4.X | general purpose
  7561. T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  7562. T2(Resp=N)
  7563. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7564. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7565. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7566. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7567. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7568. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7569.  
  7570. Fingerprint FreeBSD 4.8-STABLE - 4.9-PRERELEASE
  7571. Class FreeBSD | FreeBSD | 4.X | general purpose
  7572. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  7573. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7574. T2(Resp=N)
  7575. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7576. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7577. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7578. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7579. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7580. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7581.  
  7582. # FreeBSD 5.0-RELEASE x86
  7583. # sparc64 running FreeBSD 5.1-RELEASE
  7584. # FreeBSD 4.9-STABLE FreeBSD 4.9-STABLE  i386
  7585. Fingerprint FreeBSD 4.9 - 5.1
  7586. Class FreeBSD | FreeBSD | 4.X | general purpose
  7587. Class FreeBSD | FreeBSD | 5.X | general purpose
  7588. TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
  7589. T1(DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7590. T2(Resp=N)
  7591. T3(Resp=Y%DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7592. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7593. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7594. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7595. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7596. PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7597.  
  7598. # FreeBSD 4.9-RELEASE-p1 #0 i386
  7599. Fingerprint FreeBSD 4.9-RELEASE
  7600. Class FreeBSD | FreeBSD | 4.X | general purpose
  7601. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  7602. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7603. T2(Resp=N)
  7604. T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7605. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7606. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7607. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7608. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7609. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7610.  
  7611. # 4.9-RELEASE FreeBSD 4.9-RELEASE #0
  7612. Fingerprint FreeBSD 4.9-RELEASE
  7613. Class FreeBSD | FreeBSD | 4.X | general purpose
  7614. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7615. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7616. T2(Resp=N)
  7617. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7618. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7619. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7620. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7621. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7622. PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7623.  
  7624. Fingerprint FreeBSD 4.9-STABLE
  7625. Class FreeBSD | FreeBSD | 4.X | general purpose
  7626. TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ)
  7627. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7628. T2(Resp=N)
  7629. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7630. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7631. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7632. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7633. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7634. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7635.  
  7636. #  FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002
  7637. Fingerprint FreeBSD 5.0-CURRENT (Apr 2002)
  7638. Class FreeBSD | FreeBSD | 5.X | general purpose
  7639. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  7640. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7641. T2(Resp=N)
  7642. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7643. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7644. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7645. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7646. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7647. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7648.  
  7649. Fingerprint FreeBSD 5.0-RELEASE
  7650. Class FreeBSD | FreeBSD | 5.X | general purpose
  7651. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7652. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7653. T2(Resp=N)
  7654. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7655. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7656. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7657. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7658. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7659. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7660.  
  7661. Fingerprint FreeBSD 5.0-RELEASE
  7662. Class FreeBSD | FreeBSD | 5.X | general purpose
  7663. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7664. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7665. T2(Resp=N)
  7666. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7667. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7668. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7669. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7670. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7671. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7672.  
  7673. # FreeBSD somehost.someplace 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Jan 29 12:31:51 CST 2003 i386
  7674. # FreeBSD 5.0-RELEASE Alpha
  7675. Fingerprint FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003)
  7676. Class FreeBSD | FreeBSD | 5.X | general purpose
  7677. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  7678. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7679. T2(Resp=N)
  7680. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7681. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7682. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7683. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7684. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7685. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7686.  
  7687. Fingerprint FreeBSD 5.1-CURRENT (June 2003) on Sparc64
  7688. Class FreeBSD | FreeBSD | 5.X | general purpose
  7689. TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
  7690. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7691. T2(Resp=N)
  7692. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7693. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7694. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7695. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7696. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7697. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7698.  
  7699. Fingerprint FreeBSD 5.1-RELEASE (x86)
  7700. Class FreeBSD | FreeBSD | 5.X | general purpose
  7701. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7702. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7703. T2(Resp=N)
  7704. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  7705. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7706. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7707. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7708. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7709. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7710.  
  7711. Fingerprint FreeBSD 5.2
  7712. Class FreeBSD | FreeBSD | 5.X | general purpose
  7713. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
  7714. T2(Resp=N)
  7715. T3(Resp=Y%DF=Y%W=5B4|84%ACK=S++%Flags=AS%Ops=MNWNNT)
  7716. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7717. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7718. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7719. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7720. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7721.  
  7722. # FreeBSD 5.2-CURRENT (Jan 2004) on x86
  7723. # FreeBSD 5.2.1-RELEASE i386
  7724. # FreeBSD 5.3-RELEASE #0
  7725. Fingerprint FreeBSD 5.2 - 5.3
  7726. Class FreeBSD | FreeBSD | 5.X | general purpose
  7727. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7728. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7729. T2(Resp=N)
  7730. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7731. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7732. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7733. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7734. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7735. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7736.  
  7737. # FreeBSD 5.3-RELEASE
  7738. # FreeBSD 5.2-CURRENT i386
  7739. # FreeBSD 5.4-RELEASE #4
  7740. # FreeBSD 5.4-Stable
  7741. # FreeBSD 5.4-STABLE #0
  7742. # BummiOS 5.4-CURRENT i386 (based on FreeBSD 5.4-STABLE)
  7743. Fingerprint FreeBSD 5.2 - 5.4
  7744. Class FreeBSD | FreeBSD | 5.X | general purpose
  7745. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|U)
  7746. T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  7747. T2(Resp=N)
  7748. T3(Resp=N)
  7749. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7750. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7751. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7752. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7753. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7754.  
  7755. # FreeBSD 5.2-CURRENT (Jun 25, 2004) on x86 running pf as firewall with "scrub in all"
  7756. # FreeBSD 5.3-Beta2 (x86)
  7757. # FreeBSD 5.3-RELEASE (x86) Generic kernel
  7758. Fingerprint FreeBSD 5.2-CURRENT - 5.3 (x86) with pf scrub all
  7759. Class FreeBSD | FreeBSD | 5.X | general purpose
  7760. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7761. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7762. T2(Resp=N)
  7763. T3(Resp=N)
  7764. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7765. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7766. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7767. T7(Resp=N)
  7768. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7769.  
  7770. # FreeBSD 5.2.1 running on Ultra5 spac64
  7771. Fingerprint FreeBSD 5.2.1 (SPARC)
  7772. Class FreeBSD | FreeBSD | 5.X | general purpose
  7773. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7774. T2(Resp=N)
  7775. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7776. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7777. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7778. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7779. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7780. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7781.  
  7782. # FreeBSD 5.3-STABLE (x86) as of 2004.11.14
  7783. # FreeBSD 5.3-RELEASE
  7784. Fingerprint FreeBSD 5.3
  7785. Class FreeBSD | FreeBSD | 5.X | general purpose
  7786. TSeq(Class=TR%gcd=<6%TS=1000HZ)
  7787. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7788. T2(Resp=N)
  7789. T3(Resp=N)
  7790. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7791. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7792. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7793. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7794. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7795.  
  7796. # FreeBSD 5.3rc3 with pf scrub all
  7797. Fingerprint FreeBSD 5.3
  7798. Class FreeBSD | FreeBSD | 5.X | general purpose
  7799. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  7800. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7801. T2(Resp=N)
  7802. T3(Resp=N)
  7803. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7804. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7805. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7806. T7(Resp=N)
  7807. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7808.  
  7809. # FreeBSD 5.3-RELEASE i386
  7810. Fingerprint FreeBSD 5.3-RELEASE
  7811. Class FreeBSD | FreeBSD | 5.X | general purpose
  7812. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7813. T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  7814. T2(Resp=N)
  7815. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  7816. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7817. T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  7818. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7819. T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  7820. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  7821.  
  7822. Fingerprint FreeBSD 5.3-RELEASE
  7823. Class FreeBSD | FreeBSD | 5.X | general purpose
  7824. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  7825. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7826. T2(Resp=N)
  7827. T3(Resp=N)
  7828. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7829. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7830. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7831. T7(Resp=N)
  7832. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7833.  
  7834. # FreeBSD 5.3-STABLE #7 Tue Feb 8 17:55:23 WET 2005 i386
  7835. Fingerprint FreeBSD 5.3-STABLE
  7836. Class FreeBSD | FreeBSD | 5.X | general purpose
  7837. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7838. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7839. T2(Resp=N)
  7840. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7841. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7842. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7843. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7844. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7845. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7846.  
  7847. # FreeBSD 5.3-STABLE as of 2004-11-14, pf scrib in all random-id
  7848. Fingerprint FreeBSD 5.3-STABLE
  7849. Class FreeBSD | FreeBSD | 5.X | general purpose
  7850. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  7851. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7852. T2(Resp=N)
  7853. T3(Resp=N)
  7854. T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7855. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7856. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7857. T7(Resp=N)
  7858. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7859.  
  7860. # FreeBSD 5.4-RC2 FreeBSD 5.4-RC2 #2 i386
  7861. # FreeBSD 5.4-STABLE FreeBSD 5.4-STABLE #7 i386
  7862. Fingerprint FreeBSD 5.4
  7863. Class FreeBSD | FreeBSD | 5.X | general purpose
  7864. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  7865. T1(DF=Y%W=FFFF%ACK=O|S++%Flags=AS%Ops=MNWNNT)
  7866. T2(Resp=N)
  7867. T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT)
  7868. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7869. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7870. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7871. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7872. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7873.  
  7874. # FreeBSD 5.4-RELEASE-p2 i386
  7875. Fingerprint FreeBSD 5.4-RELEASE
  7876. Class FreeBSD | FreeBSD | 5.X | general purpose
  7877. TSeq(Class=TR%gcd=<6%TS=100HZ)
  7878. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7879. T2(Resp=N)
  7880. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7881. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7882. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7883. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7884. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7885. PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7886.  
  7887. # FreeBSD 6.0-CURRENT #1 i386
  7888. # FreeBSD 5.2.1-RELEASE
  7889. Fingerprint FreeBSD 5.2.1-RELEASE or 6.0-CURRENT
  7890. Class FreeBSD | FreeBSD | 6.X | general purpose
  7891. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7892. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7893. T2(Resp=N)
  7894. T3(Resp=N)
  7895. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7896. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7897. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7898. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7899. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7900.  
  7901. Fingerprint FreeSCO 0.27 (Linux 2.0.38)
  7902. Class FreeSCO | Linux | 2.0.X | router
  7903. TSeq(Class=RI%gcd=<6%SI=<1F22A6E&>4E0A2%IPID=Z%TS=100HZ)
  7904. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  7905. T2(Resp=N)
  7906. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  7907. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7908. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7909. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7910. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7911. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7912.  
  7913. Fingerprint FreeSCO 0.27 (Linux 2.0.38)
  7914. Class FreeSCO | Linux | 2.0.X | router
  7915. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7916. T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
  7917. T2(Resp=N)
  7918. T3(Resp=N)
  7919. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7920. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7921. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7922. T7(Resp=N)
  7923. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7924.  
  7925. Fingerprint Galacticomm WorldGroup BBS (MajorBBS) w/TCP/IP
  7926. Class Galacticomm | WorldGroup || BBS
  7927. TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&<BBBBBB)
  7928. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  7929. T2(Resp=N)
  7930. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  7931. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7932. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7933. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7934. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7935. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  7936.  
  7937. Fingerprint Galacticomm WorldGroup BBS / Vircom TCP/IP stack
  7938. Class Galacticomm | WorldGroup || BBS
  7939. TSeq(Class=C)
  7940. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  7941. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7942. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  7943. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7944. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7945. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7946. T7(Resp=N)
  7947. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7948.  
  7949. Fingerprint Gandalf LanLine Router
  7950. Class Gandalf | embedded || router
  7951. TSeq(Class=TD%gcd=<714%SI=<14)
  7952. T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  7953. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7954. T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  7955. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7956. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7957. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7958. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7959. PU(Resp=N)
  7960.  
  7961. Fingerprint Gauntlet 4.0a firewall on Solaris 2.5.1
  7962. Class Gauntlet | Solaris | 2.5.X | firewall
  7963. TSeq(Class=RI%gcd=<6%SI=<10540A&>89C%IPID=I%TS=U)
  7964. T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME)
  7965. T2(Resp=N)
  7966. T3(Resp=N)
  7967. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7968. T5(Resp=N)
  7969. T6(Resp=N)
  7970. T7(Resp=N)
  7971. PU(Resp=N)
  7972.  
  7973. Fingerprint Genius Print Server
  7974. Class Genius | embedded || print server
  7975. T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
  7976. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7977. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  7978. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7979. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7980. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7981. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7982. PU(Resp=N)
  7983.  
  7984. Fingerprint Gnat Box Light firewall v3.0.3 (from the inside interface)
  7985. Class Global Technology Associates | embedded || firewall
  7986. TSeq(Class=RI%gcd=<6%SI=<F708&>264)
  7987. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  7988. T2(Resp=N)
  7989. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  7990. T4(Resp=N)
  7991. T5(Resp=N)
  7992. T6(Resp=N)
  7993. T7(Resp=N)
  7994. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  7995.  
  7996. # GNet BB0040 DSL router
  7997. # SAR-703 Combined ADSL Modem/Router
  7998. Fingerprint GNet BB0040 or SAR 703 DSL modem + router
  7999. Class GNet | embedded || broadband router
  8000. Class SAR | embedded || broadband router
  8001. TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U)
  8002. T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  8003. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8004. T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  8005. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  8006. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8007. T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  8008. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8009. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8010.  
  8011. Fingerprint GNU Hurd 0.2 (GNUmach-1.2/Hurd-0.2) x86
  8012. Class GNU | Hurd || general purpose
  8013. TSeq(Class=TD|i800%gcd=<3000%SI=<1E%IPID=I%TS=100HZ)
  8014. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  8015. T2(Resp=N)
  8016. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  8017. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8018. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8019. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8020. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8021. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8022.  
  8023. # GrandStream 486 Voice over IP adapter
  8024. Fingerprint GrandStream 486 VoIP adapter
  8025. Class GrandStream | embedded || VoIP adapter
  8026. TSeq(Class=C%Val=3883537A%IPID=I%TS=U)
  8027. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8028. T2(Resp=Y%DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  8029. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8030. T4(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=)
  8031. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8032. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8033. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8034. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  8035.  
  8036. Fingerprint Grandstream HT-286 POTS<->VoIP phone gateway device
  8037. Class Grandstream | embedded || VoIP adapter
  8038. TSeq(Class=C%Val=66559055%IPID=I%TS=U)
  8039. T1(Resp=N)
  8040. T2(Resp=Y%DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
  8041. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8042. T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
  8043. T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
  8044. T6(DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=)
  8045. T7(DF=Y%W=400%ACK=S++%Flags=AR%Ops=)
  8046. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8047.  
  8048. Fingerprint Grandstream BT-100 IP Phone
  8049. Class GrandStream | embedded || VoIP phone
  8050. TSeq(Class=C%Val=FBD5528A%IPID=I%TS=U)
  8051. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8052. T2(Resp=Y%DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=)
  8053. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8054. T4(DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=)
  8055. T5(DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=)
  8056. T6(DF=Y%W=400%ACK=S++%Flags=AR%Ops=)
  8057. T7(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
  8058. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8059.  
  8060. Fingerprint GrandStream BT-100 IP Phone
  8061. Class GrandStream | embedded || VoIP phone
  8062. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8063. T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=)
  8064. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8065. T4(DF=Y%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  8066. T5(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
  8067. T6(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  8068. T7(DF=Y%W=800|C00|400%ACK=S++%Flags=AR%Ops=)
  8069. PU(Resp=N)
  8070.  
  8071. # Grandstream BudgeTone101 VoIP phone, firmware 1.0.4.50
  8072. Fingerprint Grandstream BT-101 IP phone
  8073. Class GrandStream | embedded || VoIP phone
  8074. TSeq(Class=C%Val=75DFD55D%IPID=I%TS=U)
  8075. T1(Resp=N)
  8076. T2(Resp=Y%DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=)
  8077. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8078. T4(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
  8079. T5(DF=Y%W=C00|800|400%ACK=S++%Flags=AR%Ops=)
  8080. T6(DF=Y%W=1000|C00|800%ACK=S++%Flags=AR%Ops=)
  8081. T7(DF=Y%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
  8082. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8083.  
  8084. # GrandStream BT-101 with firmware 1.0.5.22
  8085. Fingerprint GrandStream BT-101 IP phone
  8086. Class GrandStream | embedded || VoIP phone
  8087. TSeq(Class=C%Val=5CE04AC5%IPID=I%TS=U)
  8088. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8089. T2(Resp=Y%DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=)
  8090. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8091. T4(DF=Y%W=1000|800|400%ACK=S++%Flags=AR%Ops=)
  8092. T5(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=)
  8093. T6(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
  8094. T7(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
  8095. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8096.  
  8097. Fingerprint Grandstream BudgeTone 101 IP Phone
  8098. Class GrandStream | embedded || VoIP phone
  8099. TSeq(Class=C%IPID=I%TS=U)
  8100. T1(Resp=N)
  8101. T2(Resp=Y%DF=Y%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
  8102. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8103. T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
  8104. T5(DF=Y%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
  8105. T6(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
  8106. T7(DF=Y%W=C00|800|1000%ACK=S++%Flags=AR%Ops=)
  8107. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8108.  
  8109. Fingerprint Grandstream IP Phone
  8110. Class GrandStream | embedded || VoIP phone
  8111. TSeq(Class=C%IPID=I%TS=U)
  8112. T1(Resp=N)
  8113. T2(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
  8114. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8115. T4(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
  8116. T5(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
  8117. T6(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=)
  8118. T7(DF=Y%W=C00%ACK=S++%Flags=AR%Ops=)
  8119. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8120.  
  8121. # GrandStream BudgeTone-100 VoIP phone
  8122. # GrandStream BudgeTone-100 1.0.5.16
  8123. Fingerprint GrandStream VoIP Phone (BudgeTone-100)
  8124. Class GrandStream | embedded || VoIP phone
  8125. TSeq(Class=C%Val=4D86DFEA|F66461C1%IPID=I%TS=U)
  8126. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8127. T2(Resp=Y%DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
  8128. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8129. T4(DF=Y%W=800|1000%ACK=S++%Flags=AR%Ops=)
  8130. T5(DF=Y%W=400|800|1000%ACK=S++%Flags=AR%Ops=)
  8131. T6(DF=Y%W=800|C00|1000%ACK=S++%Flags=AR%Ops=)
  8132. T7(DF=Y%W=400|C00|1000%ACK=S++%Flags=AR%Ops=)
  8133. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8134.  
  8135. # Grandstream Budge Tone 101 VoIP phone, firmware 1.0.5.16
  8136. Fingerprint Grandstream VoIP Phone (BudgeTone-101)
  8137. Class GrandStream | embedded || VoIP phone
  8138. TSeq(Class=C%Val=4F4264AA%IPID=I%TS=U)
  8139. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8140. T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=)
  8141. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  8142. T4(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=)
  8143. T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
  8144. T6(DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=)
  8145. T7(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
  8146. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8147.  
  8148. Fingerprint PalmOS 5.2.1 on Handspring Treo
  8149. Class Handspring | PalmOS | 5.X | PDA
  8150. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  8151. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8152. T2(Resp=N)
  8153. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8154. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  8155. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8156. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8157. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8158. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  8159.  
  8160. # Hawking PS12U Embedded Print Server  (Firmware Version :    6.09.17H (2003/04/18 16:55:07)
  8161. Fingerprint Hawking PS12U Embedded Print Server
  8162. Class Hawking | embedded || print server
  8163. TSeq(Class=TD%gcd=78000|F0000%SI=<14%IPID=I%TS=U)
  8164. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  8165. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8166. T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  8167. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8168. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8169. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8170. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8171. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8172.  
  8173. # Zero One Tech. Print Server 3000
  8174. # Hawking Print Server PN7117
  8175. # Zero One Tech Printserver ZOT-PS-11 (firmware 5.4.2049)
  8176. # EUSSO Technologies UPS1211-B print server
  8177. Fingerprint Print server: Zero One Tech 3000, Hawking PN7117, or EUSSO UPS1211-B
  8178. Class Hawking | embedded || print server
  8179. Class Zero One | embedded || print server
  8180. Class EUSSO | embedded || print server
  8181. TSeq(Class=TD%gcd=<C004%SI=<1E%IPID=I%TS=U)
  8182. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  8183. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8184. T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  8185. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8186. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8187. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8188. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8189. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8190.  
  8191. Fingerprint Hitachi HI-UX/MPP
  8192. Class Hitachi | HI-UX || general purpose
  8193. TSeq(Class=64K)
  8194. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=MNNTWL)
  8195. T2(Resp=N)
  8196. T3(Resp=Y%DF=N%W=FF5E%ACK=O%Flags=A%Ops=NNT)
  8197. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8198. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8199. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8200. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8201. PU(TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8202.  
  8203. # Don't ask me what this is :)  David says
  8204. # it is "a Utah port of BSD to HP machines"
  8205. Fingerprint HP-BSD 2.0
  8206. Class HP | BSD-misc || general purpose
  8207. TSeq(Class=64K)
  8208. T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  8209. T2(Resp=N)
  8210. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  8211. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  8212. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8213. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8214. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8215. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8216.  
  8217. Fingerprint HP Procurve Routing Switch 9304M
  8218. Class HP | embedded || load balancer
  8219. TSeq(Class=C)
  8220. T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=M)
  8221. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  8222. T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  8223. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  8224. T5(Resp=N)
  8225. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  8226. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  8227. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8228.  
  8229. # HP J4899A ProCurve Switch 2650, H.08.53, ROM H.08.02 - 24 port HP Switch with 2 Uplinks
  8230. # HP ProCurve Switch 2626 - Firmware revision  : H.08.67
  8231. # HP Procurve Switch 5304XL - Image stamp: /sw/code/build/alpmo(dex_v09_2)
  8232. Fingerprint HP Procurve Switch 2600 series or 5304XL
  8233. Class HP | embedded || load balancer
  8234. TSeq(Class=64K%IPID=I%TS=2HZ)
  8235. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8236. T2(Resp=N)
  8237. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8238. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  8239. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8240. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8241. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8242. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8243.  
  8244. # HP LaserJet 1300N with JetDirect 200m LIO card
  8245. Fingerprint HP printer w/JetDirect card
  8246. Class HP | embedded || print server
  8247. TSeq(Class=RI%gcd=<6%SI=<8C9B0&>1295%IPID=I%TS=2HZ)
  8248. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8249. T2(Resp=N)
  8250. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  8251. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  8252. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8253. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8254. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8255. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8256.  
  8257. # HP Buisiness InkJet 1200 internal print server
  8258. # HP Deskjet 6127, firmware FD4R019A
  8259. Fingerprint HP Deskjet 6127 printer or InkJet 1200 printer server
  8260. Class HP | embedded || printer
  8261. Class HP | embedded || print server
  8262. TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ)
  8263. T1(DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
  8264. T2(Resp=N)
  8265. T3(Resp=Y%DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
  8266. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8267. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8268. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8269. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8270. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8271.  
  8272. # HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550
  8273. # HP LaserJet 2200 with JetDirect (J6057A)
  8274. # HP Wireless JetDirect EIO card - 680n
  8275. Fingerprint HP JetDirect Card in a LaserJet printer
  8276. Class HP | embedded || printer
  8277. TSeq(Class=64K%IPID=I%TS=U)
  8278. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW)
  8279. T2(Resp=N)
  8280. T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=)
  8281. T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=)
  8282. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8283. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8284. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8285. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0|F%UCK=0%ULEN=134%DAT=E)
  8286.  
  8287. # HP Laserjet 4250, HP JetDirect J7949E
  8288. # hp LaserJet 2420
  8289. # hp LaserJet 4250 w/ embedded HP JetDirect J7949E; firmware V.28.43.FF w/ datecode 20040902 08.007.0
  8290. # HP LaserJet 2420dn printer, JetDirect J7949E, firmware V.28.43
  8291. # hp LaserJet 4250 with embedded HP JetDirect J7949E
  8292. # HP LaserJet 2420 printer
  8293. Fingerprint HP LaserJet 2420 or 4250 printer
  8294. Class HP | embedded || printer
  8295. TSeq(Class=64K%IPID=I%TS=2HZ)
  8296. T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
  8297. T2(Resp=N)
  8298. T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT)
  8299. T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=)
  8300. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8301. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8302. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8303. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8304.  
  8305. Fingerprint HP LaserJet 4000N Printer
  8306. Class HP | embedded || printer
  8307. TSeq(Class=TD%gcd=<6%SI=<1E)
  8308. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  8309. T2(Resp=N)
  8310. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  8311. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8312. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8313. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8314. T7(Resp=N)
  8315. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8316.  
  8317. Fingerprint HP LaserJet 4100N printer
  8318. Class HP | embedded || printer
  8319. TSeq(Class=64K%IPID=I%TS=U)
  8320. T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=MNW)
  8321. T2(Resp=N)
  8322. T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=A%Ops=)
  8323. T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
  8324. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8325. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8326. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8327. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8328.  
  8329. Fingerprint HP LaserJet 5
  8330. Class HP | embedded || printer
  8331. TSeq(Class=TD%gcd=<6%SI=<FF)
  8332. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  8333. T2(Resp=N)
  8334. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8335. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8336. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8337. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8338. T7(Resp=N)
  8339. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8340.  
  8341. # 2100 Series, 4000 TN, 4000 PS, 8000 DN
  8342. # Hewlett-Packard Digital Sender 9100C (http://h10010.www1.hp.com/wwpc/us/en/sm/WF05a/15179-64175-64404-12126-64404-428008.html)
  8343. Fingerprint HP LaserJet printer/print server
  8344. Class HP | embedded || printer
  8345. Class HP | embedded || print server
  8346. Class HP | embedded || scanner
  8347. TSeq(Class=TD%gcd=<6%SI=<100)
  8348. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  8349. T2(Resp=N)
  8350. T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS%Ops=M)
  8351. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8352. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8353. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8354. T7(Resp=N)
  8355. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8356.  
  8357. # Jet Direct Model J3113A, Firmware Rev G.07.20
  8358. # HP Color LaserJet 4500N, Jet Direct J3113A/2100
  8359. Fingerprint HP printer w/Jet Direct
  8360. Class HP | embedded || printer
  8361. T1(DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=M|)
  8362. T2(Resp=N)
  8363. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8364. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8365. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8366. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8367. T7(Resp=N)
  8368. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8369.  
  8370. # HP JetDirect printer/print server
  8371. # HP JetDirect J3111A, firmware G.05.35
  8372. Fingerprint HP printer w/JetDirect card
  8373. Class HP | embedded || printer
  8374. TSeq(Class=TD%gcd=<6%SI=<1E)
  8375. T1(DF=N%W=16D0|C90%ACK=S++%Flags=AS%Ops=M)
  8376. T2(Resp=N)
  8377. T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=|M)
  8378. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8379. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8380. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8381. T7(Resp=N)
  8382. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E%ULEN=134%DAT=E)
  8383.  
  8384. Fingerprint HP printer w/JetDirect card
  8385. Class HP | embedded || printer
  8386. TSeq(Class=TD%gcd=<10%SI=<14%IPID=I%TS=U)
  8387. T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
  8388. T2(Resp=N)
  8389. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8390. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8391. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8392. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8393. T7(Resp=N)
  8394. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8395.  
  8396. Fingerprint HP printer w/JetDirect card
  8397. Class HP | embedded || printer
  8398. TSeq(Class=TD%gcd=<6%SI=<F)
  8399. T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
  8400. T2(Resp=N)
  8401. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8402. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8403. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8404. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8405. T7(Resp=N)
  8406. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8407.  
  8408. # HP printer w/JetDirect card (Firmware Rev. H.06.00)
  8409. Fingerprint HP printer w/JetDirect card
  8410. Class HP | embedded || printer
  8411. TSeq(Class=TD%gcd=<8%SI=<14)
  8412. T1(DF=N%W=860|16D0%ACK=S++%Flags=AS%Ops=M)
  8413. T2(Resp=N)
  8414. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8415. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8416. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8417. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8418. T7(Resp=N)
  8419. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8420.  
  8421. # JetDirect J6057A, firmware R.24.06, connected to an HP 2200 printer
  8422. # JetDirect 610n (Model J4169A) firmware L.24.06
  8423. # HP Color LaserJet 4600 Model Number: J6057A Firmware Rev: R.25.09
  8424. # HP Laserjet 4200 Network Printer
  8425. # HP JetDirect J6057A, firmware R.24.08 (internal print server in a LaserJet 4050n)
  8426. # HP Color Laserjet 4650 printer
  8427. Fingerprint HP printer w/JetDirect card
  8428. Class HP | embedded || printer
  8429. TSeq(Class=RI%gcd=<6%SI=<AF762&>9E9%IPID=I%TS=2HZ)
  8430. T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
  8431. T2(Resp=N)
  8432. T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT)
  8433. T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=)
  8434. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8435. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8436. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8437. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8438.  
  8439. # HP JetDirect J6057A Firmware Version R.22.09 in 4100mpf printer
  8440. Fingerprint HP printer w/JetDirect card
  8441. Class HP | embedded || printer
  8442. TSeq(Class=64K%IPID=I%TS=U)
  8443. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  8444. T2(Resp=N)
  8445. T3(Resp=Y%DF=N%W=16D0%ACK=O%Flags=A%Ops=)
  8446. T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
  8447. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8448. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8449. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8450. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8451.  
  8452. # This is a HP 5si printer with a JetDirect Ethernet card model# J2556b Firmware A.05.32
  8453. Fingerprint HP printer w/JetDirect J2556b card (firmware A.05.32)
  8454. Class HP | embedded || printer
  8455. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8456. T2(Resp=N)
  8457. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8458. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8459. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8460. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8461. T7(Resp=N)
  8462. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8463.  
  8464. Fingerprint HP printer w/JetDirect J2556b card firmware A.05.32
  8465. Class HP | embedded || printer
  8466. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8467. T2(Resp=N)
  8468. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8469. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8470. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8471. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8472. T7(Resp=N)
  8473. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8474.  
  8475. # HP iLO (Integrated Lights Out) Firmware Version 1.20 (12/04/2002)
  8476. # HP Integrated Lights Out (iLO) with firmware 1.41 08/19/2003
  8477. Fingerprint HP Integrated Lights Out remote configuration Board
  8478. Class HP | embedded || remote management
  8479. TSeq(Class=TD%gcd=<194%SI=<1E%IPID=I%TS=U)
  8480. T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  8481. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  8482. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  8483. T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  8484. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  8485. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  8486. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  8487. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8488.  
  8489. # HP Router 210 with OS 9.72
  8490. # Netgear RP114 DSL-Router with 4-Port Switch
  8491. Fingerprint HP Advancestack Etherswitch 224T or 210 or Netgear RP114 DSL-Router w/Switch
  8492. Class HP | embedded || switch
  8493. Class Netgear | embedded || broadband router
  8494. TSeq(Class=TD%SI=<20)
  8495. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  8496. T2(Resp=N)
  8497. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  8498. T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
  8499. T5(DF=N%W=400%ACK=O%Flags=R%Ops=)
  8500. T6(DF=N%W=400%ACK=O%Flags=R%Ops=)
  8501. T7(DF=N%W=400%ACK=O%Flags=R%Ops=)
  8502. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8503.  
  8504. # HP Entria II with Kernel B.09.11 and Boot Block B.08.02
  8505. Fingerprint HP Entria II X station
  8506. Class HP | embedded || X terminal
  8507. TSeq(Class=64K%IPID=I%TS=U)
  8508. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  8509. T2(Resp=N)
  8510. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  8511. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  8512. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8513. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8514. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8515. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8516.  
  8517. Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2
  8518. Class HP | HP-UX | 10.X | general purpose
  8519. TSeq(Class=RI%gcd=<6%SI=<18000)
  8520. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  8521. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8522. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  8523. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8524. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8525. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8526. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8527. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8528.  
  8529. Fingerprint HP-UX 10.20 A 9000/715 or 9000/899
  8530. Class HP | HP-UX | 10.X | general purpose
  8531. TSeq(Class=64K)
  8532. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M)
  8533. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8534. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  8535. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8536. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8537. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8538. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8539. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8540.  
  8541. Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0
  8542. Class HP | HP-UX | 10.X | general purpose
  8543. TSeq(Class=64K)
  8544. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  8545. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8546. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  8547. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8548. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8549. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8550. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8551. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8552.  
  8553. # XXX: It crashed the machine again, but I got a full
  8554. # scan this time.
  8555. Fingerprint HP-UX B.10.01 A 9000/715
  8556. Class HP | HP-UX | 10.X | general purpose
  8557. TSeq(Class=64K|TR)
  8558. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  8559. T2(Resp=N)
  8560. T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=)
  8561. T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
  8562. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8563. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8564. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8565. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8566.  
  8567. Fingerprint HP-UX B.10.20 9000/897
  8568. Class HP | HP-UX | 10.X | general purpose
  8569. TSeq(Class=64K)
  8570. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  8571. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8572. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  8573. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8574. T5(Resp=N)
  8575. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8576. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8577. PU(Resp=N)
  8578.  
  8579. Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1
  8580. Class HP | HP-UX | 10.X | general purpose
  8581. TSeq(Class=RI%gcd=<6%SI=<18000)
  8582. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  8583. T2(Resp=N)
  8584. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  8585. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  8586. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8587. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8588. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8589. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8590.  
  8591. Fingerprint HP-UX B.10.20 A 9000/750
  8592. Class HP | HP-UX | 10.X | general purpose
  8593. TSeq(Class=64K%IPID=I%TS=U)
  8594. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  8595. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  8596. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  8597. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  8598. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8599. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  8600. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  8601. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8602.  
  8603. # HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0
  8604. Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0
  8605. Class HP | HP-UX | 10.X | general purpose
  8606. TSeq(Class=64K)
  8607. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  8608. T2(Resp=N)
  8609. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  8610. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  8611. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8612. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8613. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8614. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8615.  
  8616. Fingerprint HP-UX release B.10.20 version A
  8617. Class HP | HP-UX | 10.X | general purpose
  8618. TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
  8619. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  8620. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8621. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8622. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8623. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8624. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8625. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8626. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8627.  
  8628. # HP9000 Model 804 K450 running HP-UX 11.00
  8629. # Mac OS9
  8630. Fingerprint Apple Mac OS 9, or HP-UX 11.00
  8631. Class HP | HP-UX | 11.X | general purpose
  8632. Class Apple | Mac OS | 9.X | general purpose
  8633. TSeq(Class=RI%gcd=<6%SI=<4F254&>C95)
  8634. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8635. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8636. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8637. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8638. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8639. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8640. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8641. PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8642.  
  8643. # HP-UX B.11.00
  8644. # HP-UX B.11.11
  8645. Fingerprint HP-UX 11
  8646. Class HP | HP-UX | 11.X | general purpose
  8647. TSeq(Class=RI%gcd=<6%SI=<A7B0C&>C6E%IPID=I%TS=100HZ)
  8648. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8649. T2(Resp=N)
  8650. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8651. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8652. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8653. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8654. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8655. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8656.  
  8657. Fingerprint HP-UX 11 w/tcp_isn_passphrase
  8658. Class HP | HP-UX | 11.X | general purpose
  8659. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  8660. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8661. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8662. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8663. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8664. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8665. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8666. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8667. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8668.  
  8669. # This is a weird one
  8670. Fingerprint HP-UX 11.00
  8671. Class HP | HP-UX | 11.X | general purpose
  8672. TSeq(Class=TD%gcd=>20000%SI=<3)
  8673. T1(Resp=N)
  8674. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8675. T3(Resp=N)
  8676. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8677. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8678. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8679. T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8680. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8681.  
  8682. # HP-UX test01 B.11.11 U 9000/800 1277844053 unlimited-user license
  8683. Fingerprint HP-UX 11.11
  8684. Class HP | HP-UX | 11.X | general purpose
  8685. TSeq(Class=RI%gcd=<6%SI=<C7A6A&>ABA%IPID=I%TS=100HZ)
  8686. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8687. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8688. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8689. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8690. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8691. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8692. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8693. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8694.  
  8695. Fingerprint HP-UX 11.11
  8696. Class HP | HP-UX | 11.X | general purpose
  8697. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  8698. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8699. T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=R%Ops=WNMETL)
  8700. T3(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=R%Ops=WNMETL)
  8701. T4(DF=N%W=800|1000|C00%ACK=S%Flags=R%Ops=WNMETL)
  8702. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8703. T6(DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
  8704. T7(DF=N%W=1000|800|C00%ACK=S%Flags=R%Ops=WNMETL)
  8705. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8706.  
  8707. Fingerprint HP-UX B.11.00 A 9000/785
  8708. Class HP | HP-UX | 11.X | general purpose
  8709. TSeq(Class=RI%gcd=<6%SI=<B108A&>630%IPID=I%TS=100HZ)
  8710. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8711. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8712. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8713. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8714. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8715. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8716. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8717. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8718.  
  8719. Fingerprint HP-UX B.11.00 A 9000/800
  8720. Class HP | HP-UX | 11.X | general purpose
  8721. TSeq(Class=RI%gcd=<6%SI=<8E148&>846%IPID=I%TS=100HZ)
  8722. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8723. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8724. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  8725. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8726. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8727. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8728. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  8729. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  8730.  
  8731. Fingerprint HP-UX B11.00 U 9000/839
  8732. Class HP | HP-UX | 11.X | general purpose
  8733. TSeq(Class=RI%gcd=<10%SI=<2114C&>536)
  8734. T1(Resp=N)
  8735. T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  8736. T3(Resp=N)
  8737. T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  8738. T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
  8739. T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  8740. T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  8741. PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8742.  
  8743. # HP-UX 7.0 B 9000/375
  8744. Fingerprint HP-UX 7.0
  8745. Class HP | HP-UX | 7.X | general purpose
  8746. TSeq(Class=64K%IPID=I%TS=U)
  8747. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  8748. T2(Resp=N)
  8749. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  8750. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8751. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8752. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8753. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8754. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  8755.  
  8756. Fingerprint HP-UX 9.01 - 9.07
  8757. Class HP | HP-UX | 9.X | general purpose
  8758. TSeq(Class=64K)
  8759. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  8760. T2(Resp=N)
  8761. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  8762. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  8763. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8764. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8765. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8766. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8767.  
  8768. Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777
  8769. Class HP | HP-UX | 9.X | general purpose
  8770. TSeq(Class=64K)
  8771. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
  8772. T2(Resp=N)
  8773. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  8774. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  8775. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8776. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8777. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8778. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  8779.  
  8780. Fingerprint HP MPE/iX 5.5
  8781. Class HP | MPE/iX || general purpose
  8782. TSeq(Class=TD%gcd=<6%SI=<14)
  8783. T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
  8784. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8785. T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
  8786. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8787. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8788. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8789. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8790. PU(Resp=N)
  8791.  
  8792. Fingerprint HP MPE/iX 5.5 on HP 3000
  8793. Class HP | MPE/iX || general purpose
  8794. TSeq(Class=TD%gcd=<6%SI=<1E%TS=U)
  8795. T1(DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M)
  8796. T2(Resp=N)
  8797. T3(Resp=Y%DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M)
  8798. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8799. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8800. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8801. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8802. PU(Resp=N)
  8803.  
  8804. Fingerprint HP Entria X station (running Netstation 7.x)
  8805. Class HP | Netstation || X terminal
  8806. TSeq(Class=64K)
  8807. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  8808. T2(Resp=N)
  8809. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  8810. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  8811. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8812. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8813. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8814. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8815.  
  8816. #  HPJ2600A Ethernet hub or HP ProCurve Switch 4000M
  8817. # Bay Networks MicroAnnex XL running firmware 10.0B
  8818. Fingerprint VxWorks 5.3.x bases system (usually an Ethernet hub or switch such as HP ProCurve) or Bay Networks MicroAnnex XL terminal server
  8819. Class HP | VxWorks || switch
  8820. Class Bay Networks | embedded || terminal server
  8821. TSeq(Class=64K)
  8822. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  8823. T2(Resp=N)
  8824. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  8825. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  8826. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8827. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8828. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8829. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8830.  
  8831. Fingerprint Huawei Quidway R2621 router running VRP 1.5.6(1)
  8832. Class Huawei | VRP || router
  8833. TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ)
  8834. T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
  8835. T2(Resp=N)
  8836. T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
  8837. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  8838. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8839. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8840. T7(Resp=N)
  8841. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8842.  
  8843. Fingerprint Huawei Quidway Router R2621E VRP 1.5.6
  8844. Class Huawei | VRP || router
  8845. TSeq(Class=TD%gcd=<1E806%SI=<14%IPID=I%TS=2HZ)
  8846. T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
  8847. T2(Resp=N)
  8848. T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
  8849. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  8850. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8851. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8852. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8853. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8854.  
  8855. Fingerprint Hydra HydraWEB 5000
  8856. Class Hydra | embedded || load balancer
  8857. TSeq(Class=RI%gcd=1|2|3|4%SI=<FFFF&>1111)
  8858. T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  8859. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8860. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  8861. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8862. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8863. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8864. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8865. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8866.  
  8867. Fingerprint IBM AIX 3.2
  8868. Class IBM | AIX | 3.X | general purpose
  8869. TSeq(Class=64K)
  8870. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  8871. T2(Resp=N)
  8872. T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
  8873. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  8874. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8875. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8876. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8877. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8878.  
  8879. Fingerprint IBM AIX 3.2
  8880. Class IBM | AIX | 3.X | general purpose
  8881. TSeq(Class=64K)
  8882. T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M)
  8883. T2(Resp=N)
  8884. T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=)
  8885. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  8886. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8887. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8888. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8889. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8890.  
  8891. Fingerprint IBM AIX 3.2 running on RS/6000
  8892. Class IBM | AIX | 3.X | general purpose
  8893. TSeq(Class=64K)
  8894. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  8895. T2(Resp=N)
  8896. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  8897. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8898. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8899. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8900. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8901. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8902.  
  8903. Fingerprint IBM AIX 3.2.3 running on RS6000 model 560
  8904. Class IBM | AIX | 3.X | general purpose
  8905. TSeq(Class=64K)
  8906. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  8907. T2(Resp=N)
  8908. T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
  8909. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  8910. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8911. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8912. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8913. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8914.  
  8915. Fingerprint IBM AIX 3.2.5 (Bull HardWare)
  8916. Class IBM | AIX | 3.X | general purpose
  8917. TSeq(Class=64K)
  8918. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
  8919. T2(Resp=N)
  8920. T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=)
  8921. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8922. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8923. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8924. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8925. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8926.  
  8927. # IBM AIX v3.2.5 running on 8xPower-2 wide nodes
  8928. # Fingerprint IBM AIX Version 4
  8929. Fingerprint IBM AIX v3.2.5 - 4
  8930. Class IBM | AIX | 3.X | general purpose
  8931. TSeq(Class=TR%gcd=<6)
  8932. T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  8933. T2(Resp=N)
  8934. T3(Resp=N)
  8935. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8936. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8937. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8938. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8939. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8940.  
  8941. Fingerprint IBM AIX 4.0 - 4.2
  8942. Class IBM | AIX | 4.X | general purpose
  8943. TSeq(Class=64K)
  8944. T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M)
  8945. T2(Resp=N)
  8946. T3(Resp=N)
  8947. T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=)
  8948. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8949. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8950. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8951. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  8952.  
  8953. Fingerprint IBM AIX 4.02.0001.0000
  8954. Class IBM | AIX | 4.X | general purpose
  8955. TSeq(Class=TR)
  8956. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  8957. T2(Resp=N)
  8958. T3(Resp=N)
  8959. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  8960. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8961. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8962. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8963. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  8964.  
  8965. Fingerprint IBM AIX 4.1
  8966. Class IBM | AIX | 4.X | general purpose
  8967. TSeq(Class=64K%gcd=<6%SI=<14)
  8968. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  8969. T2(Resp=N)
  8970. T3(Resp=N)
  8971. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  8972. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8973. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8974. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8975. PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8976.  
  8977. Fingerprint IBM AIX 4.1-4.1.5
  8978. Class IBM | AIX | 4.X | general purpose
  8979. TSeq(Class=64K)
  8980. T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
  8981. T2(Resp=N)
  8982. T3(Resp=N)
  8983. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  8984. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8985. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8986. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8987. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  8988.  
  8989. Fingerprint IBM AIX 4.2
  8990. Class IBM | AIX | 4.X | general purpose
  8991. TSeq(Class=TR)
  8992. T1(DF=N%W=FFAF|FFFF%ACK=S++%Flags=AS%Ops=M)
  8993. T2(Resp=N)
  8994. T3(Resp=N)
  8995. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8996. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8997. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8998. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8999. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9000.  
  9001. Fingerprint IBM AIX 4.2-4.3.3
  9002. Class IBM | AIX | 4.X | general purpose
  9003. TSeq(Class=TR)
  9004. T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
  9005. T2(Resp=N)
  9006. T3(Resp=N)
  9007. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9008. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9009. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9010. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9011. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9012.  
  9013. Fingerprint IBM AIX 4.2.X-4.3.3.0
  9014. Class IBM | AIX | 4.X | general purpose
  9015. TSeq(Class=TR%IPID=I%TS=U)
  9016. T1(DF=N|Y%W=3F25%ACK=S++%Flags=AS%Ops=M)
  9017. T2(Resp=N)
  9018. T3(Resp=N)
  9019. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9020. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9021. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9022. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9023. PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9024.  
  9025. Fingerprint IBM AIX 4.3
  9026. Class IBM | AIX | 4.X | general purpose
  9027. TSeq(Class=TR%gcd=<6)
  9028. T1(DF=Y%W=5B4|F87%ACK=S++%Flags=AS%Ops=M)
  9029. T2(Resp=N)
  9030. T3(Resp=N)
  9031. T4(DF=N%W=1000|4000%ACK=O%Flags=R%Ops=)
  9032. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9033. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9034. T7(Resp=N)
  9035. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  9036.  
  9037. Fingerprint IBM AIX 4.3.1 on a IBM RS/6000 R40
  9038. Class IBM | AIX | 4.X | general purpose
  9039. TSeq(Class=TR%gcd=<6%TS=U)
  9040. T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  9041. T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  9042. T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  9043. T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  9044. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9045. T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  9046. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  9047. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9048.  
  9049. # Fingerprint IBM AIX 4.3.3 on an RS/6000 H50
  9050. # Fingerprint IBM AIX 4.3.3 on a p660-6M1
  9051. # IBM AIX 4.3.3 ML10
  9052. Fingerprint IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/*
  9053. Class IBM | AIX | 4.X | general purpose
  9054. TSeq(Class=TR%gcd=<6)
  9055. T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  9056. T2(Resp=N)
  9057. T3(Resp=N)
  9058. T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=)
  9059. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9060. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9061. T7(Resp=N)
  9062. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0|F%UCK=0%ULEN=134%DAT=E)
  9063.  
  9064. # Fingerprint IBM-RS/6000 7017-S80, AIX Version 4.3.3.0
  9065. Fingerprint IBM AIX 4.3.3.0 on an IBM RS/*
  9066. Class IBM | AIX | 4.X | general purpose
  9067. TSeq(Class=TR%gcd=<6%TS=U)
  9068. T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M)
  9069. T2(Resp=N)
  9070. T3(Resp=N)
  9071. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9072. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9073. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9074. T7(Resp=N)
  9075. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9076.  
  9077. Fingerprint IBM AIX v4.1 running on a C10
  9078. Class IBM | AIX | 4.X | general purpose
  9079. TSeq(Class=64K)
  9080. T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  9081. T2(Resp=N)
  9082. T3(Resp=N)
  9083. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9084. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9085. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9086. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9087. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  9088.  
  9089. Fingerprint IBM AIX v4.2
  9090. Class IBM | AIX | 4.X | general purpose
  9091. TSeq(Class=TR%gcd=<6)
  9092. T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT)
  9093. T2(Resp=N)
  9094. T3(Resp=N)
  9095. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9096. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9097. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9098. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9099. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E)
  9100.  
  9101. Fingerprint IBM AIX Version 4.3
  9102. Class IBM | AIX | 4.X | general purpose
  9103. TSeq(Class=TR%gcd=<6)
  9104. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  9105. T2(Resp=N)
  9106. T3(Resp=N)
  9107. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9108. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9109. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9110. T7(Resp=N)
  9111. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  9112.  
  9113. Fingerprint IBM AIX 5.1
  9114. Class IBM | AIX | 5.X | general purpose
  9115. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9116. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  9117. T2(Resp=N)
  9118. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  9119. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9120. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9121. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9122. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9123. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9124.  
  9125. # Fingerprint IBM AIX 5.1.0.0 maintenance level 3
  9126. Fingerprint IBM AIX 5.1
  9127. Class IBM | AIX | 5.X | general purpose
  9128. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9129. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  9130. T2(Resp=N)
  9131. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  9132. T4(DF=N%W=0|4000%ACK=O%Flags=R%Ops=)
  9133. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9134. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9135. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9136. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9137.  
  9138. Fingerprint IBM AIX 5.1
  9139. Class IBM | AIX | 5.X | general purpose
  9140. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9141. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M)
  9142. T2(Resp=N)
  9143. T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M)
  9144. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  9145. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9146. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9147. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9148. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9149.  
  9150. # IBM AIX 5L 5.1
  9151. # IBM AIX 5.1 ML00
  9152. # AIX 5.1.4
  9153. # IBM AIX 5L Version 5.2
  9154. Fingerprint IBM AIX 5.1 - 5.2
  9155. Class IBM | AIX | 5.X | general purpose
  9156. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9157. T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
  9158. T2(Resp=N)
  9159. T3(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
  9160. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9161. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9162. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9163. T7(Resp=N)
  9164. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9165.  
  9166. Fingerprint IBM AIX 5.1 - 5.2
  9167. Class IBM | AIX | 5.X | general purpose
  9168. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9169. T1(DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M)
  9170. T2(Resp=N)
  9171. T3(Resp=Y%DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M)
  9172. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9173. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9174. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9175. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9176. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9177.  
  9178. # IBM AIX 5.1 on pSeries LPAR
  9179. # AIX 2 5 000B8CDC4C00 IBM AIX 5.2L Update 2
  9180. Fingerprint IBM AIX 5.1 - 5.2
  9181. Class IBM | AIX | 5.X | general purpose
  9182. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  9183. T1(DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  9184. T2(Resp=N)
  9185. T3(Resp=Y%DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  9186. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9187. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9188. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9189. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9190. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9191.  
  9192. # aix 5.1 Maintenance Level 6
  9193. Fingerprint IBM AIX 5.1 on a p610-6C1
  9194. Class IBM | AIX | 5.X | general purpose
  9195. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  9196. T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
  9197. T2(Resp=N)
  9198. T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
  9199. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9200. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9201. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9202. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9203. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9204.  
  9205. Fingerprint IBM AIX 5.1-5.2
  9206. Class IBM | AIX | 5.X | general purpose
  9207. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9208. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  9209. T2(Resp=N)
  9210. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  9211. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9212. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9213. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9214. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9215. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9216.  
  9217. # IBM AIX 5.103 on
  9218. Fingerprint IBM AIX 5.103
  9219. Class IBM | AIX | 5.X | general purpose
  9220. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  9221. T1(DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  9222. T2(Resp=N)
  9223. T3(Resp=Y%DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  9224. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9225. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9226. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9227. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9228. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9229.  
  9230. # IBM AIX 5.2 on pSeries (Power4)
  9231. Fingerprint IBM AIX 5.2
  9232. Class IBM | AIX | 5.X | general purpose
  9233. TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
  9234. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  9235. T2(Resp=N)
  9236. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  9237. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9238. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9239. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9240. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9241. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9242.  
  9243. # IBM AIX 5.2 (Maintenance Level 1) on RS/6000
  9244. Fingerprint IBM AIX 5.2 (on RS/6000)
  9245. Class IBM | AIX | 5.X | general purpose
  9246. TSeq(Class=TR%gcd=<6%TS=2HZ)
  9247. T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  9248. T2(Resp=N)
  9249. T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  9250. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9251. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9252. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9253. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9254. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9255.  
  9256. # AIX 5.2-003
  9257. Fingerprint IBM AIX 5.2.3
  9258. Class IBM | AIX | 5.X | general purpose
  9259. TSeq(Class=TR%gcd=<6%TS=2HZ)
  9260. T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  9261. T2(Resp=N)
  9262. T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  9263. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9264. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9265. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9266. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9267. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9268.  
  9269. # Fingerprint IBM AIX 5L V5.3 5765-G03 (2005/02) on IBM p5 (Power5 processor)
  9270. # Fingerprint IBM AIX 5.3 ML 01 on RS/6000 43P150
  9271. Fingerprint IBM AIX 5.3
  9272. Class IBM | AIX | 5.X | general purpose
  9273. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9274. T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M)
  9275. T2(Resp=N)
  9276. T3(Resp=Y%DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M)
  9277. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9278. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9279. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9280. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9281. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9282.  
  9283. Fingerprint IBM AIX 5.3 ML01
  9284. Class IBM | AIX | 5.X | general purpose
  9285. TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
  9286. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M)
  9287. T2(Resp=N)
  9288. T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M)
  9289. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9290. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9291. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9292. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9293. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  9294.  
  9295. Fingerprint IBM 8222 hub
  9296. Class IBM | embedded || hub
  9297. TSeq(Class=TD%gcd=<6%SI=<1A4%IPID=I%TS=U)
  9298. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  9299. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9300. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  9301. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9302. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9303. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9304. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9305. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9306.  
  9307. Fingerprint IBM 8239 Token-Ring Stackable Hub
  9308. Class IBM | embedded || hub
  9309. TSeq(Class=64K%IPID=I%TS=U)
  9310. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  9311. T2(Resp=N)
  9312. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  9313. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  9314. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9315. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9316. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9317. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9318.  
  9319. # Microplex M205 Pocket Print Server v5.7
  9320. # IBM 6400 Printer - Network Printer Server Version 7.0.9.6 [ network card ]
  9321. Fingerprint IBM 6400 printer or Microplex Pocket Print Server
  9322. Class IBM | embedded || printer
  9323. Class Microplex | embedded || print server
  9324. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  9325. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  9326. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9327. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  9328. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9329. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9330. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9331. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9332. PU(Resp=N)
  9333.  
  9334. Fingerprint IBM Infoprint 12 Net-Printer
  9335. Class IBM | embedded || printer
  9336. TSeq(Class=64K%IPID=I%TS=U)
  9337. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  9338. T2(Resp=N)
  9339. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=)
  9340. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  9341. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9342. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9343. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9344. PU(Resp=N)
  9345.  
  9346. Fingerprint IBM BladeCenter Remote Management Module
  9347. Class IBM | embedded || remote management
  9348. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9349. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  9350. T2(Resp=N)
  9351. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  9352. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9353. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9354. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9355. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9356. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9357.  
  9358. Fingerprint IBM Remote Supervisor Adapter II
  9359. Class IBM | embedded || remote management
  9360. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9361. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  9362. T2(Resp=N)
  9363. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  9364. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  9365. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  9366. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  9367. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  9368. PU(Resp=N)
  9369.  
  9370. Fingerprint IBM 2210 router
  9371. Class IBM | embedded || router
  9372. TSeq(Class=TD%gcd=<6%SI=<F)
  9373. T1(DF=N%W=0|200%ACK=S++%Flags=AS%Ops=ML)
  9374. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9375. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9376. T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
  9377. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9378. T6(DF=N%W=0%ACK=S|O|S++%Flags=R%Ops=)
  9379. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9380. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9381.  
  9382. Fingerprint IBM 2210 Router MRS 2.x on Token Ring interface
  9383. Class IBM | embedded || router
  9384. TSeq(Class=TR%gcd=<6)
  9385. T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  9386. T2(Resp=N)
  9387. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  9388. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9389. T5(DF=N%W=0%ACK=S++%Flags=AR|R%Ops=)
  9390. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  9391. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9392. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9393.  
  9394. # IBM 8210 Multiprotocol Switching Server for ATM networks, Model 3 (p/n 31L3  340),
  9395. Fingerprint IBM 8210 Multiprotocol Switching Server/router for ATM networks
  9396. Class IBM | embedded || router
  9397. TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
  9398. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  9399. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9400. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9401. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9402. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9403. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9404. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9405. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9406.  
  9407. Fingerprint Proteon OpenRoute 2.1 on a RBX200 Router or IBM 2210 Router
  9408. Class IBM | embedded || router
  9409. Class Proteon | OpenRoute || router
  9410. TSeq(Class=TD%gcd=<6%SI=<BB)
  9411. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  9412. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9413. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9414. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  9415. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9416. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  9417. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9418. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9419.  
  9420. Fingerprint IBM 3494 Magnetic Tape Library
  9421. Class IBM | embedded || storage-misc
  9422. TSeq(Class=RI%gcd=<6%SI=<A5B22&>1A6E%IPID=I%TS=U)
  9423. T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW)
  9424. T2(Resp=N)
  9425. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  9426. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  9427. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9428. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9429. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9430. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9431.  
  9432. Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT
  9433. Class IBM | embedded || switch
  9434. Class Xylan | embedded || switch
  9435. TSeq(Class=64K)
  9436. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  9437. T2(Resp=N)
  9438. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  9439. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  9440. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9441. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9442. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9443. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9444.  
  9445. # AGE Logic, Inc. IBM X-Station
  9446. Fingerprint AGE Logic, Inc. IBM XStation
  9447. Class IBM | embedded || X terminal
  9448. TSeq(Class=64K)
  9449. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  9450. T2(Resp=N)
  9451. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  9452. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  9453. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9454. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9455. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9456. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  9457.  
  9458. Fingerprint IBM MVS
  9459. Class IBM | MVS || general purpose
  9460. TSeq(Class=RI%gcd=64|C8|12C|190)
  9461. T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M)
  9462. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9463. T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|)
  9464. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9465. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9466. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9467. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9468. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  9469.  
  9470. Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2
  9471. Class IBM | MVS || general purpose
  9472. TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200)
  9473. T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
  9474. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9475. T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
  9476. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9477. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9478. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9479. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9480.  
  9481. Fingerprint IBM MVS TCP/IP TCPMVS 3.2
  9482. Class IBM | MVS || general purpose
  9483. TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E)
  9484. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  9485. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9486. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  9487. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9488. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9489. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9490. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9491. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  9492.  
  9493. Fingerprint IBM MVS TCP/IP TCPOE 3.3
  9494. Class IBM | MVS || general purpose
  9495. TSeq(Class=RI%gcd=<6%SI=<BB0)
  9496. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  9497. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9498. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  9499. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9500. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9501. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9502. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9503. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9504.  
  9505. Fingerprint IBM OS/2 V 2.1
  9506. Class IBM | OS/2 || general purpose
  9507. TSeq(Class=64K)
  9508. T1(DF=N%W=6FCC%ACK=S++%Flags=AS%Ops=M)
  9509. T2(Resp=N)
  9510. T3(Resp=Y%DF=N%W=6FCC%ACK=O%Flags=A%Ops=)
  9511. T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
  9512. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9513. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9514. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9515. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9516.  
  9517. Fingerprint IBM OS/2 V.3
  9518. Class IBM | OS/2 || general purpose
  9519. TSeq(Class=i800)
  9520. T1(DF=N%W=7000%ACK=S++%Flags=AS%Ops=M)
  9521. T2(Resp=N)
  9522. T3(Resp=Y%DF=N%W=7000%ACK=O%Flags=A%Ops=)
  9523. T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
  9524. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9525. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9526. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9527. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9528.  
  9529. Fingerprint IBM OS/2 Warp 4.0
  9530. Class IBM | OS/2 || general purpose
  9531. TSeq(Class=i800)
  9532. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
  9533. T2(Resp=N)
  9534. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  9535. T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
  9536. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9537. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9538. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9539. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9540.  
  9541. Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
  9542. Class IBM | OS/2 || general purpose
  9543. TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
  9544. T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  9545. T2(Resp=N)
  9546. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  9547. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  9548. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9549. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9550. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9551. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9552.  
  9553. Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
  9554. Class IBM | OS/2 || general purpose
  9555. TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
  9556. T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  9557. T2(Resp=N)
  9558. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  9559. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  9560. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9561. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9562. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9563. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9564.  
  9565. Fingerprint OS/2 Warp Server for eBusiness 4.52
  9566. Class IBM | OS/2 || general purpose
  9567. TSeq(Class=RI%gcd=<8%SI=<5A9A6&>633%IPID=I%TS=U)
  9568. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  9569. T2(Resp=N)
  9570. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  9571. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9572. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9573. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9574. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9575. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9576.  
  9577. Fingerprint IBM OS/390 V2R10
  9578. Class IBM | OS/390 | V2 | general purpose
  9579. TSeq(Class=RI%gcd=<6%SI=<17C1E&>128%IPID=I%TS=1000HZ)
  9580. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9581. T2(Resp=N)
  9582. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9583. T4(Resp=N)
  9584. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9585. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9586. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9587. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  9588.  
  9589. Fingerprint IBM OS/390 V5R0M0
  9590. Class IBM | OS/390 | V5 | general purpose
  9591. TSeq(Class=RI%gcd=<5%SI=>F&<BBBB)
  9592. T1(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9593. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9594. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9595. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  9596. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9597. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  9598. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9599. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9600.  
  9601. # added by Beat Rubischon <beat@rubis.ch>
  9602. Fingerprint IBM AS/400 V3 and V4
  9603. Class IBM | OS/400 | V3 | general purpose
  9604. Class IBM | OS/400 | V4 | general purpose
  9605. TSeq(Class=RI%gcd=<6)
  9606. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  9607. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9608. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  9609. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9610. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9611. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9612. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9613. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9614.  
  9615. Fingerprint IBM OS/400 V3
  9616. Class IBM | OS/400 | V3 | general purpose
  9617. TSeq(Class=RI%gcd=<8%SI=<3411C4&>5977%TS=1000HZ)
  9618. T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT)
  9619. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9620. T3(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT)
  9621. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9622. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9623. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9624. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9625. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9626.  
  9627. Fingerprint IBM AS/400 running OS/400 R4.4
  9628. Class IBM | OS/400 | V4 | general purpose
  9629. TSeq(Class=TD%gcd=<6%SI=<1E)
  9630. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9631. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9632. T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9633. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9634. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9635. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9636. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9637. PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9638.  
  9639. Fingerprint IBM OS/400 V4 r4-5
  9640. Class IBM | OS/400 | V4 | general purpose
  9641. TSeq(Class=RI%gcd=<C%SI=<C1C&>3%IPID=I%TS=1000HZ)
  9642. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9643. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9644. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9645. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9646. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9647. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9648. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9649. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9650.  
  9651. Fingerprint IBM OS/400 V4R2M0
  9652. Class IBM | OS/400 | V4 | general purpose
  9653. TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U)
  9654. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  9655. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9656. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  9657. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9658. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9659. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9660. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9661. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9662.  
  9663. Fingerprint IBM OS/400 V4R5
  9664. Class IBM | OS/400 | V4 | general purpose
  9665. TSeq(Class=C%IPID=I%TS=1000HZ)
  9666. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9667. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9668. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9669. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9670. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9671. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9672. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9673. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9674.  
  9675. Fingerprint IBM OS/400 V4R5M0
  9676. Class IBM | OS/400 | V4 | general purpose
  9677. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9678. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9679. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9680. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9681. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9682. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9683. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9684. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9685.  
  9686. Fingerprint IBM AS/400 running OS/400 5.1
  9687. Class IBM | OS/400 | V5 | general purpose
  9688. TSeq(Class=TD%gcd=<6000%SI=<14%IPID=I)
  9689. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9690. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9691. T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9692. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9693. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9694. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9695. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9696. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9697.  
  9698. # IBM proprietary operating system for AS/400 systems (now known as "iSeries")
  9699. # Fingerprint OS/400 V5R2
  9700. # IBM OS/400 V5R1M0
  9701. Fingerprint IBM OS/400 V5R1 - V5R2
  9702. Class IBM | OS/400 | V5 | general purpose
  9703. TSeq(Class=RI%gcd=<24%SI=<19DCD2&>6D3%IPID=I)
  9704. T1(DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9705. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9706. T3(Resp=Y%DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9707. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9708. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9709. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9710. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9711. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9712.  
  9713. # OS/400 V5R1M0 w/ C2134 + Autumn '02 Hiper, DB & Java
  9714. Fingerprint IBM OS/400 V5R1M0
  9715. Class IBM | OS/400 | V5 | general purpose
  9716. TSeq(Class=TD%gcd=<22222%SI=<14%IPID=I%TS=1000HZ)
  9717. T1(DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9718. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9719. T3(Resp=Y%DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9720. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9721. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9722. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9723. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9724. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9725.  
  9726. # IBM OS/400 V5.2
  9727. Fingerprint IBM OS/400 V5R2M0
  9728. Class IBM | OS/400 | V5 | general purpose
  9729. TSeq(Class=RI%gcd=<24%SI=<41D304&>7BC%IPID=I)
  9730. T1(DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
  9731. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9732. T3(Resp=Y%DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
  9733. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9734. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9735. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9736. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9737. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9738.  
  9739. Fingerprint IBM OS/400 V5R2M0
  9740. Class IBM | OS/400 | V5 | general purpose
  9741. TSeq(Class=RI%gcd=<8%SI=<2871A2&>276C%IPID=I%TS=1000HZ)
  9742. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9743. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9744. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9745. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9746. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9747. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9748. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9749. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  9750.  
  9751. # IBM iSeries OS/400 V5R2M0 L000
  9752. # IBM AS/400 - Operating System: OS/400 V5R2M0 (Version 5, Revision 2)
  9753. # IBM OS/400 V5R3M0 on iSeries
  9754. # OS/400 V5R3
  9755. Fingerprint OS/400 V5R2M0 or V5R3 or V5R3M0
  9756. Class IBM | OS/400 | V5 | general purpose
  9757. TSeq(Class=RI%gcd=<14%SI=<2EB440&>EF0%IPID=I%TS=1000HZ)
  9758. T1(DF=Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  9759. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9760. T3(Resp=N)
  9761. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9762. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9763. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9764. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9765. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9766.  
  9767. Fingerprint IBM VM/CMS (mainframe)
  9768. Class IBM | VM/CMS || general purpose
  9769. TSeq(Class=RI%gcd=64|C8%SI=>CC&<CCC)
  9770. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  9771. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9772. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  9773. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9774. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9775. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9776. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9777. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  9778.  
  9779. Fingerprint IBM VM/ESA 2.2.0 CMS Mainframe System
  9780. Class IBM | VM/CMS || general purpose
  9781. TSeq(Class=RI|TD%gcd=64|C8|12C|1F4|190%SI=<FFF)
  9782. T1(DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
  9783. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9784. T3(Resp=Y%DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
  9785. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9786. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9787. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9788. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9789. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  9790.  
  9791. # Infortrend EonStor A16U-G1410, firmware 3.42D.03
  9792. Fingerprint Infortrend EonStor A16U-G1410
  9793. Class Infortrend | embedded || storage-misc
  9794. TSeq(Class=RI|TD%gcd=<6%SI=<17CA%IPID=RD|RPI%TS=U)
  9795. T1(DF=N%W=5C8%ACK=S++%Flags=AS%Ops=MNNL)
  9796. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9797. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9798. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9799. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9800. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9801. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9802. PU(Resp=N)
  9803.  
  9804. # innovaphone 200 V4.00 sr4 IP200[02-4283], Bootcode[205], HW[202] 2048/8192
  9805. # innovaphone IP400 V4.00 hotfix IP400[02-4253], Bootcode[315], HW[102] 2048/4096
  9806. Fingerprint innovaphone IP200/IP400 VoIP phone/gateway
  9807. Class innovaphone | embedded || telecom-misc
  9808. TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
  9809. T1(DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
  9810. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9811. T3(Resp=Y%DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
  9812. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9813. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9814. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9815. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9816. PU(Resp=N)
  9817.  
  9818. # Intel NetStructure 3110 VPN Gateway V6.90p7
  9819. Fingerprint Intel NetStructure 3110 VPN Gateway
  9820. Class Intel | embedded || firewall
  9821. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9822. T1(Resp=N)
  9823. T2(Resp=N)
  9824. T3(Resp=N)
  9825. T4(Resp=N)
  9826. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  9827. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9828. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9829. PU(Resp=N)
  9830.  
  9831. Fingerprint Intel InBusiness Print Station
  9832. Class Intel | embedded || print server
  9833. TSeq(Class=64K)
  9834. T1(DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  9835. T2(Resp=N)
  9836. T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  9837. T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
  9838. T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  9839. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9840. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9841. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9842.  
  9843. Fingerprint Intel NetportExpress 10 3-port Print Server
  9844. Class Intel | embedded || print server
  9845. TSeq(Class=64K%IPID=I%TS=U)
  9846. T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  9847. T2(Resp=N)
  9848. T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  9849. T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
  9850. T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  9851. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9852. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9853. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  9854.  
  9855. # Intel NetportExpress(tm) 10/100 3-port ROM: V05.10a
  9856. Fingerprint Intel NetportExpress 10/100 3-port Print Server
  9857. Class Intel | embedded || print server
  9858. TSeq(Class=64K)
  9859. T1(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  9860. T2(Resp=N)
  9861. T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  9862. T4(Resp=Y%DF=N%W=16D0%ACK=O%Flags=R%Ops=)
  9863. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=R%Ops=)
  9864. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9865. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  9866. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  9867.  
  9868. Fingerprint Intel NetportExpress PRO Print Server V04.33a
  9869. Class Intel | embedded || print server
  9870. TSeq(Class=TD%gcd=1%SI=0)
  9871. T1(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9872. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  9873. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  9874. T4(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  9875. T5(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9876. T6(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  9877. T7(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9878. PU(Resp=N)
  9879.  
  9880. Fingerprint Intel NetportExpress XL Print Server
  9881. Class Intel | embedded || print server
  9882. TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U)
  9883. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  9884. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9885. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  9886. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9887. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9888. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9889. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9890. PU(Resp=N)
  9891.  
  9892. # Fingerprint Intel ER8100ST Express 8100 Router running firmware 3.20n
  9893. Fingerprint Intel ER8100ST Express Router 8100
  9894. Class Intel | embedded || router
  9895. TSeq(Class=TD%gcd=<E4%SI=<14%IPID=I%TS=U)
  9896. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  9897. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9898. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  9899. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9900. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9901. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9902. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9903. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9904.  
  9905. # Intel Corporation, ER9100 Express Router 9100
  9906. # Fingerprint by Ron van Daal (ronvdaal@syntonic.net)
  9907. Fingerprint Intel ER9100 Express Router 9100
  9908. Class Intel | embedded || router
  9909. TSeq(Class=TD%gcd=10|20|30%SI=1)
  9910. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  9911. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9912. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  9913. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9914. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9915. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9916. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9917. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9918.  
  9919. Fingerprint Intel Express 510T switch
  9920. Class Intel | embedded || switch
  9921. TSeq(Class=TD%gcd=10|20|30%SI=<BB)
  9922. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  9923. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9924. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  9925. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9926. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9927. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9928. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9929. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9930.  
  9931. Fingerprint Intel Express 510T switch
  9932. Class Intel | embedded || switch
  9933. TSeq(Class=i800%IPID=I%TS=U)
  9934. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  9935. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9936. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  9937. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9938. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9939. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9940. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9941. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9942.  
  9943. Fingerprint Intel NetStructure 470T Switch
  9944. Class Intel | embedded || switch
  9945. TSeq(Class=TD%gcd=<7534%SI=<64%IPID=I%TS=U)
  9946. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  9947. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9948. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  9949. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9950. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9951. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9952. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9953. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9954.  
  9955. Fingerprint Intergraph CLiX R3.1 Vr.7.6.20 6480
  9956. Class Intergraph | CLiX || general purpose
  9957. TSeq(Class=TD%gcd=<416%SI=<1E)
  9958. T1(DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
  9959. T2(Resp=N)
  9960. T3(Resp=Y%DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
  9961. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9962. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9963. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9964. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9965. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  9966.  
  9967. Fingerprint Intergraph Workstation (2000 Series) running CLiX R3.1
  9968. Class Intergraph | CLiX || general purpose
  9969. TSeq(Class=TD%gcd=209|1048|E3F%SI=<5)
  9970. T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  9971. T2(Resp=N)
  9972. T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  9973. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9974. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9975. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9976. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9977. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  9978.  
  9979. Fingerprint Intergraph jetSpeed 520 ADSL Router
  9980. Class Intracom | embedded || broadband router
  9981. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9982. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  9983. T2(Resp=N)
  9984. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  9985. T4(Resp=N)
  9986. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  9987. T6(Resp=N)
  9988. T7(Resp=N)
  9989. PU(DF=N%TOS=18%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9990.  
  9991. # IPCop 1.20 dedicated firewall Linux distro old Pentium 1 hardware + 3C509B cards http://ipcop.org/
  9992. Fingerprint IPCop 1.20 Linux 2.2.2X-based firewall
  9993. Class IPCop | Linux | 2.2.X | firewall
  9994. TSeq(Class=RI%gcd=<6%SI=<95DBC&>116E%IPID=I%TS=100HZ)
  9995. T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
  9996. T2(Resp=N)
  9997. T3(Resp=N)
  9998. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9999. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10000. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10001. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10002. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  10003.  
  10004. # Linux kernel 2.4.27 (x86) ipcop 1.40
  10005. # Linux ipcop 2.4.27 #1 Thu Sep 30 02:57:11 GMT 2004 i586 AuthenticAMD unknown GNU/Linux
  10006. # IPcop v1.4.2 Linux 2.4.27
  10007. # Linux fw.ioes.org 2.4.27 #1 Wed Sep 29 12:48:42 GMT 2004 i686 GenuineIntel unknown GNU/Linux (IPCOP+1.4)
  10008. # Linux 2.4.27-29 (IPCop 1.4.2)
  10009. # IPCop 1.4.2 (Kernel: 2.4.27) i486
  10010. # Linux 2.4.27 i686 GNU/Linux IPCop 1.4.2 (Green Interface)
  10011. # Linux 2.4.29 #1 i686 GenuineIntel+unknown GNU/Linux / IPCop 1.4.5
  10012. # IPCop Linux  1.4.5  (Linux xxx 2.4.29 #1) Pentuim II
  10013. # IPCOP 1.4.6 based on Debian/Linux 2.4.29
  10014. Fingerprint IPCop 1.4 - 1.4.6 Linux 2.4.2x-based firewall
  10015. Class IPCop | Linux | 2.4.X | firewall
  10016. TSeq(Class=RI%gcd=<6%SI=<24E74F4&>49DD3%IPID=Z%TS=U)
  10017. T1(DF=Y%W=16D0|400C%ACK=S++%Flags=AS%Ops=M)
  10018. T2(Resp=N)
  10019. T3(Resp=N)
  10020. T4(Resp=N)
  10021. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10022. T6(Resp=N)
  10023. T7(Resp=N)
  10024. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10025.  
  10026. # IPRoute V1.18, compiled at 08:26:02 on Jun 23 1998
  10027. Fingerprint IPRoute (DOS based software router)
  10028. Class IPRoute | DOS || software router
  10029. TSeq(Class=TD%gcd=<6%SI=<82%IPID=I%TS=U)
  10030. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  10031. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10032. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  10033. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10034. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10035. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10036. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10037. PU(DF=N%TOS=E0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10038.  
  10039. # IQinVison IQeye3 Version V2.1/1(030123)
  10040. Fingerprint IQinVison IQeye3 webcam
  10041. Class IQinVision | embedded || webcam
  10042. TSeq(Class=RI%gcd=<6%SI=<5168&>B3%IPID=I%TS=U)
  10043. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  10044. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10045. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10046. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10047. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10048. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10049. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10050. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10051.  
  10052. # IronPort AsyncOS 3.7.1-001 running on C60 platform
  10053. Fingerprint IronPort C60 email security appliance
  10054. Class IronPort | AsyncOS || specialized
  10055. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  10056. T1(DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT)
  10057. T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  10058. T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  10059. T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  10060. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  10061. T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  10062. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  10063. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10064.  
  10065. Fingerprint Isolation Systems Infocrypt Enterprise
  10066. Class Isolation | embedded || encryption accelerator
  10067. TSeq(Class=C)
  10068. T1(Resp=N)
  10069. T2(Resp=N)
  10070. T3(Resp=N)
  10071. T4(Resp=N)
  10072. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  10073. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  10074. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  10075. PU(Resp=N)
  10076.  
  10077. Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL traffic generation and analysis server
  10078. Class Ixia | embedded || specialized
  10079. TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI)
  10080. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  10081. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10082. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  10083. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10084. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10085. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10086. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10087. PU(Resp=N)
  10088.  
  10089. Fingerprint Juniper Networks JUNOS 5.3 on an Olive router
  10090. Class Juniper | JUNOS || router
  10091. TSeq(Class=RI%gcd=<6%SI=<ABEB4&>661%IPID=I%TS=100HZ)
  10092. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  10093. T2(Resp=N)
  10094. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  10095. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10096. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10097. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10098. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10099. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10100.  
  10101. # JUNOS <hostname> 5.6R1.3 JUNOS 5.6R1.3 #0: 2003-01-02 20:38:33 UTC -- This one was no Juniper Hardware Router but a JunOS installed on a simple i386 box.
  10102. Fingerprint Juniper Networks JUNOS 5.6R1.3 routing software on x86 box
  10103. Class Juniper | JUNOS || router
  10104. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  10105. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  10106. T2(Resp=N)
  10107. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  10108. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10109. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10110. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10111. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10112. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10113.  
  10114. # Juniper Networks JUNOS 5.5R1.2 built 2002-09-28
  10115. Fingerprint Juniper Networks router JUNOS 5.5R1.2
  10116. Class Juniper | JUNOS || router
  10117. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  10118. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  10119. T2(Resp=N)
  10120. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  10121. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10122. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10123. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10124. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10125. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10126.  
  10127. # Juniper router M10i JUNOS ROUTER 7.2R1.7 #0 i386
  10128. Fingerprint Juniper Networks router M10i running JUNOS 7.2R1.7
  10129. Class Juniper | JUNOS || router
  10130. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  10131. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  10132. T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  10133. T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
  10134. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  10135. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10136. T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  10137. T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  10138. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  10139.  
  10140. Fingerprint Juniper Router running JUNOS
  10141. Class Juniper | JUNOS || router
  10142. TSeq(Class=RI%gcd=<5%SI=>FFF)
  10143. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  10144. T2(Resp=N)
  10145. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  10146. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  10147. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10148. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10149. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10150. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10151.  
  10152. # KA9Q is a networking OS used mostly by amateur radio operators for radio to
  10153. # internet gateways.
  10154. Fingerprint KA9Q amateur radio OS
  10155. Class KA9Q | KA9Q || specialized
  10156. TSeq(Class=TD%gcd=37000%SI=<1E)
  10157. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
  10158. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10159. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
  10160. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10161. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10162. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10163. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10164. PU(Resp=N)
  10165.  
  10166. # 3Com OfficeConnect 812 ADSL router firmware 2.0.0
  10167. # Kentrox DataSMART 656 CSU/DSU or USR NETServer/16
  10168. Fingerprint Kentrox DataSMART 656 CSU/DSU, USR NETserver/16, or 3Com OfficeConnect ADSL router
  10169. Class Kentrox | embedded || CSUDSU
  10170. Class US Robotics | embedded || switch
  10171. Class 3Com | embedded || broadband router
  10172. TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=<A)
  10173. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  10174. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10175. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  10176. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10177. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10178. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10179. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10180. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10181.  
  10182. Fingerprint KIRK Wireless Server 600
  10183. Class KIRK | embedded || VoIP gateway
  10184. TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
  10185. T1(DF=N%W=2800%ACK=S++%Flags=AS%Ops=ME)
  10186. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10187. T3(Resp=Y%DF=N%W=2800%ACK=S++%Flags=AS%Ops=ME)
  10188. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10189. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10190. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10191. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10192. PU(Resp=N)
  10193.  
  10194. # Konica-Minolta magicolor2300DL printer controller f/w 02.83S engine f/w 4131.50G1.0900
  10195. Fingerprint Konica-Minolta magicolor2300DL printer controller
  10196. Class Konica | embedded || printer
  10197. TSeq(Class=64K%IPID=I%TS=2HZ)
  10198. T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=MNWNNT)
  10199. T2(Resp=N)
  10200. T3(Resp=Y%DF=N%W=1%ACK=O%Flags=A%Ops=NNT)
  10201. T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
  10202. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10203. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10204. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10205. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  10206.  
  10207. Fingerprint Kronos Time clock
  10208. Class Kronos | embedded || specialized
  10209. TSeq(Class=TD%gcd=<7C%SI=<32%IPID=I%TS=U)
  10210. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  10211. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  10212. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  10213. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  10214. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  10215. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  10216. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  10217. PU(Resp=N)
  10218.  
  10219. Fingerprint Kyocera FS-1700+ printer
  10220. Class Kyocera | embedded || printer
  10221. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  10222. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  10223. T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  10224. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AF|AR%Ops=)
  10225. T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  10226. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  10227. T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  10228. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  10229. PU(Resp=N)
  10230.  
  10231. Fingerprint Kyocera IB-21 Printer NIC
  10232. Class Kyocera | embedded || printer
  10233. TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U)
  10234. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  10235. T2(Resp=Y%DF=N%W=100%ACK=S%Flags=AR%Ops=)
  10236. T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AR%Ops=)
  10237. T4(DF=N%W=100%ACK=S%Flags=AR%Ops=)
  10238. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10239. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10240. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10241. PU(Resp=N)
  10242.  
  10243. # Kyocera FS-9100 DN printer, network firmware IB-21E 1.3.1
  10244. # Kyocera FS-6020 laser printer, system firmware 90.06, engine firmware A005, network firmware IB-21E 1.3.1
  10245. # Kyocera FS-5016N IB-21E Version 1.3.0
  10246. # Kyocera-Mita 2050 printer/copier/scanner
  10247. # Kyocera Printer FS-1900 (network firmware IB-21E 1.3.0)
  10248. # Kyocera IB-21E network module version 1.3.1
  10249. # KYOCERA Printer I/F IB-21E Ver 1.3.0
  10250. # Kyocera-Mita IB-21E
  10251. Fingerprint Kyocera Printer (network module IB-21E 1.3.x)
  10252. Class Kyocera | embedded || printer
  10253. TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U)
  10254. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  10255. T2(Resp=Y%DF=N%W=5B4%ACK=S%Flags=AR%Ops=)
  10256. T3(Resp=Y%DF=N%W=5B4%ACK=S++%Flags=AR%Ops=)
  10257. T4(DF=N%W=5B4%ACK=S%Flags=AR%Ops=)
  10258. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10259. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10260. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10261. PU(Resp=N)
  10262.  
  10263. # Kyocera SB-4e Printer-Interface in an Kyocera FS-800 laser printer
  10264. Fingerprint Kyocera SB-4e printer NIC
  10265. Class Kyocera | embedded || printer
  10266. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  10267. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  10268. T2(Resp=N)
  10269. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  10270. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10271. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10272. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10273. T7(Resp=N)
  10274. PU(Resp=N)
  10275.  
  10276. Fingerprint Labtam MT300, X-Terminal Kernel
  10277. Class Labtam | embedded || X terminal
  10278. TSeq(Class=64K)
  10279. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  10280. T2(Resp=N)
  10281. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  10282. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  10283. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10284. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10285. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10286. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  10287.  
  10288. Fingerprint Lantronix LSB4 Ethernet Switch
  10289. Class Lantronix | embedded || switch
  10290. TSeq(Class=RI%gcd=<6%SI=>CCC&<FFFF)
  10291. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  10292. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10293. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10294. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10295. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10296. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10297. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10298. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10299.  
  10300. # Radionics Ram IV Alarm System
  10301. # Lantronix CoBox DR1-IAP serial device server
  10302. Fingerprint Lantronix CoBox serial device server or Radionics RAM IV Alarm
  10303. Class Lantronix | embedded || terminal server
  10304. Class Radionics | embedded || specialized
  10305. TSeq(Class=TD%gcd=<404%SI=<6E%IPID=I%TS=U)
  10306. T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
  10307. T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10308. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10309. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10310. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10311. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10312. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10313. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10314.  
  10315. # Lantronix Consoleserver 800 (Technically, it is a Lightwave Consoleserver 800 prior to Lantronix purchase of the company.)
  10316. Fingerprint Lantronix Consoleserver 800
  10317. Class Lantronix | embedded || terminal server
  10318. TSeq(Class=TD%gcd=<6%SI=<14%IPID=I%TS=100HZ)
  10319. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  10320. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10321. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  10322. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10323. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10324. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10325. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10326. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10327.  
  10328. Fingerprint Lantronix ETS16 terminal server Version V3.4/5(961028)
  10329. Class Lantronix | embedded || terminal server
  10330. TSeq(Class=RI%gcd=<6%SI=<9D1C&>91%IPID=BI%TS=U)
  10331. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  10332. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10333. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10334. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10335. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10336. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10337. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10338. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10339.  
  10340. Fingerprint Lantronix ETS16P terminal server Version V3.5/2(970721)
  10341. Class Lantronix | embedded || terminal server
  10342. TSeq(Class=RI%gcd=<6%SI=<404C&>90)
  10343. T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M)
  10344. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10345. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10346. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10347. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10348. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10349. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10350. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10351.  
  10352. Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
  10353. Class Lantronix | embedded || terminal server
  10354. TSeq(Class=RI%gcd=<6%SI=<9318E&>1688%IPID=BI%TS=U)
  10355. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  10356. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10357. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10358. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10359. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10360. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10361. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10362. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10363.  
  10364. Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
  10365. Class Lantronix | embedded || terminal server
  10366. TSeq(Class=RI%gcd=<8%SI=<404C&>8C%IPID=BI%TS=U)
  10367. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  10368. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10369. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10370. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10371. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10372. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10373. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10374. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10375.  
  10376. Fingerprint Lantronix EPS1 Print Server version V3.5/1(970325)
  10377. Class Lantronix | Punix || print server
  10378. TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
  10379. T1(DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
  10380. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10381. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10382. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10383. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10384. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10385. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10386. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10387.  
  10388. # Lantronix EPS1 Printer Server running Punix version  2.9/342(930813)
  10389. Fingerprint Lantronix EPS1 Printer Server
  10390. Class Lantronix | Punix || print server
  10391. TSeq(Class=RI%gcd=<6%SI=<10018&>8F%IPID=BI%TS=U)
  10392. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  10393. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10394. T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=)
  10395. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10396. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10397. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10398. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10399. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10400.  
  10401. Fingerprint Lantronix EPS2 Print Server Version V3.5/2(970721)
  10402. Class Lantronix | Punix || print server
  10403. TSeq(Class=RI|TD%gcd=<6)
  10404. T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
  10405. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10406. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10407. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10408. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10409. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10410. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10411. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10412.  
  10413. # Lantronix ETS16 Version V3.1/2(940207) / [Punix version 2.9/379(940207)]
  10414. Fingerprint Lantronix ETS16 terminal server
  10415. Class Lantronix | Punix || terminal server
  10416. TSeq(Class=RI%gcd=<6%SI=<41E9C&>AD%IPID=RPI|BI%TS=U)
  10417. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  10418. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10419. T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=)
  10420. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10421. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10422. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10423. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10424. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10425.  
  10426. Fingerprint Leunig ePower Switch b723 v5.2
  10427. Class Leunig | embedded || power-device
  10428. TSeq(Class=TR)
  10429. T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  10430. T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  10431. T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  10432. T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=)
  10433. T5(Resp=N)
  10434. T6(Resp=N)
  10435. T7(Resp=N)
  10436. PU(Resp=N)
  10437.  
  10438. Fingerprint Fingerprint LevelOne WBR-3406TX Wireless Broadband router
  10439. Class Level One | embedded || broadband router
  10440. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
  10441. T1(DF=N%W=1540|1638%ACK=S++%Flags=AS%Ops=M)
  10442. T2(Resp=N)
  10443. T3(Resp=N)
  10444. T4(Resp=N)
  10445. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10446. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10447. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10448. PU(Resp=N)
  10449.  
  10450. # LevelOne Wireless router WBR-3403TX
  10451. Fingerprint LevelOne WBR-3403TX Wireless Broadband router
  10452. Class Level One | embedded || broadband router
  10453. TSeq(Class=RI%gcd=<6%SI=<102C870&>295B1%IPID=Z%TS=1000HZ)
  10454. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10455. T2(Resp=N)
  10456. T3(Resp=N)
  10457. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10458. T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=)
  10459. T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
  10460. T7(Resp=N)
  10461. PU(Resp=N)
  10462.  
  10463. Fingerprint Lexmark M412n network printer
  10464. Class Lexmark | embedded || printer
  10465. TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ)
  10466. T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
  10467. T2(Resp=N)
  10468. T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
  10469. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  10470. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10471. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10472. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10473. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10474.  
  10475. Fingerprint Lexmark Marknet X2031e printer
  10476. Class Lexmark | embedded || printer
  10477. TSeq(Class=RI%gcd=<6%SI=<AFDAC&>16E0%IPID=I%TS=2HZ)
  10478. T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
  10479. T2(Resp=N)
  10480. T3(Resp=N)
  10481. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  10482. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10483. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10484. T7(Resp=N)
  10485. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10486.  
  10487. # Lexmark Optra N Laser Printer
  10488. Fingerprint Lexmark Optra N Laser Printer
  10489. Class Lexmark | embedded || printer
  10490. TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U)
  10491. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  10492. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10493. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  10494. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10495. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10496. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10497. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10498. PU(DF=N%TOS=0%IPLEN=1C%RIPTL=0%RID=0%RIPCK=0%UCK=F%ULEN=134%DAT=E)
  10499.  
  10500. # Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1
  10501. # Lexmark Optra Lx+ Network Printer, firmware
  10502. Fingerprint Lexmark Optra network printer
  10503. Class Lexmark | embedded || printer
  10504. TSeq(Class=TD%gcd=388|1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20)
  10505. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  10506. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10507. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  10508. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  10509. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10510. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  10511. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10512. PU(Resp=N)
  10513.  
  10514. # Lexmark Optra T612 (printer) running firmware 3.11.17
  10515. # Lexmark Optra S 2420
  10516. Fingerprint Lexmark Optra printer
  10517. Class Lexmark | embedded || printer
  10518. TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
  10519. T1(DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
  10520. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10521. T3(Resp=Y%DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
  10522. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10523. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10524. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10525. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10526. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  10527.  
  10528. # Lexmark MarkNet XL Internal Printer Network Adapter on a Lexmark Optra LaserPrinter
  10529. Fingerprint Lexmark Optra printer w/MarkNet XL Network Adapter
  10530. Class Lexmark | embedded || printer
  10531. TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U)
  10532. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  10533. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10534. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  10535. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10536. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10537. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10538. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10539. PU(Resp=N)
  10540.  
  10541. #  Lexmark Optra S 1659 (MarkNetS)
  10542. #  Lexmark Optra S 2455 and SC 1275
  10543. # Lexmark S 1855 Firmware 1.9.14 Bootcode revision 7.3
  10544. Fingerprint Lexmark Optra S Printer
  10545. Class Lexmark | embedded || printer
  10546. TSeq(Class=TD%gcd=>1000%SI=<30)
  10547. T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
  10548. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10549. T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
  10550. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10551. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10552. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10553. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10554. PU(Resp=N|Y)
  10555.  
  10556. # Lexmark T520 printer, firmware 54.30.39
  10557. Fingerprint Lexmark T520 printer
  10558. Class Lexmark | embedded || printer
  10559. TSeq(Class=RI%gcd=<6%SI=<3651E88&>8AEFD%IPID=Z%TS=100HZ)
  10560. T1(DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW)
  10561. T2(Resp=N)
  10562. T3(Resp=Y%DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW)
  10563. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10564. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10565. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10566. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10567. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10568.  
  10569. Fingerprint Lexmark T522 printer
  10570. Class Lexmark | embedded || printer
  10571. TSeq(Class=RI%gcd=<6%SI=<24E3426&>5E5DB%IPID=Z%TS=100HZ)
  10572. T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
  10573. T2(Resp=N)
  10574. T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
  10575. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10576. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10577. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10578. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10579. PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10580.  
  10581. Fingerprint Lexmark T522/T622 printer
  10582. Class Lexmark | embedded || printer
  10583. TSeq(Class=RI%gcd=<8%SI=<2C2D254&>387BA%IPID=Z%TS=100HZ)
  10584. T1(DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW)
  10585. T2(Resp=N)
  10586. T3(Resp=Y%DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW)
  10587. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10588. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10589. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10590. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10591. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10592.  
  10593. Fingerprint LG Goldstream LR3001f router, software version 4.0
  10594. Class LG GoldStream | embedded || router
  10595. TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
  10596. T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
  10597. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  10598. T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
  10599. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  10600. T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  10601. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  10602. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  10603. PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  10604.  
  10605. Fingerprint LG Goldstream LR3100p router, software version 1.0-1.5
  10606. Class LG GoldStream | embedded || router
  10607. TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
  10608. T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
  10609. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  10610. T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
  10611. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  10612. T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  10613. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  10614. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  10615. PU(Resp=N)
  10616.  
  10617. Fingerprint Liebert Intellislot SNMP/Web Card (power devices, air conditioning, etc.)
  10618. Class Liebert | embedded || specialized
  10619. TSeq(Class=TD%gcd=<32DC4%SI=<14%IPID=I%TS=U)
  10620. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
  10621. T2(Resp=N)
  10622. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
  10623. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10624. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10625. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10626. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10627. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10628.  
  10629. # "This device listens on all TCP and all UDP ports, so OS
  10630. #  fingerprints are not that excellent. Actually there's not even an OS
  10631. #  running on it, it simply translates monitoring data into SNMP OIDs. It
  10632. #  can also be used to control the unit by setting specific OIDs."
  10633. Fingerprint Liebert-Hiross HiSNMP A/C controlling unit
  10634. Class Liebert-Hiross | embedded || specialized
  10635. T1(DF=Y%W=2000%ACK=S++%Flags=BAS%Ops=M)
  10636. T2(Resp=N)
  10637. T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=UAPSF%Ops=M)
  10638. T4(Resp=N)
  10639. T5(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
  10640. T6(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
  10641. T7(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
  10642. PU(Resp=N)
  10643.  
  10644. # Linksys WET-11 Wireless Ethernet bridge running firmware rev. 1.43
  10645. Fingerprint Linksys WET-11 Wireless Ethernet bridge
  10646. Class Linksys | embedded || bridge
  10647. TSeq(Class=RI%gcd=<6%SI=<2C30D0&>52F7%IPID=I%TS=U)
  10648. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  10649. T2(Resp=N)
  10650. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  10651. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10652. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  10653. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10654. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  10655. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10656.  
  10657. Fingerprint Linksys WGA54G Wireless Game Adapter (bridge)
  10658. Class Linksys | embedded || bridge
  10659. TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
  10660. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MM)
  10661. T2(Resp=N)
  10662. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  10663. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  10664. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10665. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10666. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10667. PU(Resp=N)
  10668.  
  10669. # Linksys EtherFast Cable/DSL Router with 4-port switch BEFSR41 ver. 3; firmware: 1.44.3, FEB 13 2003
  10670. Fingerprint Linksys BEFSR41 Broadband router
  10671. Class Linksys | embedded || broadband router
  10672. TSeq(Class=TD%gcd=<18%SI=<1E%IPID=Z%TS=U)
  10673. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10674. T2(Resp=N)
  10675. T3(Resp=N)
  10676. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  10677. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10678. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  10679. T7(Resp=N)
  10680. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10681.  
  10682. # Linksys BEFSR41 Broadband router and 4-port hub
  10683. Fingerprint Linksys BEFSR41 Broadband router
  10684. Class Linksys | embedded || broadband router
  10685. TSeq(Class=RI%gcd=<6%SI=<2FF88AC&>7ACA0%IPID=Z%TS=100HZ)
  10686. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10687. T2(Resp=N)
  10688. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10689. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10690. T5(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
  10691. T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
  10692. T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
  10693. PU(Resp=N)
  10694.  
  10695. # Linksys/Cisco BEFSR41 V3 Etherfast Cable/DSL Router (Firmware 1.04.17)
  10696. Fingerprint Linksys BEFSR41 V3 Etherfast cable/DSL router
  10697. Class Linksys | embedded || broadband router
  10698. T1(Resp=N)
  10699. T2(Resp=N)
  10700. T3(Resp=Y%DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  10701. T4(Resp=N)
  10702. T5(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=)
  10703. T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=)
  10704. T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
  10705. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10706.  
  10707. # Linksys BEFVP41 VPN Router - Firmware Version 1.41.1, Sep 04 2003
  10708. Fingerprint Linksys BEFVP41 VPN Router
  10709. Class Linksys | embedded || broadband router
  10710. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  10711. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  10712. T2(Resp=N)
  10713. T3(Resp=N)
  10714. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10715. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10716. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  10717. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10718. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10719.  
  10720. # Linksys BEFW11S4 DSL/Cable Router with Firmware 1.45z
  10721. Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router
  10722. Class Linksys | embedded || broadband router
  10723. TSeq(Class=TR%gcd=<6%IPID=I)
  10724. T1(DF=Y%W=4009%ACK=S++%Flags=AS%Ops=MNWNNT)
  10725. T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  10726. T3(Resp=N)
  10727. T4(DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=)
  10728. T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=)
  10729. T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  10730. T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
  10731. PU(Resp=N)
  10732.  
  10733. # Linksys BEFW11S4 firmware revision 1.45.10
  10734. Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router
  10735. Class Linksys | embedded || broadband router
  10736. TSeq(Class=TR%gcd=<6%IPID=I)
  10737. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  10738. T2(Resp=N)
  10739. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  10740. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10741. T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  10742. T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=)
  10743. T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=)
  10744. PU(Resp=N)
  10745.  
  10746. # LinkSys WRT-54G running the SVEASOFT code
  10747. # Linksys BEFW11S4 802.11B WAP
  10748. # Linksys BEFSR41 firmware ver. 1.40.2
  10749. # Linksys Router: BEFW11S4 v2/v3
  10750. Fingerprint Linksys BEFW11S4/WRT-54G Wireless Broadband router or BEFSR41 Cable/DSL router
  10751. Class Linksys | embedded || broadband router
  10752. TSeq(Class=TD|RI%gcd=<400%SI=<62C%IPID=Z|RD%TS=U)
  10753. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10754. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  10755. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10756. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  10757. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10758. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  10759. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10760. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10761.  
  10762. # Linksys WAG54G Wireless Broadband Router
  10763. Fingerprint Linksys WAG54G Wireless Broadband Router
  10764. Class Linksys | embedded || broadband router
  10765. TSeq(Class=TD%gcd=<E0%SI=<1E%IPID=Z%TS=U)
  10766. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  10767. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
  10768. T3(Resp=Y%DF=N%W=800|1000|400%ACK=S++%Flags=AR%Ops=)
  10769. T4(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=)
  10770. T5(DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
  10771. T6(DF=N%W=C00|800|1000%ACK=S%Flags=AR%Ops=)
  10772. T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  10773. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10774.  
  10775. Fingerprint Linksys WAG54G Wireless Gateway
  10776. Class Linksys | embedded || broadband router
  10777. TSeq(Class=RI%gcd=<8%SI=<1CE6872&>24FCE%IPID=Z%TS=1000HZ)
  10778. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10779. T2(Resp=N)
  10780. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10781. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10782. T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
  10783. T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=)
  10784. T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
  10785. PU(Resp=N)
  10786.  
  10787. # Linux kernel 2.4.20 (mips) on Linksys WRT54G Wireless Broadband Router with firmware Sveasoft +Alchemy-pre7a beta build version v3.37.6.8sv
  10788. Fingerprint Linksys WRT54G Wireless Broadband Router (Linux kernel 2.4.20)
  10789. Class Linksys | embedded || broadband router
  10790. TSeq(Class=RI%gcd=<6%SI=<17B7D1A&>3BAFF%IPID=Z%TS=100HZ)
  10791. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10792. T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  10793. T3(Resp=Y%DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  10794. T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  10795. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10796. T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  10797. T7(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  10798. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10799.  
  10800. Fingerprint Linksys EtherFast Print Server
  10801. Class Linksys | embedded || print server
  10802. T1(DF=N%W=0|C80%ACK=S++%Flags=AR|APS%Ops=|M)
  10803. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10804. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  10805. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10806. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10807. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10808. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10809. PU(Resp=N)
  10810.  
  10811. Fingerprint Linksys EtherFast Print Server
  10812. Class Linksys | embedded || print server
  10813. TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
  10814. T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
  10815. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10816. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
  10817. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10818. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10819. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10820. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10821. PU(Resp=N)
  10822.  
  10823. Fingerprint Linksys PSUS4 USB Print Server and switch
  10824. Class Linksys | embedded || print server
  10825. TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
  10826. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  10827. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10828. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  10829. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10830. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10831. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10832. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10833. PU(Resp=N)
  10834.  
  10835. Fingerprint Linksys WPS54GU2 Wireless Print Server
  10836. Class Linksys | embedded || print server
  10837. TSeq(Class=TD%gcd=<1A866%SI=<1E%IPID=I%TS=U)
  10838. T1(DF=N%W=111C%ACK=S++%Flags=APS|A%Ops=M|)
  10839. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10840. T3(Resp=Y%DF=N%W=111C|0%ACK=S++|O%Flags=APS|AR%Ops=M|)
  10841. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10842. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10843. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10844. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10845. PU(Resp=N)
  10846.  
  10847. # Linksys WRK54G Firmware Version: 1.56.01
  10848. # Linksys Wireless-B router/switch/802.11b access point (device model BEFW11S4 V4)
  10849. # Linksys BEFW11S4 firmware 1.50.14
  10850. # Linksys BEFSR41 v2 Firmware Version:  1.46.02, Aug 03 2004
  10851. # Linksys BEFSR81v2 Router with firmware 2.45.10
  10852. # Linksys EtherFast Cable/DSL Router (Model: BEFSR41 Ver 2)(Updated Firmware ver. 1.46.02, Aug 03+2004)
  10853. # Linksys Wireless-B Broadband Router BEFW11S4 Firmware v.1.50.14
  10854. # Linksys RT31P2  VoIP router (Vonage; firmware version 1.28.00; internal interface)
  10855. Fingerprint Linksys BEFW11S4/BEFSR41/BEFSR81/WRK54G Broadband router or RT31P2 VoIP router
  10856. Class Linksys | embedded || WAP
  10857. TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U)
  10858. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  10859. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  10860. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10861. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  10862. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10863. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  10864. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  10865. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10866.  
  10867. # Linksys WAP11 v2.6 firmware 1.06
  10868. Fingerprint Linksys WAP11 Wireless AP
  10869. Class Linksys | embedded || WAP
  10870. TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
  10871. T1(DF=N%W=1200%ACK=S++%Flags=AS%Ops=M)
  10872. T2(Resp=N)
  10873. T3(Resp=Y%DF=N%W=1200%ACK=O%Flags=A%Ops=)
  10874. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  10875. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10876. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10877. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10878. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10879.  
  10880. # Planet embedded WAP-1965
  10881. # Linksys WAP11 Wireless AP v2.2 firmware 1.06
  10882. # D-Link DWL-900+ with Firmware Version 2.57, Wed, 30 Apr 2003
  10883. # D-Link DWL - 2000 AP (WAP) firmware 2.04
  10884. Fingerprint Linksys, D-Link, or Planet WAP
  10885. Class Linksys | embedded || WAP
  10886. Class D-Link | embedded || WAP
  10887. TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
  10888. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  10889. T2(Resp=N)
  10890. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  10891. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  10892. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10893. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10894. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10895. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  10896.  
  10897. # fingerprint!
  10898. Fingerprint Linux 1.0.9
  10899. Class Linux | Linux | 1.X | general purpose
  10900. TSeq(Class=TD%gcd=30|60%SI=<F)
  10901. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  10902. T2(Resp=N)
  10903. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=ASF%Ops=M)
  10904. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10905. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10906. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10907. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10908. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10909.  
  10910. Fingerprint Linux 1.2.13
  10911. Class Linux | Linux | 1.X | general purpose
  10912. TSeq(Class=TD%gcd=1%SI=1C)
  10913. T1(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
  10914. T2(Resp=N)
  10915. T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
  10916. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10917. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10918. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10919. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10920. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10921.  
  10922. Fingerprint Linux 1.2.8 - 1.2.13
  10923. Class Linux | Linux | 1.X | general purpose
  10924. TSeq(Class=RI%gcd=<6%SI=<BBBB)
  10925. T1(DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
  10926. T2(Resp=N)
  10927. T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
  10928. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10929. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10930. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10931. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10932. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10933.  
  10934. Fingerprint Linux 1.3.20 (x86)
  10935. Class Linux | Linux | 1.X | general purpose
  10936. T1(DF=N%W=77FF|0%ACK=S++%Flags=AS|BAR%Ops=ME|)
  10937. T2(Resp=N)
  10938. T3(Resp=N)
  10939. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10940. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10941. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10942. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10943. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10944.  
  10945. Fingerprint Linux 2.0.0
  10946. Class Linux | Linux | 2.0.X | general purpose
  10947. TSeq(Class=RI%gcd=<6)
  10948. T1(DF=N%W=7C00%ACK=S++%Flags=BAS%Ops=ME)
  10949. T2(Resp=N)
  10950. T3(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=ASF%Ops=ME)
  10951. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10952. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10953. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10954. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10955. PU(DF=N%TOS=6%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10956.  
  10957. Fingerprint Linux 2.0.27 - 2.0.30
  10958. Class Linux | Linux | 2.0.X | general purpose
  10959. TSeq(Class=TR)
  10960. T1(DF=N%W=7C00|3C00%ACK=S++%Flags=BAS%Ops=ME)
  10961. T2(Resp=N)
  10962. T3(Resp=Y%DF=N%W=7C00|3C00%ACK=S++%Flags=ASF%Ops=ME)
  10963. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10964. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10965. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10966. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10967. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10968.  
  10969. Fingerprint Linux 2.0.32-34
  10970. Class Linux | Linux | 2.0.X | general purpose
  10971. TSeq(Class=TR%gcd=<6)
  10972. T1(DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=BAS%Ops=ME)
  10973. T2(Resp=N)
  10974. T3(Resp=Y%DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=ASF%Ops=ME)
  10975. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10976. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10977. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10978. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10979. PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10980.  
  10981. # On very rare cases, I get a T2 response back -- weird
  10982. Fingerprint Linux 2.0.32-34
  10983. Class Linux | Linux | 2.0.X | general purpose
  10984. TSeq(Class=TR)
  10985. T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME)
  10986. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10987. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  10988. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10989. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10990. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10991. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10992. PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10993.  
  10994. Fingerprint Linux 2.0.34-38
  10995. Class Linux | Linux | 2.0.X | general purpose
  10996. TSeq(Class=TR)
  10997. T1(DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=AS%Ops=ME|M)
  10998. T2(Resp=N)
  10999. T3(Resp=Y%DF=N%W=7FDF|7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=ASF%Ops=|ME|M)
  11000. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11001. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11002. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11003. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11004. PU(DF=N%TOS=C0|A0|0|20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11005.  
  11006. Fingerprint Linux 2.0.35 (S.u.S.E. Linux 5.3 (i386)
  11007. Class Linux | Linux | 2.0.X | general purpose
  11008. TSeq(Class=TR%gcd=<6)
  11009. T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=ME)
  11010. T2(Resp=N)
  11011. T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=ASF%Ops=ME)
  11012. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11013. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11014. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11015. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11016. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11017.  
  11018. Fingerprint Linux 2.0.39
  11019. Class Linux | Linux | 2.0.X | general purpose
  11020. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  11021. T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
  11022. T2(Resp=N)
  11023. T3(Resp=Y%DF=N%W=3FE0|0%ACK=S++%Flags=ARSF|AR%Ops=ME|)
  11024. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11025. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11026. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11027. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11028. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11029.  
  11030. Fingerprint Linux 2.1.19 - 2.2.25
  11031. Class Linux | Linux | 2.1.X | general purpose
  11032. Class Linux | Linux | 2.2.X | general purpose
  11033. TSeq(Class=RI%gcd=<8%SI=>10000%IPID=I%TS=100HZ)
  11034. T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
  11035. T2(Resp=N)
  11036. T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
  11037. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11038. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11039. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11040. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11041. PU(DF=N%TOS=28|C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  11042.  
  11043. Fingerprint Linux 2.1.24 PowerPC
  11044. Class Linux | Linux | 2.1.X | general purpose
  11045. TSeq(Class=TR)
  11046. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  11047. T2(Resp=N)
  11048. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  11049. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  11050. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11051. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  11052. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11053. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11054.  
  11055. Fingerprint Linux 2.1.76
  11056. Class Linux | Linux | 2.1.X | general purpose
  11057. TSeq(Class=TR)
  11058. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
  11059. T2(Resp=N)
  11060. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
  11061. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11062. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11063. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11064. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11065. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11066.  
  11067. Fingerprint Linux 2.1.88
  11068. Class Linux | Linux | 2.1.X | general purpose
  11069. TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7)
  11070. T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME)
  11071. T2(Resp=N)
  11072. T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|)
  11073. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11074. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11075. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11076. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11077. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11078.  
  11079. Fingerprint Linux 2.1.91 - 2.1.103
  11080. Class Linux | Linux | 2.1.X | general purpose
  11081. TSeq(Class=RI%gcd=<6%SI=>7A000)
  11082. T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW)
  11083. T2(Resp=N)
  11084. T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW)
  11085. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  11086. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11087. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  11088. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11089. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11090.  
  11091. Fingerprint Linux 2.2.12 - 2.2.25
  11092. Class Linux | Linux | 2.2.X | general purpose
  11093. TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U)
  11094. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
  11095. T2(Resp=N)
  11096. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
  11097. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11098. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11099. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11100. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11101. PU(DF=N%TOS=0|60|A0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11102.  
  11103. Fingerprint Linux 2.2.13
  11104. Class Linux | Linux | 2.2.X | general purpose
  11105. TSeq(Class=RI%gcd=<6%SI=<E5F68C&>24CA0)
  11106. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11107. T2(Resp=N)
  11108. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11109. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11110. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11111. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11112. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11113. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11114.  
  11115. # SuSE Linux 6.3 (i386) - Kernel 2.2.13
  11116. Fingerprint Linux 2.2.13 (SuSE; x86)
  11117. Class Linux | Linux | 2.2.X | general purpose
  11118. TSeq(Class=RI%gcd=<6%SI=<21DE76C&>2B4E4%IPID=I%TS=100HZ)
  11119. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
  11120. T2(Resp=N)
  11121. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
  11122. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11123. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11124. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11125. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11126. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11127.  
  11128. Fingerprint Linux 2.2.14
  11129. Class Linux | Linux | 2.2.X | general purpose
  11130. TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7)
  11131. T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11132. T2(Resp=N)
  11133. T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11134. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11135. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11136. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11137. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11138. PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)
  11139.  
  11140. Fingerprint Linux 2.2.16C37_III on Sun Cobalt
  11141. Class Linux | Linux | 2.2.X | general purpose
  11142. TSeq(Class=RI%gcd=<6%SI=<2021DA2&>3CBCC%IPID=I%TS=100HZ)
  11143. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11144. T2(Resp=N)
  11145. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11146. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11147. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11148. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11149. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11150. PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11151.  
  11152. # Linux 2.2.19-6.2.1ensim-3.1.5-2 (RedHat 7.2)
  11153. Fingerprint Linux 2.2.19
  11154. Class Linux | Linux | 2.2.X | general purpose
  11155. TSeq(Class=RI%gcd=<6%SI=<242483C&>5C202%IPID=I%TS=100HZ)
  11156. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11157. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11158. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11159. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11160. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11161. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11162. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11163. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11164.  
  11165. Fingerprint Linux 2.2.19 (Alpha)
  11166. Class Linux | Linux | 2.2.X | general purpose
  11167. TSeq(Class=RI%gcd=<6%SI=<1409420&>3348D%IPID=I%TS=1000HZ)
  11168. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11169. T2(Resp=N)
  11170. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11171. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11172. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11173. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11174. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11175. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11176.  
  11177. Fingerprint Linux 2.2.19 - 2.2.20
  11178. Class Linux | Linux | 2.2.X | general purpose
  11179. TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U)
  11180. T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
  11181. T2(Resp=N)
  11182. T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
  11183. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11184. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11185. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11186. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11187. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11188.  
  11189. # Linux 2.2.19 on a DEC Alpha 233mhz Multia
  11190. Fingerprint Linux 2.2.19 on a DEC Alpha
  11191. Class Linux | Linux | 2.2.X | general purpose
  11192. TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ)
  11193. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11194. T2(Resp=N)
  11195. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  11196. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11197. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11198. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11199. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11200. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)
  11201.  
  11202. Fingerprint Linux 2.2.20 SMP
  11203. Class Linux | Linux | 2.2.X | general purpose
  11204. TSeq(Class=RI%gcd=<6%SI=<277C73C&>6371B%IPID=I%TS=100HZ)
  11205. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
  11206. T2(Resp=N)
  11207. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
  11208. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11209. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11210. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11211. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11212. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11213.  
  11214. Fingerprint Linux 2.2.21 SMP (x86)
  11215. Class Linux | Linux | 2.2.X | general purpose
  11216. TSeq(Class=RI%gcd=<6%SI=<1921FE8&>404B1%IPID=I%TS=U)
  11217. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
  11218. T2(Resp=N)
  11219. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
  11220. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11221. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11222. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11223. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11224. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11225.  
  11226. Fingerprint Linux 2.2.22
  11227. Class Linux | Linux | 2.2.X | general purpose
  11228. TSeq(Class=RI%gcd=<6%SI=<22AB988&>58BFF%IPID=I%TS=U)
  11229. T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
  11230. T2(Resp=N)
  11231. T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
  11232. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11233. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11234. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11235. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11236. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11237.  
  11238. Fingerprint Linux 2.2.5 - 2.2.13 SMP
  11239. Class Linux | Linux | 2.2.X | general purpose
  11240. TSeq(Class=RI%gcd=<6%SI=<D49FAE&>2203C)
  11241. T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
  11242. T2(Resp=N)
  11243. T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
  11244. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11245. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11246. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11247. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11248. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)
  11249.  
  11250. # Linux kernel 2.4.4-4GB (X86) from Red hat
  11251. Fingerprint Linux 2.4.4
  11252. Class Linux | Linux | 2.2.X | general purpose
  11253. TSeq(Class=RI%gcd=<6%SI=<FC5E4&>19E%IPID=Z%TS=U)
  11254. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  11255. T2(Resp=N)
  11256. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  11257. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11258. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11259. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11260. T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  11261. PU(Resp=N)
  11262.  
  11263. Fingerprint Linux 2.3.12
  11264. Class Linux | Linux | 2.3.X | general purpose
  11265. TSeq(Class=RI%gcd=<20%SI=>DDDD)
  11266. T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
  11267. T2(Resp=N)
  11268. T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
  11269. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11270. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11271. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11272. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11273. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11274.  
  11275. Fingerprint Linux 2.3.28-33
  11276. Class Linux | Linux | 2.3.X | general purpose
  11277. TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3)
  11278. T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  11279. T2(Resp=N)
  11280. T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  11281. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11282. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11283. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11284. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11285. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11286.  
  11287. Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86
  11288. Class Linux | Linux | 2.3.X | general purpose
  11289. TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA)
  11290. T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  11291. T2(Resp=N)
  11292. T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  11293. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11294. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11295. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11296. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11297. PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11298.  
  11299. Fingerprint Linux 2.3.49 x86
  11300. Class Linux | Linux | 2.3.X | general purpose
  11301. TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E)
  11302. T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  11303. T2(Resp=N)
  11304. T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  11305. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11306. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11307. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11308. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11309. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11310.  
  11311. Fingerprint Astaro Security Linux 4 (Kernel 2.4.19)
  11312. Class Linux | Linux | 2.4.X | general purpose
  11313. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  11314. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  11315. T2(Resp=N)
  11316. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  11317. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11318. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11319. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11320. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11321. PU(Resp=N)
  11322.  
  11323. # I don't put "Gentoo" as the vendor for the classification because it
  11324. # makes output ugly when there are a bunch of Linux matches due to
  11325. # firewalling or similar problems.
  11326. Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5)
  11327. Class Linux | Linux | 2.4.X | general purpose
  11328. TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ)
  11329. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11330. T2(Resp=N)
  11331. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11332. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11333. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11334. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11335. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11336. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11337.  
  11338. # Cobalt Linux 6.0 Kernel 2.2.16c32_III on an i586
  11339. Fingerprint Linux 2.2.16
  11340. Class Linux | Linux | 2.4.X | general purpose
  11341. TSeq(Class=RI%gcd=<6%SI=<23D760E&>5BBDD%IPID=Z)
  11342. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11343. T2(Resp=N)
  11344. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11345. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11346. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11347. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11348. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11349. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11350.  
  11351. Fingerprint Linux 2.4.0 - 2.5.20
  11352. Class Linux | Linux | 2.4.X | general purpose
  11353. Class Linux | Linux | 2.5.X | general purpose
  11354. TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U)
  11355. T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
  11356. T2(Resp=N)
  11357. T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
  11358. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11359. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11360. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11361. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11362. PU(DF=Y|N%TOS=0|8|14|20|28|38|40|C0|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  11363.  
  11364. Fingerprint Linux 2.4.0 - 2.5.20 w/o tcp_timestamps
  11365. Class Linux | Linux | 2.4.X | general purpose
  11366. Class Linux | Linux | 2.5.X | general purpose
  11367. TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U)
  11368. T1(DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
  11369. T2(Resp=N)
  11370. T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
  11371. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11372. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11373. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11374. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11375. PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  11376.  
  11377. Fingerprint Linux 2.4.0-test5
  11378. Class Linux | Linux | 2.4.X | general purpose
  11379. TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8)
  11380. T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
  11381. T2(Resp=N)
  11382. T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
  11383. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11384. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11385. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11386. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11387. PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)
  11388.  
  11389. # Linux 2.4.18
  11390. # SuSE Linux 7.3 linux-2.4.10-4GB, running on amd k6-2
  11391. Fingerprint Linux 2.4.10 - 2.4.18
  11392. Class Linux | Linux | 2.4.X | general purpose
  11393. TSeq(Class=RI%gcd=<6%SI=<21BFEA2&>46B9B%IPID=Z%TS=100HZ)
  11394. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  11395. T2(Resp=N)
  11396. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  11397. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11398. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11399. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11400. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11401. PU(DF=N%TOS=D0|D8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11402.  
  11403. # Strangely enough, I have received several prints like this that claim a T2:
  11404. Fingerprint Linux 2.4.16 - 2.4.18
  11405. Class Linux | Linux | 2.4.X | general purpose
  11406. TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ)
  11407. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11408. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  11409. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11410. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11411. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11412. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11413. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11414. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11415.  
  11416. Fingerprint Linux 2.4.17 on HP 9000 s700
  11417. Class Linux | Linux | 2.4.X | general purpose
  11418. TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ)
  11419. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11420. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  11421. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  11422. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  11423. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11424. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  11425. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  11426. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11427.  
  11428. Fingerprint Linux 2.4.18
  11429. Class Linux | Linux | 2.4.X | general purpose
  11430. TSeq(Class=RI%gcd=<8%SI=<1C15A06&>23F17%IPID=Z)
  11431. T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
  11432. T2(Resp=N)
  11433. T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
  11434. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11435. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11436. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11437. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11438. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11439.  
  11440. # Debian/Gnu Linux 3.0 (Woody) Kernel 2.4.18-bf2.4
  11441. Fingerprint Linux 2.4.18
  11442. Class Linux | Linux | 2.4.X | general purpose
  11443. TSeq(Class=RI%gcd=<6%SI=<293EE44&>69651%IPID=Z%TS=100HZ)
  11444. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  11445. T2(Resp=N)
  11446. T3(Resp=N)
  11447. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11448. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11449. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11450. T7(Resp=N)
  11451. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11452.  
  11453. Fingerprint Linux 2.4.18 (PPC)
  11454. Class Linux | Linux | 2.4.X | general purpose
  11455. TSeq(Class=RI%gcd=<6%SI=<36CB986&>488A7%IPID=Z%TS=100HZ)
  11456. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  11457. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11458. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  11459. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11460. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11461. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11462. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11463. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11464.  
  11465. Fingerprint Linux 2.4.18 (x86)
  11466. Class Linux | Linux | 2.4.X | general purpose
  11467. TSeq(Class=RI%gcd=<6%SI=<5BA02C&>EA7B%IPID=Z%TS=100HZ)
  11468. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11469. T2(Resp=N)
  11470. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11471. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11472. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11473. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11474. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11475. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11476.  
  11477. Fingerprint Linux 2.4.18 (x86)
  11478. Class Linux | Linux | 2.4.X | general purpose
  11479. TSeq(Class=RI%gcd=<6%SI=<2774D66&>2F583%IPID=Z%TS=100HZ)
  11480. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11481. T2(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
  11482. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11483. T4(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=)
  11484. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11485. T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  11486. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
  11487. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11488.  
  11489. # Linux 2.4.18-custom
  11490. # Linux 2.4.19 w/o tcp_timestamps
  11491. Fingerprint Linux 2.4.18 - 2.4.19 w/o tcp_timestamps
  11492. Class Linux | Linux | 2.4.X | general purpose
  11493. TSeq(Class=RI%gcd=<6%SI=<1720870&>361B9%IPID=Z%TS=U)
  11494. T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
  11495. T2(Resp=N)
  11496. T3(Resp=Y%DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
  11497. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11498. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11499. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11500. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11501. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11502.  
  11503. Fingerprint Linux 2.4.18 - 2.4.20
  11504. Class Linux | Linux | 2.4.X | general purpose
  11505. TSeq(Class=RI%gcd=<6%SI=<14B7282&>11A94%IPID=Z%TS=100HZ)
  11506. T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11507. T2(Resp=N)
  11508. T3(Resp=Y%DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11509. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11510. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11511. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11512. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11513. PU(DF=N%TOS=30|60|D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11514.  
  11515. # Linux 2.4.20 (Gentoo 1.2; x86)
  11516. # Linux 2.4.18-14
  11517. Fingerprint Linux 2.4.18 - 2.4.20 (x86)
  11518. Class Linux | Linux | 2.4.X | general purpose
  11519. TSeq(Class=RI%gcd=<6%SI=<2B9C772&>6FA19%IPID=Z%TS=100HZ)
  11520. T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  11521. T2(Resp=N)
  11522. T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  11523. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11524. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11525. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11526. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11527. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11528.  
  11529. # linux 2.4.20 (i586) Preemptible
  11530. # Linux 2.4.18
  11531. # 2.4.21-20.ELsmp SMP RedHat AS3, REL3
  11532. Fingerprint Linux 2.4.18 - 2.4.21 (x86)
  11533. Class Linux | Linux | 2.4.X | general purpose
  11534. TSeq(Class=RI%gcd=<8%SI=<25C5808&>30578%IPID=Z%TS=100HZ)
  11535. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11536. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  11537. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11538. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11539. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11540. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11541. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11542. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11543.  
  11544. # Linux kernel 2.4.21-4.0.1.ELsmp x86 Dual Xeon RedHat EL3 AS3 (Red Hat Linux 3.2.3-20)
  11545. # Linux Kernel 2.4.21-4.0.1 Red Hat Enterprise Linux ES release 3 (Taroon)
  11546. # Linux sun 2.4.27 #3 SMP Mon Nov 1 21:24:45 GMT 2004 sparc unknown unknown GNU/Linux
  11547. # Linux AthenA-server 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i586 unknown
  11548. Fingerprint Linux 2.4.18 - 2.4.27
  11549. Class Linux | Linux | 2.4.X | general purpose
  11550. TSeq(Class=TR|RI%gcd=<6%SI=<2CA3968&>49B3D%IPID=Z%TS=100HZ)
  11551. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11552. T2(Resp=N)
  11553. T3(Resp=N)
  11554. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11555. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11556. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11557. T7(Resp=N)
  11558. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11559.  
  11560. # Linux live cd knoppix 2.4.27 (knoppix 2.6)
  11561. Fingerprint Linux 2.4.18 - 2.4.27
  11562. Class Linux | Linux | 2.4.X | general purpose
  11563. TSeq(Class=RI%gcd=<8%SI=<3859E24&>47DBA%IPID=Z%TS=100HZ)
  11564. T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11565. T2(Resp=N)
  11566. T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11567. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11568. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11569. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11570. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11571. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11572.  
  11573. # Linux 4.19-4GB #1 Tue Sep 30 19:01:07 UTC 2003 i686 unknown / SuSe Linux OpenExchange Server
  11574. Fingerprint Linux 2.4.19
  11575. Class Linux | Linux | 2.4.X | general purpose
  11576. TSeq(Class=RI%gcd=<6%SI=<13A36B6&>3244E%IPID=Z%TS=100HZ)
  11577. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11578. T2(Resp=N)
  11579. T3(Resp=N)
  11580. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11581. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  11582. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  11583. T7(Resp=N)
  11584. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11585.  
  11586. # Linux kernel 2.4.19C13_V (X86) Sun Cobalt RaQ550
  11587. Fingerprint Linux 2.4.19
  11588. Class Linux | Linux | 2.4.X | general purpose
  11589. TSeq(Class=RI%gcd=<6%SI=<20DD6C4&>54211%IPID=Z%TS=100HZ)
  11590. T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
  11591. T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL)
  11592. T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  11593. T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  11594. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11595. T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  11596. T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
  11597. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11598.  
  11599. # Mandrake 9.1 SMP 2.4.19-16mdksmp #1 SMP Fri Sep 20 16:08:37 CEST 2002 i686 unknown unknown GNU/Linux
  11600. Fingerprint Linux 2.4.19 (Mandrake, X86)
  11601. Class Linux | Linux | 2.4.X | general purpose
  11602. TSeq(Class=RI%gcd=<6%SI=<263CFAC&>55266%IPID=Z%TS=U)
  11603. T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
  11604. T2(Resp=N)
  11605. T3(Resp=Y%DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M)
  11606. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11607. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11608. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11609. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11610. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  11611.  
  11612. Fingerprint Linux 2.4.19 (x86)
  11613. Class Linux | Linux | 2.4.X | general purpose
  11614. TSeq(Class=RI%gcd=<6%SI=<25CEE8A&>341B8%IPID=Z%TS=100HZ)
  11615. T1(DF=Y%W=1680%ACK=S++|O%Flags=AS%Ops=MNNTNW)
  11616. T2(Resp=N)
  11617. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  11618. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11619. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11620. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11621. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11622. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11623.  
  11624. # Linux 2.4.20-4GB-athlon i686
  11625. # SuSE Linux 8.2 2.4.20-64GB-SMP
  11626. # linux 2.4.19-4GB
  11627. Fingerprint Linux 2.4.19 - 2.4.20
  11628. Class Linux | Linux | 2.4.X | general purpose
  11629. TSeq(Class=RI%gcd=<6%SI=<22D7C86&>2AE00%IPID=I%TS=100HZ)
  11630. T1(DF=Y%W=16A0|1680|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11631. T2(Resp=N)
  11632. T3(Resp=N)
  11633. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11634. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11635. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11636. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11637. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11638.  
  11639. Fingerprint Linux 2.4.19 w/grsecurity patch
  11640. Class Linux | Linux | 2.4.X | general purpose
  11641. TSeq(Class=RI%gcd=<6%SI=<2A492C6&>6C3F2%IPID=RD%TS=1000HZ)
  11642. T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
  11643. T2(Resp=N)
  11644. T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
  11645. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11646. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11647. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11648. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11649. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11650.  
  11651. # Linux kernel 2.4.20-4GB (X86)
  11652. Fingerprint Linux 2.4.20
  11653. Class Linux | Linux | 2.4.X | general purpose
  11654. TSeq(Class=RI%gcd=<8%SI=<1540758&>1B32B%IPID=I%TS=100HZ)
  11655. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
  11656. T2(Resp=N)
  11657. T3(Resp=N)
  11658. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11659. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11660. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11661. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11662. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11663.  
  11664. # Linux 2.4.20-wolk4.16s
  11665. Fingerprint Linux 2.4.20
  11666. Class Linux | Linux | 2.4.X | general purpose
  11667. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  11668. T1(DF=Y%W=7D74%ACK=S++%Flags=AS%Ops=MNNT)
  11669. T2(Resp=N)
  11670. T3(Resp=N)
  11671. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11672. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11673. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11674. T7(Resp=N)
  11675. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11676.  
  11677. Fingerprint Linux 2.4.20
  11678. Class Linux | Linux | 2.4.X | general purpose
  11679. TSeq(Class=RI%gcd=<6%SI=<18D4252&>3F8B9%IPID=Z%TS=100HZ)
  11680. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11681. T2(Resp=N)
  11682. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11683. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11684. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11685. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11686. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11687. PU(DF=N%TOS=8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11688.  
  11689. # Linux 2.4.20; Sysctl goodness below. Changed default TTL, syncookies, not sure what else. Scanned from localhost.
  11690. Fingerprint Linux 2.4.20
  11691. Class Linux | Linux | 2.4.X | general purpose
  11692. TSeq(Class=RI%gcd=<6%SI=<2C88A&>1E5%IPID=RD)
  11693. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11694. T2(Resp=N)
  11695. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11696. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11697. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11698. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11699. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11700. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11701.  
  11702. # Linux 2.4.20-xfs-rmap15d-ptrace #1 Debian GNU/Linux
  11703. Fingerprint Linux 2.4.20
  11704. Class Linux | Linux | 2.4.X | general purpose
  11705. TSeq(Class=RI%gcd=<6%SI=<15580A6&>30FB7%IPID=Z%TS=100HZ)
  11706. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11707. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11708. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11709. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11710. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11711. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11712. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11713. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11714.  
  11715. # Linux kernel 2.4.20 from ALT Linux Master 2.2 (uname -r = 2.4.20-alt16-smp)
  11716. Fingerprint Linux 2.4.20
  11717. Class Linux | Linux | 2.4.X | general purpose
  11718. TSeq(Class=RI%gcd=<6%SI=<25A8F50&>60659%IPID=Z%TS=U)
  11719. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  11720. T2(Resp=N)
  11721. T3(Resp=N)
  11722. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11723. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11724. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11725. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11726. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11727.  
  11728. # Linux 2.4.20-8 #1 i686 i686 i386 GNU/Linux
  11729. Fingerprint Linux 2.4.20
  11730. Class Linux | Linux | 2.4.X | general purpose
  11731. TSeq(Class=RI%gcd=<6%SI=<1A82ACC&>43DBE%IPID=Z%TS=100HZ)
  11732. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11733. T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
  11734. T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  11735. T4(DF=N%W=400|800%ACK=S%Flags=AR%Ops=WNMETL)
  11736. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11737. T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  11738. T7(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
  11739. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11740.  
  11741. # Red Hat Linux release 9 (Shrike) Kernel 2.4.20-8 on an i686
  11742. Fingerprint Linux 2.4.20 (Red Hat)
  11743. Class Linux | Linux | 2.4.X | general purpose
  11744. TSeq(Class=RI%gcd=<6%SI=<1B9DCC2&>469F7%IPID=Z%TS=100HZ)
  11745. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNTNW)
  11746. T2(Resp=N)
  11747. T3(Resp=N)
  11748. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11749. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11750. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11751. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11752. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11753.  
  11754. # Linux localhost 2.4.20-30.9 #1 Wed Feb 4 20:44:26 EST 2004 i686 i686 i386 GNU/Linux
  11755. Fingerprint Linux 2.4.20 (X86, Redhat 7.3)
  11756. Class Linux | Linux | 2.4.X | general purpose
  11757. TSeq(Class=RI%gcd=<6%SI=<3A23C96&>949CB%IPID=Z%TS=100HZ)
  11758. T1(DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW)
  11759. T2(Resp=N)
  11760. T3(Resp=Y%DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW)
  11761. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11762. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11763. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11764. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11765. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11766.  
  11767. # Red Hat Linux release 9 (Shrike), Kernel Version 2.4.20-31.9.progeny.5
  11768. # Linux 2.4.21-27.0.2.EL i686 i386 (Red Hat Enterprise Linux ES release 3 (Taroon Update 4)) + APF 0.9.3
  11769. # Linux 2.4.21-15.0.4.ELsmp #1 SMP i686 i686 i386 GNU/Linux
  11770. # Linux 2.4.22-1.2115.nptlsmp
  11771. # Linux 2.4.22-1.2199.nptlsmp #1 SMP i686 i686 +i386 GNU/Linux
  11772. Fingerprint Linux 2.4.20 - 2.4.22
  11773. Class Linux | Linux | 2.4.X | general purpose
  11774. TSeq(Class=RI%gcd=<6%SI=<3089154&>7C37E%IPID=Z%TS=U)
  11775. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
  11776. T2(Resp=N)
  11777. T3(Resp=N)
  11778. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11779. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11780. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11781. T7(Resp=N)
  11782. PU(Resp=N)
  11783.  
  11784. # Linux 2.4.20-gentoo-r5 w/grsecurity
  11785. Fingerprint Linux 2.4.20 - 2.4.22 w/grsecurity.org patch
  11786. Class Linux | Linux | 2.4.X | general purpose
  11787. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  11788. T1(DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11789. T2(Resp=N)
  11790. T3(Resp=Y%DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11791. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11792. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11793. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11794. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11795. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11796.  
  11797. # Linux kernel 2.4.20-wolk4.17s (X86)
  11798. # Linux demeter 2.4.20-wolk4.17s #1 i686 unknown
  11799. # "Devil Linux 1.2.2" 2.4.27-grsec #1 SMP i686 AuthenticAMD unknown+GNU/Linux
  11800. # Gentoo 2.4.28-hardened-r5 (Up to date with Gentoo Hardened Patches) on a Proliant 1600R
  11801. Fingerprint Linux 2.4.20 - 2.4.28
  11802. Class Linux | Linux | 2.4.X | general purpose
  11803. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  11804. T1(DF=Y%W=1690|16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11805. T2(Resp=N)
  11806. T3(Resp=N)
  11807. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11808. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11809. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11810. T7(Resp=N)
  11811. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11812.  
  11813. Fingerprint Linux 2.4.20 or 2.6.0-test5-love3 (x86)
  11814. Class Linux | Linux | 2.4.X | general purpose
  11815. Class Linux | Linux | 2.6.X | general purpose
  11816. TSeq(Class=RI%gcd=<6%SI=<DDDFF6&>23458%IPID=Z%TS=U)
  11817. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
  11818. T2(Resp=N)
  11819. T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
  11820. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11821. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11822. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11823. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11824. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11825.  
  11826. Fingerprint Linux 2.4.20 x86
  11827. Class Linux | Linux | 2.4.X | general purpose
  11828. TSeq(Class=RI%gcd=<8%SI=<1DB22CE&>1862A%IPID=Z%TS=100HZ)
  11829. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  11830. T2(Resp=N)
  11831. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  11832. T4(DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  11833. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11834. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11835. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11836. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11837.  
  11838. # Linux 2.4.20-ac2
  11839. Fingerprint Linux 2.4.20-ac2
  11840. Class Linux | Linux | 2.4.X | general purpose
  11841. TSeq(Class=RI%gcd=<6%SI=<2A812D4&>2F29E%IPID=Z%TS=100HZ)
  11842. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11843. T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=)
  11844. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11845. T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
  11846. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11847. T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
  11848. T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  11849. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11850.  
  11851. # Linux 2.4.21-32.0.1.ELsmp #1 i686 i686 i386 GNU/Linux
  11852. Fingerprint Linux 2.4.21
  11853. Class Linux | Linux | 2.4.X | general purpose
  11854. TSeq(Class=RI%gcd=<6%SI=<31EB9A2&>7FCA1%IPID=Z%TS=U)
  11855. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  11856. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  11857. T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  11858. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11859. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11860. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11861. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11862. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11863.  
  11864. # RedHat Linux Enterprise 3 2.4.21-27.0.2.EL #1
  11865. Fingerprint Linux 2.4.21 (RedHat)
  11866. Class Linux | Linux | 2.4.X | general purpose
  11867. TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
  11868. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11869. T2(Resp=N)
  11870. T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  11871. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  11872. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11873. T6(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  11874. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  11875. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11876.  
  11877. # Linux Boobie 2.4.21-9.EL #1 RedHat
  11878. Fingerprint Linux 2.4.21 (RedHat)
  11879. Class Linux | Linux | 2.4.X | general purpose
  11880. TSeq(Class=RI%gcd=<6%SI=<2E5DABA&>58D55%IPID=Z%TS=100HZ)
  11881. T1(DF=Y%W=564%ACK=S++%Flags=AS%Ops=MNNTNW)
  11882. T2(Resp=Y%DF=N%W=C00|800|400%ACK=S%Flags=AR%Ops=WNMETL)
  11883. T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
  11884. T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  11885. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11886. T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  11887. T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=WNMETL)
  11888. PU(Resp=N)
  11889.  
  11890. # base on msg 1058, 1776
  11891. # Linux kernel 2.4.21-243(athlon) from SuSE 9.0
  11892. # SuSE 9.0 with updates, kernel 2.4.21-280-default
  11893. Fingerprint Linux 2.4.21 (Suse)
  11894. Class Linux | Linux | 2.4.X | general purpose
  11895. TSeq(Class=RI%gcd=<8%SI=<243DCC4&>17466%IPID=I%TS=U)
  11896. T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M)
  11897. T2(Resp=N)
  11898. T3(Resp=N)
  11899. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11900. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11901. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11902. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11903. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11904.  
  11905. # SuSE Linux 8.1 (i386) 2.4.21 #4 SMP
  11906. Fingerprint Linux 2.4.21 (Suse, X86)
  11907. Class Linux | Linux | 2.4.X | general purpose
  11908. TSeq(Class=RI%gcd=<6%SI=<2634758&>55644%IPID=Z%TS=100HZ)
  11909. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11910. T2(Resp=N)
  11911. T3(Resp=N)
  11912. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11913. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11914. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11915. T7(Resp=N)
  11916. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11917.  
  11918. # SuSE Linux 9.0 2.4.21-215-athlon
  11919. # Linux 2.4.21-121-athlon; SuSE, x86
  11920. # Linux 2.4.21-231-athlon from SuSE 9.0
  11921. Fingerprint Linux 2.4.21 (x86 SuSE)
  11922. Class Linux | Linux | 2.4.X | general purpose
  11923. TSeq(Class=RI%gcd=<6%SI=<1C5FBC4&>48A1C%IPID=I%TS=1000HZ)
  11924. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11925. T2(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  11926. T3(Resp=N)
  11927. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11928. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11929. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11930. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11931. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11932.  
  11933. # Linux 2.4.21-0.25mdk x86
  11934. Fingerprint Linux 2.4.21 (x86)
  11935. Class Linux | Linux | 2.4.X | general purpose
  11936. TSeq(Class=RI%gcd=<6%SI=<2A2786A&>6BE77%IPID=I%TS=100HZ)
  11937. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11938. T2(Resp=N)
  11939. T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11940. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11941. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11942. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11943. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11944. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11945.  
  11946. # Linux mail2 2.4.21-4.ELsmp #1 SMP Fri Oct 3 17:52:56 EDT 2003 i686 i686 i386 GNU/Linux (Redhat Enterprise Linux AS 3)
  11947. Fingerprint Linux 2.4.21 (x86, RedHat)
  11948. Class Linux | Linux | 2.4.X | general purpose
  11949. TSeq(Class=RI%gcd=<6%SI=<26BFF42&>63303%IPID=Z%TS=100HZ)
  11950. T1(DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW)
  11951. T2(Resp=N)
  11952. T3(Resp=Y%DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW)
  11953. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11954. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11955. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11956. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11957. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11958.  
  11959. # Linux 2.4.21-166-default (Suse 9)
  11960. # Linux 2.4.23-pre6aa3 #2 Wed Mar 10 23:27:52 BRT 2004 i686 GNU/Linux
  11961. Fingerprint Linux 2.4.21 - 2.4.23
  11962. Class Linux | Linux | 2.4.X | general purpose
  11963. Class Linux | Linux | 2.6.X | general purpose
  11964. TSeq(Class=RI%gcd=<6%SI=<139B84E&>3230A%IPID=I%TS=1000HZ)
  11965. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  11966. T2(Resp=N)
  11967. T3(Resp=N)
  11968. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11969. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11970. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11971. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11972. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11973.  
  11974. # Debian Linux feeshus 2.4.22-1-ipvs-686 #1
  11975. Fingerprint Linux 2.4.22
  11976. Class Linux | Linux | 2.4.X | general purpose
  11977. TSeq(Class=RI%gcd=<6%SI=<180F182&>3D924%IPID=Z%TS=100HZ)
  11978. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  11979. T2(Resp=N)
  11980. T3(Resp=N)
  11981. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11982. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11983. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11984. T7(Resp=N)
  11985. PU(DF=N%TOS=C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11986.  
  11987. Fingerprint Linux 2.4.22 (SPARC)
  11988. Class Linux | Linux | 2.4.X | general purpose
  11989. TSeq(Class=RI%gcd=<6%SI=<256B646&>5FC9A%IPID=Z%TS=100HZ)
  11990. T1(DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW)
  11991. T2(Resp=N)
  11992. T3(Resp=Y%DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW)
  11993. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11994. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11995. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11996. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  11997. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11998.  
  11999. # Linux 2.4.22 (x86) without timestamps, grsecurity 1.9 (rand_isns, rand_ip_ids)
  12000. Fingerprint Linux 2.4.22 (x86) w/grsecurity patch and with timestamps disabled
  12001. Class Linux | Linux | 2.4.X | general purpose
  12002. TSeq(Class=TR|RI%gcd=<6%IPID=RD|Z%TS=U)
  12003. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  12004. T2(Resp=N)
  12005. T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  12006. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12007. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12008. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12009. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12010. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12011.  
  12012. # Linux 2.4.22 (x86, Gentoo)
  12013. # Linux server 2.6.7-ck5 (x86)
  12014. # Linux lamaquina 2.6.8.1-10mdk #1 Wed Sep 8 17:00:52 CEST 2004 i686 AMD Athlon(tm) 64 Processor 3200+
  12015. Fingerprint Linux 2.4.22 - 2.6.8
  12016. Class Linux | Linux | 2.4.X | general purpose
  12017. Class Linux | Linux | 2.6.X | general purpose
  12018. TSeq(Class=RI%gcd=<8%SI=<132F658&>188E0%IPID=Z%TS=1000HZ)
  12019. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12020. T2(Resp=N)
  12021. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12022. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12023. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12024. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12025. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12026. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12027.  
  12028. # Linux Kernel 2.6.10-ck (x86) Gentoo system
  12029. Fingerprint Linux 2.4.22 or 2.6.10
  12030. Class Linux | Linux | 2.4.X | general purpose
  12031. Class Linux | Linux | 2.6.X | general purpose
  12032. TSeq(Class=RI%gcd=<6%SI=<29CB48E&>6AF95%IPID=Z%TS=U)
  12033. T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M)
  12034. T2(Resp=N)
  12035. T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M)
  12036. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12037. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12038. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12039. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12040. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12041.  
  12042. # Linux 2.4.22 (x86, Gentoo)
  12043. # Linux 2.6.7-hardened-r16 #1 x86_64 AMD Athlon(tm) 64 Processor 3000+ AuthenticAMD GNU/Linux
  12044. # Slackware 10 kernel 2.6.7
  12045. # Fedora Core 2 With Kernel 2.6.8-1
  12046. # Kernel 2.6.3 (X86); Gentoo Distro
  12047. # Gentoo Base System version 1.4.16 Linux linuxbox 2.6.9 #2 SMP+Pentium III (Coppermine) GenuineIntel GNU/Linux
  12048. # Linux kernel 2.6.10-1.760_FC3 from Fedora Core 3
  12049. Fingerprint Linux 2.4.22 or 2.6.3 - 2.6.10
  12050. Class Linux | Linux | 2.4.X | general purpose
  12051. Class Linux | Linux | 2.6.X | general purpose
  12052. TSeq(Class=RI%gcd=<6%SI=<11A9004&>2D341%IPID=Z%TS=1000HZ)
  12053. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12054. T2(Resp=N)
  12055. T3(Resp=N)
  12056. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12057. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12058. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12059. T7(Resp=N)
  12060. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12061.  
  12062. # Linux 2.4.22-gentoo-r7 (x86)
  12063. # Linux 2.6.4-gentoo-grsec (x86) - manual patch on gentoo's kernel (gentoo-dev-sources) with grsecurity-2.0-test2-2.6.4.patch
  12064. # Linux 2.6.10 with grsecurity 2.6.10 i686
  12065. Fingerprint Linux 2.4.22 or 2.6.4 - 2.6.10
  12066. Class Linux | Linux | 2.4.X | general purpose
  12067. Class Linux | Linux | 2.6.X | general purpose
  12068. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  12069. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12070. T2(Resp=N)
  12071. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12072. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12073. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12074. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12075. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12076. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12077.  
  12078. Fingerprint Linux 2.4.22-ck2 (x86)   w/grsecurity.org and HZ=1000 patches
  12079. Class Linux | Linux | 2.4.X | general purpose
  12080. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  12081. T1(DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW)
  12082. T2(Resp=N)
  12083. T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW)
  12084. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12085. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12086. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12087. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12088. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12089.  
  12090. Fingerprint Linux 2.4.22-gentoo-r2 i686
  12091. Class Linux | Linux | 2.4.X | general purpose
  12092. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  12093. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12094. T2(Resp=N)
  12095. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12096. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12097. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12098. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12099. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12100. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  12101.  
  12102. # Linux gateway 2.4.22-gentoo-r5 #1 ven feb 6 05:25:25 CET 2004 i686 Celeron (Mendocino) GenuineIntel GNU/Linux - grsecurity patch + iptables
  12103. Fingerprint Linux 2.4.22-gentoo-r5 (x86) w/grsecurity
  12104. Class Linux | Linux | 2.4.X | general purpose
  12105. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  12106. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  12107. T2(Resp=N)
  12108. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  12109. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12110. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12111. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12112. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12113. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12114.  
  12115. Fingerprint Linux 2.4.22-gentoo-rc
  12116. Class Linux | Linux | 2.4.X | general purpose
  12117. TSeq(Class=RI%gcd=<8%SI=<22F8152&>2CC16%IPID=RD%TS=1000HZ)
  12118. T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  12119. T2(Resp=N)
  12120. T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  12121. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12122. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12123. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12124. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12125. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12126.  
  12127. Fingerprint Linux 2.4.23 (x86)
  12128. Class Linux | Linux | 2.4.X | general purpose
  12129. TSeq(Class=RI%gcd=<6%SI=<2B5505C&>6EEAA%IPID=I%TS=U)
  12130. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  12131. T2(Resp=N)
  12132. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  12133. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12134. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12135. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12136. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12137. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12138.  
  12139. Fingerprint Linux 2.4.23-grsec w/o timestamps
  12140. Class Linux | Linux | 2.4.X | general purpose
  12141. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  12142. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M)
  12143. T2(Resp=N)
  12144. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M)
  12145. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12146. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12147. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12148. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12149. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12150.  
  12151. # Adamantix GNU/Linux with Linux 2.4.25-grsec (X86)
  12152. Fingerprint Linux 2.4.25 w/grsec (x86)
  12153. Class Linux | Linux | 2.4.X | general purpose
  12154. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  12155. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12156. T2(Resp=N)
  12157. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12158. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12159. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12160. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12161. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12162. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12163.  
  12164. # Linux 2.4.26-gentoo-r6 #1 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
  12165. Fingerprint Linux 2.4.26
  12166. Class Linux | Linux | 2.4.X | general purpose
  12167. TSeq(Class=RI%gcd=<6%SI=<298F858&>6A637%IPID=I%TS=U)
  12168. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
  12169. T2(Resp=N)
  12170. T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
  12171. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12172. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12173. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12174. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12175. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12176.  
  12177. # Linux 2.4.26  from slackware linux 10
  12178. Fingerprint Linux 2.4.26
  12179. Class Linux | Linux | 2.4.X | general purpose
  12180. TSeq(Class=RI%gcd=<6%SI=<2961188&>6375E%IPID=Z%TS=100HZ)
  12181. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12182. T2(Resp=N)
  12183. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12184. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12185. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12186. T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12187. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12188. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  12189.  
  12190. # Linux kernel 2.4.26 from Slackware 10.0
  12191. Fingerprint Linux 2.4.26
  12192. Class Linux | Linux | 2.4.X | general purpose
  12193. TSeq(Class=RI%gcd=<8%SI=<3230066&>338AC%IPID=Z%TS=100HZ)
  12194. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12195. T2(Resp=N)
  12196. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12197. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12198. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12199. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12200. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12201. PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12202.  
  12203. # Linux 2.4.26 i686 GNU/Linux
  12204. Fingerprint Linux 2.4.26
  12205. Class Linux | Linux | 2.4.X | general purpose
  12206. TSeq(Class=RI%gcd=<6%SI=<2049F82&>52A3D%IPID=Z%TS=100HZ)
  12207. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12208. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  12209. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12210. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12211. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12212. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12213. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12214. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12215.  
  12216. # Linux 2.4.26-gentoo-r12 #5 i686 Pentium II
  12217. # Linux 2.4.26-gentoo-r9 #14 i686 Celeron (Mendocino) GenuineIntel GNU/Linux
  12218. Fingerprint Linux 2.4.26 (gentoo)
  12219. Class Linux | Linux | 2.4.X | general purpose
  12220. TSeq(Class=RI%gcd=<8%SI=<2E22EC4&>27AD8%IPID=I|RD%TS=100HZ)
  12221. T1(DF=N|Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12222. T2(Resp=N)
  12223. T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12224. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12225. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12226. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12227. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12228. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12229.  
  12230. Fingerprint Linux 2.4.26-gentoo-r6 w/grsec
  12231. Class Linux | Linux | 2.4.X | general purpose
  12232. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  12233. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
  12234. T2(Resp=N)
  12235. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
  12236. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12237. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12238. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12239. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12240. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12241.  
  12242. # Linux 2.4.27-1-586tsc #1 Wed Dec 1 19:25:25 JST 2004 i586 GNU/Linux (Debian Sid)
  12243. Fingerprint Linux 2.4.27 or D-Link DSL-500T (running linux 2.4)
  12244. Class Linux | Linux | 2.4.X | general purpose
  12245. Class D-Link | embedded || broadband router
  12246. TSeq(Class=RI%gcd=<6%SI=<2031130&>5267C%IPID=Z%TS=100HZ)
  12247. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12248. T2(Resp=N)
  12249. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12250. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12251. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12252. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12253. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12254. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12255.  
  12256. # Linux 2.4.27-grsec #1 SMP i686
  12257. # Linux 2.4.27-grsec (x86) (grsecurity 2.0.1) w/ net.ipv4.tcp_timestamps = 0
  12258. Fingerprint Linux 2.4.27 with grsec
  12259. Class Linux | Linux | 2.4.X | general purpose
  12260. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  12261. T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M)
  12262. T2(Resp=N)
  12263. T3(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
  12264. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12265. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12266. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12267. T7(Resp=N)
  12268. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12269.  
  12270. Fingerprint Linux 2.4.27 with grsec
  12271. Class Linux | Linux | 2.4.X | general purpose
  12272. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  12273. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12274. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  12275. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12276. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12277. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12278. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12279. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12280. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12281.  
  12282. # Linux kernel 2.4.29 from Slackware 10.1.0
  12283. Fingerprint Linux 2.4.29
  12284. Class Linux | Linux | 2.4.X | general purpose
  12285. TSeq(Class=RI%gcd=<6%SI=<2209F48&>571E7%IPID=Z%TS=100HZ)
  12286. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12287. T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL)
  12288. T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
  12289. T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  12290. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12291. T6(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  12292. T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
  12293. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12294.  
  12295. # Linux kernel 2.4.30 (vanilla)
  12296. Fingerprint Linux 2.4.30
  12297. Class Linux | Linux | 2.4.X | general purpose
  12298. TSeq(Class=RI%gcd=<6%SI=<293A11E&>6963B%IPID=Z%TS=100HZ)
  12299. T1(DF=Y%W=1578%ACK=S++%Flags=AS%Ops=MNNTNW)
  12300. T2(Resp=N)
  12301. T3(Resp=Y%DF=Y%W=1578%ACK=S++|O%Flags=AS|A%Ops=MNNTNW|NNT)
  12302. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12303. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12304. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12305. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12306. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12307.  
  12308. # Linux 2.4.4-4GB #1 Wed May 16 00:37:55 GMT 2001 i586 unknown
  12309. Fingerprint Linux 2.4.4
  12310. Class Linux | Linux | 2.4.X | general purpose
  12311. TSeq(Class=RI%gcd=<8%SI=<10F070C&>15ACF%IPID=Z%TS=100HZ)
  12312. T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
  12313. T2(Resp=N)
  12314. T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
  12315. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12316. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12317. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12318. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12319. PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12320.  
  12321. # Linux 2.4.26 #6 i686 unknown unknown GNU/Linux
  12322. # Linux kernel 2.6.9-1.681_FC3 from Fedora Core 3
  12323. Fingerprint Linux 2.4.6 - 2.4.26 or 2.6.9
  12324. Class Linux | Linux | 2.4.X | general purpose
  12325. TSeq(Class=RI%gcd=<6%SI=<1E74A9A&>4DF5C%IPID=Z%TS=100HZ)
  12326. T1(DF=Y%W=1680|16A0|4000|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12327. T2(Resp=N)
  12328. T3(Resp=N)
  12329. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12330. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12331. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12332. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12333. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12334.  
  12335. Fingerprint Linux 2.4.7 (x86)
  12336. Class Linux | Linux | 2.4.X | general purpose
  12337. TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U)
  12338. T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
  12339. T2(Resp=N)
  12340. T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
  12341. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12342. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12343. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12344. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12345. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12346.  
  12347. # Linux 2.4.7 (zLinux on OS/390)
  12348. Fingerprint Linux 2.4.7 (zLinux on OS/390)
  12349. Class Linux | Linux | 2.4.X | general purpose
  12350. TSeq(Class=RI%gcd=<6%SI=<152381A&>3616E%IPID=Z%TS=100HZ)
  12351. T1(DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
  12352. T2(Resp=N)
  12353. T3(Resp=Y%DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
  12354. T4(Resp=N)
  12355. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12356. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12357. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12358. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12359.  
  12360. # Linux 2.4.18 on Alpha EV4
  12361. # Linux 2.5.70 (x86)
  12362. # Linux 2.6.4 i686
  12363. # Linux gentoo 2.6.7-gentoo-r11 i686
  12364. # Linux gentoo 2.6.11-gentoo-r9
  12365. Fingerprint Linux 2.4.7 - 2.6.11
  12366. Class Linux | Linux | 2.4.X | general purpose
  12367. Class Linux | Linux | 2.5.X | general purpose
  12368. Class Linux | Linux | 2.6.X | general purpose
  12369. TSeq(Class=RI%gcd=<6%SI=<20DBA72&>5419C%IPID=Z%TS=1000HZ)
  12370. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12371. T2(Resp=N)
  12372. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12373. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12374. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12375. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12376. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12377. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12378.  
  12379. # Linux Athena 2.6.3-1-686 #2 Tue Feb 24 20:24:38 EST 2004 i686 GNU/Linux
  12380. # Linux 2.4.7 (RedHat 7.3 on SPARC)  
  12381. Fingerprint Linux 2.4.7 - 2.6.11
  12382. Class Linux | Linux | 2.4.X | general purpose
  12383. Class Linux | Linux | 2.6.X | general purpose
  12384. TSeq(Class=RI%gcd=<6%SI=<1682210&>399B1%IPID=Z%TS=1000HZ)
  12385. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12386. T2(Resp=N)
  12387. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12388. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12389. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12390. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12391. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12392. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  12393.  
  12394. # Linux RedHat 2.4.18-5 #1 Mon Jun 10 15:31:48 EDT 2002 i686 unknown
  12395. Fingerprint Linux 2.4.9 - 2.4.18
  12396. Class Linux | Linux | 2.4.X | general purpose
  12397. TSeq(Class=RI%gcd=<6%SI=<1C3AE82&>46383%IPID=Z%TS=100HZ)
  12398. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12399. T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  12400. T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
  12401. T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  12402. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12403. T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
  12404. T7(DF=N%W=800|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  12405. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  12406.  
  12407. # Mandrake Communiry 10.1  (2.6.8.1-10mdk-i586-up-1GB)
  12408. # Linux matrix 2.6.3-gentoo-r2 x86
  12409. Fingerprint Linux 2.5.25 - 2.6.8 or Gentoo 1.2 Linux 2.4.19 rc1-rc7
  12410. Class Linux | Linux | 2.4.X | general purpose
  12411. Class Linux | Linux | 2.5.X | general purpose
  12412. Class Linux | Linux | 2.6.X | general purpose
  12413. TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ)
  12414. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12415. T2(Resp=N)
  12416. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12417. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12418. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12419. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12420. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12421. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12422.  
  12423. Fingerprint Microsoft Xbox running Debian Linux 2.4.20
  12424. Class Linux | Linux | 2.4.X | general purpose
  12425. TSeq(Class=RI%gcd=<6%SI=<FB5982&>2833E%IPID=Z%TS=100HZ)
  12426. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12427. T2(Resp=N)
  12428. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12429. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12430. T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
  12431. T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=)
  12432. T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
  12433. PU(Resp=N)
  12434.  
  12435. Fingerprint Linux 2.5.5 (Gentoo)
  12436. Class Linux | Linux | 2.6.X | general purpose
  12437. TSeq(Class=RI%gcd=<6%SI=<306B8C0&>6ABCE%IPID=Z%TS=1000HZ)
  12438. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12439. T2(Resp=N)
  12440. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12441. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12442. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12443. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12444. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12445. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12446.  
  12447. Fingerprint Linux 2.6.0 (x86)
  12448. Class Linux | Linux | 2.6.X | general purpose
  12449. TSeq(Class=RI%gcd=<6%SI=<269E81A&>62D97%IPID=Z%TS=1000HZ)
  12450. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12451. T2(Resp=N)
  12452. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12453. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12454. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12455. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12456. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12457. PU(DF=N%TOS=D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12458.  
  12459. Fingerprint Linux 2.6.0 - 2.6.11
  12460. Class Linux | Linux | 2.6.X | general purpose
  12461. TSeq(Class=RI%gcd=<6%SI=<34CD71A&>861AC%IPID=Z%TS=1000HZ)
  12462. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12463. T2(Resp=N)
  12464. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12465. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12466. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12467. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12468. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12469. PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12470.  
  12471. # Linux 2.6.10 #1 Wed Jan 5 12:36:35 CET 2005 i686 unknown  Debian 3.0r2
  12472. # linux gentoo kernel 2.6.10
  12473. # Linux kernel 2.6.10-custom (x86) from Debian GNU/Linux 3.1
  12474. Fingerprint Linux 2.6.0 - 2.6.11
  12475. Class Linux | Linux | 2.6.X | general purpose
  12476. TSeq(Class=RI%gcd=<6%SI=<1A5ABDA&>43761%IPID=Z%TS=1000HZ)
  12477. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12478. T2(Resp=N)
  12479. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12480. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12481. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12482. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12483. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12484. PU(DF=N%TOS=38|A0|B8|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12485.  
  12486. # Linux 2.6.3-gentoo-r1 #5 Wed Apr 7 13:48:31 EDT 2004 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
  12487. # Gentoo 1.4.16; Kernel 2.6.7
  12488. # Linux sarge 2.6.8-2-386 #1 Thu May 19 17:40:50 JST 2005 i686 GNU/Linux
  12489. Fingerprint Linux 2.6.0 - 2.6.11
  12490. Class Linux | Linux | 2.6.X | general purpose
  12491. TSeq(Class=RI%gcd=<6%SI=<16883CC&>1CD61%IPID=Z%TS=1000HZ)
  12492. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12493. T2(Resp=N)
  12494. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12495. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12496. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12497. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12498. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12499. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12500.  
  12501. # Linux 2.6.8.1-12mdk #1 i686 Intel(R) Xeon(TM) CPU 2.80GHz unknown GNU/Linux
  12502. # Linux 2.6.8-1-k7 #1 i686 GNU/Linux
  12503. Fingerprint Linux 2.6.0 - 2.6.11
  12504. Class Linux | Linux | 2.6.X | general purpose
  12505. TSeq(Class=RI%gcd=<6%SI=<18C0F36&>3F49D%IPID=Z%TS=1000HZ)
  12506. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12507. T2(Resp=N)
  12508. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12509. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12510. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12511. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12512. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12513. PU(DF=N%TOS=14|30%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12514.  
  12515. # Linux kernel 2.6.8-1-k7-smp (X86) Debian GNU/Linux 3.1 (Sarge - testing)
  12516. # Linux 2.6.11-gentoo-r2-ck1
  12517. # Linux 2.6.11-gentoo-r4 #1 i686 P4CPU+2.40GHz GenuineIntel GNU/Linux Gentoo Base System version 1.4.16
  12518. # Linux 2.6.11-gentoo-r9-nymph #1i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
  12519. Fingerprint Linux 2.6.0 - 2.6.11
  12520. Class Linux | Linux | 2.6.X | general purpose
  12521. TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ)
  12522. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12523. T2(Resp=N)
  12524. T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
  12525. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12526. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12527. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12528. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12529. PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12530.  
  12531. # Linux 2.6.9 #1 i686
  12532. # Linux kernel 2.6.9 (PIII-80Mhz)
  12533. Fingerprint Linux 2.6.0 - 2.6.11
  12534. Class Linux | Linux | 2.6.X | general purpose
  12535. TSeq(Class=RI%gcd=<6%SI=<2AB93AA&>6D5A3%IPID=Z%TS=1000HZ)
  12536. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12537. T2(Resp=N)
  12538. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12539. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12540. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12541. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12542. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12543. PU(DF=N%TOS=28|40%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12544.  
  12545. Fingerprint Linux 2.6.0-test10 (x86)
  12546. Class Linux | Linux | 2.6.X | general purpose
  12547. TSeq(Class=RI%gcd=<6%SI=<226FBCC&>58267%IPID=Z%TS=1000HZ)
  12548. T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  12549. T2(Resp=N)
  12550. T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  12551. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12552. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12553. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12554. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12555. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12556.  
  12557. # Linux 2.6.0-test5 x86
  12558. Fingerprint Linux 2.6.0-test5 x86
  12559. Class Linux | Linux | 2.6.X | general purpose
  12560. TSeq(Class=RI%gcd=<6%SI=<2D3CFA0&>73C6B%IPID=Z%TS=1000HZ)
  12561. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12562. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  12563. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12564. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12565. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12566. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12567. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12568. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12569.  
  12570. Fingerprint Linux 2.6.0-test7 (x86)
  12571. Class Linux | Linux | 2.6.X | general purpose
  12572. TSeq(Class=RI%gcd=<6%SI=<1488090&>34896%IPID=Z%TS=1000HZ)
  12573. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT)
  12574. T2(Resp=N)
  12575. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT)
  12576. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12577. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12578. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12579. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12580. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12581.  
  12582. Fingerprint Linux 2.6.0-test9 - 2.6.0 (x86)
  12583. Class Linux | Linux | 2.6.X | general purpose
  12584. TSeq(Class=RI%gcd=<6%SI=<263F536&>61B8F%IPID=Z%TS=1000HZ)
  12585. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12586. T2(Resp=N)
  12587. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12588. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12589. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12590. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12591. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12592. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12593.  
  12594. # Gentoo Linux running on a UML client, Linux 2.6.10-linode12 #1 i686 UML User Mode
  12595. Fingerprint Linux 2.6.10
  12596. Class Linux | Linux | 2.6.X | general purpose
  12597. TSeq(Class=RI%gcd=<6%SI=<2CE05FC&>72AE6%IPID=Z%TS=100HZ)
  12598. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12599. T2(Resp=N)
  12600. T3(Resp=N)
  12601. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12602. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12603. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12604. T7(Resp=N)
  12605. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  12606.  
  12607. # Linux 2.6.10 i686 on IBM Thinkpad T30
  12608. # Linux barton 2.6.10-gentoo-r6 Gentoo
  12609. # Linux 2.6.10-grsec #1 Fri Jan 28 00:37:15 CET 2005 i686 GNU/Linux
  12610. Fingerprint Linux 2.6.10
  12611. Class Linux | Linux | 2.6.X | general purpose
  12612. TSeq(Class=TR|RI%gcd=<6%SI=<321C62E&>8044F%IPID=I|RD%TS=1000HZ)
  12613. T1(DF=Y|N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12614. T2(Resp=N)
  12615. T3(Resp=N)
  12616. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12617. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12618. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12619. T7(Resp=N)
  12620. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12621.  
  12622. # Linux kernel 2.6.10 X86 Slackware 10.0
  12623. Fingerprint Linux 2.6.10
  12624. Class Linux | Linux | 2.6.X | general purpose
  12625. TSeq(Class=RI%gcd=<6%SI=<1FB5BDE&>51299%IPID=Z%TS=1000HZ)
  12626. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12627. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  12628. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  12629. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12630. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12631. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12632. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12633. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12634.  
  12635. # Ubuntu Hoary Hedgehog - Linux ubuntu 2.6.10-5-386 #1 Tue Apr 5 12:12:40 UTC 2005 i686 GNU/Linux
  12636. Fingerprint Linux 2.6.10
  12637. Class Linux | Linux | 2.6.X | general purpose
  12638. TSeq(Class=RI%gcd=<6%SI=<15962A2&>3740B%IPID=Z%TS=1000HZ)
  12639. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12640. T2(Resp=N)
  12641. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12642. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12643. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12644. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12645. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12646. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  12647.  
  12648. # Linux runerm 2.6.10-kanotix-8 #1 Wed Feb 2 16:49:31 GMT 2005 i686 GNU/Linux
  12649. # Linux Kernel 2.6.11 With some Fixes from debian/kanotix
  12650. # debian 3.1 kernel : 2.6.11-rc7
  12651. Fingerprint Linux 2.6.10 - 2.6.11
  12652. Class Linux | Linux | 2.6.X | general purpose
  12653. TSeq(Class=RI%gcd=<6%SI=<249F172&>5DBEE%IPID=Z%TS=U)
  12654. T1(DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M)
  12655. T2(Resp=N)
  12656. T3(Resp=N)
  12657. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12658. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12659. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12660. T7(Resp=N)
  12661. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12662.  
  12663. # Linux linux 2.6.11.9 #1 Sat May 14 00:49:06 CEST 2005 i686 unknown unknown GNU/Linux
  12664. Fingerprint Linux 2.6.11
  12665. Class Linux | Linux | 2.6.X | general purpose
  12666. TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
  12667. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12668. T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  12669. T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  12670. T4(DF=N%W=800|400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  12671. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12672. T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  12673. T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  12674. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12675.  
  12676. # Linux 2.6.11 (gentoo-dev-sources)
  12677. Fingerprint Linux 2.6.11 (gentoo)
  12678. Class Linux | Linux | 2.6.X | general purpose
  12679. TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ)
  12680. T1(DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12681. T2(Resp=N)
  12682. T3(Resp=Y%DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12683. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12684. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12685. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12686. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12687. PU(Resp=N)
  12688.  
  12689. # Linux 2.6.10-1.741_FC3 i686 athlon i386 GNU/Linux
  12690. Fingerprint Linux 2.6.3 - 2.6.10
  12691. Class Linux | Linux | 2.6.X | general purpose
  12692. TSeq(Class=RI%gcd=<6%SI=<3552DC&>8860%IPID=Z%TS=1000HZ)
  12693. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12694. T2(Resp=N)
  12695. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12696. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12697. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12698. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12699. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12700. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12701.  
  12702. # Linux Kernel 2.6.3 (X86)
  12703. # Linux 2.6.7 #3 Sat Jul 17 13:25:29 EEST 2004 i486
  12704. Fingerprint Linux 2.6.3 - 2.6.7 (X86)
  12705. Class Linux | Linux | 2.6.X | general purpose
  12706. TSeq(Class=RI%gcd=<6%SI=<205C682&>528B7%IPID=Z%TS=1000HZ)
  12707. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
  12708. T2(Resp=N)
  12709. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
  12710. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12711. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12712. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12713. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12714. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12715.  
  12716. # Linux 2.6.3-6mdksecure #1 SMP x86_64 from Mandrake 10
  12717. # Linux 2.6.8-p4 #1 SMP i686 GNU/Linux
  12718. Fingerprint Linux 2.6.3 or 2.6.8
  12719. Class Linux | Linux | 2.6.X | general purpose
  12720. TSeq(Class=RI%gcd=<8%SI=<24F1576&>1E7BD%IPID=Z%TS=1000HZ)
  12721. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12722. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12723. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12724. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  12725. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12726. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  12727. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12728. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12729.  
  12730. # LINUX Suse 9.1 Professional Kernel 2.6.4 i686
  12731. Fingerprint Linux 2.6.4 (Suse)
  12732. Class Linux | Linux | 2.6.X | general purpose
  12733. TSeq(Class=RI%gcd=<6%SI=<1B18996&>45556%IPID=Z%TS=1000HZ)
  12734. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12735. T2(Resp=N)
  12736. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12737. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12738. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12739. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12740. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12741. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12742.  
  12743. # Slackware current kernel 2.6.9
  12744. # Fedora Core 3 Linux Kernel 2.6.9 x86 (i386)
  12745. # Linux kernel 2.6.4-52 from (X86) SuSE Linux 9.1
  12746. # Debian Sarge Linux 2.6.6-1, i686 (x86)
  12747. Fingerprint Linux 2.6.4 - 2.6.9
  12748. Class Linux | Linux | 2.6.X | general purpose
  12749. TSeq(Class=RI%gcd=<6%SI=<28A04EC&>2F60A%IPID=Z%TS=1000HZ)
  12750. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12751. T2(Resp=N)
  12752. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12753. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12754. T5(DF=N%W=1000|800|C00|400%ACK=S++%Flags=AR%Ops=)
  12755. T6(DF=N%W=C00|1000|400|800%ACK=S%Flags=AR%Ops=)
  12756. T7(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
  12757. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  12758.  
  12759. # Linux 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux
  12760. Fingerprint Linux 2.6.5
  12761. Class Linux | Linux | 2.6.X | general purpose
  12762. TSeq(Class=RI%gcd=<6%SI=<265B754&>6225F%IPID=Z%TS=1000HZ)
  12763. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12764. T2(Resp=N)
  12765. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  12766. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12767. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12768. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12769. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12770. PU(Resp=N)
  12771.  
  12772. # Linux 2.6.7-gentoo-r11 #2 Wed Jul 28 23:25:03 PDT 2004 i686 Pentium II (Deschutes)
  12773. # Linux  2.6.8-rc3 #1 Sat Aug 7 07:19:34 EDT 2004 i686 GNU/Linux
  12774. # Debian Sarge GNU/Linux kernel 2.6.8-1 (i386)
  12775. # Linux 2.6.7-hardened-r17 Gentoo
  12776. # Linux 2.6.9-1.681_FC3smp #1 SMP i586 i586 i386 GNU/Linux (Fedora Core 3+kernel as supplied)
  12777. # Linux 2.6.8-1-686 from Debian sid
  12778. # SuSE Linux Prefessional 9.1, with kernel 2.6.10
  12779. # Linux 2.6.8, PLD distribution, SMP
  12780. # Linux 2.6.11.4-20a-default #1 i686 i686 i386 GNU/Linux from+Suse 9.3
  12781. # Linux 2.6.8-24.11-default #1 Fri Jan 14 13:01:26 UTC 2005 i686 i686 i386 GNU/Linux
  12782. # Linux 2.6.5-7.155.29-default #1 Thu Jun 2 12:07:05 UTC 2005 i686 i686 i386 GNU/Linux (SuSE+9.2 )
  12783. # Linux Debian Sarge 2.6.11.7
  12784. # Linux kernel 2.6.10-4GB (X86) with Debian GNU/Linux 3.1
  12785. # Linux Kernel 2.6.7-1-686-smp from backports.org Debian Woody
  12786. Fingerprint Linux 2.6.5 - 2.6.11
  12787. Class Linux | Linux | 2.6.X | general purpose
  12788. TSeq(Class=RI%gcd=<6%SI=<2BF6254&>70895%IPID=Z%TS=1000HZ)
  12789. T1(DF=Y%W=15E0|16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12790. T2(Resp=N)
  12791. T3(Resp=N)
  12792. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12793. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12794. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12795. T7(Resp=N)
  12796. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  12797.  
  12798. # Linux 2.6.9 #1 i686 Intel(R) Pentium(R) 4 CPU 3.06GHz+GenuineIntel GNU/Linux
  12799. # Linux kernel 2.6.10-rc3 from Gentoo on an Ultra 1 (sparc)
  12800. # Linux 2.6.5 i686 P42.00GHz, Gentoo Base System version 1.6.6, Portage+2.0.51-r3
  12801. # Gentoo Linux 2004.1 PPC (old blue and white G3)  Kernel 2.6.11.7
  12802. Fingerprint Linux 2.6.5 - 2.6.11
  12803. Class Linux | Linux | 2.6.X | general purpose
  12804. TSeq(Class=RI%gcd=<6%SI=<360764E&>48D40%IPID=Z%TS=1000HZ)
  12805. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12806. T2(Resp=Y%DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  12807. T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  12808. T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  12809. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12810. T6(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  12811. T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  12812. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12813.  
  12814. # Linux 2.6.6-rc2-bk3
  12815. Fingerprint Linux 2.6.6
  12816. Class Linux | Linux | 2.6.X | general purpose
  12817. TSeq(Class=RI%gcd=<6%SI=<2E04BFE&>4ADED%IPID=Z%TS=1000HZ)
  12818. T1(DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW)
  12819. T2(Resp=N)
  12820. T3(Resp=Y%DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW)
  12821. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12822. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12823. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12824. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12825. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12826.  
  12827. # Linux kernel 2.6.6-1-k7 (X86) from Debian Testing
  12828. Fingerprint Linux 2.6.6-1-k7 (X86)
  12829. Class Linux | Linux | 2.6.X | general purpose
  12830. TSeq(Class=RI%gcd=<6%SI=<235C288&>5A817%IPID=Z%TS=1000HZ)
  12831. T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12832. T2(Resp=N)
  12833. T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12834. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12835. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12836. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12837. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12838. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12839.  
  12840. # Linux 2.6.7-tp #5 i686 GNU/Linux
  12841. Fingerprint Linux 2.6.7
  12842. Class Linux | Linux | 2.6.X | general purpose
  12843. TSeq(Class=RI%gcd=<8%SI=<13C059A&>1B365%IPID=Z%TS=100HZ)
  12844. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12845. T2(Resp=N)
  12846. T3(Resp=N)
  12847. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12848. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12849. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12850. T7(Resp=N)
  12851. PU(DF=N%TOS=14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12852.  
  12853. # Linux kernel 2.6.7 with grsecurity patches
  12854. Fingerprint Linux 2.6.7
  12855. Class Linux | Linux | 2.6.X | general purpose
  12856. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  12857. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12858. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  12859. T3(Resp=N)
  12860. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12861. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12862. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12863. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12864. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12865.  
  12866. # Linux 2.6.7-hardened-r16 (Gentoo hardened-dev-sources) x86
  12867. # Linux 2.6.7-hardened-r16 #3 SMP i686  GNU/Linux (grsec+pax, gentoo hardened-dev-sources))
  12868. Fingerprint Linux 2.6.7
  12869. Class Linux | Linux | 2.6.X | general purpose
  12870. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  12871. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12872. T2(Resp=N)
  12873. T3(Resp=N)
  12874. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12875. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12876. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12877. T7(Resp=N)
  12878. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12879.  
  12880. # Linux kernel 2.6.7 (X86) from Mepis
  12881. Fingerprint Linux 2.6.7 (X86)
  12882. Class Linux | Linux | 2.6.X | general purpose
  12883. TSeq(Class=RI%gcd=<6%SI=<14E7284&>35813%IPID=Z%TS=U)
  12884. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW)
  12885. T2(Resp=N)
  12886. T3(Resp=Y%DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW)
  12887. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12888. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12889. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12890. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12891. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12892.  
  12893. # Linux kernel 2.6.8 on PLD Linux
  12894. # Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 Community
  12895. # Linux kernel 2.6.8.1-10mdk (X86) from Mandrake 10.1 community
  12896. # Linux kernel 2.6.7-SMP from Knoppix 3.6
  12897. # Linux 2.6.8.1-4-k7 i686 GNU/Linux
  12898. Fingerprint Linux 2.6.7 - 2.6.8
  12899. Class Linux | Linux | 2.6.X | general purpose
  12900. TSeq(Class=RI%gcd=<6%SI=<1D19DA8&>4A672%IPID=Z%TS=1000HZ)
  12901. T1(DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW)
  12902. T2(Resp=N)
  12903. T3(Resp=Y%DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW)
  12904. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12905. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12906. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12907. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12908. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12909.  
  12910. Fingerprint Linux 2.6.7 w/grsecurity.org patch
  12911. Class Linux | Linux | 2.6.X | general purpose
  12912. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  12913. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12914. T2(Resp=N)
  12915. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12916. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12917. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12918. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12919. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12920. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12921.  
  12922. # Linux 2.6.8-24.14-smp GNU/Linux Suse Linux 9.2 Professional
  12923. Fingerprint Linux 2.6.8
  12924. Class Linux | Linux | 2.6.X | general purpose
  12925. TSeq(Class=RI%gcd=<6%SI=<C0DF46&>1ED0B%IPID=Z%TS=1000HZ)
  12926. T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12927. T2(Resp=N)
  12928. T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12929. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12930. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12931. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12932. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12933. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12934.  
  12935. # Linux Mandrake 10.1, i586, kernel 2.6.8.1-12mdk
  12936. # Linux 2.6.8.1-12mdk #1 Fri Oct 1 12:53:41 CEST 2004 i686 AMD Athlon(tm) XP 3000+ unknown GNU/Linux
  12937. Fingerprint Linux 2.6.8
  12938. Class Linux | Linux | 2.6.X | general purpose
  12939. TSeq(Class=RI%gcd=<6%SI=<1E91DE8&>4E3D1%IPID=Z%TS=1000HZ)
  12940. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW)
  12941. T2(Resp=N)
  12942. T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW)
  12943. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12944. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12945. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12946. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12947. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12948.  
  12949. # Linux 2.6.8-1.521 #1 i686 athlon i386 GNU/Linux
  12950. Fingerprint Linux 2.6.8
  12951. Class Linux | Linux | 2.6.X | general purpose
  12952. TSeq(Class=RI%gcd=<6%SI=<C88D22&>20154%IPID=I%TS=1000HZ)
  12953. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12954. T2(Resp=N)
  12955. T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  12956. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12957. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12958. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12959. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12960. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12961.  
  12962. # Linux 2.6.8-2-k7 #1 Thu May 19 18:03:29 JST 2005 i686 GNU/Linux
  12963. # Linux 2.6.8-2-386 #1 Mon Jan 24 03:01:58 EST 2005 i686 GNU/Linux, from Debian testing
  12964. Fingerprint Linux 2.6.8
  12965. Class Linux | Linux | 2.6.X | general purpose
  12966. TSeq(Class=RI%gcd=<6%SI=<32035F2&>2A223%IPID=Z%TS=1000HZ)
  12967. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12968. T2(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  12969. T3(Resp=Y%DF=N%W=1000|400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  12970. T4(DF=N%W=C00|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  12971. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12972. T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  12973. T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  12974. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12975.  
  12976. # Debian Sarge Kernel 2.6.8
  12977. Fingerprint Linux 2.6.8 (Debian)
  12978. Class Linux | Linux | 2.6.X | general purpose
  12979. TSeq(Class=RI%gcd=<6%SI=<2C96D4E&>34B7A%IPID=Z%TS=100HZ)
  12980. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12981. T2(Resp=N)
  12982. T3(Resp=N)
  12983. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12984. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12985. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12986. T7(Resp=N)
  12987. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12988.  
  12989. # Linux ubuntu 2.6.8.1-5-386 #1 Sat Feb 12 00:19:31 UTC 2005 i686 GNU/Linux
  12990. Fingerprint Linux 2.6.8 (Ubuntu)
  12991. Class Linux | Linux | 2.6.X | general purpose
  12992. TSeq(Class=RI%gcd=<6%SI=<10F66C0&>2B6A6%IPID=Z%TS=1000HZ)
  12993. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12994. T2(Resp=N)
  12995. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  12996. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12997. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12998. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12999. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13000. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13001.  
  13002. # Linux kernel 2.6.8.1 from Debian sarge netinst
  13003. # Linux kernel 2.6.11-1.27 from Fedora Core 3
  13004. Fingerprint Linux 2.6.8 - 2.6.11
  13005. Class Linux | Linux | 2.6.X | general purpose
  13006. TSeq(Class=RI%gcd=<6%SI=<23C986A&>4BB91%IPID=Z%TS=1000HZ)
  13007. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
  13008. T2(Resp=N)
  13009. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
  13010. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13011. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13012. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13013. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13014. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13015.  
  13016. # Linux 2.6.9-gentoo-r13Hipcia #3 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
  13017. # Linux 2.6.8-1-686-smp #1 SMP i686 GNU/Linux from Debian 3.1
  13018. Fingerprint Linux 2.6.8 - 2.6.9
  13019. Class Linux | Linux | 2.6.X | general purpose
  13020. TSeq(Class=RI%gcd=<6%SI=<11DFD8E&>15CCF%IPID=Z%TS=1000HZ)
  13021. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  13022. T2(Resp=Y%DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  13023. T3(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  13024. T4(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  13025. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13026. T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  13027. T7(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  13028. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13029.  
  13030. # Linux 2.6.9-1.649 FC Rawhide
  13031. # Linux kernel 2.6.9 (x86_64) from kernel.org
  13032. Fingerprint Linux 2.6.9
  13033. Class Linux | Linux | 2.6.X | general purpose
  13034. TSeq(Class=RI%gcd=<6%SI=<13935EA&>32119%IPID=Z%TS=1000HZ)
  13035. T1(DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW)
  13036. T2(Resp=N)
  13037. T3(Resp=Y%DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW)
  13038. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13039. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13040. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13041. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13042. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13043.  
  13044. # Linux 2.6.9-1.681_FC3 #1 i686 i686 i386 GNU/Linux Fedora Core 3
  13045. Fingerprint Linux 2.6.9
  13046. Class Linux | Linux | 2.6.X | general purpose
  13047. TSeq(Class=RI%gcd=<6%SI=<1BA9D60&>26DF4%IPID=Z%TS=1000HZ)
  13048. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  13049. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13050. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13051. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13052. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13053. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13054. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13055. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13056.  
  13057. # Linux 2.6.5 (Gentoo)
  13058. # Linux 2.6.8 (Fedora Core 2)
  13059. # Fingerprint Linux kernel 2.6.8-1.521 Fedora 2
  13060. Fingerprint Linux kernel 2.6.5 - 2.6.8
  13061. Class Linux | Linux | 2.6.X | general purpose
  13062. TSeq(Class=RI%gcd=<6%SI=<17F9116&>3D580%IPID=Z%TS=1000HZ)
  13063. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  13064. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13065. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  13066. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13067. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13068. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13069. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13070. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13071.  
  13072. Fingerprint ComOS based terminal server - Livingston PortMaster or U.S. Robotics/3Com Total Control
  13073. Class Livingston | ComOS || terminal server
  13074. Class 3Com | ComOS || terminal server
  13075. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13076. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13077. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13078. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13079. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13080. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13081. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13082. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  13083.  
  13084. Fingerprint ATT UNIX SVR4.2 on a Lucent Definity voicemail system
  13085. Class Lucent | BSD-misc || general purpose
  13086. TSeq(Class=64K)
  13087. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13088. T2(Resp=N)
  13089. T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
  13090. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13091. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13092. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13093. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13094. PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  13095.  
  13096. Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2
  13097. Class Lucent | ComOS || terminal server
  13098. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13099. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13100. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13101. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13102. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13103. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13104. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13105. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13106.  
  13107. # http://www.sics.se/~adam/lwip/
  13108. Fingerprint lwIP (Lightweight TCP/IP stack) version lwip-0.5.3-win32
  13109. Class lwIP | lwIP || general purpose
  13110. TSeq(Class=TD%gcd=<6%SI=<3C%IPID=I%TS=U)
  13111. T1(DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
  13112. T2(Resp=N)
  13113. T3(Resp=Y%DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
  13114. T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13115. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13116. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13117. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13118. PU(Resp=N)
  13119.  
  13120. # M0n0wall 1.2b2 - Firewall based on FreeBSD 4.1
  13121. # M0n0wall 1.2b2 FreeBSD-based firewall running on PC Engines WRAP board (Geode x86 architecture)
  13122. # m0n0wall FreeBSD based firewall (http://m0n0.ch/wall/) version 1.2b3 (version 1.2 beta 3) generic PC
  13123. # m0n0wall Router/Captive portal version 1.2b8 running on stripped down version of FreeBSD
  13124. Fingerprint M0n0wall 1.2b2 - 1.2b8 FreeBSD 4.1 based firewall
  13125. Class m0n0wall | FreeBSD | 4.X | firewall
  13126. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  13127. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13128. T2(Resp=N)
  13129. T3(Resp=N)
  13130. T4(Resp=N)
  13131. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13132. T6(Resp=N)
  13133. T7(Resp=N)
  13134. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  13135.  
  13136. # m0n0wall or pfsense firewall distro based on FreeBSD 5.3
  13137. # M0n0wall (FreeBSD 5.3 based) with firmware beta version 1.2b7
  13138. Fingerprint M0n0wall 1.2b7 FreeBSD 5.3 based firewall
  13139. Class m0n0wall | FreeBSD | 5.X | firewall
  13140. TSeq(Class=TR%gcd=<6%TS=1000HZ)
  13141. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  13142. T2(Resp=N)
  13143. T3(Resp=N)
  13144. T4(Resp=N)
  13145. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13146. T6(Resp=N)
  13147. T7(Resp=N)
  13148. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  13149.  
  13150. Fingerprint Madge Smart Ringswitch
  13151. Class Madge | embedded || switch
  13152. T1(DF=N%W=1F4%ACK=S++%Flags=AS%Ops=)
  13153. T2(Resp=N)
  13154. T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AS%Ops=)
  13155. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13156. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13157. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13158. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13159. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13160.  
  13161. Fingerprint Magna SG10 intranet router
  13162. Class Magna | embedded || router
  13163. TSeq(Class=RI%gcd=<6%SI=<31AD68E&>5F62F%TS=100HZ)
  13164. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  13165. T2(Resp=N)
  13166. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13167. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13168. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13169. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13170. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13171. PU(Resp=N)
  13172.  
  13173. Fingerprint Maxim-IC TiniOS DS80c400
  13174. Class Maxim-IC | TiniOS || general purpose
  13175. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  13176. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  13177. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13178. T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  13179. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13180. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13181. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13182. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13183. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  13184.  
  13185. Fingerprint Maxim/Dallas TINI embedded Java v1.02b
  13186. Class Maxim-IC | TiniOS || general purpose
  13187. TSeq(Class=TD%gcd=<1F408%SI=<28%IPID=Z%TS=U)
  13188. T1(DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|)
  13189. T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13190. T3(Resp=Y%DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|)
  13191. T4(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13192. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13193. T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13194. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13195. PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  13196.  
  13197. # Maxim/Dallas TINI embedded Java v1.11
  13198. # Dallas Semiconductor TINI OS 1.02d
  13199. Fingerprint Maxim/Dallas TINI embedded Java v1.02d
  13200. Class Maxim-IC | TiniOS || general purpose
  13201. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  13202. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  13203. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13204. T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  13205. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13206. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13207. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13208. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13209. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13210.  
  13211. Fingerprint MegaBit Gear TE4111C modem
  13212. Class Megabit | embedded || terminal server
  13213. TSeq(Class=64K%IPID=I%TS=U)
  13214. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  13215. T2(Resp=N)
  13216. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  13217. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  13218. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13219. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13220. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13221. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  13222.  
  13223. Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
  13224. Class Meridian | embedded || storage-misc
  13225. TSeq(Class=TD%gcd=40000%SI=<A)
  13226. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  13227. T2(Resp=N)
  13228. T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
  13229. T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
  13230. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13231. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13232. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13233. PU(Resp=N)
  13234.  
  13235. Fingerprint Microbase VirtuOS v3.00b R.09
  13236. Class Microbase | VirtuOS || general purpose
  13237. TSeq(Class=TD%gcd=<2120004%SI=<14%IPID=I%TS=U)
  13238. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13239. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  13240. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  13241. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  13242. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  13243. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  13244. T7(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  13245. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13246.  
  13247. Fingerprint Microplex Print Server
  13248. Class Microplex | embedded || print server
  13249. TSeq(Class=C)
  13250. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  13251. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13252. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  13253. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13254. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13255. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13256. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13257. PU(Resp=N)
  13258.  
  13259. # Bart's Network Boot Disk 2.7 http://www.nu2.nu/bootdisk/network/ i386
  13260. Fingerprint Bart's Network Boot Disk 2.7 (X86) MS-DOS
  13261. Class Microsoft | DOS || general purpose
  13262. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  13263. T1(DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M)
  13264. T2(Resp=N)
  13265. T3(Resp=Y%DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M)
  13266. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13267. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13268. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13269. T7(Resp=N)
  13270. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  13271.  
  13272. Fingerprint NCSA Telnet (dos)
  13273. Class Microsoft | DOS || general purpose
  13274. TSeq(Class=C)
  13275. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13276. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13277. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13278. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13279. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13280. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13281. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13282. PU(Resp=N)
  13283.  
  13284. # I'm not 100% sure this version is for DOS, just a guess
  13285. Fingerprint NCSA Telnet 2.3.08 for the PC (DOS)
  13286. Class Microsoft | DOS || general purpose
  13287. TSeq(Class=C)
  13288. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  13289. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  13290. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  13291. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  13292. T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  13293. T6(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  13294. T7(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  13295. PU(Resp=N)
  13296.  
  13297. Fingerprint Watt-32 DOS tcp/ip stack
  13298. Class Microsoft | DOS || general purpose
  13299. TSeq(Class=C%IPID=I%TS=1000HZ)
  13300. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MNNT)
  13301. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  13302. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13303. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13304. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13305. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13306. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13307. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13308.  
  13309. Fingerprint WNOS 5.0 on Microsoft DOS 6.22
  13310. Class Microsoft | DOS || general purpose
  13311. TSeq(Class=TD%gcd=1000|2000|3000%SI=<7F)
  13312. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13313. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13314. T3(DF=N%W=400%ACK=O%Flags=AS%Ops=M)
  13315. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13316. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13317. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13318. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13319. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13320.  
  13321. # Microsoft xbox with hacked bios and xbmc running
  13322. # Evolution-X 2.X (unsure which evolution-x version is running, one from the 2.X series though...) on mod-chipped XBOX
  13323. # XBOX running Xbox Media center v1.0.0
  13324. # Microsoft XBOX 1.0.5101.1, mod chip ALX2+, running Avalaunch v0.49.3 Xmas edition
  13325. # XBox hardware version 1.5 running XBox Media Centre version 1.1.0
  13326. Fingerprint Microsoft Xbox (modified)
  13327. Class Microsoft | embedded || game console
  13328. TSeq(Class=RI%gcd=<6%SI=<5C26%IPID=RPI|I%TS=U)
  13329. T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
  13330. T2(Resp=N)
  13331. T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
  13332. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13333. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13334. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13335. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13336. PU(Resp=N)
  13337.  
  13338. # xbox v1.1 running EvoX bios
  13339. # v1.5 XBOX running Evolution build 3935, fresh default install.
  13340. # Microsoft XBOX with SmartXX modchip - running XBOX Media Center v1.0
  13341. # Microsoft Xbox v1.6
  13342. Fingerprint Microsoft Xbox (modified)
  13343. Class Microsoft | embedded || game console
  13344. TSeq(Class=RI%gcd=<6%SI=<AD02&>20%TS=U)
  13345. T1(DF=N%W=4238%ACK=S++%Flags=AS%Ops=M)
  13346. T2(Resp=N)
  13347. T3(Resp=Y%DF=N%W=4238%ACK=S++%Flags=AS%Ops=M)
  13348. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13349. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13350. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13351. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13352. PU(Resp=N)
  13353.  
  13354. # Microsoft Xbox Console running Xbox Media Centre version 1.1.01
  13355. # Microsoft Xbox (modified) running EvolutionX
  13356. Fingerprint Microsoft Xbox (modified)
  13357. Class Microsoft | embedded || game console
  13358. TSeq(Class=TD%gcd=<6%SI=<2E4%IPID=I%TS=U)
  13359. T1(DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M)
  13360. T2(Resp=N)
  13361. T3(Resp=Y%DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M)
  13362. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13363. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13364. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13365. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13366. PU(Resp=N)
  13367.  
  13368. # Xbox V1.1 Running Evolution-X Dashboard v1.8.3752
  13369. Fingerprint Microsoft Xbox (modified) running evolutionX
  13370. Class Microsoft | embedded || game console
  13371. TSeq(Class=RI%gcd=<6%SI=<5A14&>20%IPID=I%TS=U)
  13372. T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
  13373. T2(Resp=N)
  13374. T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
  13375. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13376. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13377. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13378. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13379. PU(Resp=N)
  13380.  
  13381. Fingerprint Microsoft Xbox (modified) running UnleashX 0.26
  13382. Class Microsoft | embedded || game console
  13383. TSeq(Class=RI%gcd=<6%SI=<A79E&>99%IPID=I%TS=U)
  13384. T1(DF=N%W=8470%ACK=S++%Flags=AS%Ops=M)
  13385. T2(Resp=N)
  13386. T3(Resp=Y%DF=N%W=8470%ACK=S++%Flags=AS%Ops=M)
  13387. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13388. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13389. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13390. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13391. PU(Resp=N)
  13392.  
  13393. # Microsoft Windows Longhorn Preview, Version 6.0 Build 4051.idx 02.031001-1340
  13394. Fingerprint Microsoft Windows Longhorn Preview
  13395. Class Microsoft | Windows Longhorn || general purpose
  13396. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  13397. T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13398. T2(Resp=N)
  13399. T3(Resp=N)
  13400. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13401. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13402. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13403. T7(Resp=N)
  13404. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13405.  
  13406. # Microsoft Windows Server 2003, Enterprise Edition, Build 3790
  13407. # Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947)
  13408. # Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947)
  13409. # Windows Server 2003 Standard Edition. no SP, all current hotfixes
  13410. Fingerprint Microsoft Windows 2003 Server
  13411. Class Microsoft | Windows | 2003/.NET | general purpose
  13412. TSeq(Class=TR%gcd=<6%IPID=I)
  13413. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13414. T2(Resp=N)
  13415. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13416. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13417. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13418. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13419. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13420. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  13421.  
  13422. # Microsoft Windows 2003 Server Edition, no service packs
  13423. Fingerprint Microsoft Windows 2003 Server
  13424. Class Microsoft | Windows | 2003/.NET | general purpose
  13425. TSeq(Class=TR%gcd=<6%IPID=I)
  13426. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13427. T2(Resp=Y%DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL)
  13428. T3(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL)
  13429. T4(DF=N%W=C00|400%ACK=S%Flags=R%Ops=WNMETL)
  13430. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13431. T6(DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL)
  13432. T7(DF=N%W=C00|1000|400%ACK=S%Flags=R%Ops=WNMETL)
  13433. PU(Resp=N)
  13434.  
  13435. Fingerprint Microsoft Windows 2003 Server
  13436. Class Microsoft | Windows | 2003/.NET | general purpose
  13437. TSeq(Class=TR%gcd=<6%IPID=I)
  13438. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13439. T2(Resp=N)
  13440. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13441. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13442. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13443. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13444. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13445. PU(DF=N%TOS=80%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  13446.  
  13447. # Microsoft Windows 2003 Server (Version 5.2 build 3790.srv03_rtm.030324-2048)
  13448. Fingerprint Microsoft Windows 2003 Server
  13449. Class Microsoft | Windows | 2003/.NET | general purpose
  13450. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  13451. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  13452. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13453. T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  13454. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13455. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13456. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13457. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13458. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13459.  
  13460. Fingerprint Microsoft Windows 2003 Server
  13461. Class Microsoft | Windows | 2003/.NET | general purpose
  13462. TSeq(Class=TR%gcd=<6)
  13463. T1(DF=Y%W=FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
  13464. T2(Resp=N)
  13465. T3(Resp=N)
  13466. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13467. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13468. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13469. T7(Resp=N)
  13470. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13471.  
  13472. Fingerprint Microsoft Windows 2003 Server
  13473. Class Microsoft | Windows | 2003/.NET | general purpose
  13474. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  13475. T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW)
  13476. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13477. T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW)
  13478. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13479. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13480. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13481. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13482. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13483.  
  13484. # Microsoft Windows Server 2003 Enterprise Edition (English) with latest Windows Update patches as of September 2, 2004
  13485. Fingerprint Microsoft Windows 2003 Server Enterprise Edition
  13486. Class Microsoft | Windows | 2003/.NET | general purpose
  13487. T1(DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT)
  13488. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13489. T3(Resp=Y%DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT)
  13490. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13491. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13492. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13493. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13494. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13495.  
  13496. Fingerprint Microsoft Windows 2003 Server Enterprise Edition
  13497. Class Microsoft | Windows | 2003/.NET | general purpose
  13498. TSeq(Class=TR%gcd=<6%IPID=I)
  13499. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13500. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13501. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13502. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13503. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13504. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13505. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13506. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  13507.  
  13508. # Microsoft Windows Server 2003, Enterprise Edition, no service packs, (build 3790.srv03_rtm.030324-2048)
  13509. # Microsoft Windows XP Professional (English) SP2 with latest updates through Nov. 24, 2004
  13510. Fingerprint Microsoft Windows 2003 Server Enterprise Edition or XP Pro SP2
  13511. Class Microsoft | Windows | 2003/.NET | general purpose
  13512. Class Microsoft | Windows | NT/2K/XP | general purpose
  13513. TSeq(Class=TR%gcd=<6%IPID=I)
  13514. T1(DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT)
  13515. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13516. T3(Resp=Y%DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT)
  13517. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13518. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13519. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13520. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13521. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13522.  
  13523. # Microsoft Windows.NET Enterprise Server (build 3615 beta)
  13524. # Windows .NET Standard Server build 3604
  13525. # Microsoft Windows 2003 Standard Build V5.2.3790 build 3790
  13526. # Microsoft Windows 2003 Server - Web edition - all available critical fixes as of 15th feb 2004
  13527. # Windows 2003 Standard Edition RTM
  13528. # Window Server 2003 Enterprise Edition Swedish
  13529. # Microsoft Windows XP Professional (English) w/ SP2 RC1 build 2600.xpsp_sp2_rc1.040311-2315 - WINDOWS FIREWALL DISABLED
  13530. # Microsoft Windows 5.2 Build 3790.srv03_rtm.030324-2048
  13531. # Microsoft Windows Version 5.1 (Build 2600.spdp_sp2_rtm.040803-2158 : Services Pack 2)
  13532. Fingerprint Microsoft Windows 2003 Server or XP SP2
  13533. Class Microsoft | Windows | 2003/.NET | general purpose
  13534. Class Microsoft | Windows | NT/2K/XP | general purpose
  13535. TSeq(Class=TR%gcd=<6%IPID=I)
  13536. T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
  13537. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13538. T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
  13539. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13540. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13541. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13542. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13543. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  13544.  
  13545. # Microsoft Windows XP Pro (French) version:2002 SP2
  13546. # Microsoft Windows Server 2003 version 5.2 (Build 3790.srv03_gdr.040410-1234)
  13547. # Microsoft Windows Server 2003 Enterprise Edition (Trial Version downloaded from Microsoft as at 06/03
  13548. # Microsoft Windows 2003 Server Enterprise Edition (German) build 3790.srv03_rtm.030324-2048
  13549. # Microsoft Windows .NET Standard Server RC#2 (build 3718)
  13550. # Microsoft Windows XP Professional version 2002 service pack 2
  13551. # Microsoft Windows XP Home Edition (English) SP2 Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
  13552. # Microsoft Windows XP Home /SP2 Polish Edition
  13553. Fingerprint Microsoft Windows 2003 Server or XP SP2
  13554. Class Microsoft | Windows | 2003/.NET | general purpose
  13555. Class Microsoft | Windows | NT/2K/XP | general purpose
  13556. TSeq(Class=TR%gcd=<6%IPID=I)
  13557. T1(DF=Y|N%W=2017|402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  13558. T2(Resp=N)
  13559. T3(Resp=N)
  13560. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13561. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13562. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13563. T7(Resp=N)
  13564. PU(DF=N%TOS=0|20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  13565.  
  13566. # Windows Server 2003, build 3790
  13567. # Microsoft Windows XP Media Center Edition
  13568. Fingerprint Microsoft Windows 2003 Server or XP SP2
  13569. Class Microsoft | Windows | 2003/.NET | general purpose
  13570. Class Microsoft | Windows | NT/2K/XP | general purpose
  13571. TSeq(Class=TR%gcd=<6)
  13572. T1(DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  13573. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13574. T3(Resp=Y%DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  13575. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13576. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13577. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13578. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13579. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  13580.  
  13581. # Microsoft Windows 2003 Server with SP1 and latest Windows Update patches as of May, 2005
  13582. # Windows Server 2003 w/ SP1, build 3790.srv03_sp1
  13583. # Microsoft Windows 2003 Server, version SBS 2003 Premium, just after Windows Server SP1 installed
  13584. # Windows Server 2003 Version 5.2 (Build 3790.srv03_sp1_rtm.050324-1447: Service Pack 1
  13585. # Windows Server 2003 w/ SP1, build 3790.srv03_sp1
  13586. Fingerprint Microsoft Windows 2003 Server SP1
  13587. Class Microsoft | Windows | 2003/.NET | general purpose
  13588. TSeq(Class=TR%gcd=<6%IPID=I)
  13589. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13590. T2(Resp=N)
  13591. T3(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13592. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13593. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13594. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13595. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13596. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13597.  
  13598. # Microsoft Windows Server 2003 SP1 [Version 5.2.3790]
  13599. # Windows 2003 Service Pack 1 32 Bit Running on Abit Mobo AMD64
  13600. Fingerprint Microsoft Windows 2003 Server SP1
  13601. Class Microsoft | Windows | 2003/.NET | general purpose
  13602. TSeq(Class=TR%gcd=<6%IPID=I)
  13603. T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
  13604. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13605. T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
  13606. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13607. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13608. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13609. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13610. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13611.  
  13612. # Windows 5.2 (Build 3790.srv03_sp1_rtm.050324-1447 : Service Pack 1)
  13613. # Windows Server 2003 SP1 all patches as of June-23-05
  13614. Fingerprint Microsoft Windows 2003 Server SP1
  13615. Class Microsoft | Windows | 2003/.NET | general purpose
  13616. TSeq(Class=TR%gcd=<6%IPID=I)
  13617. T1(DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  13618. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13619. T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  13620. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13621. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13622. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13623. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13624. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13625.  
  13626. Fingerprint Microsoft Windows 2003 Server Standard Edition
  13627. Class Microsoft | Windows | 2003/.NET | general purpose
  13628. TSeq(Class=TR%gcd=<6%IPID=I)
  13629. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13630. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13631. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13632. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13633. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13634. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13635. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13636. PU(DF=N%TOS=20%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13637.  
  13638. Fingerprint Microsoft Windows 2003 Server Standard Edition
  13639. Class Microsoft | Windows | 2003/.NET | general purpose
  13640. TSeq(Class=TR%gcd=<6%IPID=I)
  13641. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13642. T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  13643. T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
  13644. T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  13645. T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
  13646. T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  13647. T7(DF=N%W=400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  13648. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13649.  
  13650. # Microsoft Windows 2003 Server Standard Edition (Build 3790.srv03_gdr.040410-1234)
  13651. Fingerprint Microsoft Windows 2003 Server Standard Edition
  13652. Class Microsoft | Windows | 2003/.NET | general purpose
  13653. TSeq(Class=TR%gcd=<6)
  13654. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13655. T2(Resp=N)
  13656. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13657. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13658. T5(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13659. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13660. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13661. PU(Resp=N)
  13662.  
  13663. Fingerprint Microsoft Windows 2003 Server Standart Edition SP1
  13664. Class Microsoft | Windows | 2003/.NET | general purpose
  13665. TSeq(Class=TR%gcd=<6%IPID=I)
  13666. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13667. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13668. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13669. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13670. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13671. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13672. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13673. PU(DF=N%TOS=5C%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13674.  
  13675. # Windows 2003 standard edition version 5.2 build 3790.srv03_rtm.030324-2048 and lastest windows updates patches as november 9, 2004
  13676. Fingerprint Microsoft Windows 2003 standard edition
  13677. Class Microsoft | Windows | 2003/.NET | general purpose
  13678. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13679. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13680. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  13681. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13682. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13683. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13684. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13685. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13686.  
  13687. # Microsoft Windows Server 2003, No Service Packs build 3790.srv03_gdr.040410-1234
  13688. Fingerprint Microsoft Windows Server 2003
  13689. Class Microsoft | Windows | 2003/.NET | general purpose
  13690. TSeq(Class=TR%gcd=<6%IPID=I)
  13691. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
  13692. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13693. T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT)
  13694. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13695. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13696. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13697. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13698. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  13699.  
  13700. # Microsoft Windows Server 2003 Enterprise Edition Version 5.2.3790
  13701. Fingerprint Microsoft Windows Server 2003 Enterprise Edition
  13702. Class Microsoft | Windows | 2003/.NET | general purpose
  13703. TSeq(Class=TR%gcd=<6%IPID=I)
  13704. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13705. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13706. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13707. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13708. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13709. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13710. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13711. PU(DF=N%TOS=10%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13712.  
  13713. Fingerprint Microsoft Windows 3.1 with Trumpet Winsock 2.0 revision B
  13714. Class Microsoft | Windows | 3.X | general purpose
  13715. TSeq(Class=TD%gcd=10000%SI=<FF)
  13716. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13717. T2(Resp=N)
  13718. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13719. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13720. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13721. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13722. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13723. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13724.  
  13725. Fingerprint Microsoft Windows for Workgroups 3.11 / TCP/IP-32 3.11b stack or Windows 98
  13726. Class Microsoft | Windows | 3.X | general purpose
  13727. Class Microsoft | Windows | 95/98/ME | general purpose
  13728. TSeq(Class=TD%gcd=<F%SI=<F)
  13729. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  13730. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13731. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  13732. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13733. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13734. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13735. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13736. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13737.  
  13738. # Windows 95 Version 4.00.950 OEM HP Pavilion 5010
  13739. Fingerprint Microsoft Windows 95 4.00.950
  13740. Class Microsoft | Windows | 95/98/ME | general purpose
  13741. TSeq(Class=TD%gcd=<E4%SI=<14%IPID=BI)
  13742. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  13743. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13744. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  13745. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13746. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13747. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13748. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13749. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13750.  
  13751. # Win95 4.00.950B  -  IE 5 5.50.4807.2300
  13752. Fingerprint Microsoft Windows 95 4.00.950B
  13753. Class Microsoft | Windows | 95/98/ME | general purpose
  13754. TSeq(Class=TD%gcd=<6%SI=<3C%IPID=BI%TS=U)
  13755. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  13756. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13757. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  13758. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13759. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13760. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13761. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13762. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13763.  
  13764. Fingerprint Microsoft Windows 95 4.00.950B (IE 5 5.00 2314.1003)
  13765. Class Microsoft | Windows | 95/98/ME | general purpose
  13766. TSeq(Class=TD%gcd=<14%SI=<32%IPID=BI)
  13767. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  13768. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13769. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  13770. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13771. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13772. T6(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
  13773. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13774. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13775.  
  13776. Fingerprint Microsoft Windows 95/98/NT 4.0 or PocketPC
  13777. Class Microsoft | Windows | 95/98/ME | general purpose
  13778. Class Microsoft | Windows | PocketPC/CE | PDA
  13779. TSeq(Class=TD|RI%gcd=1|2|3|4|5|8|A|14|1E|28|5A|17C%SI=<1F4)
  13780. T1(DF=Y%W=2017|16D0|860|8000|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT)
  13781. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13782. T3(Resp=Y%DF=Y|N%W=0%ACK=O%Flags=AR%Ops=)
  13783. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  13784. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13785. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  13786. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13787. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13788.  
  13789. Fingerprint Microsoft Windows 98
  13790. Class Microsoft | Windows | 95/98/ME | general purpose
  13791. TSeq(Class=RI%gcd=<6%SI=<FFF)
  13792. T1(DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
  13793. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13794. T3(Resp=Y%DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
  13795. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13796. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13797. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13798. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13799. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13800.  
  13801. Fingerprint Microsoft Windows 98
  13802. Class Microsoft | Windows | 95/98/ME | general purpose
  13803. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U)
  13804. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  13805. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13806. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  13807. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13808. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13809. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13810. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13811. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13812.  
  13813. # Microsoft Windows 98 X86 No Service Pack
  13814. # Microsoft Windows 98 4.10.1998
  13815. Fingerprint Microsoft Windows 98 4.10.1998
  13816. Class Microsoft | Windows | 95/98/ME | general purpose
  13817. TSeq(Class=TD%gcd=<142%SI=<186%IPID=BI%TS=U)
  13818. T1(DF=Y%W=2024|7D78%ACK=S++%Flags=AS%Ops=M)
  13819. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13820. T3(Resp=Y%DF=Y%W=2024|7D78%ACK=S++%Flags=AS%Ops=M)
  13821. T4(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
  13822. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13823. T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
  13824. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13825. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13826.  
  13827. Fingerprint Microsoft Windows 98 4.10.1998
  13828. Class Microsoft | Windows | 95/98/ME | general purpose
  13829. TSeq(Class=TD%gcd=<6%SI=<78%IPID=BI%TS=U)
  13830. T1(DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
  13831. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13832. T3(Resp=Y%DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
  13833. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  13834. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13835. T6(DF=N%W=0%ACK=S|O%Flags=R%Ops=)
  13836. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13837. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13838.  
  13839. # Windows 98SE 4.10.2222A
  13840. # Windows 98 4.10.1998
  13841. Fingerprint Microsoft Windows 98 or 98SE
  13842. Class Microsoft | Windows | 95/98/ME | general purpose
  13843. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U)
  13844. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  13845. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13846. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  13847. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13848. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13849. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13850. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13851. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13852.  
  13853. Fingerprint Microsoft Windows 98 SP1
  13854. Class Microsoft | Windows | 95/98/ME | general purpose
  13855. TSeq(Class=TD%gcd=<5%SI=<20)
  13856. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  13857. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13858. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  13859. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13860. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13861. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  13862. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13863. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13864.  
  13865. Fingerprint Microsoft Windows 98 SP2
  13866. Class Microsoft | Windows | 95/98/ME | general purpose
  13867. TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U)
  13868. T1(DF=Y%W=270F|5FA0%ACK=S++%Flags=AS%Ops=M)
  13869. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13870. T3(Resp=Y%DF=Y%W=270F|5FA0%ACK=S++%Flags=AS%Ops=M)
  13871. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13872. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13873. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13874. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13875. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13876.  
  13877. # Windows 98SE, no service packs, on AMD Sempron 2.4 GHz
  13878. Fingerprint Microsoft Windows 98SE
  13879. Class Microsoft | Windows | 95/98/ME | general purpose
  13880. TSeq(Class=RI%gcd=<6%SI=<1AA4&>D%IPID=RPI%TS=U)
  13881. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  13882. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13883. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  13884. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13885. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13886. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13887. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13888. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13889.  
  13890. # Microsoft Windows 98 4.10.2222.A
  13891. # "Windows 98SE, patched up to date" (1/25/03)
  13892. Fingerprint Microsoft Windows 98SE
  13893. Class Microsoft | Windows | 95/98/ME | general purpose
  13894. TSeq(Class=TD%gcd=<A%SI=<46%IPID=RPI|RD|BI%TS=U)
  13895. T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
  13896. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13897. T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
  13898. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13899. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13900. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13901. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13902. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13903.  
  13904. # Windows 98 4.10.2222 A (1/27/04)
  13905. Fingerprint Microsoft Windows 98SE
  13906. Class Microsoft | Windows | 95/98/ME | general purpose
  13907. TSeq(Class=TD%gcd=<F4%SI=<14%IPID=RPI%TS=U)
  13908. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  13909. T2(Resp=N)
  13910. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  13911. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13912. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13913. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13914. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13915. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13916.  
  13917. # Windows 98SE (build 2222)
  13918. Fingerprint Microsoft Windows 98SE
  13919. Class Microsoft | Windows | 95/98/ME | general purpose
  13920. TSeq(Class=TD%gcd=<6%SI=<46%IPID=RPI|RD|BI%TS=U)
  13921. T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
  13922. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13923. T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
  13924. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13925. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13926. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13927. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13928. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13929.  
  13930. # Microsoft Windows 98SE, no service packs
  13931. Fingerprint Microsoft Windows 98SE
  13932. Class Microsoft | Windows | 95/98/ME | general purpose
  13933. TSeq(Class=TD%gcd=<FF%SI=<32%IPID=BI%TS=U)
  13934. T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  13935. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13936. T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  13937. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13938. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13939. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13940. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13941. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13942.  
  13943. # Windows 98SE + unoffical service pack 1.6.1 (includes all cumulative patches and hotfixes)
  13944. #                (http://exuberant.ms11.net/98sesp.html)
  13945. Fingerprint Microsoft Windows 98SE
  13946. Class Microsoft | Windows | 95/98/ME | general purpose
  13947. TSeq(Class=TD%gcd=<E2%SI=<1E%IPID=RPI%TS=U)
  13948. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  13949. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13950. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  13951. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13952. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13953. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13954. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13955. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13956.  
  13957. Fingerprint Microsoft Windows 98SE + IE5.5sp1
  13958. Class Microsoft | Windows | 95/98/ME | general purpose
  13959. T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M)
  13960. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13961. T3(Resp=N)
  13962. T4(DF=N%W=2DA0|0%ACK=S++|O%Flags=AS|R%Ops=M|)
  13963. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13964. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13965. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13966. PU(Resp=N|Y)
  13967.  
  13968. # Win 98SE, 4.10.2222 A (fully WindowsUpdated)
  13969. # Windows 98SE build 4.10.2222 A
  13970. # Microsoft Windows 98SE, Version 4.10.2222
  13971. # Windows 98SE 4.10.2222 A  Compaq OEM version Patched as of 1/2005
  13972. Fingerprint Microsoft Windows 98SE 4.10.2222
  13973. Class Microsoft | Windows | 95/98/ME | general purpose
  13974. TSeq(Class=TD%gcd=<E4%SI=<14%IPID=BI|RPI%TS=U)
  13975. T1(DF=Y%W=2017|2058|FAF0|FFFF%ACK=S++%Flags=AS%Ops=M)
  13976. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13977. T3(Resp=Y%DF=Y%W=2017|2058|FAF0|FFFF%ACK=S++%Flags=AS%Ops=M)
  13978. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13979. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13980. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13981. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13982. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13983.  
  13984. # Microsoft Windows 98SE, service pack 1 installed, litepc installed (www.litepc.com)
  13985. Fingerprint Microsoft Windows 98SE SP1
  13986. Class Microsoft | Windows | 95/98/ME | general purpose
  13987. TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U)
  13988. T1(DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=M)
  13989. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13990. T3(Resp=Y%DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=M)
  13991. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13992. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13993. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13994. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13995. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13996.  
  13997. Fingerprint Microsoft Windows 98SE with security patch A
  13998. Class Microsoft | Windows | 95/98/ME | general purpose
  13999. TSeq(Class=TD%gcd=<6%SI=<AA%IPID=BI%TS=U)
  14000. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  14001. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14002. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  14003. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14004. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14005. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14006. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14007. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14008.  
  14009. # Microsoft Windows Millenium Edition - no service packs
  14010. Fingerprint Microsoft Windows Millennium Edition (Me)
  14011. Class Microsoft | Windows | 95/98/ME | general purpose
  14012. TSeq(Class=RI%gcd=<6%SI=<2B05C&>2D1%IPID=I)
  14013. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
  14014. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14015. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
  14016. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14017. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14018. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14019. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14020. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14021.  
  14022. # Windows ME + all updates as of 1/1/03
  14023. Fingerprint Microsoft Windows Millennium Edition (Me)
  14024. Class Microsoft | Windows | 95/98/ME | general purpose
  14025. TSeq(Class=RI%gcd=<8%SI=<1DA74&>117%IPID=I)
  14026. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14027. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14028. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  14029. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14030. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14031. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14032. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14033. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14034.  
  14035. # Microsoft Windows Millennium (German) 4.90.3000
  14036. Fingerprint Microsoft Windows Millennium Edition (Me)
  14037. Class Microsoft | Windows | 95/98/ME | general purpose
  14038. TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I)
  14039. T1(DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT)
  14040. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14041. T3(Resp=Y%DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT)
  14042. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14043. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14044. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14045. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14046. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14047.  
  14048. # Windows Millenium Edition v4.90.300
  14049. # Windows Me or Windows 2000 RC1 through final release
  14050. # Microsoft Windows 2000 Advanced Server
  14051. # Windows 2000 with SP2 and long fat pipe (RFC 1323)
  14052. # Windows 2000 Professional Service Pack 3
  14053. # Windows 2000 5.00.2195 Service Pack 2 and latest hotfixes
  14054. # Windows 2000 Professional (x86)
  14055. # Compaq ProLiant DL-380G2 running Windows 2000 with SP3 and all the current patch sets (2/3/03)
  14056. # Windows XP Professional version 2002 on PC Intel processor
  14057. # Windows XP Build 2600
  14058. # XP Professional 5.1 (build 2600).. all patches up to June 20, 2002
  14059. # Fingerprint Microsoft Windows XP Professional with all current updates to May 2002
  14060. # Windows 2000 Version 5.0 Build (2195: Service Pack 3)
  14061. #  Windows 2000 Advanced Server SP3
  14062. Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP
  14063. Class Microsoft | Windows | 95/98/ME | general purpose
  14064. Class Microsoft | Windows | NT/2K/XP | general purpose
  14065. TSeq(Class=RI%gcd=<6%SI=<FFFFF&>49C%IPID=I%TS=0)
  14066. T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|4470|8052|B5C9|B580|C000|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT)
  14067. T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14068. T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|4470|8052|B5C9|B580|C000|402E|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14069. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14070. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14071. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14072. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14073. PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  14074.  
  14075. # Windows NT 3.51 SP5
  14076. Fingerprint Microsoft Windows NT 3.51 SP5, NT 4.0 or 95/98/98SE
  14077. Class Microsoft | Windows | 95/98/ME | general purpose
  14078. Class Microsoft | Windows | NT/2K/XP | general purpose
  14079. TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4%IPID=BI|RPI|RD%TS=U|0)
  14080. T1(DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=A|AS%Ops=|M|MNWNNT)
  14081. T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14082. T3(Resp=Y%DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=AS%Ops=M|MNWNNT)
  14083. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  14084. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14085. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  14086. T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=)
  14087. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  14088.  
  14089. # Microsoft Windows XP Professional (English) w/ SP2 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
  14090. # Widows XP Professional (English UK) SP2 - latest patches as of 20 Dec 2004 - build 2600.xpsp_sp2_rtm.040803-2158
  14091. # Microsoft Windows XP Home Edition (French) SP2 build 2600.xpsp_sp2_rtm.040803-2158
  14092. # Microsoft Windows XP Profesional (English) SP2 Ver 5.1 build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2
  14093. Fingerprint Microsoft Widows XP SP2
  14094. Class Microsoft | Windows | NT/2K/XP | general purpose
  14095. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  14096. T1(DF=Y%W=805C|88A4|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNW)
  14097. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14098. T3(Resp=Y%DF=Y%W=805C|88A4|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNW)
  14099. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14100. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14101. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14102. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14103. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14104.  
  14105. Fingerprint Microsoft Windows 2000 Advanced Server SP2
  14106. Class Microsoft | Windows | NT/2K/XP | general purpose
  14107. TSeq(Class=RI%gcd=<6%SI=<22FBA&>28B%IPID=I)
  14108. T1(DF=Y%W=7530%ACK=S++%Flags=AS%Ops=MNWNNT)
  14109. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14110. T3(Resp=Y%DF=Y%W=7530%ACK=S++%Flags=AS%Ops=MNWNNT)
  14111. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14112. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14113. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14114. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14115. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14116.  
  14117. Fingerprint Microsoft Windows 2000 Advanced Server SP3
  14118. Class Microsoft | Windows | NT/2K/XP | general purpose
  14119. TSeq(Class=RI%gcd=<6%SI=<206B6&>2E7%IPID=I)
  14120. T1(DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT)
  14121. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14122. T3(Resp=Y%DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT)
  14123. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14124. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14125. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14126. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14127. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14128.  
  14129. # Microsoft Windows 2000 Advanced Server SP3, all available updates as of 11/13/02
  14130. Fingerprint Microsoft Windows 2000 Advanced Server SP3
  14131. Class Microsoft | Windows | NT/2K/XP | general purpose
  14132. TSeq(Class=RI%gcd=<6%SI=<58066&>3E9%IPID=I)
  14133. T1(DF=Y%W=402E|FFF0%ACK=S++%Flags=AS%Ops=MNNT|MNWNNT)
  14134. T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  14135. T3(Resp=Y%DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14136. T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  14137. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14138. T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  14139. T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14140. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14141.  
  14142. # Windows 2000 Advanced Server Service Pack 4 With ALL updates as of October 9th 2003 Winver: Version 5 build 2195 SP4
  14143. Fingerprint Microsoft Windows 2000 Advanced Server SP4
  14144. Class Microsoft | Windows | NT/2K/XP | general purpose
  14145. TSeq(Class=RI%gcd=<6%SI=<1FD06&>42A)
  14146. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14147. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14148. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14149. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14150. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14151. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14152. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14153. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  14154.  
  14155. Fingerprint Microsoft Windows 2000 Advanced Server SP4
  14156. Class Microsoft | Windows | NT/2K/XP | general purpose
  14157. TSeq(Class=RI%gcd=<6%SI=<7CE98&>6B7)
  14158. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14159. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14160. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14161. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14162. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14163. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14164. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14165. PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14166.  
  14167. # Windows 2000 Advanced Server Version 5.0 (Build 2195: Service Pack 4)
  14168. Fingerprint Microsoft Windows 2000 Advanced Server SP4
  14169. Class Microsoft | Windows | NT/2K/XP | general purpose
  14170. TSeq(Class=TR%gcd=<6%IPID=I)
  14171. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14172. T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  14173. T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  14174. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  14175. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14176. T6(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  14177. T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14178. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14179.  
  14180. Fingerprint Microsoft Windows 2000 Professional
  14181. Class Microsoft | Windows | NT/2K/XP | general purpose
  14182. TSeq(Class=RI%gcd=<6%SI=<1C476&>472)
  14183. T1(DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
  14184. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14185. T3(Resp=Y%DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
  14186. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14187. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14188. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14189. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14190. PU(DF=N%TOS=0|20|80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  14191.  
  14192. # Microsoft Windows 2000 Professional (Russian) SP2 with some antiworm patches (MS04-011 etc.), firewalled with wipfw (http://wipfw.sourceforge.net) dropping TCP_SYNFIN
  14193. # Microsoft Windows 2000 Professional Rus with SP2 with only Sasser etc. patches
  14194. Fingerprint Microsoft Windows 2000 Professional (Russian) SP2
  14195. Class Microsoft | Windows | NT/2K/XP | general purpose
  14196. TSeq(Class=RI%gcd=<6%SI=<3073C&>393)
  14197. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14198. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14199. T3(Resp=N)
  14200. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14201. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14202. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14203. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14204. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14205.  
  14206. Fingerprint Microsoft Windows 2000 Professional RC1 or Windows 2000 Advanced Server Beta3
  14207. Class Microsoft | Windows | NT/2K/XP | general purpose
  14208. TSeq(Class=RI%gcd=<8%SI=<27D922&>65EE)
  14209. T1(DF=Y%W=402E|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  14210. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14211. T3(Resp=Y%DF=Y%W=402E|2017%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  14212. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14213. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14214. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14215. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14216. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14217.  
  14218. # Microsoft Windows NT 5 Beta2 or Beta3
  14219. # Microsoft Windows 2000 Professional Edition (English) Build 2195 with SP2 - x86
  14220. Fingerprint Microsoft Windows 2000 Professional SP2
  14221. Class Microsoft | Windows | NT/2K/XP | general purpose
  14222. TSeq(Class=TD%gcd=<6%SI=<1000)
  14223. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14224. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14225. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14226. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  14227. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14228. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  14229. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14230. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14231.  
  14232. # Windows 2000 Professional Build 2195 Service Pack 3
  14233. Fingerprint Microsoft Windows 2000 Professional SP3
  14234. Class Microsoft | Windows | NT/2K/XP | general purpose
  14235. TSeq(Class=RI%gcd=<6%SI=<1BB0C&>2DC%IPID=I%TS=U)
  14236. T1(DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M)
  14237. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14238. T3(Resp=Y%DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M)
  14239. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14240. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14241. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14242. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14243. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14244.  
  14245. # base one msg 170, 666
  14246. # Windows 2000 Professional SP4 fully patched as of 10/20/04
  14247. # Microsoft Windows 2000 Professional SP4 and latest Windows Update as of December 8th, 2004
  14248. # Microsoft Windows 2000 Professional Version: 5.0.2195 Service Pack 4 Build 2195
  14249. # Microsoft 2000 Professional SP4  CPU AMD
  14250. Fingerprint Microsoft Windows 2000 Professional SP4
  14251. Class Microsoft | Windows | NT/2K/XP | general purpose
  14252. TSeq(Class=TR|RI%gcd=<6%SI=<2B0D4&>22E%IPID=I)
  14253. T1(DF=Y%W=2238|7D78|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT)
  14254. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14255. T3(Resp=Y%DF=Y%W=2238|7D78|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT)
  14256. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14257. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14258. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14259. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14260. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14261.  
  14262. # Microsoft Windows 2000 Professional SP4 build 2195
  14263. Fingerprint Microsoft Windows 2000 Professional SP4
  14264. Class Microsoft | Windows | NT/2K/XP | general purpose
  14265. TSeq(Class=RI%gcd=<6%SI=<29B6C&>2EF%IPID=I%TS=U)
  14266. T1(DF=Y%W=FB06|FF70%ACK=S++%Flags=AS%Ops=MNW)
  14267. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14268. T3(Resp=Y%DF=Y%W=FB06|FF70%ACK=S++%Flags=AS%Ops=MNW)
  14269. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14270. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14271. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14272. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14273. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14274.  
  14275. Fingerprint Microsoft Windows 2000 Server SP1
  14276. Class Microsoft | Windows | NT/2K/XP | general purpose
  14277. TSeq(Class=RI%gcd=<6%SI=<1B26A&>26A%IPID=I%TS=U)
  14278. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  14279. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14280. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  14281. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14282. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14283. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14284. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14285. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  14286.  
  14287. Fingerprint Microsoft Windows 2000 Server SP2
  14288. Class Microsoft | Windows | NT/2K/XP | general purpose
  14289. TSeq(Class=RI%gcd=<6%SI=<25224&>22C%IPID=I)
  14290. T1(DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
  14291. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14292. T3(Resp=Y%DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
  14293. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14294. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14295. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14296. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14297. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14298.  
  14299. # Microsoft Windows 2000 Server with Service Pack 3 and MS Exchange 2000 Server
  14300. Fingerprint Microsoft Windows 2000 Server SP3
  14301. Class Microsoft | Windows | NT/2K/XP | general purpose
  14302. TSeq(Class=RI%gcd=<6%SI=<DF0C&>186%IPID=I)
  14303. T1(DF=Y%W=FAF0%ACK=S++%Flags=A%Ops=NNT)
  14304. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14305. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  14306. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14307. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14308. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14309. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14310. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14311.  
  14312. Fingerprint Microsoft Windows 2000 Server SP3
  14313. Class Microsoft | Windows | NT/2K/XP | general purpose
  14314. TSeq(Class=RI%gcd=<8%SI=<255BC&>24F%IPID=I)
  14315. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14316. T2(Resp=N)
  14317. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14318. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14319. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14320. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14321. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14322. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14323.  
  14324. Fingerprint Microsoft Windows 2000 Server SP3
  14325. Class Microsoft | Windows | NT/2K/XP | general purpose
  14326. TSeq(Class=RI%gcd=<6%SI=<230DC&>388%IPID=I)
  14327. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  14328. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  14329. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  14330. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  14331. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14332. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  14333. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  14334. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  14335.  
  14336. # Windows (XP Pro) version 5.1 (numero 260.xpsp2.030422-1633:Service Pack 1)
  14337. Fingerprint Microsoft Windows 2000 Server SP3 or Windows XP Pro SP1
  14338. Class Microsoft | Windows | NT/2K/XP | general purpose
  14339. TSeq(Class=RI%gcd=<6%SI=<24F5E&>47E%IPID=I%TS=U)
  14340. T1(DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW)
  14341. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14342. T3(Resp=Y%DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW)
  14343. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14344. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14345. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14346. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14347. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14348.  
  14349. # Microsoft Windows 2000 Server (Spanish) with SP4 build 2195
  14350. Fingerprint Microsoft Windows 2000 Server SP4
  14351. Class Microsoft | Windows | NT/2K/XP | general purpose
  14352. TSeq(Class=RI%gcd=<6%SI=<67DF4&>2FB%IPID=I)
  14353. T1(DF=Y%W=402E%ACK=S++%Flags=A%Ops=NNT)
  14354. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14355. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14356. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14357. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14358. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14359. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14360. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14361.  
  14362. # Microsoft Windows 2000 Server with SP4 and Windows Update patches as of January 14, 2005.
  14363. # Microsoft Windows 2000 Server with SP4 and latest Update Patches as of January 10 2005
  14364. Fingerprint Microsoft Windows 2000 Server SP4
  14365. Class Microsoft | Windows | NT/2K/XP | general purpose
  14366. TSeq(Class=RI%gcd=<6%SI=<E76A8&>110C)
  14367. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14368. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14369. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14370. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14371. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14372. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14373. T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=)
  14374. PU(DF=N%TOS=C0|68%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  14375.  
  14376. # Windows 2000 Server Edition Version 5.0 (Build 2195: Service Pack 4)
  14377. Fingerprint Microsoft Windows 2000 Server SP4
  14378. Class Microsoft | Windows | NT/2K/XP | general purpose
  14379. TSeq(Class=RI%gcd=<6%SI=<21E62&>256%IPID=I)
  14380. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14381. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14382. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14383. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14384. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14385. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14386. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14387. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  14388.  
  14389. Fingerprint Microsoft Windows 2000 Server SP4
  14390. Class Microsoft | Windows | NT/2K/XP | general purpose
  14391. TSeq(Class=RI%gcd=<6%SI=<DDB08&>6AA%IPID=I)
  14392. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14393. T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  14394. T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14395. T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  14396. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14397. T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  14398. T7(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  14399. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14400.  
  14401. # Windows 2000 Server SP4 with all current patches april 9th 2005
  14402. Fingerprint Microsoft Windows 2000 Server SP4
  14403. Class Microsoft | Windows | NT/2K/XP | general purpose
  14404. TSeq(Class=RI%gcd=<6%SI=<1C3B8&>157%IPID=I)
  14405. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14406. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14407. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14408. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  14409. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14410. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  14411. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14412. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14413.  
  14414. # Windows 2003 Standard build 3790
  14415. # Microsoft Windows 2003/.NET Standard Edition
  14416. # Windows 2000 Server with SP4 fully patched as of 10/8/04
  14417. Fingerprint Microsoft Windows 2000 Server SP4 or 2003 Server Standard Edition
  14418. Class Microsoft | Windows | NT/2K/XP | general purpose
  14419. Class Microsoft | Windows | 2003/.NET | general purpose
  14420. TSeq(Class=TR%gcd=<6%IPID=I)
  14421. T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNNT)
  14422. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  14423. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  14424. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  14425. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14426. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  14427. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  14428. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  14429.  
  14430. # Microsoft Windows 2000 Server with SP4 and no other updates
  14431. # Windows 2000 Server SP 4 + ALL patches at 25 Sep. 2003
  14432. # Windows XP Professional SP1 and latest Windows Update patches as of Oct 04, 2004
  14433. Fingerprint Microsoft Windows 2000 Server SP4 or XP SP1
  14434. Class Microsoft | Windows | NT/2K/XP | general purpose
  14435. TSeq(Class=RI%gcd=<6%SI=<2B430&>5AD%IPID=I)
  14436. T1(DF=Y%W=FA00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14437. T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  14438. T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  14439. T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  14440. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14441. T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
  14442. T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14443. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14444.  
  14445. Fingerprint Microsoft Windows 2000 SP1
  14446. Class Microsoft | Windows | NT/2K/XP | general purpose
  14447. TSeq(Class=RI%gcd=<6%SI=<1F216&>251%IPID=I)
  14448. T1(DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT)
  14449. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14450. T3(Resp=Y%DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT)
  14451. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14452. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14453. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14454. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14455. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14456.  
  14457. # Microsoft Windows 2000 Build 2195 Service Pack 1
  14458. Fingerprint Microsoft Windows 2000 SP1
  14459. Class Microsoft | Windows | NT/2K/XP | general purpose
  14460. TSeq(Class=RI%gcd=<6%SI=<220164&>80000%TS=U)
  14461. T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  14462. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14463. T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  14464. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14465. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14466. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14467. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14468. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14469.  
  14470. # Windows 2000 version 5 build 2195 Service Pack 2
  14471. Fingerprint Microsoft Windows 2000 SP2
  14472. Class Microsoft | Windows | NT/2K/XP | general purpose
  14473. TSeq(Class=RI%gcd=<6%SI=<270D8&>4BF%IPID=I)
  14474. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14475. T2(Resp=N)
  14476. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14477. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14478. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14479. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14480. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14481. PU(DF=N%TOS=28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14482.  
  14483. Fingerprint Microsoft Windows 2000 SP2
  14484. Class Microsoft | Windows | NT/2K/XP | general purpose
  14485. TSeq(Class=RI%gcd=<6%SI=<1D362&>237%IPID=I)
  14486. T1(DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT)
  14487. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14488. T3(Resp=Y%DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT)
  14489. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14490. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14491. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14492. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14493. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14494.  
  14495. Fingerprint Microsoft Windows 2000 SP2
  14496. Class Microsoft | Windows | NT/2K/XP | general purpose
  14497. TSeq(Class=RI%gcd=<6%SI=<2FE90&>6F9%IPID=I%TS=U)
  14498. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  14499. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14500. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  14501. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14502. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14503. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14504. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14505. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14506.  
  14507. Fingerprint Microsoft Windows 2000 SP2
  14508. Class Microsoft | Windows | NT/2K/XP | general purpose
  14509. TSeq(Class=RI%gcd=<6%SI=<2928E&>4B7%IPID=I%TS=U)
  14510. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  14511. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14512. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  14513. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14514. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14515. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14516. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14517. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14518.  
  14519. # Microsoft Windows 2000 Professional SP2
  14520. # Microsoft Windows XP Professional SP1
  14521. # Microsoft Windows XP Professional, ver. 5.1 Build 2600.xpclnt_qfe.010827-1803
  14522. Fingerprint Microsoft Windows 2000 SP2 or XP or XP SP1
  14523. Class Microsoft | Windows | NT/2K/XP | general purpose
  14524. TSeq(Class=RI%gcd=<6%SI=<327F6C&>3E9%IPID=I)
  14525. T1(DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT)
  14526. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14527. T3(Resp=Y%DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT)
  14528. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14529. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14530. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14531. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14532. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14533.  
  14534. # base on msg 1039
  14535. # Microsoft Windows 2000 SP2 with Hotfix Q300972, Q301625
  14536. Fingerprint Microsoft Windows 2000 SP2 with Hotfix (Pre-SP3)
  14537. Class Microsoft | Windows | NT/2K/XP | general purpose
  14538. TSeq(Class=RI%gcd=<8%SI=<1E08C&>15A%IPID=I)
  14539. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14540. T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  14541. T3(Resp=Y%DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
  14542. T4(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  14543. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14544. T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  14545. T7(DF=N%W=400|1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
  14546. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14547.  
  14548. # Microsoft Windows 2000 Professional with SP3 and latest Windows Update
  14549. # patches as of August 22, 2003 - Laptop using G-Trans PCMCIA CDMA
  14550. # Wireless card.
  14551. Fingerprint Microsoft Windows 2000 SP3
  14552. Class Microsoft | Windows | NT/2K/XP | general purpose
  14553. TSeq(Class=RI%gcd=<6%SI=<39062&>5B5%IPID=I)
  14554. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14555. T2(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  14556. T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  14557. T4(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  14558. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14559. T6(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  14560. T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  14561. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14562.  
  14563. Fingerprint Microsoft Windows 2000 SP3
  14564. Class Microsoft | Windows | NT/2K/XP | general purpose
  14565. TSeq(Class=RI%gcd=<6%SI=<2382B18&>5AE4C%IPID=Z%TS=U)
  14566. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  14567. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14568. T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  14569. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14570. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14571. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14572. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14573. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14574.  
  14575. Fingerprint Microsoft Windows 2000 SP3
  14576. Class Microsoft | Windows | NT/2K/XP | general purpose
  14577. TSeq(Class=RI%gcd=<6%SI=<1A748&>D9%IPID=I%TS=U)
  14578. T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
  14579. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14580. T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
  14581. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14582. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14583. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14584. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14585. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14586.  
  14587. # Microsoft Windows 2000 SP3
  14588. Fingerprint Microsoft Windows 2000 SP3
  14589. Class Microsoft | Windows | NT/2K/XP | general purpose
  14590. TSeq(Class=RI%gcd=<6%SI=<2425C&>383%IPID=I)
  14591. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT)
  14592. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14593. T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT)
  14594. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14595. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14596. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14597. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14598. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14599.  
  14600. Fingerprint Microsoft Windows 2000 SP3
  14601. Class Microsoft | Windows | NT/2K/XP | general purpose
  14602. TSeq(Class=RI%gcd=<6%SI=<13EEB2&>2BD%IPID=I%TS=U)
  14603. T1(DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW)
  14604. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14605. T3(Resp=Y%DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW)
  14606. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14607. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14608. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14609. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14610. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14611.  
  14612. # Microsoft Windows 2000 [Version 5.00.2195]  SP3
  14613. Fingerprint Microsoft Windows 2000 SP3
  14614. Class Microsoft | Windows | NT/2K/XP | general purpose
  14615. TSeq(Class=RI%gcd=<6%SI=<269EE&>2EC%IPID=I)
  14616. T1(DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT)
  14617. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14618. T3(Resp=Y%DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT)
  14619. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14620. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14621. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14622. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14623. PU(DF=N%TOS=0|D0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14624.  
  14625. # Microsoft Windows 2000 SP3
  14626. Fingerprint Microsoft Windows 2000 SP3
  14627. Class Microsoft | Windows | NT/2K/XP | general purpose
  14628. TSeq(Class=RI%gcd=<6%SI=<28B54&>31B%IPID=I)
  14629. T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  14630. T2(Resp=N)
  14631. T3(Resp=N)
  14632. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14633. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14634. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14635. T7(Resp=N)
  14636. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14637.  
  14638. # Windows 2000 5.00.2195 with SP 3
  14639. Fingerprint Microsoft Windows 2000 SP3
  14640. Class Microsoft | Windows | NT/2K/XP | general purpose
  14641. TSeq(Class=TR%gcd=<6%IPID=I)
  14642. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14643. T2(Resp=N)
  14644. T3(Resp=N)
  14645. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14646. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14647. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14648. T7(Resp=N)
  14649. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14650.  
  14651. Fingerprint Microsoft Windows 2000 SP3
  14652. Class Microsoft | Windows | NT/2K/XP | general purpose
  14653. TSeq(Class=RI%gcd=<6%SI=<876AE&>98E)
  14654. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  14655. T2(Resp=N)
  14656. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  14657. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14658. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14659. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14660. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14661. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14662.  
  14663. Fingerprint Microsoft Windows 2000 SP3
  14664. Class Microsoft | Windows | NT/2K/XP | general purpose
  14665. TSeq(Class=RI%gcd=<6%SI=<15374&>110%IPID=I)
  14666. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  14667. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14668. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  14669. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14670. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14671. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14672. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14673. PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14674.  
  14675. # Microsoft Windows 2000: v5.00.2195: SP4
  14676. Fingerprint Microsoft Windows 2000 SP4
  14677. Class Microsoft | Windows | NT/2K/XP | general purpose
  14678. TSeq(Class=TR%gcd=<6)
  14679. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14680. T2(Resp=Y%DF=N%W=400|1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  14681. T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14682. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  14683. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14684. T6(DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  14685. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  14686. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14687.  
  14688. # Microsoft Windows 2000 with SP4 ( version 5.0 (build 2195: sp 4) )
  14689. Fingerprint Microsoft Windows 2000 SP4
  14690. Class Microsoft | Windows | NT/2K/XP | general purpose
  14691. TSeq(Class=RI%gcd=<6%SI=<17D54&>2B4%IPID=I%TS=U)
  14692. T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS|A%Ops=MNW|)
  14693. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14694. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  14695. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14696. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14697. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14698. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14699. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14700.  
  14701. # Windows 2000 Professional 5.00.2195 SP4 incl. latest Hotfixes till 30.12.2004
  14702. # Microsoft Windows 2000 build 2195 SP 4
  14703. Fingerprint Microsoft Windows 2000 SP4
  14704. Class Microsoft | Windows | NT/2K/XP | general purpose
  14705. TSeq(Class=RI%gcd=<6%SI=<139354&>972%IPID=I%TS=U)
  14706. T1(DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNW)
  14707. T2(Resp=N)
  14708. T3(Resp=Y%DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNW)
  14709. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14710. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14711. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14712. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14713. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14714.  
  14715. # Microsoft Windows 2000 build 2195 SP4 with update patches through 4/22/2004
  14716. Fingerprint Microsoft Windows 2000 SP4
  14717. Class Microsoft | Windows | NT/2K/XP | general purpose
  14718. TSeq(Class=RI%gcd=<6%SI=<1BFDA&>357%IPID=I%TS=U)
  14719. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  14720. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14721. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  14722. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14723. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14724. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14725. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14726. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14727.  
  14728. Fingerprint Microsoft Windows 2000 SP4
  14729. Class Microsoft | Windows | NT/2K/XP | general purpose
  14730. TSeq(Class=RI%gcd=<C%SI=<B994C&>A06%IPID=I%TS=U)
  14731. T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  14732. T2(Resp=N)
  14733. T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  14734. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14735. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14736. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14737. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14738. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14739.  
  14740. Fingerprint Microsoft Windows 2000 SP4
  14741. Class Microsoft | Windows | NT/2K/XP | general purpose
  14742. TSeq(Class=RI%gcd=<6%SI=<51CB6&>2DF%IPID=I)
  14743. T1(DF=Y%W=B547%ACK=S++%Flags=AS%Ops=MNWNNT)
  14744. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14745. T3(Resp=Y%DF=Y%W=B547%ACK=S++%Flags=AS%Ops=MNWNNT)
  14746. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14747. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14748. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14749. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14750. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14751.  
  14752. # Fingerprint Windows 2000 build 5.00.2195 SP4
  14753. Fingerprint Microsoft Windows 2000 SP4
  14754. Class Microsoft | Windows | NT/2K/XP | general purpose
  14755. TSeq(Class=RI%gcd=<8%SI=<78816&>95%IPID=I)
  14756. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14757. T2(Resp=N)
  14758. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14759. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14760. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14761. T6(Resp=N)
  14762. T7(Resp=N)
  14763. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14764.  
  14765. # Windows 2000 Version 5.0 Build 2195 SP 4 X86
  14766. Fingerprint Microsoft Windows 2000 SP4
  14767. Class Microsoft | Windows | NT/2K/XP | general purpose
  14768. TSeq(Class=TR%gcd=<6%IPID=I)
  14769. T1(DF=Y%W=4204|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14770. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14771. T3(Resp=Y%DF=Y%W=4204|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14772. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14773. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14774. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14775. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14776. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14777.  
  14778. # Windows Version 5.0 build 2195 SP 4
  14779. Fingerprint Microsoft Windows 2000 SP4
  14780. Class Microsoft | Windows | NT/2K/XP | general purpose
  14781. TSeq(Class=TR%gcd=<6%IPID=I)
  14782. T1(DF=Y%W=7FFF|832C|FA00%ACK=S++%Flags=AS%Ops=MNWNNT)
  14783. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14784. T3(Resp=Y%DF=Y%W=7FFF|832C|FA00%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  14785. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14786. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14787. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14788. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14789. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14790.  
  14791. # Microsoft Windows 2000 SP4 and latest Windows Update patches as of Sept 26, 2003 running BlackICE
  14792. # Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of September 01, 2003
  14793. Fingerprint Microsoft Windows 2000 SP4 or Windows XP SP1
  14794. Class Microsoft | Windows | NT/2K/XP | general purpose
  14795. TSeq(Class=RI%gcd=<6%SI=<1E58A2&>1517)
  14796. T1(DF=Y%W=2238|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14797. T2(Resp=N)
  14798. T3(Resp=N)
  14799. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14800. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14801. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14802. T7(Resp=N)
  14803. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14804.  
  14805. # base on msg 2213(-2210), 2378, 2473, 2476, 2174, 2153, 1942, 1955
  14806. # Microsoft Windows 2000 Professional (German) with SP4 build 2195 and latest Windows Update patches (2005.5.19)
  14807. # Windows 2000 terminal version 5.0 build 2195 service pack 4
  14808. # Microsoft Windows 2000 Professional SP4 and latest Windows Update patches (2005.6.11)
  14809. # Microsoft Windows 2000 Server with SP4 and latest Windows Update patches as of May 17, 2005
  14810. # Windows XP Professional Version 2002 Service Pack 1
  14811. # Microsoft Windows 2000 Advanced Server SP4
  14812. Fingerprint Microsoft Windows 2000 SP4 or XP SP1
  14813. Class Microsoft | Windows | NT/2K/XP | general purpose
  14814. TSeq(Class=TR%gcd=<6%IPID=I)
  14815. T1(DF=Y%W=B547|FC00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14816. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14817. T3(Resp=Y%DF=Y%W=B547|FC00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14818. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14819. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14820. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14821. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14822. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14823.  
  14824. # Microsoft Windows Server 2003 Standard Edition
  14825. # Microsoft Windows 2003 standard edition Version 5.2 (Build 3790.srv03_gdr.040410-1234)
  14826. # Microsoft Windows 2003 Server with SP1
  14827. # Windows Server 2003 Enterprise SP1 + hotfixes (build 3790.srv30_sp1_rtm.050324-1447 : Service Pack 1)
  14828. # Windows 2003 Enterprise SP1 Version 5.2 (Build 3790.srv03_sp1_rc1.041202-1618 : +Service Pack 1, v.1)
  14829. # Microsoft Windows XP Professional /w SP2 build 2600.xpsp_sp2_rtm.040803-2158
  14830. # Microsoft Windows 2003 Standard Edition SP1 Updated through June 19th 2005
  14831. # Windows Server 2003 Enterprise Edition (Version 5.2 Build 3790.srv03_sp1_rtm.050324-1447 : +Service Pack 1)
  14832. Fingerprint Microsoft Windows 2003 Server, 2003 Server SP1 or XP Pro SP2
  14833. Class Microsoft | Windows | NT/2K/XP | general purpose
  14834. Class Microsoft | Windows | 2003/.NET | general purpose
  14835. TSeq(Class=TR%gcd=<6%IPID=I)
  14836. T1(DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14837. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14838. T3(Resp=Y%DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  14839. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14840. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14841. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14842. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14843. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14844.  
  14845. #  Microsoft Windows 2000 with Service Pack 3
  14846. # Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of February 1st, 2003
  14847. Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000, or Windows XP
  14848. Class Microsoft | Windows | NT/2K/XP | general purpose
  14849. Class Microsoft | Windows | 95/98/ME | general purpose
  14850. TSeq(Class=RI%gcd=<20%SI=<E92A&>240)
  14851. T1(DF=Y%W=40E8|5B8E|7FFF|FAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
  14852. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14853. T3(Resp=Y%DF=Y%W=40E8|5B8E|7FFFFAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
  14854. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14855. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14856. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14857. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14858. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14859.  
  14860. Fingerprint Microsoft Windows NT 3.10 (Build 528)
  14861. Class Microsoft | Windows | NT/2K/XP | general purpose
  14862. TSeq(Class=RI|TD%gcd=<24%SI=<69A%IPID=I%TS=U)
  14863. T1(DF=N%W=1400%ACK=S++%Flags=AS%Ops=M)
  14864. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14865. T3(Resp=N)
  14866. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14867. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14868. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14869. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14870. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14871.  
  14872. Fingerprint Microsoft Windows NT 4.0 Server SP5-SP6
  14873. Class Microsoft | Windows | NT/2K/XP | general purpose
  14874. TSeq(Class=RI%gcd=<8%SI=<11784E&>2CA4)
  14875. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  14876. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14877. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  14878. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14879. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14880. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14881. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14882. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14883.  
  14884. Fingerprint Microsoft Windows NT 4.0 SP 6a + hotfixes
  14885. Class Microsoft | Windows | NT/2K/XP | general purpose
  14886. TSeq(Class=RI%gcd=<6%SI=<40132&>290%IPID=BI|RPI%TS=U)
  14887. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14888. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14889. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14890. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14891. T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  14892. T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  14893. T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  14894. PU(Resp=N|Y)
  14895.  
  14896. Fingerprint Microsoft Windows NT 4.0 SP3
  14897. Class Microsoft | Windows | NT/2K/XP | general purpose
  14898. TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73)
  14899. T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT)
  14900. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14901. T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT)
  14902. T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
  14903. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14904. T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
  14905. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14906. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14907.  
  14908. Fingerprint Microsoft Windows NT 4.0 SP3
  14909. Class Microsoft | Windows | NT/2K/XP | general purpose
  14910. TSeq(Class=TD%gcd=<F4%SI=<3C%IPID=BI%TS=U)
  14911. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14912. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14913. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14914. T4(DF=N%W=0%ACK=S|S++%Flags=R%Ops=)
  14915. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14916. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  14917. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14918. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14919.  
  14920. Fingerprint Microsoft Windows NT 4.0 SP5
  14921. Class Microsoft | Windows | NT/2K/XP | general purpose
  14922. TSeq(Class=TD%gcd=<6%SI=<50%IPID=BI%TS=U)
  14923. T1(DF=Y%W=C000%ACK=S++%Flags=AS%Ops=M)
  14924. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14925. T3(Resp=Y%DF=Y%W=C000%ACK=S++%Flags=AS%Ops=M)
  14926. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14927. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14928. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14929. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14930. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14931.  
  14932. Fingerprint Microsoft Windows NT 4.0 SP5-SP6
  14933. Class Microsoft | Windows | NT/2K/XP | general purpose
  14934. TSeq(Class=RI%gcd=<6%SI=<DA16&>21A)
  14935. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14936. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14937. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14938. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14939. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14940. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14941. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14942. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14943.  
  14944. # Windows NT 4.0 Service pack 6 w/exchange 5.5
  14945. # Microsoft Windows NT 4.0 service pack 6 (English)
  14946. Fingerprint Microsoft Windows NT 4.0 SP6
  14947. Class Microsoft | Windows | NT/2K/XP | general purpose
  14948. TSeq(Class=RI%gcd=<8%SI=<1F9C8&>FA%IPID=BI|RPI|RD%TS=U)
  14949. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14950. T2(Resp=N)
  14951. T3(Resp=N)
  14952. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14953. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14954. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14955. T7(Resp=N)
  14956. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14957.  
  14958. # Microsoft Windows NT4.0 Workstation SP6a
  14959. # Windows NT4.0 with Service Pack 6
  14960. # Microsoft Windows NT4.0 Terminal Server Edition with Service Pack 6 and Citrix MetaFrame 1.8 with Service Pack 4
  14961. Fingerprint Microsoft Windows NT 4.0 SP6a
  14962. Class Microsoft | Windows | NT/2K/XP | general purpose
  14963. TSeq(Class=RI%gcd=<A%SI=<1A66C&>112%IPID=RPI|BI%TS=U)
  14964. T1(DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M)
  14965. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14966. T3(Resp=Y%DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M)
  14967. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14968. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14969. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14970. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14971. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14972.  
  14973. Fingerprint Microsoft Windows NT 4.0 SP6a
  14974. Class Microsoft | Windows | NT/2K/XP | general purpose
  14975. TSeq(Class=RI%gcd=<6%SI=<8D3CE&>1017%IPID=RPI|RD%TS=U)
  14976. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  14977. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14978. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  14979. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14980. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14981. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14982. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14983. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14984.  
  14985. Fingerprint Microsoft Windows NT 4.0 SP6a with Kerio WinRoute Pro 4.27 Firewall
  14986. Class Microsoft | Windows | NT/2K/XP | general purpose
  14987. TSeq(Class=TD%gcd=<8%SI=<8C%IPID=BI|RPI%TS=U)
  14988. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14989. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  14990. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14991. T4(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  14992. T5(DF=N%W=1000|400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  14993. T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  14994. T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  14995. PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14996.  
  14997. Fingerprint Microsoft Windows NT 4.0 Terminal Server Edition
  14998. Class Microsoft | Windows | NT/2K/XP | general purpose
  14999. TSeq(Class=RI%gcd=<8%SI=<BEF0&>1D4%IPID=BI%TS=U)
  15000. T1(DF=N|Y%W=0|2017%ACK=S++%Flags=AR|AS%Ops=|M)
  15001. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15002. T3(Resp=Y%DF=N|Y%W=0|2017%ACK=O|S++%Flags=AR|AS%Ops=|M)
  15003. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15004. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15005. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15006. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15007. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15008.  
  15009. # Windows NT Version 4.0 (Build 1381 - Service Pack 6), Revised Service Pack 6a
  15010. Fingerprint Microsoft Windows NT 4.0 Workstation SP6a
  15011. Class Microsoft | Windows | NT/2K/XP | general purpose
  15012. TSeq(Class=TD%gcd=<8%SI=<46%IPID=RPI|RD|BI%TS=U)
  15013. T1(DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M)
  15014. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15015. T3(Resp=Y%DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M)
  15016. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15017. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15018. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15019. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15020. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15021.  
  15022. Fingerprint Microsoft Windows NT 4.0 Workstation SP6a
  15023. Class Microsoft | Windows | NT/2K/XP | general purpose
  15024. TSeq(Class=TD%gcd=<6%SI=<46%IPID=BI%TS=U)
  15025. T1(DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M)
  15026. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15027. T3(Resp=Y%DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M)
  15028. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15029. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15030. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15031. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15032. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15033.  
  15034. Fingerprint Microsoft Windows NT Version 4 (Build 1381) Service Pack 6a
  15035. Class Microsoft | Windows | NT/2K/XP | general purpose
  15036. TSeq(Class=RI%gcd=<6%SI=<377BC&>3BB%IPID=RPI|BI%TS=U)
  15037. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  15038. T2(Resp=Y%DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  15039. T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  15040. T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  15041. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15042. T6(DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  15043. T7(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
  15044. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15045.  
  15046. # Microsoft Windows XP [Version 5.1.2600]
  15047. Fingerprint Microsoft Windows XP
  15048. Class Microsoft | Windows | NT/2K/XP | general purpose
  15049. TSeq(Class=RI%gcd=<6%SI=<2C09C&>2CB%IPID=I%TS=U)
  15050. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  15051. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15052. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  15053. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15054. T5(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=)
  15055. T6(DF=N%W=400|800%ACK=S%Flags=AR%Ops=)
  15056. T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  15057. PU(Resp=N)
  15058.  
  15059. Fingerprint Microsoft Windows XP Home Edition
  15060. Class Microsoft | Windows | NT/2K/XP | general purpose
  15061. TSeq(Class=RI%gcd=<6%SI=<23C4E&>330%IPID=I%TS=U)
  15062. T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  15063. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15064. T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  15065. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  15066. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15067. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  15068. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15069. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15070.  
  15071. # Microsoft Windows XP Home Edition (English) SP2 build 2600.xps_p2_gdr.050301:1519
  15072. Fingerprint Microsoft Windows XP Home Edition (English) SP2
  15073. Class Microsoft | Windows | NT/2K/XP | general purpose
  15074. TSeq(Class=TR%gcd=<6)
  15075. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15076. T2(Resp=N)
  15077. T3(Resp=N)
  15078. T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  15079. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15080. T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  15081. T7(Resp=N)
  15082. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15083.  
  15084. # Microsoft Windows XP Home Edition (German) SP1
  15085. # ver 5.1 build 2600.xpsp2.030422-1633 : SP 1; German version
  15086. # Microsoft Windows XP Home Edition (German) SP1 
  15087. Fingerprint Microsoft Windows XP Home Edition (German) SP1
  15088. Class Microsoft | Windows | NT/2K/XP | general purpose
  15089. TSeq(Class=RI%gcd=<6%SI=<129062&>775%IPID=I)
  15090. T1(DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15091. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15092. T3(Resp=Y%DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15093. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15094. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15095. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15096. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15097. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  15098.  
  15099. # Microsoft Windows XP Version 5.1 Home German SP2 (Build 2600.xpsp_sp2_rtm.040803-2158 : SP2), latest Updates as of Oct 27, 2004
  15100. Fingerprint Microsoft Windows XP Home Edition (German) SP2
  15101. Class Microsoft | Windows | NT/2K/XP | general purpose
  15102. TSeq(Class=TR%gcd=<6%IPID=I)
  15103. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  15104. T2(Resp=N)
  15105. T3(Resp=N)
  15106. T4(Resp=N)
  15107. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15108. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15109. T7(Resp=N)
  15110. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15111.  
  15112. # Microsoft Windows XP Home Edition (English) SP1 Version 5.1.2600.1106 build 2600 xpsp.1.020828-1-920
  15113. Fingerprint Microsoft Windows XP Home Edition SP1
  15114. Class Microsoft | Windows | NT/2K/XP | general purpose
  15115. TSeq(Class=RI%gcd=<6%SI=<163E6&>31F%IPID=I)
  15116. T1(DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT)
  15117. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15118. T3(Resp=Y%DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT)
  15119. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15120. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15121. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15122. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15123. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15124.  
  15125. # Microsoft Windows XP Home Edition (Italian) SP1 build 2600.xpclnt_qfe.021108-2107
  15126. # Windows XP Home Edition SP2
  15127. Fingerprint Microsoft Windows XP Home Edition SP1 or SP2
  15128. Class Microsoft | Windows | NT/2K/XP | general purpose
  15129. TSeq(Class=RI%gcd=<6%SI=<2522E&>381%IPID=I%TS=U)
  15130. T1(DF=Y%W=1FE0%ACK=S++%Flags=AS%Ops=M)
  15131. T2(Resp=N)
  15132. T3(Resp=N)
  15133. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15134. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15135. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15136. T7(Resp=N)
  15137. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15138.  
  15139. # Windows XP Professional WITHOUT ANY service packs
  15140. # Windows XP SP1
  15141. Fingerprint Microsoft Windows XP Pro
  15142. Class Microsoft | Windows | NT/2K/XP | general purpose
  15143. TSeq(Class=RI%gcd=<6%SI=<2EBEE&>45E%IPID=I%TS=U)
  15144. T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  15145. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15146. T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  15147. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15148. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15149. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15150. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15151. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15152.  
  15153. # No service packs
  15154. Fingerprint Microsoft Windows XP Pro (German)
  15155. Class Microsoft | Windows | NT/2K/XP | general purpose
  15156. TSeq(Class=RI%gcd=<6%SI=<1074EE&>E48%TS=U)
  15157. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  15158. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15159. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  15160. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15161. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15162. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15163. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15164. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15165.  
  15166. # Microsoft Windows XP Prof Corporate (German) SP1 + all Security Updates as of Febr. 10, 2004
  15167. Fingerprint Microsoft Windows XP Pro (German) SP1
  15168. Class Microsoft | Windows | NT/2K/XP | general purpose
  15169. TSeq(Class=RI%gcd=<6%SI=<15BA8&>2DA%IPID=I%TS=U)
  15170. T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW)
  15171. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15172. T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW)
  15173. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15174. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15175. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15176. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15177. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15178.  
  15179. Fingerprint Microsoft Windows XP Pro (German) SP1
  15180. Class Microsoft | Windows | NT/2K/XP | general purpose
  15181. TSeq(Class=RI%gcd=<6%SI=<23E9C&>195%IPID=I)
  15182. T1(DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT)
  15183. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15184. T3(Resp=Y%DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT)
  15185. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15186. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15187. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15188. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15189. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15190.  
  15191. # No service packs
  15192. Fingerprint Microsoft Windows XP Pro (Italian)
  15193. Class Microsoft | Windows | NT/2K/XP | general purpose
  15194. TSeq(Class=RI%gcd=<6%SI=<3CF14&>33C)
  15195. T1(DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT)
  15196. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15197. T3(Resp=Y%DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT)
  15198. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15199. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15200. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15201. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15202. PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15203.  
  15204. # Fingerprint Microsoft Windows XP Pro (Spanish) SP2
  15205. Fingerprint Microsoft Windows XP Pro (Spanish) SP2
  15206. Class Microsoft | Windows | NT/2K/XP | general purpose
  15207. TSeq(Class=TR%gcd=<6)
  15208. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  15209. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15210. T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  15211. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15212. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15213. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15214. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15215. PU(Resp=N)
  15216.  
  15217. Fingerprint Microsoft Windows XP Pro or Windows 2000 Professional SP2+
  15218. Class Microsoft | Windows | NT/2K/XP | general purpose
  15219. TSeq(Class=RI%gcd=<16%SI=<25AEE&>6B%IPID=I)
  15220. T1(DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  15221. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15222. T3(Resp=Y%DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  15223. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15224. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15225. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15226. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15227. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15228.  
  15229. Fingerprint Microsoft Windows XP Pro RC1+ through final release
  15230. Class Microsoft | Windows | NT/2K/XP | general purpose
  15231. TSeq(Class=RI%gcd=<8%SI=<2959A&>356%IPID=I)
  15232. T1(DF=Y|N%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15233. T2(Resp=N)
  15234. T3(Resp=N)
  15235. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15236. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15237. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15238. T7(Resp=N)
  15239. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15240.  
  15241. # Microaodr Windows XP Pro with SP! and latest Windows Update patches as of June 1, 2005
  15242. Fingerprint Microsoft Windows XP Pro SP1
  15243. Class Microsoft | Windows | NT/2K/XP | general purpose
  15244. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  15245. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  15246. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15247. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  15248. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15249. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15250. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15251. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15252. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15253.  
  15254. # bsed on msg 2236, 1304
  15255. # Microsoft R Windows Version 5.1 (Build 2600.xpsp2.040919-1003 : Service Pack 1)
  15256. # Microsoft Windows XP version 5.1 (no. 2600 xpsp2.040919-1003: Service Pack 1)
  15257. Fingerprint Microsoft Windows XP Pro SP1
  15258. Class Microsoft | Windows | NT/2K/XP | general purpose
  15259. TSeq(Class=RI%gcd=<6%SI=<2553A&>42E%IPID=I)
  15260. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNT)
  15261. T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15262. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNT)
  15263. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15264. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15265. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15266. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15267. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15268.  
  15269. Fingerprint Microsoft Windows XP Pro SP1
  15270. Class Microsoft | Windows | NT/2K/XP | general purpose
  15271. TSeq(Class=RI%gcd=<6%SI=<31812&>7D7%IPID=I)
  15272. T1(DF=Y%W=7D00%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  15273. T2(Resp=N)
  15274. T3(Resp=N)
  15275. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15276. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15277. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15278. T7(Resp=N)
  15279. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15280.  
  15281. # Microsoft Windows XP Professional Edition Version 5.1 Build (2600.xpsp2.030422-1633: Service Pack 1)
  15282. # Microsoft Windows XP Professional SP1 and latest patches as of Jan 31,2004
  15283. # Microsoft Windows XP Professional (Italian) SP1 build 2600.xpsp2.030422-1633# Microsoft Windows XP Pro (Spanish) SP1 (Build 2600.xpsp2.030422-1633 : Service Pack 1) Intel
  15284. Fingerprint Microsoft Windows XP Pro SP1
  15285. Class Microsoft | Windows | NT/2K/XP | general purpose
  15286. TSeq(Class=RI%gcd=<6%SI=<29446&>49E%IPID=I)
  15287. T1(DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT)
  15288. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15289. T3(Resp=Y%DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT)
  15290. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15291. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15292. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15293. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15294. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15295.  
  15296. Fingerprint Microsoft Windows XP Pro SP1
  15297. Class Microsoft | Windows | NT/2K/XP | general purpose
  15298. TSeq(Class=RI%gcd=<8%SI=<10225A&>105E)
  15299. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15300. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15301. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15302. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15303. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15304. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15305. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15306. PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15307.  
  15308. Fingerprint Microsoft Windows XP Pro SP1
  15309. Class Microsoft | Windows | NT/2K/XP | general purpose
  15310. TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I)
  15311. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15312. T2(Resp=N)
  15313. T3(Resp=N)
  15314. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15315. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15316. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15317. T7(Resp=N)
  15318. PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15319.  
  15320. # Windows XP Version 5.1 (Build 2600.xpsp2.030422-1633: Service pack 1)
  15321. # Windows XP Professional With serice pack 1... English..   2600.xpsp1.020828-1920
  15322. Fingerprint Microsoft Windows XP Pro SP1
  15323. Class Microsoft | Windows | NT/2K/XP | general purpose
  15324. TSeq(Class=RI%gcd=<6%SI=<9A6AA&>18A0%IPID=I%TS=U)
  15325. T1(DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS|A%Ops=M|)
  15326. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15327. T3(Resp=Y%DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS||A%Ops=M||)
  15328. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15329. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15330. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15331. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15332. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15333.  
  15334. # Windows XP Professional Version 5.1 (Build 2600.xpsp2.030422-1633: Service Pack1)
  15335. # Windows XP SP1 running ZoneAlarm
  15336. # Microsoft Windows XP Professional Version 5.1 (Build 2600.xpsp2_gdr.040517-1325: Service Pack 1)
  15337. Fingerprint Microsoft Windows XP Pro SP1
  15338. Class Microsoft | Windows | NT/2K/XP | general purpose
  15339. TSeq(Class=RI%gcd=<6%SI=<63826&>D28%IPID=I%TS=U)
  15340. T1(DF=Y%W=3BB8|6270|8000|9448|A1D3|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW)
  15341. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15342. T3(Resp=Y%DF=Y%W=3BB8|6270|8000|9448|A1D3|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW)
  15343. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15344. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15345. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15346. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15347. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  15348.  
  15349. Fingerprint Microsoft Windows XP Pro SP1
  15350. Class Microsoft | Windows | NT/2K/XP | general purpose
  15351. TSeq(Class=RI%gcd=<6%SI=<2F7D8&>239%IPID=I)
  15352. T1(DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT)
  15353. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15354. T3(Resp=Y%DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT)
  15355. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15356. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15357. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15358. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15359. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15360.  
  15361. Fingerprint Microsoft Windows XP Pro SP1
  15362. Class Microsoft | Windows | NT/2K/XP | general purpose
  15363. TSeq(Class=RI%gcd=<6%SI=<14686&>1A0%IPID=I)
  15364. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15365. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15366. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  15367. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15368. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15369. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15370. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15371. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15372.  
  15373. # Windows Xp Professional Service Pack 1 version 5.1 - Build  2600
  15374. # Microsoft Windows XP version 5.1 (build 2600.xpsp2.030422-1633 : Service Pack 1)
  15375. Fingerprint Microsoft Windows XP Pro SP1
  15376. Class Microsoft | Windows | NT/2K/XP | general purpose
  15377. TSeq(Class=RI%gcd=<6%SI=<3316C&>33B%IPID=I)
  15378. T1(DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT)
  15379. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15380. T3(Resp=Y%DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT)
  15381. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15382. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15383. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15384. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15385. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15386.  
  15387. Fingerprint Microsoft Windows XP Pro SP1
  15388. Class Microsoft | Windows | NT/2K/XP | general purpose
  15389. TSeq(Class=RI%gcd=<6%SI=<17D36&>18B%IPID=I)
  15390. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15391. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15392. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15393. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  15394. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15395. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  15396. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15397. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15398.  
  15399. # Microsoft Windows XP [Version 5.1.2600] (XP Professional SP1)
  15400. Fingerprint Microsoft Windows XP Pro SP1
  15401. Class Microsoft | Windows | NT/2K/XP | general purpose
  15402. TSeq(Class=TR%gcd=<6%IPID=I)
  15403. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15404. T2(Resp=Y%DF=N%W=C00|800%ACK=S%Flags=R%Ops=WNMETL)
  15405. T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S%Flags=R%Ops=WNMETL)
  15406. T4(DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL)
  15407. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15408. T6(DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL)
  15409. T7(DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL)
  15410. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15411.  
  15412. # Microsoft Windows Version 5.1 Build 2600.xpsp2.030825-2117: Service Pack 1
  15413. # Microsoft Windows XP Professional SP1 build 2600, latest windows updates (march 27, 2005)
  15414. Fingerprint Microsoft Windows XP Pro SP1
  15415. Class Microsoft | Windows | NT/2K/XP | general purpose
  15416. TSeq(Class=RI%gcd=<6%SI=<1B1AC&>29E%IPID=I%TS=U)
  15417. T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
  15418. T2(Resp=N)
  15419. T3(Resp=N)
  15420. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15421. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15422. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15423. T7(Resp=N)
  15424. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15425.  
  15426. # Windows XP Professional 2002 - Service Pack 1 - Hotfixes
  15427. # Windows XP Profesional build 2600.xpsp2.030422-1633: Service Pack 1
  15428. # Windows XP Professional SP1 build 2600.xpsp1.030422-166: Service Pack 1
  15429. # Windows XP Professional (Italian) build 2600 with SP1 and latest Windows Update patches as of middle Sept. 2004 circa
  15430. # Microsoft Windows 2000 SP4 all updates as of Apr 17 2004
  15431. Fingerprint Microsoft Windows XP Pro SP1 or 2000 SP4
  15432. Class Microsoft | Windows | NT/2K/XP | general purpose
  15433. TSeq(Class=RI%gcd=<6%SI=<209B8&>33C%IPID=I)
  15434. T1(DF=Y%W=6270|FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
  15435. T2(Resp=N)
  15436. T3(Resp=N)
  15437. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15438. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15439. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15440. T7(Resp=N)
  15441. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15442.  
  15443. # Microsoft Windows XP Professional SP1
  15444. # Microsoft Windows 2000 Advanced Server with Service Pack 3
  15445. Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 Advanced Server SP3
  15446. Class Microsoft | Windows | NT/2K/XP | general purpose
  15447. TSeq(Class=RI%gcd=<8%SI=<272A4&>31E%IPID=I%TS=U)
  15448. T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
  15449. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15450. T3(Resp=Y%DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
  15451. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15452. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15453. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15454. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15455. PU(DF=N%TOS=0|5C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15456.  
  15457. # Windows XP Professional Build 2600.xpsp1.020828-1920 with Windows Services for UNIX 3.0 installed
  15458. # Windows 2000 Advanced Server with SP3
  15459. # Microsoft Windows 2000 Server version 5.0 build 2195 Service Pack 3
  15460. # Windows 2000 SP3
  15461. Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 SP3
  15462. Class Microsoft | Windows | NT/2K/XP | general purpose
  15463. TSeq(Class=RI%gcd=<6%SI=<57472&>68D%IPID=I)
  15464. T1(DF=N|Y%W=0|FFF0%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  15465. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15466. T3(Resp=Y%DF=N|Y%W=0|FFF0%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT)
  15467. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15468. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15469. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15470. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15471. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15472.  
  15473. # Microsoft Windows XP Professional w/ SP1 V5.1.2600 and most WU patches as of 4/20/05
  15474. # Microsoft Windows XP Professional 5.1.2600 Service Pack 1 Build 2600
  15475. # Microsoft Windows XP Home Edition (English) with Service Pack 2
  15476. # Windows XP Professional (Version 5.1 - Build 2600.xpsp2.050301-1526: Service Pack 1)
  15477. # version 5.1 build 2600 xpsp2 040919-1003 service pack 1
  15478. # Windows 2000 SP4 Version 5.0 (Build 2195: Service Pack 4) on a 2 GHz Pentium 4
  15479. # Microsoft Windows 2000 s/SP4 build 5.00.2195
  15480. # Microsoft Windows 2000 Professional 5.00.2195 SP4 - all patches as of 02 Jun 2005 (OEM)
  15481. # Windows 2000 Advanced Server SP4 and patches as of June 17 2004
  15482. # Microsoft Windows 2000 Professional (v5.0, Build 2195, SP4), all current hotfixes applied 7th June
  15483. # Microsoft Windows 2000 Professional with SP4 and latest Windows Update patches as of June 21, 2005
  15484. # Microsoft Windows 2000 Advanced SP4 running Sphinx a-Wall
  15485. # Microsoft Windows XP Professional SP1a build 2600.xpsp2.050301-1526
  15486. # Microsoft Windows XP Professional (German) SP1 build 2600.xpsp1.050301-1526
  15487. Fingerprint Microsoft Windows XP Pro SP1/SP2 or 2000 SP4
  15488. Class Microsoft | Windows | NT/2K/XP | general purpose
  15489. TSeq(Class=TR%gcd=<6%IPID=I)
  15490. T1(DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15491. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15492. T3(Resp=Y%DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15493. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15494. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15495. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15496. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15497. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15498.  
  15499. # Windows XP Professionnel (5.1) Service Pack 2
  15500. Fingerprint Microsoft Windows XP Pro SP2
  15501. Class Microsoft | Windows | NT/2K/XP | general purpose
  15502. TSeq(Class=TR%gcd=<6%IPID=I)
  15503. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15504. T2(Resp=Y%DF=N%W=C00|800|400%ACK=S%Flags=AR%Ops=WNMETL)
  15505. T3(Resp=Y%DF=N%W=C00|800|400%ACK=S++%Flags=AR%Ops=WNMETL)
  15506. T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  15507. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  15508. T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  15509. T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  15510. PU(Resp=N)
  15511.  
  15512. # Microsoft Windows XP Professional Service Pack 2 Build 5 1 2600
  15513. Fingerprint Microsoft Windows XP Pro SP2
  15514. Class Microsoft | Windows | NT/2K/XP | general purpose
  15515. TSeq(Class=TR%gcd=<6%IPID=I)
  15516. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15517. T2(Resp=N)
  15518. T3(Resp=N)
  15519. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15520. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15521. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15522. T7(Resp=N)
  15523. PU(DF=N%TOS=20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15524.  
  15525. # Microsoft Windows Version 5.1 (Build 2600.xpsp_sp2_trm.040803-2158 : Service Paxk 2) (XP Professional +SP2 + Hotfix)
  15526. Fingerprint Microsoft Windows XP Pro SP2
  15527. Class Microsoft | Windows | NT/2K/XP | general purpose
  15528. TSeq(Class=TR%gcd=<6%IPID=I)
  15529. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15530. T2(Resp=N)
  15531. T3(Resp=N)
  15532. T4(Resp=N)
  15533. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15534. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15535. T7(Resp=N)
  15536. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15537.  
  15538. # Windows xp Professional SP2 German (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) with Agnitum Outpost Firewall Pro ver.+2.1.303.4009 (314)
  15539. # Microsoft Windows XP Professional Version 2002 SP2 build 5.1.2600 latest MS patches as of Feb 9, 2005
  15540. Fingerprint Microsoft Windows XP Pro SP2
  15541. Class Microsoft | Windows | NT/2K/XP | general purpose
  15542. TSeq(Class=TR%gcd=<6%IPID=I)
  15543. T1(DF=N%W=FB8B|FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
  15544. T2(Resp=N)
  15545. T3(Resp=N)
  15546. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15547. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15548. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15549. T7(Resp=N)
  15550. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15551.  
  15552. # Fingerprint Microsoft Windows XP Professional SP2 and latest updates
  15553. Fingerprint Microsoft Windows XP Pro SP2
  15554. Class Microsoft | Windows | NT/2K/XP | general purpose
  15555. TSeq(Class=TR%gcd=<6%IPID=I)
  15556. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15557. T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=R%Ops=WNMETL)
  15558. T3(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=R%Ops=WNMETL)
  15559. T4(DF=N%W=800|1000%ACK=S%Flags=R%Ops=WNMETL)
  15560. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15561. T6(DF=N%W=C00%ACK=S%Flags=R%Ops=WNMETL)
  15562. T7(DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
  15563. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15564.  
  15565. # bsed on msg 1079
  15566. # Fingerprint Microsoft Windows XP Proffesional (Polish) with SP2 and all patches available on January 19, 2005
  15567. Fingerprint Microsoft Windows XP Pro SP2
  15568. Class Microsoft | Windows | NT/2K/XP | general purpose
  15569. TSeq(Class=TR%gcd=<6%IPID=I)
  15570. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  15571. T2(Resp=N)
  15572. T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  15573. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15574. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15575. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15576. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15577. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15578.  
  15579. # Microsoft Windows XP Professional SP2 ( Build 2600.xpsp_sp2_rtm.040803-2158)
  15580. # Microsoft WIndows XP Proffesional Version 2002 Service Pack 2
  15581. Fingerprint Microsoft Windows XP Pro SP2
  15582. Class Microsoft | Windows | NT/2K/XP | general purpose
  15583. TSeq(Class=TR%gcd=<6%IPID=I)
  15584. T1(DF=N%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  15585. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15586. T3(Resp=Y%DF=N%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  15587. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15588. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15589. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15590. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15591. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15592.  
  15593. # Windows XP Professional SP2: Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158: Service Pack 2 (firewall disabled)
  15594. Fingerprint Microsoft Windows XP Pro SP2 (firewall disabled)
  15595. Class Microsoft | Windows | NT/2K/XP | general purpose
  15596. TSeq(Class=TR%IPID=I%TS=0)
  15597. T1(Resp=Y%DF=Y%W=FC94%ACK=S++%Flags=AS%Ops=MNWNNT)
  15598. T2(Resp=N)
  15599. T3(Resp=N)
  15600. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  15601. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15602. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  15603. T7(Resp=N)
  15604. PU(Resp=Y%DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15605.  
  15606. # Microsoft Windows XP Professional CORP. ED. Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
  15607. # Microsoft Windows 2003 Enterprize Edition (version 5.2 (build 3790.srv03_gdr.040410-1234))
  15608. # Microsoft Windows XP Professional SP2 5.1.2600 SP2 Build 2600, Athlon x86, no firewall
  15609. # Windows 2003 Enterprise Server 5.2 build 3790, srv03_gdr.040410-1234  as of Feb 22, 2003
  15610. # Mircosoft Windows Server 2003 Enterprise SP1 build 3790.srv03_sp1_rtm.050324-1447
  15611. Fingerprint Microsoft Windows XP Pro SP2 or 2003 Server Enterprise Edition
  15612. Class Microsoft | Windows | NT/2K/XP | general purpose
  15613. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  15614. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  15615. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15616. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  15617. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15618. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15619. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15620. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15621. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15622.  
  15623. Fingerprint Microsoft Windows XP Pro Version 5.1 Build 2600
  15624. Class Microsoft | Windows | NT/2K/XP | general purpose
  15625. TSeq(Class=RI%gcd=<6%SI=<32578&>18D%IPID=I)
  15626. T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15627. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15628. T3(Resp=Y%DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15629. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15630. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15631. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15632. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15633. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15634.  
  15635. Fingerprint Microsoft Windows XP SP1
  15636. Class Microsoft | Windows | NT/2K/XP | general purpose
  15637. TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I)
  15638. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15639. T2(Resp=N)
  15640. T3(Resp=N)
  15641. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15642. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15643. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15644. T7(Resp=N)
  15645. PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15646.  
  15647. # Microsoft Windows XP Prof (Build 2600.xpsp2.030422-1633: SP1
  15648. Fingerprint Microsoft Windows XP SP1
  15649. Class Microsoft | Windows | NT/2K/XP | general purpose
  15650. TSeq(Class=RI%gcd=<8%SI=<F2F30&>702%TS=U)
  15651. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  15652. T2(Resp=N)
  15653. T3(Resp=N)
  15654. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15655. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15656. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15657. T7(Resp=N)
  15658. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15659.  
  15660. Fingerprint Microsoft Windows XP SP1
  15661. Class Microsoft | Windows | NT/2K/XP | general purpose
  15662. TSeq(Class=RI%gcd=<6%SI=<C99A0A&>291F)
  15663. T1(DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15664. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15665. T3(Resp=Y%DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15666. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15667. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15668. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15669. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15670. PU(DF=N%TOS=0|40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15671.  
  15672. # Microsoft Windows XP Version 5.1 (Build 2600.xpsp 1.020828-1920: Service Pack 1) > latest Windows Update patch too (1/31/03)
  15673. # Windows 2000 with Service Pack 3
  15674. Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP3
  15675. Class Microsoft | Windows | NT/2K/XP | general purpose
  15676. TSeq(Class=RI%gcd=<6%SI=<2461C&>3BA%IPID=I%TS=U)
  15677. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  15678. T2(Resp=N)
  15679. T3(Resp=N)
  15680. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15681. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15682. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15683. T7(Resp=N)
  15684. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15685.  
  15686. # Microsoft Windows XP SP1 (Build 2600.XP SP2.030422-1633:Service Pack 1)
  15687. # Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of Oct 12, 2003 except Q817778
  15688. # Windows 2000 Professional with SP4 and latest Windows Update patches as of november 25th, 2003
  15689. Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP4
  15690. Class Microsoft | Windows | NT/2K/XP | general purpose
  15691. TSeq(Class=RI%gcd=<6%SI=<18DEE&>24B%IPID=I)
  15692. T1(DF=Y%W=402E|FC00|FD20%ACK=S++%Flags=AS%Ops=MNWNNT)
  15693. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15694. T3(Resp=N)
  15695. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15696. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15697. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15698. T7(Resp=N)
  15699. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  15700.  
  15701. # Microsoft Windows XP2 - version 5.1 (Build 2600.xpsp_sp2_gdr.050301-1519 : Service Pack 2)
  15702. Fingerprint Microsoft Windows XP SP2
  15703. Class Microsoft | Windows | NT/2K/XP | general purpose
  15704. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  15705. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  15706. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15707. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  15708. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15709. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15710. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15711. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15712. PU(DF=N%TOS=F0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15713.  
  15714. # Microsoft Windows XP SP2 (English) Build 2600.xpsp2_rtm.040803-2158
  15715. # Microsoft Windows XP Professional Version 5.1 (Build 2600.xpsp2_gdr.050301-1519 : Service Pack 2)
  15716. # Microsoft Windows XP Professional (Spanizh) with SP2 and latest Windows Update patches as June 5,+2005
  15717. Fingerprint Microsoft Windows XP SP2
  15718. Class Microsoft | Windows | NT/2K/XP | general purpose
  15719. TSeq(Class=TR%gcd=<6%IPID=I)
  15720. T1(DF=Y%W=C6C|4000|7D41%ACK=S++%Flags=AS%Ops=MNWNNT)
  15721. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15722. T3(Resp=Y%DF=Y%W=C6C|4000|7D41%ACK=S++%Flags=AS%Ops=MNWNNT)
  15723. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15724. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15725. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15726. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15727. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15728.  
  15729. # windows XP Professional SP2 and latest updates as of 3/7/05
  15730. # Microsoft Windows XP version 5.1 600.xpsp_sp2_rtm.040803-2158 : service pack 2
  15731. Fingerprint Microsoft Windows XP SP2
  15732. Class Microsoft | Windows | NT/2K/XP | general purpose
  15733. TSeq(Class=TR%gcd=<6%TS=U)
  15734. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  15735. T2(Resp=N)
  15736. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  15737. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15738. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15739. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15740. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15741. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15742.  
  15743. # base on msg 570, 1033
  15744. # Windows XP SP2 (firewall off).  Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
  15745. # Microsoft Windows Windows XP Corporate (French) SP2 build 2600.xpsp_sp2_rtm.040803-2158 on Intel Pentium 4 1.2 GHz
  15746. Fingerprint Microsoft Windows XP SP2
  15747. Class Microsoft | Windows | NT/2K/XP | general purpose
  15748. TSeq(Class=TR%gcd=<6%IPID=I)
  15749. T1(DF=Y%W=7E4A%ACK=S++%Flags=AS%Ops=MNWNNT)
  15750. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15751. T3(Resp=Y%DF=Y%W=7E4A%ACK=S++%Flags=AS%Ops=MNWNNT)
  15752. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15753. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15754. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15755. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15756. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15757.  
  15758. # Microsoft Windows XP Home Edition (English) SP2 build 2600.xpsp_sp2_rtm.040803-2158
  15759. # Microsoft Windows XP Home Edition (English) SP2 build 2600.xpsp_sp2_rtm.040803-2158
  15760. # Microsoft Windows XP Professional with SP2 (Version 5.1 Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
  15761. # Microsoft Windows XP Professional SP2 (Build 2600.xpsp_sp2_rtm.040803-2158)
  15762. # Microsoft Windows XP Professional SP2
  15763. # Windows XP SP2 (build 2600.xpsp_sp2_gdr.050301-1519 : Service Pack 2)
  15764. Fingerprint Microsoft Windows XP SP2
  15765. Class Microsoft | Windows | NT/2K/XP | general purpose
  15766. TSeq(Class=TR%gcd=<6%IPID=I%TS=U|0)
  15767. T1(DF=Y%W=6360|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNW)
  15768. T2(Resp=N)
  15769. T3(Resp=N)
  15770. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15771. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15772. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15773. T7(Resp=N)
  15774. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15775.  
  15776. # Microsoft Windows Version 5.1 (Build 2600.XPSP_SP2_GDR.050301-1519 : Service Pack 2)
  15777. Fingerprint Microsoft Windows XP SP2
  15778. Class Microsoft | Windows | NT/2K/XP | general purpose
  15779. TSeq(Class=TR%gcd=<6%IPID=I)
  15780. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15781. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15782. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15783. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15784. T5(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15785. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15786. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15787. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15788.  
  15789. # Microsoft Windows XP Professional Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2
  15790. # Microsoft Windows XP Professional SP2 build 2600.xpsp_sp2_rtm.040803-2158
  15791. # Microsoft Windows XP Professional SP2 and latest Windows Updates patches as of Dec 15, 2004
  15792. # Windows Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
  15793. # Microsoft Windows XP Professional (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
  15794. # Microsoft Windows XP Professional (Spanish) SP2 build 2600.xpsp_sp2_trm.040803-2158
  15795. # Windows Server 2003 Standard edition, Microsoft windows vers.5.2 build 3790.srv03_rtm.030324-2048
  15796. # Microsoft Windows XP Professional Version 2002 Service Pack 2
  15797. # Windows 2003 Server Standard Edition germany
  15798. # Microsoft Windows Server 2003 EE Version 5.2 (Build 3790.srv03_gdr.040410-1234)
  15799. # Microsoft Windows XP Home Edition (hebrew) with SP2
  15800. Fingerprint Microsoft Windows XP SP2 or 2003 Server
  15801. Class Microsoft | Windows | NT/2K/XP | general purpose
  15802. Class Microsoft | Windows | 2003/.NET | general purpose
  15803. TSeq(Class=TR%gcd=<6%IPID=I)
  15804. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15805. T2(Resp=N)
  15806. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15807. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15808. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15809. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15810. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15811. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15812.  
  15813. # Microsoft Windows 2003 Enterprise Server patches as of 3 May 2003  - NO SP1
  15814. # Microsoft windows Server 2003 Standard Edition (Corp. build) - Version 5.2 (Build+3790.srv03_gdr.040410-1234)
  15815. Fingerprint Microsoft Windows XP SP2 or 2003 Server
  15816. Class Microsoft | Windows | NT/2K/XP | general purpose
  15817. TSeq(Class=TR%gcd=<6%IPID=I)
  15818. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15819. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15820. T3(Resp=N)
  15821. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15822. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15823. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15824. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15825. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15826.  
  15827. # HP Jornada running Windows CE 2.11 (Handheld/PC Pro 3.0) running on StrongARM 1100
  15828. Fingerprint HP Jornada running Microsoft Windows CE 2.11 (Handheld/PC Pro 3.0 PDA)
  15829. Class Microsoft | Windows | PocketPC/CE | PDA
  15830. TSeq(Class=TD%gcd=<36%SI=<28%IPID=BI%TS=U)
  15831. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  15832. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15833. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  15834. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15835. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15836. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  15837. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15838. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15839.  
  15840. Fingerprint Microsoft PocketPC 3.0.11171 running on Compaq iPAQ 3870 Pocket PC
  15841. Class Microsoft | Windows | PocketPC/CE | PDA
  15842. TSeq(Class=TD%gcd=<6%SI=<104%IPID=BI)
  15843. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  15844. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15845. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  15846. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  15847. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15848. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  15849. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15850. PU(DF=N%TOS=40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15851.  
  15852. # Microsoft Windows CE 3.0 build 126 on StrongARM
  15853. Fingerprint Microsoft Windows CE 3.0
  15854. Class Microsoft | Windows | PocketPC/CE | specialized
  15855. TSeq(Class=TD%gcd=<E4%SI=<14%IPID=RPI|BI)
  15856. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  15857. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15858. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  15859. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15860. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15861. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15862. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15863. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15864.  
  15865. # Windows Pocket PC 2003 second edition vanilla on a Dell Axim x30 via 802.11
  15866. # HP t5300 running `Microsoft Windows CE 4.2
  15867. # ADAM-6500 controller with Windows CE .NET 4.10 build 908
  15868. Fingerprint Microsoft Windows CE or Pocket PC (PDA or other embedded device)
  15869. Class Microsoft | Windows | PocketPC/CE | specialized
  15870. TSeq(Class=RI%gcd=<A%SI=<1BF76&>12A%IPID=I)
  15871. T1(DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT)
  15872. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15873. T3(Resp=Y%DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT)
  15874. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15875. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15876. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15877. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15878. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15879.  
  15880. # Windows 2000 Pro, Build 2195 SP4
  15881. Fingerprint Microsoft Windows 2000 Professional SP4
  15882. Class Microsoft | Windows || general purpose
  15883. TSeq(Class=RI%gcd=<6%SI=<457D6&>35E%IPID=I)
  15884. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15885. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15886. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  15887. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15888. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15889. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15890. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15891. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  15892.  
  15893. Fingerprint Microsoft Windows 2000 Professional with SP4 and latest Windows Update patches as of August 11, 2004
  15894. Class Microsoft | Windows || general purpose
  15895. TSeq(Class=RI%gcd=<6%SI=<15E32&>1A1%IPID=I)
  15896. T1(DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT)
  15897. T2(Resp=N)
  15898. T3(Resp=N)
  15899. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15900. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  15901. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15902. T7(Resp=N)
  15903. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15904.  
  15905. Fingerprint Microsoft Windows 2000 Server SP3
  15906. Class Microsoft | Windows || general purpose
  15907. TSeq(Class=RI%gcd=<6%SI=<30714&>2A7%IPID=I)
  15908. T1(DF=Y%W=2DA0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15909. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15910. T3(Resp=Y%DF=Y%W=2DA0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15911. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15912. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15913. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15914. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15915. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15916.  
  15917. Fingerprint Microsoft Windows Longhorn eval build 4051
  15918. Class Microsoft | Windows || general purpose
  15919. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  15920. T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15921. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15922. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  15923. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15924. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15925. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15926. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15927. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15928.  
  15929. Fingerprint MikroTik RouterOS 2.7.20
  15930. Class MikroTik | RouterOS || software router
  15931. TSeq(Class=RI%gcd=<6%SI=<1B9B36E&>46A4A%IPID=Z%TS=100HZ)
  15932. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  15933. T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  15934. T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  15935. T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  15936. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15937. T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL)
  15938. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  15939. PU(Resp=N)
  15940.  
  15941. Fingerprint Minix 32-bit/Intel 2.0.0
  15942. Class Minix | Minix || general purpose
  15943. TSeq(Class=RI|TD%gcd=1|2|3|457%SI=<FFF)
  15944. T1(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=)
  15945. T2(Resp=N)
  15946. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  15947. T4(Resp=N)
  15948. T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15949. T6(Resp=N)
  15950. T7(Resp=N)
  15951. PU(Resp=N)
  15952.  
  15953. Fingerprint Minix 32-bit/Intel 2.0.3
  15954. Class Minix | Minix || general purpose
  15955. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  15956. T2(Resp=N)
  15957. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  15958. T4(Resp=N)
  15959. T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  15960. T6(Resp=N)
  15961. T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  15962. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15963.  
  15964. Fingerprint Minix v2.0.2 32bits
  15965. Class Minix | Minix || general purpose
  15966. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  15967. T2(Resp=N)
  15968. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
  15969. T4(Resp=N)
  15970. T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  15971. T6(Resp=N)
  15972. T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  15973. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15974.  
  15975. Fingerprint Konica-Minolta Di3010 photocopier/printer/scanner
  15976. Class Minolta | embedded || printer
  15977. TSeq(Class=64K%IPID=I%TS=2HZ)
  15978. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  15979. T2(Resp=N)
  15980. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  15981. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15982. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15983. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15984. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15985. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  15986.  
  15987. # Minolta Di183 printer/copy machine ROM Version 1.52
  15988. Fingerprint Minolta Di183 printer/copier
  15989. Class Minolta | embedded || printer
  15990. TSeq(Class=64K%IPID=I%TS=U)
  15991. T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=MNW)
  15992. T2(Resp=N)
  15993. T3(Resp=Y%DF=N%W=1%ACK=O%Flags=A%Ops=)
  15994. T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
  15995. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15996. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15997. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15998. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  15999.  
  16000. # VxWorks (for Destiny D8405 Pass 2 (Firmware build for Pass 1)) version 5.4.2.
  16001. Fingerprint Minolta QMS Printer running VxWorks 5.4.2
  16002. Class Minolta | VxWorks || printer
  16003. TSeq(Class=64K%IPID=I%TS=2HZ)
  16004. T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16005. T2(Resp=N)
  16006. T3(Resp=Y%DF=N%W=6000%ACK=O%Flags=A%Ops=NNT)
  16007. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  16008. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16009. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16010. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16011. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16012.  
  16013. Fingerprint Mirapoint messaging server M1000 (OS v 1.0.0)
  16014. Class MiraPoint | embedded || general purpose
  16015. TSeq(Class=RI%gcd=<6)
  16016. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  16017. T2(Resp=N)
  16018. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  16019. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  16020. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16021. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16022. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16023. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  16024.  
  16025. Fingerprint MiraPoint messaging server v3.1
  16026. Class MiraPoint | embedded || general purpose
  16027. TSeq(Class=RI%gcd=<6%SI=<DCCC6&>C2B%IPID=I%TS=100HZ)
  16028. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  16029. T2(Resp=N)
  16030. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  16031. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16032. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16033. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16034. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16035. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  16036.  
  16037. # Motorola BSR 1000R(tm) version 1.1.19.PRR
  16038. Fingerprint Motorola BSR 1000R
  16039. Class Motorola | BSD-misc || general purpose
  16040. TSeq(Class=64K%IPID=I%TS=U)
  16041. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  16042. T2(Resp=N)
  16043. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  16044. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16045. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  16046. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16047. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  16048. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16049.  
  16050. Fingerprint Motorola System V/68 version R3V7 on a 68030
  16051. Class Motorola | BSD-misc || general purpose
  16052. TSeq(Class=RI%gcd=<14%SI=<52F8&>C0)
  16053. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  16054. T2(Resp=N)
  16055. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  16056. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16057. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16058. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16059. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16060. PU(Resp=N)
  16061.  
  16062. # Motorola Surfboard SB5100e VxWorks Version: 5.4
  16063. # Motorola CG4500E Communication Gateway (cable modem)
  16064. # Thomson TCM390 cable modem; Software Version:  ST33.07.00; Software Model:   A801; Bootloader:  2.1.4c
  16065. # Motorola Surfboard Cable modem Software Version: SB5100-2.3.1.3-SCM00-NOSHHardware Version: 3MIB+Version: IIGUI Version: 1.0VxWorks Version: 5.4
  16066. # Motorola Cable Modem SB5100E SW_REV: SB5100E-2.3.1.3-SCM01-NOSH
  16067. # Motorola SB5100 Surfboard 5100 Cable Modem vSB5100-2.3.1.6-SCM01-NOSH
  16068. # Thomson Cable Modem TCM410
  16069. Fingerprint Motorola (SB5100/CG4500E) or Thomson (TCM390/TCM410) Cable Modem
  16070. Class Motorola | VxWorks || broadband router
  16071. TSeq(Class=64K%IPID=I%TS=U)
  16072. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  16073. T2(Resp=N)
  16074. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  16075. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16076. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16077. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16078. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16079. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  16080.  
  16081. # Motorola SurfBoard 4401 provided by adelphia
  16082. Fingerprint Motorola SurfBoard 4401 cable modem
  16083. Class Motorola | VxWorks || broadband router
  16084. TSeq(Class=64K%IPID=I%TS=U)
  16085. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  16086. T2(Resp=N)
  16087. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  16088. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  16089. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16090. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16091. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16092. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F|0%ULEN=134%DAT=E)
  16093.  
  16094. # VxWorks Version: 5.3; Software Version: SB4100E-4.1.11-SCM05-NOSHELL; Hardware Version: 3
  16095. Fingerprint Motorola SurfBoard SB4100E Cable Modem
  16096. Class Motorola | VxWorks || broadband router
  16097. TSeq(Class=64K%IPID=I%TS=U)
  16098. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  16099. T2(Resp=N)
  16100. T3(Resp=N)
  16101. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  16102. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16103. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16104. T7(Resp=N)
  16105. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16106.  
  16107. # Motorola Surfboard SB5100 running Software version SB5100-2.3.1.6-SCM01-NOSH
  16108. Fingerprint Motorola Surfboard SB5100 cable modem
  16109. Class Motorola | VxWorks || broadband router
  16110. TSeq(Class=RI%gcd=<6%SI=<FCB886&>286BF%IPID=I%TS=U)
  16111. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  16112. T2(Resp=N)
  16113. T3(Resp=Y%DF=N|Y%W=16D0%ACK=S++|O%Flags=AS|A%Ops=MNW|)
  16114. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16115. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16116. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16117. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16118. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  16119.  
  16120. # Motorola SURFboard SBG1000-0.1.3.0-SCM05-NOSH
  16121. Fingerprint Motorola SURFboard SBG1000 Broadband router
  16122. Class Motorola | VxWorks || broadband router
  16123. TSeq(Class=64K%IPID=I%TS=U)
  16124. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
  16125. T2(Resp=N)
  16126. T3(Resp=N)
  16127. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  16128. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16129. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16130. T7(Resp=N)
  16131. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16132.  
  16133. Fingerprint MultiTech standalone firewall box, version 3
  16134. Class MultiTech | embedded || firewall
  16135. TSeq(Class=TD%gcd=<714%SI=<14)
  16136. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  16137. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16138. T3(Resp=Y%DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  16139. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16140. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16141. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16142. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16143.  
  16144. Fingerprint MultiTech MultiVoIP Version 2.01A Firmware
  16145. Class MultiTech | embedded || telecom-misc
  16146. TSeq(Class=TD%gcd=<714%SI=<14)
  16147. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  16148. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16149. T3(Resp=N)
  16150. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16151. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16152. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16153. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16154. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16155.  
  16156. Fingerprint MultiTech CommPlete (modem server) RAScard
  16157. Class MultiTech | embedded || terminal server
  16158. TSeq(Class=TD%gcd=388|710|A98%SI=<44)
  16159. T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M)
  16160. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16161. T3(Resp=N)
  16162. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16163. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16164. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16165. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16166. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16167.  
  16168. Fingerprint MultiTech CommPlete Controller (terminal server)
  16169. Class MultiTech | embedded || terminal server
  16170. TSeq(Class=TR|RI%gcd=<6%SI=>FFFF)
  16171. T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
  16172. T2(Resp=N)
  16173. T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
  16174. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16175. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16176. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16177. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16178. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  16179.  
  16180. # Multi-Tech Voice over IP Box. Model number (MultiVoip 2410)
  16181. Fingerprint MultiTech MultiVoip 2410
  16182. Class MultiTech | embedded || VoIP gateway
  16183. TSeq(Class=TD%gcd=<1F502%SI=<1E%TS=U)
  16184. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  16185. T2(Resp=Y%DF=N%W=400|800%ACK=S%Flags=AR%Ops=WNMETL)
  16186. T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
  16187. T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  16188. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16189. T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  16190. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  16191. PU(Resp=N)
  16192.  
  16193. Fingerprint NAT LANB/290 router Console Program V4.00
  16194. Class NAT | embedded || router
  16195. TSeq(Class=TD%gcd=<80004%SI=<14)
  16196. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  16197. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16198. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
  16199. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16200. T5(Resp=N)
  16201. T6(Resp=N)
  16202. T7(Resp=N)
  16203. PU(Resp=N)
  16204.  
  16205. # NCD X server (SNMP says: NCD16 server 2.3.0 03/12/91 downloaded)
  16206. Fingerprint NCD X server (NCD16 server 2.3.0 03/12/91)
  16207. Class NCD | embedded || X terminal
  16208. TSeq(Class=64K)
  16209. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
  16210. T2(Resp=N)
  16211. T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
  16212. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  16213. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16214. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16215. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16216. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16217.  
  16218. Fingerprint NCR MP-RAS 3.0.x
  16219. Class NCR | BSD-misc || general purpose
  16220. TSeq(Class=64K)
  16221. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  16222. T2(Resp=N)
  16223. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
  16224. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16225. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16226. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16227. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  16228. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16229.  
  16230. Fingerprint NCR MP-RAS 3.01
  16231. Class NCR | BSD-misc || general purpose
  16232. TSeq(Class=i800)
  16233. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  16234. T2(Resp=N)
  16235. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
  16236. T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
  16237. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16238. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16239. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  16240. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16241.  
  16242. Fingerprint NCR S26 server (i386) running NCR MP-RAS SVR4 UNIX System
  16243. Class NCR | BSD-misc || general purpose
  16244. TSeq(Class=RI%gcd=<6%SI=<2BB718&>6FD5)
  16245. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  16246. T2(Resp=N)
  16247. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
  16248. T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
  16249. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16250. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16251. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  16252. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16253.  
  16254. Fingerprint NCR server running MP-RAS SVR4 UNIX System Version 3
  16255. Class NCR | BSD-misc || general purpose
  16256. TSeq(Class=RI%gcd=<6%SI=<31BA1E&>7F38)
  16257. T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  16258. T2(Resp=N)
  16259. T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
  16260. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  16261. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16262. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16263. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16264. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16265.  
  16266. Fingerprint NEC UX/4800
  16267. Class NEC | UX/4800 || general purpose
  16268. TSeq(Class=64K)
  16269. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  16270. T2(Resp=N)
  16271. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  16272. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16273. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16274. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16275. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16276. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  16277.  
  16278. # Necomm NB1300 ADSL Ethernet Modem/Router
  16279. Fingerprint Necomm NB1300 DSL router
  16280. Class Necomm | embedded || broadband router
  16281. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16282. T2(Resp=N)
  16283. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  16284. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16285. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16286. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16287. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16288. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  16289.  
  16290. # Host information:  @WorkStation (i960 based) X-terminal
  16291. # Neoware (was HDS) NetOS V. 2.0.1
  16292. # Hewlett-Packard Entria Model C3230A Server Version B.05.30
  16293. # Cisco 11151/Arrowpoint 150 Load Balancer
  16294. Fingerprint Cisco 11151/Arrowpoint 150 load balancer, Neoware (was HDS) NetOS V. 2.0.1 or HP Entria C3230A
  16295. Class Neoware | NetOS || X terminal
  16296. Class HP | embedded || X terminal
  16297. Class Cisco | embedded || load balancer
  16298. TSeq(Class=64K)
  16299. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=|M)
  16300. T2(Resp=N)
  16301. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  16302. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16303. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16304. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16305. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16306. PU(Resp=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16307.  
  16308. Fingerprint NetApp Data ONTAP 3.1.6 or BSDi 1.1
  16309. Class NetApp | Data ONTAP || fileserver
  16310. TSeq(Class=64K)
  16311. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  16312. T2(Resp=N)
  16313. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  16314. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  16315. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16316. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16317. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16318. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16319.  
  16320. Fingerprint NetApp Data ONTAP 5.1.2 - 5.3.5r2
  16321. Class NetApp | Data ONTAP || fileserver
  16322. TSeq(Class=RI%gcd=<6%SI=>BBB)
  16323. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16324. T2(Resp=N)
  16325. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  16326. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16327. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16328. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16329. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16330. PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E)
  16331.  
  16332. Fingerprint NetApp Data ONTAP 6.1.2R3 on an F840 filer
  16333. Class NetApp | Data ONTAP || fileserver
  16334. TSeq(Class=RI%gcd=<6%SI=<83FEA&>B28%IPID=BI%TS=2HZ)
  16335. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16336. T2(Resp=N)
  16337. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  16338. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16339. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16340. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16341. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16342. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  16343.  
  16344. # NetApp Data ONTAP Release 6.3.1: Wed Nov 20 13:03:17 PST 2002
  16345. Fingerprint NetApp Data ONTAP Release 6.3.1
  16346. Class NetApp | Data ONTAP || fileserver
  16347. TSeq(Class=RI%gcd=<6%SI=<44A20&>AE7%IPID=BI%TS=100HZ)
  16348. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16349. T2(Resp=N)
  16350. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  16351. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16352. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16353. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16354. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16355. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  16356.  
  16357. Fingerprint NetApp F360 or F760 Filer
  16358. Class NetApp | Data ONTAP || fileserver
  16359. TSeq(Class=RI%gcd=<6%SI=<7CA10&>CA2%IPID=BI%TS=2HZ)
  16360. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16361. T2(Resp=N)
  16362. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  16363. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16364. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16365. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16366. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16367. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  16368.  
  16369. # NetApp Release 6.5.2R1: Wed Sep  8 17:00:29 PDT 2004
  16370. # NetApp Filer F820 running Ontap Release 6.5.2R1
  16371. # NetApp NetCache 5.6
  16372. # Network Appliance DataOnTap v6.5.2 "NetApp Release 6.5.2: Sun Jul 25 10:56:02 PDT 2004"
  16373. # NetApp NetCache Release 5.6.2
  16374. # NetCache OS 6.0.1
  16375. Fingerprint NetApp Filer (Data OnTap 6.5.2) or NetCache (NetApp 5.6 - 6.0.1)
  16376. Class NetApp | Data ONTAP || fileserver
  16377. Class NetApp | embedded || web proxy
  16378. TSeq(Class=TR%gcd=<6%IPID=BI%TS=100HZ)
  16379. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16380. T2(Resp=N)
  16381. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16382. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16383. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16384. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16385. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16386. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16387.  
  16388. Fingerprint NetApp ONTAP Release 6.3.3
  16389. Class NetApp | Data ONTAP || fileserver
  16390. TSeq(Class=RI%gcd=<6%SI=<7128C&>B45%IPID=BI%TS=100HZ)
  16391. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16392. T2(Resp=N)
  16393. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  16394. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16395. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16396. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16397. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16398. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  16399.  
  16400. Fingerprint Network Appliance Filer running Data ONTAP Release 6.4.3
  16401. Class NetApp | Data ONTAP || fileserver
  16402. TSeq(Class=RI%gcd=<6%SI=<93792&>969%IPID=RPI|RD%TS=100HZ)
  16403. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16404. T2(Resp=N)
  16405. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16406. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16407. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16408. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16409. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16410. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16411.  
  16412. # NetCache 5.1D4 on a NetApp C1100 Box
  16413. Fingerprint NetApp NetCache C1100 (NetApp 5.1D4)
  16414. Class NetApp | embedded || web proxy
  16415. TSeq(Class=RI%gcd=<6%SI=<ABC02&>1371%IPID=BI%TS=2HZ)
  16416. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
  16417. T2(Resp=N)
  16418. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  16419. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16420. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16421. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16422. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16423. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  16424.  
  16425. # Network Appliance NetCache C1100 (NetApp 5.0)
  16426. Fingerprint NetApp NetCache C1100 with NetAppliance 5.0
  16427. Class NetApp | embedded || web proxy
  16428. TSeq(Class=RI%gcd=<6%SI=<93D5A&>95A%IPID=BI%TS=2HZ)
  16429. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16430. T2(Resp=N)
  16431. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  16432. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16433. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16434. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16435. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16436. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  16437.  
  16438. Fingerprint NetApp NetCache C6100 (NetApp 5.5)
  16439. Class NetApp | embedded || web proxy
  16440. TSeq(Class=RI%gcd=<6%SI=<2642EC&>3974%IPID=BI%TS=100HZ)
  16441. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16442. T2(Resp=N)
  16443. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16444. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16445. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16446. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16447. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16448. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  16449.  
  16450. Fingerprint NetApp NetCache C760 os 4.x
  16451. Class NetApp | embedded || web proxy
  16452. TSeq(Class=RI%gcd=<6%SI=<4E51740&>FAA%IPID=I%TS=2HZ)
  16453. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16454. T2(Resp=N)
  16455. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  16456. T4(DF=N%W=5000%ACK=O%Flags=R%Ops=)
  16457. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16458. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16459. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16460. PU(Resp=N)
  16461.  
  16462. Fingerprint NetApp NetCache running OS 5.4R2
  16463. Class NetApp | embedded || web proxy
  16464. TSeq(Class=RI%gcd=<6%SI=<22AD62&>1619%IPID=BI%TS=100HZ)
  16465. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16466. T2(Resp=N)
  16467. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16468. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16469. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16470. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16471. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16472. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16473.  
  16474. Fingerprint NetBSD 1.0 big endian arch
  16475. Class NetBSD | NetBSD || general purpose
  16476. TSeq(Class=64K)
  16477. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  16478. T2(Resp=N)
  16479. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
  16480. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  16481. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16482. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16483. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16484. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16485.  
  16486. # Notes on NetBSD (written by Charles M. Hannum <root@ihack.net>):
  16487. # * The set of options in a SYN-ACK depends on the state of the
  16488. #   `net.inet.tcp.rfc1323' flag.
  16489. # * Releases prior to 1.3 did not randomize the ISS at all.
  16490. # * Releases prior to 1.3 incorrectly added the IP header length to the IP
  16491. #   packet length when returning an ICMP unreachable.
  16492. # * Releases prior to 1.3 calculated the window size slightly wrong.
  16493. # * Releases prior to 1.3 returned a non-zero window size when sending a RST
  16494. #   in response to an ACK on a listening socket (thereby making them
  16495. #   susceptible to stealth scanning).
  16496. # * Releases prior to 1.3H/1.3.4 did not return a response to the null flag
  16497. #   test (thereby making them susceptible to stealth scanning).
  16498. # * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in
  16499. #   the encapsulated IP header when sending an ICMP reply.  On little endian
  16500. #   machines the IP ID field was byte-swapped.  The checksums were always
  16501. #   zeroed.
  16502. # * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when
  16503. #   MTU discovery was enabled.
  16504. Fingerprint NetBSD 1.0 i386
  16505. Class NetBSD | NetBSD || general purpose
  16506. TSeq(Class=64K%IPID=I%TS=2HZ)
  16507. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  16508. T2(Resp=N)
  16509. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
  16510. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  16511. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16512. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16513. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16514. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  16515.  
  16516. Fingerprint NetBSD 1.0 little endian arch
  16517. Class NetBSD | NetBSD || general purpose
  16518. TSeq(Class=64K)
  16519. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  16520. T2(Resp=N)
  16521. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
  16522. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  16523. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16524. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16525. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16526. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16527.  
  16528. Fingerprint NetBSD 1.1 - 1.2.1 litle endian arch
  16529. Class NetBSD | NetBSD || general purpose
  16530. TSeq(Class=64K)
  16531. T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16532. T2(Resp=N)
  16533. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16534. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  16535. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16536. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16537. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16538. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16539.  
  16540. Fingerprint NetBSD 1.2 - 1.2.1 big endian arch
  16541. Class NetBSD | NetBSD || general purpose
  16542. TSeq(Class=64K)
  16543. T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16544. T2(Resp=N)
  16545. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16546. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  16547. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16548. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16549. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16550. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16551.  
  16552. Fingerprint NetBSD 1.3 - 1.3.3 big endian arch
  16553. Class NetBSD | NetBSD || general purpose
  16554. TSeq(Class=RI%gcd=<6%SI=>18000)
  16555. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16556. T2(Resp=N)
  16557. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16558. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16559. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16560. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16561. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16562. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16563.  
  16564. Fingerprint NetBSD 1.3 - 1.3.3 little endian arch
  16565. Class NetBSD | NetBSD || general purpose
  16566. TSeq(Class=RI%gcd=<6%SI=>18000)
  16567. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16568. T2(Resp=N)
  16569. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16570. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16571. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16572. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16573. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16574. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16575.  
  16576. Fingerprint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch
  16577. Class NetBSD | NetBSD || general purpose
  16578. TSeq(Class=RI%gcd=<6%SI=>18000)
  16579. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16580. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16581. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16582. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16583. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16584. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16585. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16586. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16587.  
  16588. Fingerprint NetBSD 1.3H-1.5  big endian arch
  16589. Class NetBSD | NetBSD || general purpose
  16590. TSeq(Class=RI%gcd=<6%SI=>18000)
  16591. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16592. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16593. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16594. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16595. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16596. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16597. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16598. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16599.  
  16600. # NetBSD 1.3I (after 19990119)
  16601. # NetBSD 1.4 x86
  16602. # NetBSD 1.6L/Alpha
  16603. # NetBSD 1.6 NetBSD 1.6 (GENERIC) #0 Sun Sep 8 2002 i386
  16604. Fingerprint NetBSD 1.3I through 1.6
  16605. Class NetBSD | NetBSD || general purpose
  16606. TSeq(Class=RI%gcd=<6%SI=>18000)
  16607. T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16608. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16609. T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  16610. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16611. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16612. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16613. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16614. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16615.  
  16616. Fingerprint NetBSD 1.5.2 running on a Commodore Amiga (68040 processor)
  16617. Class NetBSD | NetBSD || general purpose
  16618. TSeq(Class=RI%gcd=<6%SI=<7AAB142&>874A7%IPID=I%TS=2HZ)
  16619. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16620. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16621. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16622. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16623. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16624. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16625. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16626. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16627.  
  16628. Fingerprint NetBSD 1.5_ALPHA i386
  16629. Class NetBSD | NetBSD || general purpose
  16630. TSeq(Class=RI%gcd=<6%SI=<5CF5F1C&>EDF97)
  16631. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16632. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16633. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16634. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16635. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16636. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16637. T7(Resp=N)
  16638. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16639.  
  16640. Fingerprint NetBSD 1.6
  16641. Class NetBSD | NetBSD || general purpose
  16642. TSeq(Class=RI%gcd=<8%SI=<601F422&>60539%IPID=I)
  16643. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16644. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16645. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16646. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16647. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16648. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16649. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16650. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  16651.  
  16652. Fingerprint NetBSD 1.6 - 1.6.1 (Alpha)
  16653. Class NetBSD | NetBSD || general purpose
  16654. TSeq(Class=RI|TR%gcd=<6%SI=<656F846%IPID=I)
  16655. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16656. T2(Resp=N)
  16657. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16658. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16659. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16660. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16661. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16662. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16663.  
  16664. Fingerprint NetBSD 1.6 BETA 4 i386 (20020630 snapshot)
  16665. Class NetBSD | NetBSD || general purpose
  16666. TSeq(Class=RI%gcd=<6%SI=<76BC4C8&>A6C26%IPID=I)
  16667. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16668. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16669. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16670. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16671. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16672. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16673. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16674. PU(DF=N%TOS=0%IPLEN=38%RIPTL=4801%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  16675.  
  16676. Fingerprint NetBSD 1.6.2 (alpha)
  16677. Class NetBSD | NetBSD || general purpose
  16678. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16679. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16680. T3(Resp=N)
  16681. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16682. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16683. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16684. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16685. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16686.  
  16687. # 1262
  16688. # NetBSD 1.6.2 (GENERIC) #0: Wed Feb 11 08:05:11 UTC 2004 sparc
  16689. Fingerprint NetBSD 1.6.2 (X86)
  16690. Class NetBSD | NetBSD || general purpose
  16691. T1(DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  16692. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16693. T3(Resp=Y%DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  16694. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16695. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16696. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16697. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16698. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16699.  
  16700. # NetBSD 1.6.2 on X86
  16701. # Avocent Switchview net KVM switch - this is a embedded device that makes a regular KVM accessible over IP.
  16702. # NetBSD 2.0_BETA i386
  16703. Fingerprint NetBSD 1.6.2 - 2.0_BETA or Avocent Switchview net KVM switch
  16704. Class NetBSD | NetBSD || general purpose
  16705. Class Avocent | embedded || specialized
  16706. TSeq(Class=RI%gcd=<6%SI=<7679164&>F13C6%IPID=I)
  16707. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  16708. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16709. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  16710. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16711. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16712. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16713. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16714. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16715.  
  16716. Fingerprint NetBSD 1.6ZC (SPARC)
  16717. Class NetBSD | NetBSD || general purpose
  16718. TSeq(Class=RI%gcd=<6%SI=<67F4F30&>941F1%IPID=RD)
  16719. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16720. T2(Resp=N)
  16721. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16722. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16723. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16724. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16725. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16726. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  16727.  
  16728. Fingerprint NetBSD 1.6ZD
  16729. Class NetBSD | NetBSD || general purpose
  16730. TSeq(Class=RI%gcd=<8%SI=<7C2EB86&>76383%IPID=RD)
  16731. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16732. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16733. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16734. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16735. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16736. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16737. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16738. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16739.  
  16740. # netbsd 1.6ZH GENERIC
  16741. # NetBSD 1.6ZK NetBSD 1.6ZK #1: Thu Feb 19 18:05:56 EST 2004
  16742. # NetBSD 2.0
  16743. # NetBSD alpha1 2.0_RC4
  16744. # NetBSD 2.0.1
  16745. # NetBSD 2.0.2 (GENERIC_LAPTOP) #0: Wed Mar 23 08:59:09 UTC 2005 i386
  16746. # NetBSD 2.0.2 i386
  16747. # NetBSD 2.0.2 on sparc64
  16748. Fingerprint NetBSD 1.6ZH or 2.0 - 2.0.2
  16749. Class NetBSD | NetBSD || general purpose
  16750. TSeq(Class=RI%gcd=<6%SI=<714D5B4&>50BA4%IPID=I)
  16751. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16752. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16753. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16754. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16755. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16756. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16757. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16758. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16759.  
  16760. # NetBSD 2.0 (GENERIC) i386
  16761. Fingerprint NetBSD 2.0
  16762. Class NetBSD | NetBSD || general purpose
  16763. TSeq(Class=RI%gcd=<6%SI=<71C334A&>9705A%IPID=I%TS=U)
  16764. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  16765. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16766. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  16767. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16768. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16769. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16770. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16771. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16772.  
  16773. # NetBSD 2.0 (GENERIC) IP Filter: v4.1.3 (396) Dsl Router x86
  16774. Fingerprint NetBSD 2.0
  16775. Class NetBSD | NetBSD || general purpose
  16776. TSeq(Class=RI%gcd=<6%SI=<73607AC&>AC1A6%IPID=RD)
  16777. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  16778. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16779. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  16780. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16781. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16782. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16783. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16784. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16785.  
  16786. Fingerprint NetBSD/Alpha 1.5.2 on a DEC 000/300 LX
  16787. Class NetBSD | NetBSD || general purpose
  16788. TSeq(Class=RI%gcd=<6%SI=<736B300&>106DED%IPID=I%TS=2HZ)
  16789. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16790. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16791. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16792. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16793. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16794. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16795. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16796. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  16797.  
  16798. Fingerprint Netburner Model 5282 Embedded Ethernet Microcontroller
  16799. Class Netburner | embedded || specialized
  16800. TSeq(Class=RI|TD%gcd=<6%SI=<45498%IPID=I%TS=U)
  16801. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=MNNNL)
  16802. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  16803. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=MNNNL)
  16804. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16805. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16806. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16807. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16808. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16809.  
  16810. # Netgear DG824M Wireless (WAP) & 4-Port ADSL Router  - Version 1.4 Release 05
  16811. Fingerprint Netgear DG824M WAP
  16812. Class Netgear | embedded || broadband router
  16813. TSeq(Class=TD%gcd=<104%SI=<14%IPID=I%TS=U)
  16814. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  16815. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16816. T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  16817. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16818. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16819. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16820. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16821. PU(Resp=N)
  16822.  
  16823. # NETGEAR FVL238 Firmware Version  Version 1.5 Release 09
  16824. Fingerprint Netgear FVL238 vpn/firewall/router
  16825. Class Netgear | embedded || broadband router
  16826. TSeq(Class=RI%gcd=<6%SI=<2E7205A&>76E53%IPID=I%TS=U)
  16827. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  16828. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16829. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  16830. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16831. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16832. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16833. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16834. PU(Resp=N)
  16835.  
  16836. Fingerprint Netgear FVL328 vpn/firewall/router
  16837. Class Netgear | embedded || broadband router
  16838. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  16839. T2(Resp=N)
  16840. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  16841. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16842. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16843. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16844. T7(Resp=N)
  16845. PU(Resp=N)
  16846.  
  16847. Fingerprint Netgear WGR614 Wireless router
  16848. Class Netgear | embedded || broadband router
  16849. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  16850. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  16851. T2(Resp=N)
  16852. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  16853. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16854. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16855. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16856. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16857. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  16858.  
  16859. # Netgear FM114P ProSafe Wireless Firewall with Print Server
  16860. # netgear wgr614 v4 Wireless router
  16861. # REPOTEC IP515H Cable Router / Print Server
  16862. Fingerprint Netgear Wireless router or Netgear FM114P/REPOTEC IP515H Router & Print Server
  16863. Class Netgear | embedded || broadband router
  16864. TSeq(Class=TD%gcd=<404%SI=<1E%IPID=I%TS=U)
  16865. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  16866. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16867. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  16868. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16869. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16870. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16871. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16872. PU(Resp=N)
  16873.  
  16874. # Netgear PS101 print server with firmware 6026
  16875. Fingerprint Netgear PS101 Print Server
  16876. Class Netgear | embedded || print server
  16877. T1(DF=N%W=5B4%ACK=S++%Flags=APS%Ops=M)
  16878. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16879. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  16880. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16881. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16882. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16883. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16884. PU(Resp=N)
  16885.  
  16886. # Netgear Printer Server PS110 firmware version: 6017
  16887. Fingerprint Netgear PS110 Print Server
  16888. Class Netgear | embedded || print server
  16889. TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
  16890. T1(DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M)
  16891. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16892. T3(Resp=Y%DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M)
  16893. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16894. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16895. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16896. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16897. PU(Resp=N)
  16898.  
  16899. Fingerprint Netgear GS724T Gigabit Smart Switch
  16900. Class Netgear | embedded || switch
  16901. TSeq(Class=TD%gcd=<18%SI=<14%IPID=I%TS=U)
  16902. T1(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  16903. T2(Resp=Y%DF=Y%W=800|1000%ACK=S++%Flags=AR%Ops=)
  16904. T3(Resp=Y%DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=)
  16905. T4(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
  16906. T5(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=)
  16907. T6(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
  16908. T7(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
  16909. PU(Resp=N)
  16910.  
  16911. Fingerprint NetJet Version 3.0 - 4.0 Printer
  16912. Class NetJet | embedded || printer
  16913. TSeq(Class=TD%gcd=<4%SI=<4)
  16914. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  16915. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16916. T3(Resp=Y%DF=N%W=0|800%ACK=S++%Flags=AR%Ops=|M)
  16917. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16918. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16919. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16920. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16921. PU(Resp=N)
  16922.  
  16923. # IPAD Model 5000 (see www.ipad-canada.com)
  16924. # eSoft IPAD, v.1.52 -- 64 line option on i86 hardware
  16925. Fingerprint IPAD (Internet Protocol Adapter) Model 5000 or V.1.52
  16926. Class NetMatrix | embedded || general purpose
  16927. TSeq(Class=TD|RI%gcd=1000|2000|3000%SI=<444)
  16928. T1(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  16929. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16930. T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  16931. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16932. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16933. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16934. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16935. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16936.  
  16937. Fingerprint Broadband Router (Farralon Netopia or Compatible Systems 900i)
  16938. Class Netopia | embedded || broadband router
  16939. Class Compatible Systems | embedded || router
  16940. TSeq(Class=TD%gcd=388|710|A98%SI=<F)
  16941. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16942. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16943. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16944. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16945. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16946. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16947. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16948. PU(Resp=N)
  16949.  
  16950. # Netopia 4541 ADSL router v5.3.4
  16951. # Netopia R7100 SDSL router
  16952. Fingerprint Netopia 4541/R7100 DSL router
  16953. Class Netopia | embedded || broadband router
  16954. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  16955. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16956. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16957. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16958. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16959. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16960. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16961. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16962. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16963.  
  16964. # Netopia Cayman 3341-ENT firmware v8.3.1r0
  16965. Fingerprint Netopia Cayman 3341-ENT ADSL Router
  16966. Class Netopia | embedded || broadband router
  16967. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  16968. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16969. T2(Resp=N)
  16970. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16971. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16972. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16973. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16974. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16975. PU(Resp=N)
  16976.  
  16977. Fingerprint Netopia DSL router
  16978. Class Netopia | embedded || broadband router
  16979. TSeq(Class=TR)
  16980. T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  16981. T2(Resp=N)
  16982. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  16983. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16984. T5(Resp=N)
  16985. T6(Resp=N)
  16986. T7(Resp=N)
  16987. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16988.  
  16989. # Netopia R3100-I DSL Router Firmware version v4.7.2
  16990. # Netopia 7100-C with firmware v4.6.3
  16991. Fingerprint Netopia DSL Router
  16992. Class Netopia | embedded || broadband router
  16993. TSeq(Class=TD%gcd=<EA64%SI=<10E%IPID=I%TS=U)
  16994. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16995. T2(Resp=N)
  16996. T3(Resp=N)
  16997. T4(Resp=N)
  16998. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16999. T6(Resp=N)
  17000. T7(Resp=N)
  17001. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17002.  
  17003. # Netopia R7100-C v4.11
  17004. # Netopia R5300 router; firmware v4.11
  17005. # Netopia R9171 v4.10
  17006. # Netopia R910 v8.2r1
  17007. Fingerprint Netopia DSL router
  17008. Class Netopia | embedded || broadband router
  17009. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  17010. T1(DF=N%W=400|2260%ACK=S++%Flags=AS%Ops=M)
  17011. T2(Resp=N)
  17012. T3(Resp=N)
  17013. T4(Resp=N)
  17014. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17015. T6(Resp=N)
  17016. T7(Resp=N)
  17017. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  17018.  
  17019. # Netopia R5300 Router; firmware v4.6
  17020. Fingerprint Netopia R5300 Router
  17021. Class Netopia | embedded || broadband router
  17022. TSeq(Class=TD%gcd=<D6DC%SI=<1E%IPID=I%TS=U)
  17023. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  17024. T2(Resp=N)
  17025. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  17026. T4(Resp=N)
  17027. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17028. T6(Resp=N)
  17029. T7(Resp=N)
  17030. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  17031.  
  17032. # Netopia R9100 v4.8.2
  17033. Fingerprint Netopia R9100 DSL Router
  17034. Class Netopia | embedded || broadband router
  17035. TSeq(Class=TD%gcd=<FDEC%SI=<1E%IPID=I%TS=U)
  17036. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  17037. T2(Resp=N)
  17038. T3(Resp=N)
  17039. T4(Resp=N)
  17040. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17041. T6(Resp=N)
  17042. T7(Resp=N)
  17043. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  17044.  
  17045. # Netopia Cayman 3341 DSL router
  17046. # Radware Web Server Director NP with SynApps v8.10.02
  17047. # Cayman Model 3347W Wireless DSL Ethernet Switch
  17048. # Netopia Cayman 3347W DSL Modem and NAT Router
  17049. Fingerprint Netopia Cayman 334x router/WAP or Radware Web Server Director load balancer
  17050. Class Netopia | embedded || WAP
  17051. Class Radware | embedded || load balancer
  17052. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  17053. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  17054. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17055. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  17056. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17057. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17058. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17059. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17060. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17061.  
  17062. Fingerprint Netscreen 5GT Plus running ScreenOS 4.0.0r5.3
  17063. Class NetScreen | ScreenOS || firewall
  17064. TSeq(Class=TR%gcd=<6%TS=U)
  17065. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17066. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  17067. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  17068. T4(Resp=N)
  17069. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17070. T6(Resp=N)
  17071. T7(Resp=N)
  17072. PU(Resp=N)
  17073.  
  17074. Fingerprint Netscreen 5XP firewall+vpn (OS 3.0.1r2)
  17075. Class Netscreen | ScreenOS || firewall
  17076. TSeq(Class=TD%gcd=1000%SI=<FF)
  17077. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17078. T2(Resp=N)
  17079. T3(Resp=N)
  17080. T4(Resp=N)
  17081. T5(Resp=N)
  17082. T6(Resp=N)
  17083. T7(Resp=N)
  17084. PU(Resp=N)
  17085.  
  17086. Fingerprint Netscreen 5XP firewall+vpn (os 4.0.3r2.0)
  17087. Class Netscreen | ScreenOS || firewall
  17088. TSeq(Class=TR%gcd=<6)
  17089. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17090. T2(Resp=N)
  17091. T3(Resp=N)
  17092. T4(Resp=N)
  17093. T5(Resp=N)
  17094. T6(Resp=N)
  17095. T7(Resp=N)
  17096. PU(Resp=N)
  17097.  
  17098. # NetScreen NS-204 Firewall (Version: 5.2.0r1.0)
  17099. Fingerprint NetScreen NS-204 Firewall
  17100. Class NetScreen | ScreenOS || firewall
  17101. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  17102. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  17103. T2(Resp=N)
  17104. T3(Resp=N)
  17105. T4(Resp=N)
  17106. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17107. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  17108. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17109. PU(Resp=N)
  17110.  
  17111. Fingerprint NetScreen-100
  17112. Class NetScreen | ScreenOS || firewall
  17113. TSeq(Class=RI%gcd=<6%SI=<276A&>50)
  17114. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  17115. T2(Resp=N)
  17116. T3(Resp=N)
  17117. T4(Resp=N)
  17118. T5(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  17119. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  17120. T7(Resp=N)
  17121. PU(Resp=N)
  17122.  
  17123. Fingerprint NetSilicon NetARM running ThreadX 2.0
  17124. Class NetSilicon | ThreadX || specialized
  17125. TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
  17126. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17127. T2(Resp=N)
  17128. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  17129. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  17130. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17131. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17132. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17133. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17134.  
  17135. Fingerprint Network Systems router NS6614 (NSC 6600 series)
  17136. Class Network Systems | embedded || router
  17137. TSeq(Class=64K)
  17138. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  17139. T2(Resp=N)
  17140. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  17141. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  17142. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17143. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  17144. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17145. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  17146.  
  17147. # Nexland ISB Pro800 Turbo, Firmware version: V1 Rel 5U
  17148. Fingerprint Nexland ISB Pro800 Turbo Cable/DSL router
  17149. Class Nexland | embedded || broadband router
  17150. TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I)
  17151. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  17152. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17153. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  17154. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17155. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17156. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17157. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17158. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17159.  
  17160. # A NeXT Turbo, unknown version number
  17161. Fingerprint NeXT Mach
  17162. Class NeXT | Mach || general purpose
  17163. TSeq(Class=64K)
  17164. T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  17165. T2(Resp=N)
  17166. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  17167. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  17168. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17169. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  17170. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17171. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  17172.  
  17173. Fingerprint NeXTStep/OpenStep 4.2/Intel
  17174. Class NeXT | NeXTStep || general purpose
  17175. TSeq(Class=64K)
  17176. T1(Resp=Y%DF=N%W=F87%ACK=S++|O%Flags=AS%Ops=M)
  17177. T2(Resp=N)
  17178. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  17179. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  17180. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17181. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  17182. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17183. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  17184.  
  17185. Fingerprint OpenStep 4.0-4.2 or NeXTStep 1.0-3.3 (Intel)
  17186. Class NeXT | NeXTStep || general purpose
  17187. TSeq(Class=64K)
  17188. T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  17189. T2(Resp=N)
  17190. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  17191. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  17192. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17193. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  17194. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17195. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  17196.  
  17197. Fingerprint OpenStep 4.1/NeXTStep 3.3
  17198. Class NeXT | NeXTStep || general purpose
  17199. TSeq(Class=64K)
  17200. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  17201. T2(Resp=N)
  17202. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  17203. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  17204. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17205. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17206. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17207. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  17208.  
  17209. Fingerprint NIB 450-E printer network interface
  17210. Class NIB | embedded || printer
  17211. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  17212. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17213. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  17214. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17215. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17216. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17217. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17218. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17219.  
  17220. # Nokia M1122 DSL Router (Nokia Mrouter rel-Gx1x2220.R08)
  17221. Fingerprint Nokia M1122 DSL Router
  17222. Class Nokia | embedded || broadband router
  17223. TSeq(Class=RI%gcd=<6%SI=<1AF18&>43B%IPID=I)
  17224. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  17225. T2(Resp=N)
  17226. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  17227. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17228. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17229. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17230. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17231. PU(Resp=N)
  17232.  
  17233. Fingerprint Nokia Rooftop Wireless Router model R240A
  17234. Class Nokia | embedded || router
  17235. T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME)
  17236. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17237. T3(Resp=Y%DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME)
  17238. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17239. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17240. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17241. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17242. PU(DF=N%TOS=0%IPLEN=40%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  17243.  
  17244. Fingerprint Nokia IP530 Network Appliance (IPSO 3.4-3.4.2)
  17245. Class Nokia | IPSO || firewall
  17246. TSeq(Class=RI%gcd=<8%SI=<85DD6&>987%IPID=I%TS=2HZ)
  17247. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  17248. T2(Resp=N)
  17249. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  17250. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17251. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17252. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17253. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17254. PU(DF=Y%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  17255.  
  17256. # Nokia IPSO 3.7-BUILD026 x86
  17257. Fingerprint Nokia IPSO 3.7 running CheckPoint FW-1
  17258. Class Nokia | IPSO || firewall
  17259. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  17260. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  17261. T2(Resp=N)
  17262. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  17263. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17264. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17265. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17266. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17267. PU(DF=N%TOS=0|E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  17268.  
  17269. # Nokia IPSO 3.8 Build039 (IPSO 3.8-BUILD039 releng 1404 07.23.2004-193500+i386)
  17270. # Nokia IPSO 3.8.1-BUILD028 releng 1518  12.02.2004-222502 i386
  17271. Fingerprint Nokia IPSO 3.8.x
  17272. Class Nokia | IPSO || firewall
  17273. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  17274. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  17275. T2(Resp=N)
  17276. T3(Resp=N)
  17277. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17278. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17279. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17280. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17281. PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  17282.  
  17283. # Symbian OS 6.1 on Nokia N-Gage v 4.03
  17284. Fingerprint Symbian OS 6.1 on Nokia N-Gage v 4.03 phone
  17285. Class Nokia | Symbian || phone
  17286. TSeq(Class=64K%IPID=I%TS=U)
  17287. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  17288. T2(Resp=N)
  17289. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  17290. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  17291. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17292. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17293. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17294. PU(Resp=N)
  17295.  
  17296. # Nortel Networks BayStack 450-24T Versions: HW:RevL  FW:V1.48 SW:v4.2.0.16 ISVN:2
  17297. Fingerprint Nortel Networks BayStack switch
  17298. Class Nortel | embedded || switch
  17299. TSeq(Class=RI%gcd=<6%SI=<762A&>C8%IPID=I%TS=U)
  17300. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  17301. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17302. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  17303. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17304. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17305. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17306. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17307. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17308.  
  17309. # Nortel Networks Passport 1100 (version 2.0.7.2)
  17310. Fingerprint Nortel Networks Passport 1100 switch
  17311. Class Nortel | embedded || switch
  17312. TSeq(Class=64K%IPID=I%TS=U)
  17313. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  17314. T2(Resp=N)
  17315. T3(Resp=N)
  17316. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  17317. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17318. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17319. T7(Resp=N)
  17320. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  17321.  
  17322. Fingerprint Nortel Networks Passport 8600 routing switch sw 3.3.0.0
  17323. Class Nortel | embedded || switch
  17324. TSeq(Class=RI%gcd=<6%SI=<E1C8A&>113A%IPID=I%TS=U)
  17325. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17326. T2(Resp=N)
  17327. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  17328. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  17329. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17330. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17331. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17332. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  17333.  
  17334. # Nortel CallPilot 100 voicemail system
  17335. # 3Com superstack 3 4300 (3c17100) Hardware Version: V4.0 Software Version:  V1.12
  17336. # Cisco 1538M Micro Hub running latest firmware
  17337. # HP TopTools Remote Control Card
  17338. # Enterasys VH2402 Switch Firmware 2.05.02 
  17339. # NTT East VoIP gateway of some sort (  http://www.ntt-east.co.jp/ced/goods/voip/index.html )
  17340. Fingerprint Nortel CallPilot 100 voicemail system, 3Com Superstack 3 switch, Enterasys switch, HP TopTools remote control card, or Cisco 1538M hub
  17341. Class Nortel | embedded || telecom-misc
  17342. Class NTT | embedded || telecom-misc
  17343. Class 3Com | embedded || switch
  17344. Class Cisco | embedded || hub
  17345. Class Enterasys | embedded || switch
  17346. Class HP | embedded || remote management
  17347. TSeq(Class=64K%IPID=I%TS=U)
  17348. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17349. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17350. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  17351. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17352. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17353. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17354. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17355.  
  17356. # Northern Telecom Supernode - Nortel Micronode telephone switch running OS version GSM15
  17357. Fingerprint Nortel Micronode telephone switch running OS version GSM15
  17358. Class Nortel | embedded || telecom-misc
  17359. TSeq(Class=TD%gcd=<120004%SI=<14%IPID=Z%TS=U)
  17360. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17361. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17362. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17363. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17364. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17365. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17366. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17367. PU(Resp=N)
  17368.  
  17369. # Nortel Passport 4400 Series - Release 4.0.3
  17370. Fingerprint Nortel Passport 4400 Series multiservice access switch
  17371. Class Nortel | embedded || telecom-misc
  17372. TSeq(Class=64K%IPID=I%TS=U)
  17373. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17374. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17375. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17376. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17377. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17378. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17379. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17380. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17381.  
  17382. Fingerprint Nortel Networks CVX1800 RAS. Software version 2.02
  17383. Class Nortel | embedded || terminal server
  17384. TSeq(Class=64K%gcd=<6%SI=<14)
  17385. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  17386. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17387. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  17388. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17389. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17390. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17391. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17392. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17393.  
  17394. Fingerprint Novell NetWare 3.12 - 5.00
  17395. Class Novell | NetWare | 3.X | general purpose
  17396. Class Novell | NetWare | 4.X | general purpose
  17397. Class Novell | NetWare | 5.X | general purpose
  17398. TSeq(Class=TD%gcd=10|20|30|40%SI=<64)
  17399. T1(DF=Y|N%W=7D0|8000|2000|1FFF|7FFF|8000|FFFF%ACK=S++%Flags=AS%Ops=M|ME)
  17400. T2(Resp=N)
  17401. T3(Resp=Y%DF=Y|N%W=7D0|8000|2000|1FFE|7FFF|8000|FFFF%ACK=O|S++%Flags=AS|ASF%Ops=M|ME)
  17402. T4(Resp=N)
  17403. T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  17404. T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
  17405. T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  17406. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17407.  
  17408. Fingerprint Novell NetWare 3.12 or 386 TCP/IP
  17409. Class Novell | NetWare | 3.X | general purpose
  17410. TSeq(Class=TD%gcd=<6B4A%SI=<1E)
  17411. T1(DF=N%W=73F|F87|3F25%ACK=S++%Flags=AS%Ops=ME)
  17412. T2(Resp=N)
  17413. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS|ASF%Ops=ME)
  17414. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17415. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17416. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17417. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17418. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17419.  
  17420. Fingerprint NetWare 4.11 SP7- 5 SP3A BorderManager 3.5
  17421. Class Novell | NetWare | 4.X | general purpose
  17422. TSeq(Class=RI%gcd=<6%SI=<1843D74&>3E1D0)
  17423. T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
  17424. T2(Resp=N)
  17425. T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
  17426. T4(Resp=N)
  17427. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17428. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17429. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17430. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  17431.  
  17432. Fingerprint NetWare 4.11 SP8a - NetWare 5 SP4
  17433. Class Novell | NetWare | 4.X | general purpose
  17434. TSeq(Class=RI%gcd=<6%SI=<2DB195E&>74F88)
  17435. T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
  17436. T2(Resp=N)
  17437. T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
  17438. T4(Resp=N)
  17439. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17440. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17441. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17442. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17443.  
  17444. Fingerprint novell netware 4.11
  17445. Class Novell | NetWare | 4.X | general purpose
  17446. TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U)
  17447. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MWN)
  17448. T2(Resp=N)
  17449. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17450. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17451. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17452. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17453. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17454. PU(Resp=N)
  17455.  
  17456. Fingerprint Novell NetWare 4.11-5.0SP5
  17457. Class Novell | NetWare | 4.X | general purpose
  17458. Class Novell | NetWare | 5.X | general purpose
  17459. TSeq(Class=RI%gcd=<6%SI=<2B302C0&>6E8E8)
  17460. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  17461. T2(Resp=N)
  17462. T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
  17463. T4(Resp=N)
  17464. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17465. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17466. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17467. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17468.  
  17469. Fingerprint NetWare 5.0 SP 3a
  17470. Class Novell | NetWare | 5.X | general purpose
  17471. TSeq(Class=RI%gcd=<8%SI=<5641338&>DCCE9)
  17472. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  17473. T2(Resp=N)
  17474. T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
  17475. T4(Resp=N)
  17476. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17477. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17478. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17479. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17480.  
  17481. Fingerprint NetWare 5.1 SP3
  17482. Class Novell | NetWare | 5.X | general purpose
  17483. TSeq(Class=RI%gcd=<6%SI=<2385886&>53F65%IPID=RPI|BI|RD%TS=U)
  17484. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  17485. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17486. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17487. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17488. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17489. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17490. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17491. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17492.  
  17493. Fingerprint Novell NetWare 5.0 with Border Manager
  17494. Class Novell | NetWare | 5.X | general purpose
  17495. TSeq(Class=RI%gcd=<5%SI=>BBBBB)
  17496. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  17497. T2(Resp=N)
  17498. T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
  17499. T4(Resp=N)
  17500. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17501. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17502. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17503. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  17504.  
  17505. # Novell NetWare 5 Support Pack Revision 06 Server Version 5.00.09
  17506. Fingerprint Novell NetWare 5.00.09 SP06
  17507. Class Novell | NetWare | 5.X | general purpose
  17508. TSeq(Class=RI%gcd=<6%SI=<1EDA0D4&>2F197%IPID=I%TS=U)
  17509. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  17510. T2(Resp=N)
  17511. T3(Resp=Y%DF=Y%W=FFF%ACK=O%Flags=AS%Ops=M)
  17512. T4(Resp=N)
  17513. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17514. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17515. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17516. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17517.  
  17518. # Novell NetWare 5.1 SP5 with Groupwise
  17519. Fingerprint Novell NetWare 5.1 SP5
  17520. Class Novell | NetWare | 5.X | general purpose
  17521. TSeq(Class=RI%gcd=<6%SI=<2378ABE&>57780%IPID=BI%TS=U)
  17522. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M|MEWN)
  17523. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17524. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  17525. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17526. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17527. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17528. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17529. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17530.  
  17531. Fingerprint Novell NetWare 5.1 SP5 with Groupwise
  17532. Class Novell | NetWare | 5.X | general purpose
  17533. TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U)
  17534. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17535. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17536. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  17537. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17538. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17539. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17540. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17541. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17542.  
  17543. # Novell NetWare 5.1 SP8
  17544. # Novell NetWare 6.5 SP3
  17545. # Novell Open Enterprise Server, NetWare 6.5 Support Pack Revision 03
  17546. # Novell NetWare Open Enterprise Server (OES) (English, First Customer Shipping version) installed with everything on it, X86
  17547. Fingerprint Novell NetWare 5.1 SP8 or 6.5 SP3
  17548. Class Novell | NetWare | 5.X | general purpose
  17549. Class Novell | NetWare | 6.X | general purpose
  17550. TSeq(Class=TR%gcd=<6%IPID=BI|RPI%TS=U)
  17551. T1(DF=N|Y%W=17FF%ACK=S++%Flags=AS%Ops=MEWN)
  17552. T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  17553. T3(Resp=Y%DF=N|Y%W=0%ACK=O%Flags=AR%Ops=)
  17554. T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  17555. T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
  17556. T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  17557. T7(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
  17558. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17559.  
  17560. Fingerprint Novell NetWare 5.1-6.0
  17561. Class Novell | NetWare | 5.X | general purpose
  17562. Class Novell | NetWare | 6.X | general purpose
  17563. TSeq(Class=RI%gcd=<6%SI=<2883446&>599C6%IPID=RD|RPI%TS=U)
  17564. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17565. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17566. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17567. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17568. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17569. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17570. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17571. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17572.  
  17573. Fingerprint Novell NetWare 5.1SP4 - 6.0
  17574. Class Novell | NetWare | 5.X | general purpose
  17575. Class Novell | NetWare | 6.X | general purpose
  17576. TSeq(Class=RI%gcd=<6%SI=<253064A&>5F32F%IPID=BI%TS=U)
  17577. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17578. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17579. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17580. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17581. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17582. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17583. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17584. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17585.  
  17586. Fingerprint Novell NetWare 5.1SP5 - 6.5
  17587. Class Novell | NetWare | 5.X | general purpose
  17588. Class Novell | NetWare | 6.X | general purpose
  17589. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  17590. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17591. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17592. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17593. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17594. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17595. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17596. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17597. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17598.  
  17599. Fingerprint Novell NetWare 5.x
  17600. Class Novell | NetWare | 5.X | general purpose
  17601. TSeq(Class=RI%gcd=<8%SI=<286248A&>1B465%IPID=I%TS=U)
  17602. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  17603. T2(Resp=N)
  17604. T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
  17605. T4(Resp=N)
  17606. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17607. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17608. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17609. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  17610.  
  17611. # NetWare 6.5 SP2 (running on a Compaq Proliant ML370)
  17612. Fingerprint NetWare 6.5 SP2
  17613. Class Novell | NetWare | 6.X | general purpose
  17614. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  17615. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17616. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17617. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17618. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17619. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17620. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17621. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17622. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  17623.  
  17624. Fingerprint Novell Netware 6 (no service packs)
  17625. Class Novell | NetWare | 6.X | general purpose
  17626. TSeq(Class=RI%gcd=<6%SI=<3B034FE&>24038%IPID=BI%TS=U)
  17627. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17628. T2(Resp=N)
  17629. T3(Resp=N)
  17630. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17631. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17632. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17633. T7(Resp=N)
  17634. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17635.  
  17636. Fingerprint Novell NetWare 6 SP1
  17637. Class Novell | NetWare | 6.X | general purpose
  17638. TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=U)
  17639. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17640. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17641. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17642. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17643. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17644. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17645. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17646. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17647.  
  17648. # Novell NetWare 6 SP2 running BM3.7 (with no service packs)
  17649. Fingerprint Novell NetWare 6 SP2
  17650. Class Novell | NetWare | 6.X | general purpose
  17651. TSeq(Class=RI%gcd=<6%SI=<30102C2&>766BA%IPID=BI%TS=U)
  17652. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17653. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17654. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17655. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17656. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17657. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17658. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17659. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17660.  
  17661. Fingerprint Novell NetWare 6.0 SP3
  17662. Class Novell | NetWare | 6.X | general purpose
  17663. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  17664. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17665. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17666. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17667. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17668. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17669. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17670. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17671. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  17672.  
  17673. Fingerprint Novell Netware 6.0 SP4
  17674. Class Novell | NetWare | 6.X | general purpose
  17675. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  17676. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  17677. T2(Resp=N)
  17678. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17679. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17680. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17681. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17682. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17683. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17684.  
  17685. Fingerprint Novell Netware 6.5 SP2
  17686. Class Novell | NetWare | 6.X | general purpose
  17687. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  17688. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MWN)
  17689. T2(Resp=N)
  17690. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  17691. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17692. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17693. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17694. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17695. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  17696.  
  17697. # NSG 500 router. OS version 7.6.1 (http://www.nsg.ru)
  17698. # NSG-520/Network Systems Group, running Version 7.6.1
  17699. # NX-300/3wl/1e1/Network Systems Group running Version 7.6.3
  17700. Fingerprint NSG-300/500 series router running Version 7.6.x
  17701. Class NSG | embedded || router
  17702. TSeq(Class=TD%gcd=<50004%SI=<3C%IPID=I%TS=U)
  17703. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17704. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17705. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  17706. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  17707. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17708. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  17709. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17710. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17711.  
  17712. # OkiData 20nx printer with OkiLAN 6100e TCP/IP Ethernet module
  17713. Fingerprint OkiData 20nx printer with OkiLAN ethernet module
  17714. Class Okidata | embedded || printer
  17715. TSeq(Class=C%IPID=I%TS=U)
  17716. T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  17717. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17718. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17719. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17720. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17721. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17722. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17723. PU(Resp=N)
  17724.  
  17725. Fingerprint Okidata 7200 Printer
  17726. Class Okidata | embedded || printer
  17727. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  17728. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17729. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17730. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17731. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17732. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17733. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17734. PU(Resp=N)
  17735.  
  17736. Fingerprint Okidata OKI C5100 Laser Printer
  17737. Class Okidata | embedded || printer
  17738. T1(DF=N%W=C00%ACK=S++%Flags=AS|AR%Ops=M||MNW)
  17739. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  17740. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  17741. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  17742. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17743. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17744. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17745. PU(Resp=N)
  17746.  
  17747. Fingerprint Okidata OKI C7200 Printer
  17748. Class Okidata | embedded || printer
  17749. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17750. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17751. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17752. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17753. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17754. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17755. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17756. PU(Resp=N)
  17757.  
  17758. Fingerprint Open Network 501r or 531r (ADSL Router)
  17759. Class Open Networks | embedded || broadband router
  17760. TSeq(Class=TD%gcd=<2C%SI=<1E%IPID=I%TS=U)
  17761. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  17762. T2(Resp=N)
  17763. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  17764. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17765. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17766. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17767. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17768. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17769.  
  17770. Fingerprint OpenBSD 2.7/SPARC or NFR IDS Appliance ( 12/10/00 )
  17771. Class OpenBSD | OpenBSD | 2.7 | general purpose
  17772. TSeq(Class=RI%gcd=<6%SI=<8FC28&>16EC)
  17773. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17774. T2(Resp=N)
  17775. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17776. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17777. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17778. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17779. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17780. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  17781.  
  17782. Fingerprint OpenBSD 2.1 - 2.3/SPARC
  17783. Class OpenBSD | OpenBSD | 2.X | general purpose
  17784. TSeq(Class=RI%gcd=<6%SI=>FF)
  17785. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  17786. T2(Resp=N)
  17787. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  17788. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17789. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17790. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17791. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17792. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  17793.  
  17794. # This fingerprint had LAND patch installed
  17795. Fingerprint OpenBSD 2.1/x86
  17796. Class OpenBSD | OpenBSD | 2.X | general purpose
  17797. TSeq(Class=RI%gcd=<6%SI=>BBB)
  17798. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  17799. T2(Resp=N)
  17800. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  17801. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17802. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17803. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17804. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17805. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  17806.  
  17807. Fingerprint OpenBSD 2.2 - 2.3
  17808. Class OpenBSD | OpenBSD | 2.X | general purpose
  17809. TSeq(Class=RI%gcd=<6)
  17810. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  17811. T2(Resp=N)
  17812. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  17813. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17814. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17815. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17816. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17817. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  17818.  
  17819. Fingerprint OpenBSD 2.6 with all available patches as of roughly Feb01
  17820. Class OpenBSD | OpenBSD | 2.X | general purpose
  17821. TSeq(Class=RI%gcd=<6%SI=<4C22A&>C1A)
  17822. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  17823. T2(Resp=N)
  17824. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  17825. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17826. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17827. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17828. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17829. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F|E%UCK=F|E%ULEN=134%DAT=E)
  17830.  
  17831. # With more info provided by Theo De Raadt
  17832. # OpenBSD 2.6
  17833. Fingerprint OpenBSD 2.6-2.8
  17834. Class OpenBSD | OpenBSD | 2.X | general purpose
  17835. TSeq(Class=RI%gcd=<6%SI=<1869F6&>3E6B)
  17836. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17837. T2(Resp=N)
  17838. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17839. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17840. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17841. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17842. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17843. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134|3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17844.  
  17845. Fingerprint OpenBSD 2.6-2.8
  17846. Class OpenBSD | OpenBSD | 2.X | general purpose
  17847. TSeq(Class=RI%gcd=<6%SI=<AD084&>1B9B)
  17848. T1(DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  17849. T2(Resp=N)
  17850. T3(Resp=Y%DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  17851. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  17852. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17853. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17854. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17855. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17856.  
  17857. Fingerprint OpenBSD 2.8 (x86)
  17858. Class OpenBSD | OpenBSD | 2.X | general purpose
  17859. TSeq(Class=TD|RI%gcd=<6%SI=<A8C&>1%IPID=RPI|BI%TS=U)
  17860. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  17861. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17862. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  17863. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17864. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17865. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17866. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17867. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17868.  
  17869. Fingerprint OpenBSD 2.9-beta through release (x86)
  17870. Class OpenBSD | OpenBSD | 2.X | general purpose
  17871. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  17872. T1(DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17873. T2(Resp=N)
  17874. T3(Resp=Y%DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17875. T4(DF=Y|N%W=4000%ACK=O%Flags=R%Ops=)
  17876. T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  17877. T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
  17878. T7(DF=Y|N%W=0%ACK=S%Flags=AR%Ops=)
  17879. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  17880.  
  17881. Fingerprint OpenBSD 2.9-stable
  17882. Class OpenBSD | OpenBSD | 2.X | general purpose
  17883. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  17884. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
  17885. T2(Resp=N)
  17886. T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
  17887. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  17888. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17889. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17890. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17891. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17892.  
  17893. Fingerprint OpenBSD Post 2.4 (November 1998) - 2.5
  17894. Class OpenBSD | OpenBSD | 2.X | general purpose
  17895. TSeq(Class=RI%gcd=<6%SI=>FFF&<BBBBB)
  17896. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17897. T2(Resp=N)
  17898. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17899. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17900. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17901. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17902. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17903. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17904.  
  17905. # OpenBSD 3.0 (x86 or SPARC)
  17906. # OpenBSD 3.3 (hppa)
  17907. # OpenBSD 3.3 (GENERIC) i386
  17908. Fingerprint OpenBSD 3.0 or 3.3
  17909. Class OpenBSD | OpenBSD | 3.X | general purpose
  17910. TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=2HZ)
  17911. T1(DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  17912. T2(Resp=N)
  17913. T3(Resp=Y%DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  17914. T4(DF=Y%W=4000|FFFF%ACK=O%Flags=R%Ops=)
  17915. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17916. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17917. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17918. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  17919.  
  17920. Fingerprint OpenBSD 3.0 SPARC with pf "scrub in all"
  17921. Class OpenBSD | OpenBSD | 3.X | general purpose
  17922. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U|2HZ)
  17923. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17924. T2(Resp=N)
  17925. T3(Resp=N)
  17926. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  17927. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17928. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17929. T7(Resp=N)
  17930. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  17931.  
  17932. Fingerprint OpenBSD 3.0-STABLE (x86)
  17933. Class OpenBSD | OpenBSD | 3.X | general purpose
  17934. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  17935. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17936. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  17937. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17938. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  17939. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17940. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  17941. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  17942. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  17943.  
  17944. Fingerprint OpenBSD 3.1 (x86)
  17945. Class OpenBSD | OpenBSD | 3.X | general purpose
  17946. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  17947. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17948. T2(Resp=N)
  17949. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17950. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  17951. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17952. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17953. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17954. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  17955.  
  17956. Fingerprint OpenBSD 3.1 (x86)
  17957. Class OpenBSD | OpenBSD | 3.X | general purpose
  17958. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17959. T2(Resp=N)
  17960. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  17961. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  17962. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17963. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17964. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17965. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  17966.  
  17967. Fingerprint OpenBSD 3.1 on an Alpha
  17968. Class OpenBSD | OpenBSD | 3.X | general purpose
  17969. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  17970. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  17971. T2(Resp=N)
  17972. T3(Resp=N)
  17973. T4(DF=Y%W=FFFF%ACK=O%Flags=R%Ops=)
  17974. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17975. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17976. T7(Resp=N)
  17977. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  17978.  
  17979. Fingerprint OpenBSD 3.2 (x86)
  17980. Class OpenBSD | OpenBSD | 3.X | general purpose
  17981. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  17982. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  17983. T2(Resp=N)
  17984. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  17985. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  17986. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  17987. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  17988. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  17989. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  17990.  
  17991. Fingerprint OpenBSD 3.2 with pf scrub and no-df
  17992. Class OpenBSD | OpenBSD | 3.X | general purpose
  17993. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  17994. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  17995. T2(Resp=N)
  17996. T3(Resp=N)
  17997. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  17998. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17999. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18000. T7(Resp=N)
  18001. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  18002.  
  18003. Fingerprint OpenBSD 3.3
  18004. Class OpenBSD | OpenBSD | 3.X | general purpose
  18005. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18006. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18007. T2(Resp=N)
  18008. T3(Resp=N)
  18009. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  18010. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18011. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18012. T7(Resp=N)
  18013. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  18014.  
  18015. Fingerprint OpenBSD 3.3 x86 with pf "scrub in all"
  18016. Class OpenBSD | OpenBSD | 3.X | general purpose
  18017. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18018. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18019. T2(Resp=N)
  18020. T3(Resp=N)
  18021. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  18022. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18023. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18024. T7(Resp=N)
  18025. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  18026.  
  18027. Fingerprint OpenBSD 3.3 x86 with pf "scrub in all"
  18028. Class OpenBSD | OpenBSD | 3.X | general purpose
  18029. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18030. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18031. T2(Resp=N)
  18032. T3(Resp=N)
  18033. T4(DF=Y%W=0|4000%ACK=O%Flags=R%Ops=)
  18034. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18035. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18036. T7(Resp=N)
  18037. PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  18038.  
  18039. # OpenBSD 3.4 GENERIC#18 i386
  18040. Fingerprint OpenBSD 3.4
  18041. Class OpenBSD | OpenBSD | 3.X | general purpose
  18042. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18043. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18044. T2(Resp=N)
  18045. T3(Resp=N)
  18046. T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18047. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18048. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18049. T7(Resp=N)
  18050. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18051.  
  18052. # OpenBSD 3.4 GENERIC#18 i386
  18053. Fingerprint OpenBSD 3.4 (X86)
  18054. Class OpenBSD | OpenBSD | 3.X | general purpose
  18055. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18056. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18057. T2(Resp=N)
  18058. T3(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18059. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  18060. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18061. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18062. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18063. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  18064.  
  18065. Fingerprint OpenBSD 3.4 x86
  18066. Class OpenBSD | OpenBSD | 3.X | general purpose
  18067. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18068. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18069. T2(Resp=N)
  18070. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18071. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  18072. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18073. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18074. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18075. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  18076.  
  18077. # OpenBSD 3.4, custom kernel, pf firewall enabled
  18078. Fingerprint OpenBSD 3.4 x86 with pf "scrub in all"
  18079. Class OpenBSD | OpenBSD | 3.X | general purpose
  18080. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18081. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18082. T2(Resp=N)
  18083. T3(Resp=N)
  18084. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  18085. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18086. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18087. T7(Resp=N)
  18088. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=E%ULEN=134%DAT=E)
  18089.  
  18090. Fingerprint OpenBSD 3.4 x86 with pf "scrub in all"
  18091. Class OpenBSD | OpenBSD | 3.X | general purpose
  18092. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18093. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18094. T2(Resp=N)
  18095. T3(Resp=N)
  18096. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  18097. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18098. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18099. T7(Resp=N)
  18100. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18101.  
  18102. Fingerprint OpenBSD 3.4-BETA
  18103. Class OpenBSD | OpenBSD | 3.X | general purpose
  18104. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18105. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18106. T2(Resp=N)
  18107. T3(Resp=N)
  18108. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  18109. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18110. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18111. T7(Resp=N)
  18112. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  18113.  
  18114. # OpenBSD 3.5 (GENERIC#34 i386)
  18115. # OpenBSD 3.5 GENERIC#34 i386
  18116. # OpenBSD 3.6 GENERIC#59 i386
  18117. # OpenBSD 3.5 GENERIC#20 mac68k
  18118. # OpenBSD 3.6 GENERIC#203 sparc
  18119. # OpenBSD 3.6-stable on SPARC
  18120. # OpenBSD 3.6 GENERIC#304 sparc64
  18121. # OpenBSD 3.7 GENERIC#50 i386
  18122. Fingerprint OpenBSD 3.5 - 3.9
  18123. Class OpenBSD | OpenBSD | 3.X | general purpose
  18124. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18125. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18126. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18127. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18128. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18129. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18130. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18131. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18132. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18133.  
  18134. # OpenBSD 3.5 GENERIC#34 i386
  18135. # Fingerprint OpenBSD 3.5 (SPARC)
  18136. # OpenBSD 3.6 GENERIC#59 i386
  18137. Fingerprint OpenBSD 3.5 or 3.6
  18138. Class OpenBSD | OpenBSD | 3.X | general purpose
  18139. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18140. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18141. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18142. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18143. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18144. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18145. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18146. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18147. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18148.  
  18149. # Open BSD 3.6 on Soekris net 4801
  18150. # Openbsd 3.6 SPARC Generic#203
  18151. # OpenBSD 3.6 i386, default kernel
  18152. Fingerprint OpenBSD 3.5 or 3.6
  18153. Class OpenBSD | OpenBSD | 3.X | general purpose
  18154. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18155. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18156. T2(Resp=N)
  18157. T3(Resp=N)
  18158. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18159. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18160. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18161. T7(Resp=N)
  18162. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18163.  
  18164. # OpenBSD 3.6 GENERIC#1 i386
  18165. # OpenBSD 3.5 GENERIC#72 amd64
  18166. # OpenBSD 3.6 GENERIC#59 i386
  18167. Fingerprint OpenBSD 3.5 or 3.6
  18168. Class OpenBSD | OpenBSD | 3.X | general purpose
  18169. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18170. T1(DF=Y|N%W=4000%ACK=O|S++%Flags=AS%Ops=MNWNNT)
  18171. T2(Resp=N)
  18172. T3(Resp=N)
  18173. T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18174. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18175. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18176. T7(Resp=N)
  18177. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18178.  
  18179. # OpenBSD convex.tohveli.net 3.6 GENERIC#3 i386, applied binpatches #1 to #10
  18180. Fingerprint OpenBSD 3.6
  18181. Class OpenBSD | OpenBSD | 3.X | general purpose
  18182. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18183. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18184. T2(Resp=N)
  18185. T3(Resp=N)
  18186. T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18187. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18188. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18189. T7(Resp=N)
  18190. PU(DF=N%TOS=20|38%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18191.  
  18192. # OpenBSD 3.6 GENERIC.MP#173 i386
  18193. Fingerprint OpenBSD 3.6
  18194. Class OpenBSD | OpenBSD | 3.X | general purpose
  18195. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18196. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18197. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18198. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18199. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18200. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18201. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18202. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18203. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  18204.  
  18205. # OpenBSD 3.6 i386
  18206. Fingerprint OpenBSD 3.6
  18207. Class OpenBSD | OpenBSD | 3.X | general purpose
  18208. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18209. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  18210. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18211. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  18212. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18213. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18214. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18215. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18216. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18217.  
  18218. # OpenBSD 3.6 on a Sparc 20
  18219. Fingerprint OpenBSD 3.6
  18220. Class OpenBSD | OpenBSD | 3.X | general purpose
  18221. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18222. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18223. T2(Resp=N)
  18224. T3(Resp=N)
  18225. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18226. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18227. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18228. T7(Resp=N)
  18229. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18230.  
  18231. # OpenBSD 3.6-current i386 AMD-K6(tm) 3D processor ("AuthenticAMD" 586-class)
  18232. Fingerprint OpenBSD 3.6
  18233. Class OpenBSD | OpenBSD | 3.X | general purpose
  18234. TSeq(Class=TR%gcd=<6%IPID=RD)
  18235. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18236. T2(Resp=N)
  18237. T3(Resp=N)
  18238. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18239. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18240. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18241. T7(Resp=N)
  18242. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18243.  
  18244. # OpenBSD 3.6 GENERIC i386
  18245. Fingerprint OpenBSD 3.6
  18246. Class OpenBSD | OpenBSD | 3.X | general purpose
  18247. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18248. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18249. T2(Resp=N)
  18250. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18251. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18252. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18253. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  18254. T7(Resp=N)
  18255. PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  18256.  
  18257. Fingerprint OpenBSD 3.6 (i386)
  18258. Class OpenBSD | OpenBSD | 3.X | general purpose
  18259. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  18260. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18261. T2(Resp=N)
  18262. T3(Resp=N)
  18263. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18264. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18265. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18266. T7(Resp=N)
  18267. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18268.  
  18269. # OpenBSD fwall.xxx.xx 3.6 GENERIC#42 i386
  18270. Fingerprint OpenBSD 3.6 x86 with pf "scrub in all"
  18271. Class OpenBSD | OpenBSD | 3.X | general purpose
  18272. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18273. T2(Resp=N)
  18274. T3(Resp=N)
  18275. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18276. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18277. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18278. T7(Resp=N)
  18279. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18280.  
  18281. Fingerprint OpenBSD 3.7
  18282. Class OpenBSD | OpenBSD | 3.X | general purpose
  18283. TSeq(Class=TR%gcd=<6%IPID=RD)
  18284. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18285. T2(Resp=N)
  18286. T3(Resp=N)
  18287. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18288. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18289. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  18290. T7(Resp=N)
  18291. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  18292.  
  18293. Fingerprint Pace digital cable TV receiver
  18294. Class Pace | embedded || media device
  18295. TSeq(Class=RI%gcd=<6%SI=<2C3AB3E&>62A0A%IPID=Z%TS=100HZ)
  18296. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  18297. T2(Resp=N)
  18298. T3(Resp=N)
  18299. T4(Resp=N)
  18300. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  18301. T6(Resp=N)
  18302. T7(Resp=N)
  18303. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18304.  
  18305. Fingerprint Packet Engines PowerRail 5200 router version 2.6.0r10 - 16 Sep, 1999
  18306. Class Packet Engines | embedded || router
  18307. TSeq(Class=64K)
  18308. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  18309. T2(Resp=N)
  18310. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  18311. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  18312. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18313. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18314. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18315. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18316.  
  18317. # Packet8 BPA410 Broadband Phone Adapter
  18318. Fingerprint Packet8 BPA410 Broadband Phone Adapter
  18319. Class Packet8 | embedded || VoIP adapter
  18320. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  18321. T1(DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  18322. T2(Resp=N)
  18323. T3(Resp=N)
  18324. T4(DF=Y%W=578%ACK=O%Flags=R%Ops=)
  18325. T5(DF=Y%W=578%ACK=S++%Flags=AR%Ops=)
  18326. T6(DF=Y%W=578%ACK=O%Flags=R%Ops=)
  18327. T7(Resp=N)
  18328. PU(DF=Y%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  18329.  
  18330. Fingerprint Packet8 DTA310 VoIP/POTS gateway
  18331. Class Packet8 | embedded || VoIP adapter
  18332. TSeq(Class=TD%gcd=<200034%SI=<1E%TS=U)
  18333. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=)
  18334. T2(Resp=N)
  18335. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=)
  18336. T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
  18337. T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  18338. T6(DF=N%W=578%ACK=O%Flags=R%Ops=)
  18339. T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  18340. PU(DF=N%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  18341.  
  18342. # Packet8 DTA-310 (DTA version 1.0 US (8x8 001239))
  18343. # Packet 8 DTA310 broadband phone adapter
  18344. Fingerprint Packet8 DTA310 VoIP/POTS gateway
  18345. Class Packet8 | embedded || VoIP adapter
  18346. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  18347. T1(DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  18348. T2(Resp=N)
  18349. T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  18350. T4(DF=Y%W=578%ACK=O%Flags=R%Ops=)
  18351. T5(DF=Y%W=578%ACK=S++%Flags=AR%Ops=)
  18352. T6(DF=Y%W=578%ACK=O%Flags=R%Ops=)
  18353. T7(DF=Y%W=578%ACK=S++%Flags=AR%Ops=)
  18354. PU(DF=Y%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  18355.  
  18356. Fingerprint Packeteer PacketShaper 4000 v4.1.3b2 2000-04-05
  18357. Class Packeteer | pSOS || load balancer
  18358. TSeq(Class=64K)
  18359. T1(DF=N%W=430%ACK=S++%Flags=AS%Ops=)
  18360. T2(Resp=N)
  18361. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  18362. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  18363. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18364. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18365. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18366. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  18367.  
  18368. # Packeteer IP-PacketShaper 2000 V3.1
  18369. Fingerprint pSOS embedded IP stack, such as Packeteer IP-PacketShaper 2000 V3.1
  18370. Class Packeteer | pSOS || load balancer
  18371. TSeq(Class=64K)
  18372. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  18373. T2(Resp=N)
  18374. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  18375. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  18376. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18377. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  18378. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18379. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  18380.  
  18381. Fingerprint PalmOS 3.5.1 on m100 PDA
  18382. Class Palm | PalmOS | 3.X | PDA
  18383. TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U)
  18384. T1(DF=N%W=A78%ACK=S++%Flags=AS%Ops=M)
  18385. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18386. T3(Resp=Y%DF=N%W=A78%ACK=S++%Flags=AS%Ops=M)
  18387. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18388. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18389. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18390. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18391. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18392.  
  18393. Fingerprint Panasonic IP Technology Broadband Networking Gateway, KX-HGW200
  18394. Class Panasonic | embedded || broadband router
  18395. TSeq(Class=RI%gcd=<6%SI=<27BE484&>16928%IPID=Z%TS=100HZ)
  18396. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  18397. T2(Resp=N)
  18398. T3(Resp=N)
  18399. T4(Resp=N)
  18400. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18401. T6(Resp=N)
  18402. T7(Resp=N)
  18403. PU(Resp=N)
  18404.  
  18405. # (printer, scanner, copier, fax machine)
  18406. Fingerprint Panasonic DP-3520 multi-function printer
  18407. Class Panasonic | embedded || printer
  18408. TSeq(Class=TD%gcd=<E0%SI=<1E%IPID=I%TS=U)
  18409. T1(Resp=N)
  18410. T2(Resp=N)
  18411. T3(Resp=N)
  18412. T4(Resp=N)
  18413. T5(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
  18414. T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
  18415. T7(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
  18416. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18417.  
  18418. Fingerprint Panasonic panafax DX2000 SuperG3 fax machine
  18419. Class Panasonic | embedded || printer
  18420. TSeq(Class=TD|RI%gcd=<18%SI=<177A&>27)
  18421. T1(Resp=N)
  18422. T2(Resp=N)
  18423. T3(Resp=N)
  18424. T4(Resp=N)
  18425. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  18426. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  18427. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  18428. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18429.  
  18430. # Panasonic WJ-NT104 Network Interface Unit w/firmware version : V1.01G 010323A
  18431. Fingerprint Panasonic WJ-NT104 Network video device
  18432. Class Panasonic | embedded || webcam
  18433. TSeq(Class=RI%gcd=<6%SI=<3183A&>7C8%IPID=I%TS=U)
  18434. T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M)
  18435. T2(Resp=N)
  18436. T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=AS%Ops=M)
  18437. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18438. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18439. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18440. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18441. PU(Resp=N)
  18442.  
  18443. Fingerprint Parks Altavia 671R router
  18444. Class Parks | embedded || broadband router
  18445. TSeq(Class=TD%gcd=<F404%SI=<1E%IPID=I%TS=2HZ)
  18446. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18447. T2(Resp=N)
  18448. T3(Resp=Y%DF=N%W=403D%ACK=O%Flags=A%Ops=NNT)
  18449. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  18450. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18451. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18452. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18453. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  18454.  
  18455. # PCS Intus 3100 running TCL Version 5 with Firmware version 4.54
  18456. Fingerprint PCS Intus 3100 time management device
  18457. Class PCS | embedded || specialized
  18458. TSeq(Class=RI%gcd=<2004%SI=<1612&>21%IPID=I%TS=U)
  18459. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AS%Ops=M)
  18460. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  18461. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  18462. T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  18463. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  18464. T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  18465. T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  18466. PU(Resp=N)
  18467.  
  18468. Fingerprint Pelco Network Camera
  18469. Class Pelco | embedded || webcam
  18470. TSeq(Class=RI%gcd=<6%SI=<1000018&>28F48%IPID=I%TS=U)
  18471. T1(DF=N%W=B4%ACK=S++%Flags=AS%Ops=)
  18472. T2(Resp=Y%DF=N%W=B4%ACK=S%Flags=R%Ops=)
  18473. T3(Resp=Y%DF=N%W=B4%ACK=S++%Flags=AS%Ops=)
  18474. T4(DF=N%W=B4%ACK=S%Flags=R%Ops=)
  18475. T5(DF=N%W=B4%ACK=S++%Flags=R%Ops=)
  18476. T6(DF=N%W=B4%ACK=S%Flags=R%Ops=)
  18477. T7(DF=N%W=B4%ACK=S%Flags=R%Ops=)
  18478. PU(Resp=N)
  18479.  
  18480. # Perle 594e Network Controller
  18481. Fingerprint Perle 594e Network Controller
  18482. Class Perle | embedded || remote management
  18483. T1(DF=Y%W=C39%ACK=S++%Flags=AS%Ops=M)
  18484. T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  18485. T3(Resp=Y%DF=Y%W=C39%ACK=O%Flags=AS%Ops=M)
  18486. T4(DF=Y%W=100%ACK=O%Flags=R%Ops=)
  18487. T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=)
  18488. T6(DF=Y%W=100%ACK=O%Flags=R%Ops=)
  18489. T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  18490. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18491.  
  18492. Fingerprint Perle JetStream 8500 Serial/Access Server, v 2.6.0
  18493. Class Perle | embedded || terminal server
  18494. TSeq(Class=64K%IPID=I%TS=U)
  18495. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  18496. T2(Resp=N)
  18497. T3(Resp=Y%DF=N%W=7FC%ACK=O%Flags=A%Ops=)
  18498. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18499. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18500. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18501. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18502. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  18503.  
  18504. Fingerprint Phillips ReplayTV 5000 DVR
  18505. Class Phillips | embedded || media device
  18506. TSeq(Class=64K%IPID=I%TS=2HZ)
  18507. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18508. T2(Resp=N)
  18509. T3(Resp=N)
  18510. T4(Resp=N)
  18511. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18512. T6(Resp=N)
  18513. T7(Resp=N)
  18514. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  18515.  
  18516. Fingerprint Pigtail Express VoIP phone (runs VxWorks)
  18517. Class Pigtail | VxWorks || VoIP phone
  18518. TSeq(Class=64K%IPID=I%TS=U)
  18519. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  18520. T2(Resp=N)
  18521. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  18522. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  18523. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18524. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18525. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18526. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  18527.  
  18528. Fingerprint Pirelli Microbusiness ADSL router
  18529. Class Pirelli | embedded || broadband router
  18530. TSeq(Class=64K%IPID=I%TS=2HZ)
  18531. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  18532. T2(Resp=N)
  18533. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  18534. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  18535. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18536. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18537. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18538. PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  18539.  
  18540. # Pitney Bowes DL550 photocopier
  18541. #  Konica IP Controller Internal Print Server Module for Konica Multi-Purpose Printer/Fax/Scanner, Model KCA_018823
  18542. Fingerprint Pitney Bowes photocopier, Konica printer/fax/scanner, or Toshiba E-Studio16 printer
  18543. Class Pitney Bowes | embedded || printer
  18544. Class Konica | embedded || printer
  18545. Class Toshiba | embedded || printer
  18546. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  18547. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18548. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  18549. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18550. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18551. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18552. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18553. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18554.  
  18555. # switch planet-fgsw-2620vs http://www.planet.com.tw/news/productnews/FGSW-2620VS.htm
  18556. Fingerprint Planet FGSW-2620VS switch
  18557. Class Planet | embedded || switch
  18558. TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U)
  18559. T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  18560. T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  18561. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  18562. T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  18563. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  18564. T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  18565. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  18566. PU(Resp=N)
  18567.  
  18568. Fingerprint Planet WAP 1950 Wireless Access Point
  18569. Class Planet | embedded || WAP
  18570. TSeq(Class=TD%gcd=<1C%SI=<14%IPID=I%TS=U)
  18571. T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
  18572. T2(Resp=N)
  18573. T3(Resp=Y%DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
  18574. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18575. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18576. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18577. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18578. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18579.  
  18580. Fingerprint Polycom Video Conference node
  18581. Class Polycom | embedded || webcam
  18582. TSeq(Class=C%Val=8B6A000%IPID=I%TS=U)
  18583. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  18584. T2(Resp=N)
  18585. T3(Resp=N)
  18586. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18587. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18588. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18589. T7(Resp=N)
  18590. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18591.  
  18592. Fingerprint Polycom ViewStation
  18593. Class Polycom | embedded || webcam
  18594. TSeq(Class=C)
  18595. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  18596. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18597. T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  18598. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18599. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18600. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18601. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18602. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18603.  
  18604. Fingerprint Polycom ViewStation 512K videoconferencing system
  18605. Class Polycom | embedded || webcam
  18606. TSeq(Class=C)
  18607. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  18608. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18609. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  18610. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18611. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18612. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18613. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18614. PU(DF=N%TOS=0|80%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18615.  
  18616. Fingerprint PolyCom ViewStation video-conferencing system (firmware v7.2)
  18617. Class PolyCom | embedded || webcam
  18618. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  18619. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  18620. T2(Resp=N)
  18621. T3(Resp=N)
  18622. T4(Resp=N)
  18623. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18624. T6(Resp=N)
  18625. T7(Resp=N)
  18626. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  18627.  
  18628. Fingerprint PowerShow NetworKam webcam
  18629. Class PowerShow | embedded || webcam
  18630. TSeq(Class=TD%gcd=<194%SI=<14%IPID=I%TS=U)
  18631. T1(Resp=N)
  18632. T2(Resp=N)
  18633. T3(Resp=N)
  18634. T4(Resp=N)
  18635. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  18636. T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=)
  18637. T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=)
  18638. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18639.  
  18640. Fingerprint Proteon OpenRoute 3.0 gt series router
  18641. Class Proteon | OpenRoute || router
  18642. TSeq(Class=TD%gcd=1%SI=0)
  18643. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  18644. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18645. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18646. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  18647. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18648. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  18649. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18650. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18651.  
  18652. # Proxim Stratum MP FW: 7_8_18;  managed via HTTP and only relevant data is (I guess) the firmware version: FW: 7_8_18
  18653. Fingerprint Proxim Stratum MP Wireless bridge
  18654. Class Proxim | embedded || bridge
  18655. TSeq(Class=TD%gcd=<61AC%SI=<46%IPID=I%TS=1000HZ)
  18656. T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  18657. T2(Resp=N)
  18658. T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  18659. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18660. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18661. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18662. T7(Resp=N)
  18663. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  18664.  
  18665. # Proxim 8571 802.11a Access Point Software Version:  2.0-B11 : Aug 12 2002 11:08:16
  18666. Fingerprint Proxim 8571 802.11a Access Point
  18667. Class Proxim | embedded || WAP
  18668. TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
  18669. T1(DF=N%W=1770%ACK=S++%Flags=AS%Ops=M)
  18670. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18671. T3(Resp=Y%DF=N%W=1770%ACK=S++%Flags=AS%Ops=M)
  18672. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  18673. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18674. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  18675. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18676. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18677.  
  18678. Fingerprint QMS Magicolor 2200 DeskLaser printer
  18679. Class QMS | embedded || printer
  18680. T1(DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M)
  18681. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  18682. T3(Resp=Y%DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M)
  18683. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18684. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18685. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18686. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18687. PU(Resp=N)
  18688.  
  18689. Fingerprint QNX 4.24 - 4.25 realtime embedded OS
  18690. Class QNX | QNX || general purpose
  18691. TSeq(Class=64K)
  18692. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
  18693. T2(Resp=N)
  18694. T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
  18695. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  18696. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18697. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18698. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18699. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  18700.  
  18701. Fingerprint QNX 6.00 realtime embedded OS (x86)
  18702. Class QNX | QNX || general purpose
  18703. TSeq(Class=TD%gcd=<7D4%SI=<8C%IPID=I%TS=U)
  18704. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  18705. T2(Resp=N)
  18706. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  18707. T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  18708. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  18709. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  18710. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  18711. PU(Resp=N)
  18712.  
  18713. # QNX 6.00 2000/10/17-14:59:25edt x86pc x86
  18714. Fingerprint QNX 6.00 realtime embedded OS (x86)
  18715. Class QNX | QNX || general purpose
  18716. TSeq(Class=TD%gcd=<4AB54%SI=<82%IPID=I%TS=U)
  18717. T1(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
  18718. T2(Resp=N)
  18719. T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  18720. T4(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  18721. T5(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  18722. T6(DF=N%W=C00|1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
  18723. T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  18724. PU(Resp=N)
  18725.  
  18726. # Quanterra OS/9 V2.4 on 68K (Quanterra Q4124 - 68030)
  18727. Fingerprint Quanterra seismic data acquisition system running OS/9 V2.4 on 68K
  18728. Class Quanterra | OS/9 || specialized
  18729. TSeq(Class=i800)
  18730. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=)
  18731. T2(Resp=N)
  18732. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=)
  18733. T4(DF=N%W=C000%ACK=O%Flags=R%Ops=)
  18734. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18735. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18736. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18737. PU(Resp=N)
  18738.  
  18739. Fingerprint Quantum Snap server 4100
  18740. Class Quantum | embedded || storage-misc
  18741. TSeq(Class=i800%IPID=I%TS=U)
  18742. T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
  18743. T2(Resp=N)
  18744. T3(Resp=Y%DF=N%W=2238%ACK=O%Flags=A%Ops=)
  18745. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  18746. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18747. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18748. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18749. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  18750.  
  18751. Fingerprint Quantum Snap Server Network Storage Box
  18752. Class Quantum | embedded || storage-misc
  18753. TSeq(Class=i800)
  18754. T1(Resp=Y%DF=N%W=4470%ACK=S++%Flags=AS%Ops=M)
  18755. T2(Resp=N)
  18756. T3(Resp=Y%DF=N%W=4470%ACK=O%Flags=A%Ops=)
  18757. T4(Resp=Y%DF=N%W=4470%ACK=O%Flags=R%Ops=)
  18758. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18759. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  18760. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18761. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  18762.  
  18763. Fingerprint Racal 7100 Host Security Module 1.05 / 5.05
  18764. Class Racal | embedded || encryption accelerator
  18765. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  18766. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  18767. T2(Resp=N)
  18768. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  18769. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18770. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18771. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18772. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18773. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  18774.  
  18775. Fingerprint Radware Content Inspection Director v2.10.03
  18776. Class Radware | embedded || security-misc
  18777. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  18778. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  18779. T2(Resp=N)
  18780. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  18781. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18782. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18783. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18784. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18785. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  18786.  
  18787. Fingerprint Raptor firewall 5.03 on NT 4
  18788. Class Raptor | embedded || firewall
  18789. TSeq(Class=TR)
  18790. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  18791. T2(Resp=N)
  18792. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  18793. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18794. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18795. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18796. T7(Resp=N)
  18797. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18798.  
  18799. Fingerprint Raptor Firewall 6 on Solaris 2.6
  18800. Class Raptor | Solaris | 2.X | firewall
  18801. TSeq(Class=RI%gcd=<6%SI=<E5CB8&>24B0)
  18802. T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
  18803. T2(Resp=N)
  18804. T3(Resp=N)
  18805. T4(Resp=N)
  18806. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18807. T6(Resp=N)
  18808. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18809. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18810.  
  18811. Fingerprint Cisco 1538M HUB running Cisco 1538M EES (1.00.00) or Assured Access Technology ISAS Switch Release-2.3.0 or Thomson Multimedia RCA DCM245 Cable Modem
  18812. Class RCA | embedded || broadband router
  18813. Class Cisco | embedded || hub
  18814. TSeq(Class=64K)
  18815. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  18816. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18817. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  18818. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  18819. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18820. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  18821. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18822. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18823.  
  18824. Fingerprint RCA/Thomson cable modem DCM-235/245
  18825. Class RCA | embedded || broadband router
  18826. TSeq(Class=64K%IPID=I%TS=U)
  18827. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  18828. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18829. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  18830. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18831. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18832. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18833. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18834. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  18835.  
  18836. Fingerprint Redback SMS 1800 router
  18837. Class Redback | AOS || router
  18838. TSeq(Class=RI%gcd=<6%SI=<4CA7C&>C2F)
  18839. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  18840. T2(Resp=N)
  18841. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  18842. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  18843. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18844. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18845. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18846. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  18847.  
  18848. # Redback SMS 1800 router AOS Release 5.0.3.8
  18849. # Redback Networks SMS 10000 AOS 6.0.5.0
  18850. # Thomson TMC 390 cable modem
  18851. Fingerprint Redback SMS 1800/10000 router or Thomson TMC 390 cable modem
  18852. Class Redback | AOS || router
  18853. Class Thomson | embedded || broadband router
  18854. TSeq(Class=RI%gcd=<6%SI=<7B6BA&>BA7%IPID=I%TS=U)
  18855. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  18856. T2(Resp=N)
  18857. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  18858. T4(Resp=N)
  18859. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18860. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18861. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18862. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  18863.  
  18864. # Redback SMS500 Redback Networks AOS Release 5.0.4.0 PRODUCTION RELEASE
  18865. # Redback Networks AOS Release 5.0.3.8 PRODUCTION MAINTENANCE RELEASE
  18866. Fingerprint Redback SMS500 Redback Networks router AOS Release 5.0.3.8 - 5.0.4.0
  18867. Class Redback | AOS || router
  18868. TSeq(Class=RI%gcd=<6%SI=<56DF6&>337%IPID=I%TS=U)
  18869. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  18870. T2(Resp=N)
  18871. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  18872. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  18873. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18874. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18875. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18876. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|E|F%UCK=0|F%ULEN=134%DAT=E)
  18877.  
  18878. Fingerprint Redback SMS 1000-2000 DSL Router
  18879. Class Redback | embedded || broadband router
  18880. TSeq(Class=RI%gcd=<4%SI=>1000&<FFFF)
  18881. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  18882. T2(Resp=N)
  18883. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  18884. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  18885. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18886. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18887. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18888. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  18889.  
  18890. Fingerprint Ricoh Aficio AP4500 Network Laser Printer
  18891. Class Ricoh | embedded || printer
  18892. TSeq(Class=C%Val=0)
  18893. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  18894. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18895. T3(Resp=N)
  18896. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18897. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18898. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18899. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18900. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18901.  
  18902. Fingerprint Ringdale RP21 Print Server
  18903. Class Ringdale | embedded || print server
  18904. TSeq(Class=TR%gcd=<6)
  18905. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  18906. T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  18907. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
  18908. T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  18909. T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  18910. T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  18911. T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  18912. PU(Resp=N)
  18913.  
  18914. Fingerprint Rio Karma mp3 player
  18915. Class Rio | embedded || media device
  18916. TSeq(Class=RI%gcd=<6%SI=<47130&>1BB%IPID=RD%TS=U)
  18917. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  18918. T2(Resp=N)
  18919. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  18920. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  18921. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18922. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18923. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18924. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  18925.  
  18926. # RiverStone RS3000 System Software version 9.1.2.5
  18927. Fingerprint RiverStone RS3000 router
  18928. Class RiverStone | embedded || router
  18929. TSeq(Class=RI%gcd=<6%SI=<60158&>7CD%IPID=I%TS=2HZ)
  18930. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18931. T2(Resp=Y%DF=N%W=400|1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  18932. T3(Resp=Y%DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  18933. T4(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  18934. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18935. T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
  18936. T7(DF=N%W=800|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  18937. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  18938.  
  18939. Fingerprint RoadLanner Broadband router BRL-04FW 6.15.02r Build 0091 L:01
  18940. Class RoadLanner | embedded || broadband router
  18941. TSeq(Class=TD%gcd=<6E004%SI=<14%IPID=I%TS=1000HZ)
  18942. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL)
  18943. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18944. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL)
  18945. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18946. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18947. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18948. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18949. PU(Resp=N)
  18950.  
  18951. Fingerprint Rockwell Spectrum 100 POTS switcher release 7.2
  18952. Class Rockwell | embedded || telecom-misc
  18953. TSeq(Class=i800%IPID=I%TS=U)
  18954. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=)
  18955. T2(Resp=N)
  18956. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  18957. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  18958. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18959. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18960. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18961. PU(Resp=N)
  18962.  
  18963. # Ricoh Aficio 270 copier Ver. 1.4.9, Network Interface Board Ver. 4.0.7 (ELAND__99)
  18964. Fingerprint Savin 9927 Copier or Ricoh Aficio 270 copier
  18965. Class Savin | embedded || printer
  18966. Class Ricoh | embedded || printer
  18967. TSeq(Class=i800%IPID=I%TS=U)
  18968. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  18969. T2(Resp=N)
  18970. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  18971. T4(DF=N%W=2000%ACK=O%Flags=UR%Ops=)
  18972. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18973. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18974. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18975. PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=1C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  18976.  
  18977. # Scientific Atlanta Explorer 4200 - Digital Cable Box
  18978. Fingerprint Scientific Atlanta Explorer 4200 Digital Cable Box
  18979. Class Scientific-Atlanta | embedded || media device
  18980. TSeq(Class=64K%IPID=I%TS=2HZ)
  18981. T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18982. T2(Resp=N)
  18983. T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
  18984. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  18985. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18986. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18987. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  18988. PU(DF=N%TOS=68%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  18989.  
  18990. # Scientific Atlanta PowerVu Program Receiver Model D9850/9010, Version: 1.51 2004-02-06 14:45:06
  18991. Fingerprint Scientific Atlanta PowerVu Program Receiver Model D9850/9010
  18992. Class Scientific-Atlanta | embedded || media device
  18993. TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
  18994. T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  18995. T2(Resp=N)
  18996. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  18997. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  18998. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  18999. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19000. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19001. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19002.  
  19003. Fingerprint SCO OpenServer 5.0.5
  19004. Class SCO | OpenServer || general purpose
  19005. TSeq(Class=RI%gcd=<5%SI=>FFFF)
  19006. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  19007. T2(Resp=N)
  19008. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
  19009. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  19010. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  19011. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  19012. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  19013. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19014.  
  19015. Fingerprint SCO OpenServer 5.0.7
  19016. Class SCO | OpenServer || general purpose
  19017. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  19018. T1(DF=N%W=832C%ACK=S++%Flags=AS%Ops=M)
  19019. T2(Resp=N)
  19020. T3(Resp=Y%DF=N%W=8058%ACK=O%Flags=A%Ops=)
  19021. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19022. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19023. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19024. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19025. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19026.  
  19027. Fingerprint SCO OpenServer Release 5
  19028. Class SCO | OpenServer || general purpose
  19029. TSeq(Class=RI%gcd=<6%SI=>FFFF)
  19030. T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M)
  19031. T2(Resp=N)
  19032. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
  19033. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  19034. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  19035. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  19036. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  19037. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19038.  
  19039. Fingerprint SCO OpenServer Release 5
  19040. Class SCO | OpenServer || general purpose
  19041. TSeq(Class=RI%gcd=<6%SI=<34A71A&>86B6)
  19042. T1(DF=N%W=1000|6000|111C%ACK=S++%Flags=AS%Ops=M)
  19043. T2(Resp=N)
  19044. T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=)
  19045. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19046. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19047. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19048. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19049. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19050.  
  19051. # SCO Open Desktop ( Same as SCO UNIX?)
  19052. Fingerprint SCO Open Desktop 2.0
  19053. Class SCO | SCO UNIX || general purpose
  19054. TSeq(Class=64K)
  19055. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  19056. T2(Resp=N)
  19057. T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
  19058. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  19059. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19060. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  19061. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19062. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  19063.  
  19064. Fingerprint SCO UNIX release 3.2
  19065. Class SCO | SCO UNIX || general purpose
  19066. TSeq(Class=64K%IPID=I%TS=U)
  19067. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  19068. T2(Resp=N)
  19069. T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
  19070. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19071. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19072. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19073. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19074. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  19075.  
  19076. Fingerprint SCO UnixWare 2.01
  19077. Class SCO | UnixWare || general purpose
  19078. TSeq(Class=64K)
  19079. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M)
  19080. T2(Resp=N)
  19081. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  19082. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19083. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19084. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19085. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19086. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19087.  
  19088. Fingerprint SCO UnixWare 2.1
  19089. Class SCO | UnixWare || general purpose
  19090. TSeq(Class=RI%gcd=<6%SI=>FFF)
  19091. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  19092. T2(Resp=N)
  19093. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  19094. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19095. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19096. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19097. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19098. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19099.  
  19100. # SCO UnixWare 2.1 LiveScan Fingerprint Server
  19101. Fingerprint SCO UnixWare 2.1
  19102. Class SCO | UnixWare || general purpose
  19103. TSeq(Class=RI%gcd=<6%SI=<6D77C0&>B174%IPID=I%TS=U)
  19104. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  19105. T2(Resp=N)
  19106. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  19107. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19108. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19109. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19110. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19111. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19112.  
  19113. Fingerprint SCO UnixWare 2.1.2
  19114. Class SCO | UnixWare || general purpose
  19115. TSeq(Class=RI%gcd=<6%SI=>FFFF)
  19116. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  19117. T2(Resp=N)
  19118. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  19119. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19120. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19121. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19122. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19123. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19124.  
  19125. Fingerprint SCO UnixWare 7.0.0 or OpenServer 5.0.4-5.0.6
  19126. Class SCO | UnixWare || general purpose
  19127. TSeq(Class=RI%gcd=<BB%SI=>FFFF)
  19128. T1(W=60F4%ACK=S++%Flags=AS%Ops=M)
  19129. T2(Resp=N)
  19130. T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=)
  19131. T4(W=0%ACK=O%Flags=R%Ops=)
  19132. T5(W=0%ACK=S++%Flags=AR%Ops=)
  19133. T6(W=0%ACK=O%Flags=R%Ops=)
  19134. T7(W=0%ACK=S%Flags=AR%Ops=)
  19135. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19136.  
  19137. Fingerprint SCO UnixWare 7.1.0 - 7.1.1 (x86)
  19138. Class SCO | UnixWare || general purpose
  19139. TSeq(Class=RI%gcd=<6%SI=<403094&>8C71%IPID=I%TS=100HZ)
  19140. T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  19141. T2(Resp=N)
  19142. T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
  19143. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  19144. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19145. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19146. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19147. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19148.  
  19149. Fingerprint SCO UnixWare 7.1.0 x86
  19150. Class SCO | UnixWare || general purpose
  19151. TSeq(Class=RI%gcd=<6%SI=<442BB8&>AE70)
  19152. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  19153. T2(Resp=N)
  19154. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
  19155. T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
  19156. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  19157. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  19158. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  19159. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19160.  
  19161. #  UnixWare 7.1.1 i386 x86at SCO UNIX_SVR5
  19162. Fingerprint SCO UnixWare 7.1.1
  19163. Class SCO | UnixWare || general purpose
  19164. TSeq(Class=RI%gcd=<6%SI=<874330&>B9D5%IPID=I%TS=U)
  19165. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=M)
  19166. T2(Resp=N)
  19167. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=)
  19168. T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
  19169. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  19170. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  19171. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  19172. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19173.  
  19174. Fingerprint Secure Computing SECUREZone Firewall Version 2.0
  19175. Class Secure Computing | embedded || firewall
  19176. TSeq(Class=TR%gcd=<6)
  19177. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  19178. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19179. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  19180. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19181. T5(Resp=N)
  19182. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19183. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19184. PU(Resp=N)
  19185.  
  19186. Fingerprint Secure Computing Sidewinder firewall 3.2 update 4
  19187. Class Secure Computing | embedded || firewall
  19188. TSeq(Class=RI%gcd=<5%SI=>FFF&<FFFFF)
  19189. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  19190. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19191. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
  19192. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19193. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19194. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19195. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19196. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  19197.  
  19198. Fingerprint Secure Computing Sidewinder firewall 5.2.1.06
  19199. Class Secure Computing | embedded || firewall
  19200. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  19201. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  19202. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19203. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  19204. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19205. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19206. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19207. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19208. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19209.  
  19210. Fingerprint Sega Dreamcast game console
  19211. Class Sega | embedded || game console
  19212. TSeq(Class=TD%gcd=<780%SI=<14)
  19213. T1(DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
  19214. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19215. T3(Resp=Y%DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
  19216. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  19217. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19218. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  19219. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19220. PU(Resp=N)
  19221.  
  19222. Fingerprint Sequent DYNIX/PTX 4.4.2
  19223. Class Sequent | DYNIX || general purpose
  19224. TSeq(Class=RI%gcd=<6%SI=<15E0&>23)
  19225. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  19226. T2(Resp=N)
  19227. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  19228. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  19229. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19230. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19231. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19232. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19233.  
  19234. Fingerprint Sequent DYNIX/ptx 4.4.6 x86
  19235. Class Sequent | DYNIX || general purpose
  19236. TSeq(Class=RI%gcd=<6%SI=<2E4AA&>752%IPID=I%TS=U)
  19237. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNW)
  19238. T2(Resp=N)
  19239. T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=A%Ops=)
  19240. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  19241. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19242. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19243. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19244.  
  19245. Fingerprint Sequent DYNIX/ptx V4.2.1
  19246. Class Sequent | embedded || general purpose
  19247. TSeq(Class=RI%gcd=<F%SI=>FF&<FFFFF)
  19248. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  19249. T2(Resp=N)
  19250. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  19251. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  19252. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19253. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  19254. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19255. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  19256.  
  19257. Fingerprint Sequent DYNIX/ptx V4.4.6
  19258. Class Sequent | embedded || general purpose
  19259. TSeq(Class=RI|TD%gcd=<6%SI=<3FC)
  19260. T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MNW)
  19261. T2(Resp=N)
  19262. T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=A%Ops=)
  19263. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  19264. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19265. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19266. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19267. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  19268.  
  19269. # SGI Iris Indigo R4000 running IRIX 4.0.5F
  19270. Fingerprint SGI IRIX 4.0.5F
  19271. Class SGI | IRIX | 4.X | general purpose
  19272. TSeq(Class=64K%IPID=I%TS=U)
  19273. T1(DF=N%W=EF1F%ACK=S++%Flags=AS%Ops=M)
  19274. T2(Resp=N)
  19275. T3(Resp=Y%DF=N%W=EF1F%ACK=O%Flags=A%Ops=)
  19276. T4(DF=N%W=F000%ACK=O%Flags=R%Ops=)
  19277. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19278. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19279. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19280. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19281.  
  19282. Fingerprint SGI IRIX 5.2
  19283. Class SGI | IRIX | 5.X | general purpose
  19284. TSeq(Class=64K)
  19285. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
  19286. T2(Resp=N)
  19287. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  19288. T4(DF=N%W=F000%ACK=O%Flags=R%Ops=)
  19289. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19290. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19291. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19292. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19293.  
  19294. Fingerprint SGI IRIX 5.3
  19295. Class SGI | IRIX | 5.X | general purpose
  19296. TSeq(Class=64K)
  19297. T1(DF=N%W=EF2A|F000%ACK=S++%Flags=AS%Ops=MNWNNT)
  19298. T2(Resp=N)
  19299. T3(Resp=Y%DF=N%W=EF2A|F000%ACK=O%Flags=A%Ops=NNT)
  19300. T4(DF=N%W=EF2A|F000%ACK=O%Flags=R%Ops=)
  19301. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19302. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19303. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19304. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19305.  
  19306. Fingerprint SGI IRIX 6.2
  19307. Class SGI | IRIX | 6.X | general purpose
  19308. TSeq(Class=64K%IPID=I%TS=2HZ)
  19309. T1(DF=N%W=1FA0%ACK=S++%Flags=AS%Ops=MNWNNT)
  19310. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19311. T3(Resp=Y%DF=N%W=1FA0%ACK=O%Flags=A%Ops=NNT)
  19312. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19313. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19314. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19315. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19316. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19317.  
  19318. Fingerprint SGI IRIX 6.2 - 6.5
  19319. Class SGI | IRIX | 6.X | general purpose
  19320. TSeq(Class=TD|64K|RI%gcd=<6|3E8|7D0|BB8|FA0)
  19321. T1(DF=N%W=EF2A|C000%ACK=S++%Flags=AS%Ops=MNWNNT)
  19322. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19323. T3(Resp=Y%DF=N%W=EF2A|C000%ACK=O%Flags=A%Ops=NNT)
  19324. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19325. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19326. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19327. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19328. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19329.  
  19330. Fingerprint SGI IRIX 6.2 - 6.5
  19331. Class SGI | IRIX | 6.X | general purpose
  19332. TSeq(Class=i800)
  19333. T1(DF=N%W=C000|EF2A%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  19334. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19335. T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
  19336. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19337. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19338. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19339. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19340. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19341.  
  19342. Fingerprint SGI IRIX 6.4 - 6.5.3m
  19343. Class SGI | IRIX | 6.X | general purpose
  19344. TSeq(Class=RI|TD%gcd=28|50|78|A0|C8|F0|140%SI=<3E8)
  19345. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT)
  19346. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19347. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
  19348. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19349. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19350. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19351. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19352. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19353.  
  19354. Fingerprint SGI IRIX 6.5
  19355. Class SGI | IRIX | 6.X | general purpose
  19356. TSeq(Class=RI%gcd=10%SI=<2222)
  19357. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
  19358. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19359. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  19360. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19361. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19362. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19363. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19364. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19365.  
  19366. # IRIX sgi 6.5 10100655 IP32 - Silicon Graphics O2 on MIPS R12000 
  19367. Fingerprint SGI IRIX 6.5 (MIPS)
  19368. Class SGI | IRIX | 6.X | general purpose
  19369. TSeq(Class=TD%gcd=<FA4%SI=<118%IPID=I%TS=2HZ)
  19370. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19371. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19372. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  19373. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19374. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19375. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19376. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19377. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19378.  
  19379. Fingerprint SGI IRIX 6.5 Origin2
  19380. Class SGI | IRIX | 6.X | general purpose
  19381. TSeq(Class=64K)
  19382. T1(Resp=Y%DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
  19383. T2(Resp=N)
  19384. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  19385. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  19386. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19387. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  19388. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19389. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19390.  
  19391. # IP19/IP27/IP30/IP32
  19392. Fingerprint SGI IRIX 6.5-6.5.15m
  19393. Class SGI | IRIX | 6.X | general purpose
  19394. TSeq(Class=RI|64K|i800%gcd=<144%SI=<FFFF&>8%IPID=I%TS=2HZ)
  19395. T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19396. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19397. T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
  19398. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19399. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19400. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19401. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19402. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19403.  
  19404. # SGI IRIX 6.5.14, SGI O2
  19405. # SGI IRIX 6.5 IP32
  19406. Fingerprint SGI IRIX 6.5.14
  19407. Class SGI | IRIX | 6.X | general purpose
  19408. TSeq(Class=RI%gcd=<C%SI=<13876&>257%IPID=I%TS=2HZ)
  19409. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19410. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19411. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  19412. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19413. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19414. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19415. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19416. PU(Resp=N)
  19417.  
  19418. Fingerprint SGI IRIX 6.5.15m on SGI O2
  19419. Class SGI | IRIX | 6.X | general purpose
  19420. TSeq(Class=TD%gcd=<104%SI=<1AE%IPID=I%TS=2HZ)
  19421. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19422. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19423. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  19424. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19425. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19426. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19427. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19428. PU(Resp=N)
  19429.  
  19430. Fingerprint SGI IRIX 6.5.16m
  19431. Class SGI | IRIX | 6.X | general purpose
  19432. TSeq(Class=RI|i800%gcd=<144%SI=<712%IPID=RPI%TS=2HZ)
  19433. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19434. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19435. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
  19436. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19437. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19438. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19439. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19440. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19441.  
  19442. # IRIX 6.5 6.5.20m IP32
  19443. Fingerprint SGI IRIX 6.5.20m
  19444. Class SGI | IRIX | 6.X | general purpose
  19445. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  19446. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19447. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19448. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  19449. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19450. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19451. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19452. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19453. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19454.  
  19455. # SGI Indigo2 R10000 running IRIX64 6.5.20m
  19456. Fingerprint SGI IRIX 6.5.20m
  19457. Class SGI | IRIX | 6.X | general purpose
  19458. TSeq(Class=64K%IPID=I%TS=2HZ)
  19459. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19460. T2(Resp=N)
  19461. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
  19462. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19463. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19464. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19465. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19466. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19467.  
  19468. Fingerprint SGI IRIX 6.5.25
  19469. Class SGI | IRIX | 6.X | general purpose
  19470. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  19471. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19472. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19473. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
  19474. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19475. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19476. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19477. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19478. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19479.  
  19480. Fingerprint SGI IRIX 6.5.7f-6.5.8f
  19481. Class SGI | IRIX | 6.X | general purpose
  19482. TSeq(Class=64K)
  19483. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19484. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19485. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  19486. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19487. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19488. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19489. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19490. PU(Resp=N)
  19491.  
  19492. # SGI O2 running SGI IRIX 6.5.7f
  19493. Fingerprint SGI IRIX 6.5.7f-6.5.8f
  19494. Class SGI | IRIX | 6.X | general purpose
  19495. TSeq(Class=64K)
  19496. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  19497. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19498. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  19499. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19500. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19501. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19502. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19503. PU(Resp=N)
  19504.  
  19505. Fingerprint Sharp DIGITAL Imager (copier) AR-507
  19506. Class Sharp | embedded || printer
  19507. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  19508. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19509. T3(Resp=N)
  19510. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19511. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19512. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19513. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19514. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19515.  
  19516. Fingerprint Sharp Network Printer AR-337
  19517. Class Sharp | embedded || printer
  19518. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  19519. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19520. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  19521. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19522. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19523. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19524. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19525. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19526.  
  19527. #  Shiva AccessPort Bridge/Router Software V 2.1.0
  19528. #  3Com HiPer Access Router Card hardware 1.0.0 software 4.1.59
  19529. Fingerprint Shiva AccessPort Bridge/Router Software V 2.1.0 or 3Com HiPer Access Router Card hardware V1.0.0 software V4.1.59
  19530. Class Shiva | embedded || router
  19531. Class 3Com | embedded || router
  19532. TSeq(Class=TD%gcd=<6%SI=<F)
  19533. T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  19534. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19535. T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  19536. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19537. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19538. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19539. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19540. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19541.  
  19542. Fingerprint Shiva LanRover/8E Version 3.5
  19543. Class Shiva | embedded || terminal server
  19544. TSeq(Class=64K)
  19545. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  19546. T2(Resp=N)
  19547. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  19548. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  19549. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19550. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19551. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19552. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19553.  
  19554. # Siemens 5940 T1E1 [COMBO] Router (5940-001) v6.1.020-1
  19555. Fingerprint Siemens Broadband Router 5940 T1/E1
  19556. Class Siemens | embedded || broadband router
  19557. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  19558. T2(Resp=N)
  19559. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19560. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19561. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19562. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19563. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19564. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  19565.  
  19566. # Siemens Santis 50 Wireless adsl router / Firmware version: 5.0.0.11 CPU: Helium 210-80
  19567. # A Wireless router which functions as a gateway to the internet.
  19568. Fingerprint Siemens Santis 50 Wireless adsl router
  19569. Class Siemens | embedded || broadband router
  19570. TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U)
  19571. T1(DF=N%W=1FFE%ACK=S++%Flags=AS%Ops=ME)
  19572. T2(Resp=Y%DF=N%W=1FFE%ACK=O%Flags=R%Ops=)
  19573. T3(Resp=N)
  19574. T4(DF=N%W=1FFE%ACK=O%Flags=R%Ops=)
  19575. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19576. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19577. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19578. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19579.  
  19580. Fingerprint Siemens Speedstream 2602 DSL/Cable router
  19581. Class Siemens | embedded || broadband router
  19582. TSeq(Class=RI%gcd=<6%SI=<22E601A&>31AA1%IPID=Z%TS=100HZ)
  19583. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  19584. T2(Resp=N)
  19585. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  19586. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  19587. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19588. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19589. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19590. PU(Resp=N)
  19591.  
  19592. # Siemens HICOM 300 Phone switch (PBX) (WAML LAN card)
  19593. Fingerprint Siemens HICOM 300 Phone switch (PBX)
  19594. Class Siemens | embedded || PBX
  19595. TSeq(Class=64K)
  19596. T1(DF=N%W=808%ACK=S++%Flags=AS%Ops=M)
  19597. T2(Resp=N)
  19598. T3(Resp=Y%DF=N%W=808%ACK=O%Flags=A%Ops=)
  19599. T4(DF=N%W=808%ACK=O%Flags=R%Ops=)
  19600. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19601. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19602. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19603. PU(Resp=N)
  19604.  
  19605. Fingerprint Siemens HICOM Phone switch (PBX)
  19606. Class Siemens | embedded || PBX
  19607. TSeq(Class=RI%gcd=<A%SI=<4184D0&>4EB3%IPID=I%TS=100HZ)
  19608. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNWNNT)
  19609. T2(Resp=N)
  19610. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=NNT)
  19611. T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
  19612. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  19613. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  19614. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  19615. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19616.  
  19617. Fingerprint Siemens HiPATH3500 VoIP PBX
  19618. Class Siemens | embedded || PBX
  19619. TSeq(Class=64K%IPID=I%TS=U)
  19620. T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=M)
  19621. T2(Resp=N)
  19622. T3(Resp=Y%DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=M)
  19623. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  19624. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19625. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19626. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19627. PU(Resp=N)
  19628.  
  19629. # Siemens S7-400 PLC CPU-416-2
  19630. Fingerprint Siemens S7-400 programmable logic controller
  19631. Class Siemens | embedded || specialized
  19632. TSeq(Class=RI%gcd=<6%SI=<583DCAE&>977AD%IPID=I%TS=U)
  19633. T1(DF=N%W=230%ACK=S++%Flags=AS%Ops=ME)
  19634. T2(Resp=N)
  19635. T3(Resp=Y%DF=N%W=230%ACK=S++%Flags=AS%Ops=ME)
  19636. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19637. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19638. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19639. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19640. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  19641.  
  19642. Fingerprint Siemens HiCom 300E business phone system Release 6.5
  19643. Class Siemens | embedded || VoIP phone
  19644. TSeq(Class=RI%gcd=<6%SI=<5D131C&>4A3C%IPID=I%TS=U)
  19645. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  19646. T2(Resp=N)
  19647. T3(Resp=N)
  19648. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19649. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19650. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19651. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19652. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19653.  
  19654. Fingerprint ReliantUNIX-Y 5.44 B0033 RM600 1/256 R10000
  19655. Class Siemens | ReliantUNIX || general purpose
  19656. TSeq(Class=64K)
  19657. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  19658. T2(Resp=N)
  19659. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
  19660. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19661. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19662. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19663. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19664. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19665.  
  19666. # Reliant UNIX 5.45B20 running on an RM400 (Siemens stuff)
  19667. Fingerprint Siemens Reliant UNIX 5.45B20
  19668. Class Siemens | ReliantUNIX || general purpose
  19669. TSeq(Class=RI%gcd=<6%SI=<A53AC&>100C%IPID=I%TS=2HZ)
  19670. T1(DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT)
  19671. T2(Resp=N)
  19672. T3(Resp=Y%DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT)
  19673. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  19674. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19675. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19676. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19677. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  19678.  
  19679. Fingerprint Siemens RM200-C40 running ReliantUNIX-N 5.45
  19680. Class Siemens | ReliantUNIX || general purpose
  19681. TSeq(Class=RI%gcd=<6%SI=<7DF64&>AAA%IPID=I%TS=2HZ)
  19682. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  19683. T2(Resp=N)
  19684. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  19685. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  19686. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19687. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19688. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19689. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  19690.  
  19691. Fingerprint Siemens SINIX-N 5.41C0005
  19692. Class Siemens | SINIX || general purpose
  19693. TSeq(Class=64K%gcd=<6%SI=<14)
  19694. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
  19695. T2(Resp=N)
  19696. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  19697. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19698. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19699. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19700. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19701. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=0%ULEN=134%DAT=E)
  19702.  
  19703. Fingerprint Siemens SINIX-N 5.43C3002
  19704. Class Siemens | SINIX || general purpose
  19705. TSeq(Class=64K%gcd=<6%SI=<14)
  19706. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=NW)
  19707. T2(Resp=N)
  19708. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=NW)
  19709. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19710. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19711. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19712. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19713. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=E%ULEN=134%DAT=E)
  19714.  
  19715. Fingerprint Siemens SINIX-Y 5.43B0045
  19716. Class Siemens | SINIX || general purpose
  19717. TSeq(Class=64K)
  19718. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
  19719. T2(Resp=N)
  19720. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=A%Ops=)
  19721. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19722. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19723. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19724. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19725. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19726.  
  19727. Fingerprint Siemens SINIX-Y 5.43C4001
  19728. Class Siemens | SINIX || general purpose
  19729. TSeq(Class=RI%gcd=<6%SI=<26E76&>625)
  19730. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  19731. T2(Resp=N)
  19732. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
  19733. T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  19734. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19735. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19736. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19737. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  19738.  
  19739. # Sipura SPA-2000 VoIP Firmware version 2.09d
  19740. # SPA-841 VoIP Phone (SIP) with firmware 0.9.5
  19741. # Sipura SPA SPA-1000 Software Version: 1.0.33 Hardware Version: 2.0.1
  19742. # Sipura SPA-2000 VoIP Adapter
  19743. # Sipura SPA-2000  Software Version: 2.0.10(d)   IP Phone Adaptor
  19744. # Sipura SPA-3000, firmware 2.0.13(GWg)
  19745. Fingerprint Sipura SPA-841/1000/2000/3000 POTS<->VoIP gateway
  19746. Class Sipura | embedded || VoIP adapter
  19747. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  19748. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  19749. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  19750. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  19751. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  19752. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  19753. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  19754. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  19755. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19756.  
  19757. # SMC Barricade SMC7004VR2.0EU DSL-Router Firmware R1.02-DDNS
  19758. Fingerprint SMC Barricade SMC7004VR2.0EU DSL router
  19759. Class SMC | embedded || broadband router
  19760. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
  19761. T1(DF=N%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
  19762. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19763. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19764. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19765. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19766. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19767. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19768. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19769.  
  19770. # Panasonic KX-HCM10 network camera
  19771. # SMC EZConnect Wireless Access Point SMC2655W V.2
  19772. Fingerprint Panasonic network camera or SMC WAP
  19773. Class SMC | embedded || WAP
  19774. Class Panasonic | embedded || webcam
  19775. TSeq(Class=TD%gcd=<F4%SI=<1E%TS=U)
  19776. T1(Resp=N)
  19777. T2(Resp=N)
  19778. T3(Resp=N)
  19779. T4(Resp=N)
  19780. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19781. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  19782. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19783. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19784.  
  19785. # SMC Barricade7004VBR Boot Code v1.05
  19786. # SMC 7004VBR broadband router - firmware v1.2
  19787. # SMC Wireless AP 7004WFW
  19788. # SMC7004vwbr Barricade Wireless Cable/DSL Broadband Router
  19789. Fingerprint SMC Barricade DSL Router/Modem/Wireless AP
  19790. Class SMC | embedded || WAP
  19791. TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U)
  19792. T1(DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME)
  19793. T2(Resp=N)
  19794. T3(Resp=Y%DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME)
  19795. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19796. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19797. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19798. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19799. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19800.  
  19801. Fingerprint SMC Barricade Router, firmware 1.94a
  19802. Class SMC | embedded || WAP
  19803. TSeq(Class=TD%gcd=<68%SI=<32%IPID=I%TS=U)
  19804. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  19805. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  19806. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  19807. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  19808. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  19809. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  19810. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  19811. PU(Resp=N)
  19812.  
  19813. Fingerprint SMC Barricade Wireless Broadband Router (firmware R1.93e)
  19814. Class SMC | embedded || WAP
  19815. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  19816. T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19817. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
  19818. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19819. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  19820. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19821. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  19822. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19823. PU(Resp=N)
  19824.  
  19825. Fingerprint Smoothwall Linux-based firewall 2.2.23
  19826. Class Smoothwall | Linux | 2.2.X | firewall
  19827. TSeq(Class=RI%gcd=<6%SI=<F1DA6&>474%IPID=I)
  19828. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  19829. T2(Resp=N)
  19830. T3(Resp=N)
  19831. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19832. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19833. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19834. T7(Resp=N)
  19835. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19836.  
  19837. # Softek Digi One RealPort serial device server
  19838. # Digi One SP Serial to Ethernet Converter Version 82000774_E 06/13/2003
  19839. Fingerprint Softek Digi One serial device server
  19840. Class Softek | embedded || specialized
  19841. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  19842. T2(Resp=N)
  19843. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  19844. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19845. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19846. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19847. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19848. PU(DF=Y%TOS=0%IPLEN=8E%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  19849.  
  19850. # SonicWall Pro 200 Firmware Version 6.4.2.0
  19851. Fingerprint SonicWall Pro 200 firewall
  19852. Class SonicWall | embedded || firewall
  19853. TSeq(Class=TR%gcd=<6%IPID=I)
  19854. T1(DF=N|Y%W=0|402E%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  19855. T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  19856. T3(Resp=Y%DF=N|Y%W=0|402E%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT)
  19857. T4(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
  19858. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  19859. T6(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
  19860. T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=)
  19861.  
  19862. # SonicWall 4060 firewall running SonicOS Enhaced 2.5
  19863. Fingerprint SonicWall 4060 firewall
  19864. Class SonicWall | SonicOS || firewall
  19865. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  19866. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
  19867. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  19868. T3(Resp=N)
  19869. T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  19870. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  19871. T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  19872. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  19873. PU(Resp=N)
  19874.  
  19875. # base on msg 2615
  19876. # PRO 3060 Standard SonicOS Standard 3.1.0.1-60s
  19877. Fingerprint SonicWall PRO 3060 firewall
  19878. Class SonicWall | SonicOS || firewall
  19879. TSeq(Class=64K%IPID=I%TS=U)
  19880. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
  19881. T2(Resp=N)
  19882. T3(Resp=N)
  19883. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  19884. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19885. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19886. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19887. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  19888.  
  19889. # Cisco 350 Access Point, software rev 12.02T1
  19890. # Accelerated Networks VoDSL - But what sort of device?
  19891. Fingerprint SonicWall SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL, or Cisco 350 Access Point
  19892. Class SonicWall | SonicOS || firewall
  19893. Class Enterasys | embedded || switch
  19894. Class Cisco | embedded || WAP
  19895. TSeq(Class=64K)
  19896. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  19897. T2(Resp=N)
  19898. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  19899. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  19900. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19901. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19902. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19903. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  19904.  
  19905. Fingerprint SonicWall SOHO-3 firewall
  19906. Class SonicWall | SonicOS || firewall
  19907. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19908. T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19909. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19910. T4(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19911. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19912. T6(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19913. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19914. PU(Resp=N)
  19915.  
  19916. Fingerprint SonicWall SOHO-3 firewall
  19917. Class SonicWall | SonicOS || firewall
  19918. TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
  19919. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  19920. T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19921. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  19922. T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19923. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19924. T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19925. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19926. PU(Resp=N)
  19927.  
  19928. # SonicWall SOHO3 (CPU: Toshiba 3927 H2 / 133 Mhz) Firmware version: 6.6.0.6 ROM version: 6.2.0.0
  19929. Fingerprint SonicWall SOHO3 firewall
  19930. Class SonicWall | SonicOS || firewall
  19931. TSeq(Class=RI%gcd=<6%SI=<708FA&>904%IPID=I%TS=U)
  19932. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  19933. T2(Resp=N)
  19934. T3(Resp=N)
  19935. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  19936. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19937. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19938. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19939. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  19940.  
  19941. # SonicWall TZ 170 SonicOS 2.5.0.2 Enhanced
  19942. Fingerprint SonicWall TZ 170
  19943. Class SonicWall | SonicOS || firewall
  19944. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  19945. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  19946. T2(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
  19947. T3(Resp=N)
  19948. T4(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
  19949. T5(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
  19950. T6(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
  19951. T7(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=)
  19952. PU(Resp=N)
  19953.  
  19954. Fingerprint SonicWall TZ 170 Firewall
  19955. Class SonicWall | SonicOS || firewall
  19956. TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
  19957. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  19958. T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
  19959. T3(Resp=N)
  19960. T4(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
  19961. T5(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=)
  19962. T6(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
  19963. T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  19964. PU(Resp=N)
  19965.  
  19966. # SonicWall TZ170 Firewall with SonicOS
  19967. # SonicWall FZ170 Unrestricted (firewall/VPN appliances)  with SonicOS 2.6
  19968. # SonicOS 3.0.0.4-41s on SonicWall TZ 170
  19969. Fingerprint SonicWall TZ170 Firewall
  19970. Class SonicWall | SonicOS || firewall
  19971. TSeq(Class=64K%IPID=I%TS=2HZ)
  19972. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  19973. T2(Resp=N)
  19974. T3(Resp=N)
  19975. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  19976. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  19977. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  19978. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  19979. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  19980.  
  19981. Fingerprint SonicWall/10 firewall
  19982. Class SonicWall | SonicOS || firewall
  19983. TSeq(Class=TR)
  19984. T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  19985. T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19986. T3(Resp=Y%DF=Y|N%W=7FE0|7FDF%ACK=O|S++%Flags=A|ASF%Ops=ME)
  19987. T4(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19988. T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19989. T6(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19990. T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  19991. PU(Resp=N)
  19992.  
  19993. Fingerprint SonicWall/10 firewall
  19994. Class SonicWall | SonicOS || firewall
  19995. TSeq(Class=TR)
  19996. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  19997. T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  19998. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  19999. T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  20000. T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  20001. T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  20002. T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  20003. PU(Resp=N)
  20004.  
  20005. Fingerprint Sony AIBO ERS-7 running AIBO Mind 2
  20006. Class Sony | embedded || robotic pet
  20007. TSeq(Class=TR|TD%gcd=<186A4%SI=<64%IPID=I%TS=U)
  20008. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  20009. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  20010. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  20011. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20012. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20013. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20014. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  20015. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20016.  
  20017. Fingerprint PS2 Linux 1.0 on Sony PS2 game console
  20018. Class Sony | Linux || game console
  20019. TSeq(Class=RI%gcd=<6%SI=<20E2FE8&>5428C%IPID=I%TS=100HZ)
  20020. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNT)
  20021. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  20022. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  20023. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  20024. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20025. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  20026. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  20027.  
  20028. # This appears to be used by game developers to test performance.
  20029. Fingerprint Sony PlayStation 2 Performance Analyser
  20030. Class Sony | Linux || specialized
  20031. TSeq(Class=RI%gcd=<6%SI=<18EC23A&>3FCBC%IPID=I%TS=100HZ)
  20032. T1(DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW)
  20033. T2(Resp=N)
  20034. T3(Resp=Y%DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW)
  20035. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20036. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20037. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20038. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20039. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20040.  
  20041. Fingerprint Sony NewsOS 6.1.2
  20042. Class Sony | NewsOS || general purpose
  20043. TSeq(Class=64K%gcd=<6%SI=<14)
  20044. T1(DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
  20045. T2(Resp=N)
  20046. T3(Resp=Y%DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
  20047. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20048. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20049. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20050. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20051. PU(Resp=N)
  20052.  
  20053. Fingerprint Sony Ericsson P800 mobile phone, Symbian OS v7.0
  20054. Class Sony | Symbian || phone
  20055. TSeq(Class=RI%gcd=<8%SI=<31996C&>200D%IPID=I)
  20056. T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL)
  20057. T2(Resp=N)
  20058. T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL)
  20059. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20060. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20061. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20062. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20063. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20064.  
  20065. Fingerprint Soyo G668 VoIP phone
  20066. Class Soyo | embedded || VoIP phone
  20067. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  20068. T1(DF=N%W=514%ACK=S++%Flags=AS%Ops=M)
  20069. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20070. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  20071. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  20072. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20073. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20074. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20075. PU(Resp=N)
  20076.  
  20077. # speedstream router 5871 v4.0.1
  20078. Fingerprint Speedstream 5871 DSL router
  20079. Class SpeedStream | embedded || broadband router
  20080. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  20081. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  20082. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  20083. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  20084. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  20085. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20086. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  20087. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  20088. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  20089.  
  20090. Fingerprint Spirent AX4000 Network Testing Tool
  20091. Class Spirent | embedded || specialized
  20092. TSeq(Class=RI%gcd=<6%SI=<761F6&>E8E%IPID=I%TS=U)
  20093. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  20094. T2(Resp=N)
  20095. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  20096. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  20097. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20098. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20099. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20100. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  20101.  
  20102. Fingerprint StackTools StackTos 1.0 embedded networking OS
  20103. Class StackTools | StackTos || general purpose
  20104. TSeq(Class=64K%IPID=I%TS=U)
  20105. T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
  20106. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  20107. T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
  20108. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20109. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20110. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20111. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20112. PU(DF=N%TOS=A8%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20113.  
  20114. Fingerprint StackTos 2.1
  20115. Class StackTools | StackTos || general purpose
  20116. TSeq(Class=64K%IPID=I%TS=U)
  20117. T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
  20118. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  20119. T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
  20120. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20121. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20122. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20123. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20124. PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20125.  
  20126. Fingerprint Stratus VOS Release 14.3.1ae
  20127. Class Stratus | VOS || general purpose
  20128. T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
  20129. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  20130. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  20131. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  20132. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  20133. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  20134. T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  20135. PU(Resp=N)
  20136.  
  20137. # Sun StorEdge T3 / Sun StorEdge T3B, Workgroup Storage Array
  20138. Fingerprint Sun StorEdge T3 Storage Array
  20139. Class Sun | embedded || storage-misc
  20140. TSeq(Class=64K%IPID=I%TS=U)
  20141. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  20142. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20143. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  20144. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20145. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20146. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20147. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20148. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  20149.  
  20150. Fingerprint Sun Solaris 5.10.1
  20151. Class Sun | Solaris | 10 | general purpose
  20152. TSeq(Class=RI%gcd=<6%SI=<1C36BAC&>4838E%IPID=RPI%TS=U)
  20153. T1(DF=Y%W=C0B7%ACK=O|S++%Flags=A|AS%Ops=NNT|NNTMNW)
  20154. T2(Resp=N)
  20155. T3(Resp=N)
  20156. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20157. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20158. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20159. T7(Resp=N)
  20160. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20161.  
  20162. # SunOS 5.10 Generic sun4u sparc SUNW,Sun-Fire-V250
  20163. Fingerprint SunOS 5.10 (sparc)
  20164. Class Sun | Solaris | 10 | general purpose
  20165. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  20166. T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
  20167. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20168. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20169. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20170. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20171. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20172. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20173. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20174.  
  20175. # SunOS webbox 5.10 Generic i86pc i386 i86pc
  20176. Fingerprint SunOS webbox 5.10 Generic
  20177. Class Sun | Solaris | 10 | general purpose
  20178. TSeq(Class=RI%gcd=<6%SI=<BE528&>D98%IPID=I%TS=100HZ)
  20179. T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
  20180. T2(Resp=N)
  20181. T3(Resp=N)
  20182. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20183. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20184. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20185. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20186. PU(DF=N%TOS=C%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20187.  
  20188. Fingerprint Sun Solaris 2.3 - 2.4
  20189. Class Sun | Solaris | 2.X | general purpose
  20190. TSeq(Class=64K)
  20191. T1(DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
  20192. T2(Resp=N)
  20193. T3(Resp=Y%DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
  20194. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20195. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20196. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20197. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20198. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20199.  
  20200. Fingerprint Sun Solaris 2.4 w/most Sun patches (jumbo cluster patch, security patches, etc)
  20201. Class Sun | Solaris | 2.X | general purpose
  20202. TSeq(Class=64K)
  20203. T1(DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
  20204. T2(Resp=N)
  20205. T3(Resp=Y%DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
  20206. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20207. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20208. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20209. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20210. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20211.  
  20212. Fingerprint Sun Solaris 2.5, 2.5.1
  20213. Class Sun | Solaris | 2.X | general purpose
  20214. TSeq(Class=RI%gcd=<6)
  20215. T1(DF=Y|N%W=2229|2332|4452|FFAF|8377|8EDA|879B%ACK=S++%Flags=AS%Ops=ME)
  20216. T2(Resp=N)
  20217. T3(Resp=N)
  20218. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20219. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20220. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20221. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20222. PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20223.  
  20224. Fingerprint Sun Solaris 2.6
  20225. Class Sun | Solaris | 2.X | general purpose
  20226. TSeq(Class=RI%gcd=<6%SI=<512B6&>CE8)
  20227. T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=NNTME)
  20228. T2(Resp=N)
  20229. T3(Resp=N)
  20230. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20231. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20232. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20233. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20234. PU(Resp=N)
  20235.  
  20236. # SunOS dabox 5.6 Generic_105181-30 sun4u sparc SUNW,Ultra-Enterprise
  20237. Fingerprint Sun Solaris 2.6 (SPARC)
  20238. Class Sun | Solaris | 2.X | general purpose
  20239. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  20240. T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
  20241. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  20242. T3(Resp=N)
  20243. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  20244. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20245. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  20246. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  20247. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20248.  
  20249. Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=0
  20250. Class Sun | Solaris | 2.X | general purpose
  20251. Class Sun | Solaris | 7 | general purpose
  20252. TSeq(Class=64K)
  20253. T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
  20254. T2(Resp=N)
  20255. T3(Resp=N)
  20256. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20257. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20258. T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
  20259. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20260. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20261.  
  20262. Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=2
  20263. Class Sun | Solaris | 2.X | general purpose
  20264. Class Sun | Solaris | 7 | general purpose
  20265. TSeq(Class=TR%IPID=I%TS=100HZ)
  20266. T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
  20267. T2(Resp=N)
  20268. T3(Resp=N)
  20269. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20270. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20271. T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
  20272. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20273. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  20274.  
  20275. Fingerprint Sun Solaris 2.6 - 7 x86
  20276. Class Sun | Solaris | 2.X | general purpose
  20277. Class Sun | Solaris | 7 | general purpose
  20278. TSeq(Class=RI%gcd=<6)
  20279. T1(DF=Y%W=2491|462B%ACK=S++%Flags=AS%Ops=NNTNWME)
  20280. T2(Resp=N)
  20281. T3(Resp=N)
  20282. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20283. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20284. T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
  20285. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20286. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20287.  
  20288. Fingerprint Sun Solaris 2.6 - 8 (SPARC)
  20289. Class Sun | Solaris | 2.X | general purpose
  20290. Class Sun | Solaris | 7 | general purpose
  20291. Class Sun | Solaris | 8 | general purpose
  20292. TSeq(Class=RI%gcd=<6%SI=<57A26&>DF1)
  20293. T1(DF=Y|N%W=109|212|2297|2788|4431|8371|8F4D|ABCD|FFF7|FFFF|2297%ACK=S++%Flags=AS%Ops=NNTNWME)
  20294. T2(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  20295. T3(Resp=N)
  20296. T4(DF=Y|N%W=0%ACK=O%Flags=R%Ops=|WNMETL)
  20297. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20298. T6(DF=Y|N%W=0%ACK=O|S%Flags=AR|R%Ops=|WNMETL)
  20299. T7(DF=Y|N%W=0%ACK=S|O%Flags=AR|R%Ops=|WNMETL)
  20300. PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=F|E%ULEN=134%DAT=E)
  20301.  
  20302. # Sun Solaris 8 // Sun Fire 80080
  20303. Fingerprint Sun Solaris 8
  20304. Class Sun | Solaris | 8 | general purpose
  20305. TSeq(Class=RI|TR%gcd=<8%SI=<FEC86&>E0F%IPID=I%TS=100HZ)
  20306. T1(DF=Y%W=5B4|60DA|801B|807A|B68%ACK=S++%Flags=AS%Ops=NNTNWM|NNTM)
  20307. T2(Resp=N)
  20308. T3(Resp=N)
  20309. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20310. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20311. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20312. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20313. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  20314.  
  20315. Fingerprint Sun Solaris 8
  20316. Class Sun | Solaris | 8 | general purpose
  20317. TSeq(Class=RI%gcd=<8%SI=<7FA08&>620%IPID=I%TS=U)
  20318. T1(DF=Y%W=6050%ACK=S++%Flags=AS%Ops=NWM)
  20319. T2(Resp=N)
  20320. T3(Resp=N)
  20321. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20322. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20323. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20324. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20325. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  20326.  
  20327. Fingerprint Sun Solaris 8
  20328. Class Sun | Solaris | 8 | general purpose
  20329. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  20330. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  20331. T2(Resp=N)
  20332. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20333. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20334. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20335. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20336. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20337. PU(DF=Y%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20338.  
  20339. # Sun Netra T1 - SunOS 5.8 Generic_108528-24 sun4u sparc SUNW,UltraAX-i2
  20340. # SunOS 5.8 Generic 117000-03, sun4u+sparc SUNW,UltraAX-i2
  20341. Fingerprint Sun Solaris 8
  20342. Class Sun | Solaris | 8 | general purpose
  20343. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  20344. T1(DF=Y%W=60DA%ACK=S++%Flags=AS|A%Ops=NNTNWM|NNT)
  20345. T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  20346. T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  20347. T4(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  20348. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20349. T6(DF=N%W=800|400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  20350. T7(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  20351. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20352.  
  20353. # SunOS 5.8 Generic_108528-05 sun4u sparc SUNW,Ultra-5_10
  20354. # SunOS fenix 5.8 Generic_117350-22 sun4u sparc SUNW,Sun-Fire-880
  20355. Fingerprint Sun Solaris 8
  20356. Class Sun | Solaris | 8 | general purpose
  20357. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  20358. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  20359. T2(Resp=Y%DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  20360. T3(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  20361. T4(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  20362. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20363. T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  20364. T7(DF=N%W=1000|400|800%ACK=S%Flags=AR%Ops=WNMETL)
  20365. PU(Resp=N)
  20366.  
  20367. # SunOS 5.8 Generic_108528-16 sun4u sparc SUNW,Ultra-5_10
  20368. Fingerprint Sun Solaris 8
  20369. Class Sun | Solaris | 8 | general purpose
  20370. TSeq(Class=RI%gcd=<6%SI=<A4254&>10B4%IPID=I%TS=100HZ)
  20371. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  20372. T2(Resp=N)
  20373. T3(Resp=N)
  20374. T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
  20375. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20376. T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  20377. T7(Resp=N)
  20378. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  20379.  
  20380. # Trusted Solaris 8 - SunOS SunRayServer 5.8 TS8 sun4u sparc SUNW,Ultra-60
  20381. Fingerprint Sun Trusted Solaris 8
  20382. Class Sun | Solaris | 8 | general purpose
  20383. TSeq(Class=RI%gcd=<8%SI=<AD48A&>109A%IPID=I%TS=100HZ)
  20384. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  20385. T2(Resp=N)
  20386. T3(Resp=N)
  20387. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20388. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20389. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20390. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20391. PU(DF=Y%TOS=0%IPLEN=138%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20392.  
  20393. # SunOS 5.9 Generic_117171-11 sun4u sparc SUNW,Sun-Fire-480R
  20394. Fingerprint Sun Solaris 9
  20395. Class Sun | Solaris | 9 | general purpose
  20396. TSeq(Class=TR%gcd=<6%IPID=I)
  20397. T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
  20398. T2(Resp=N)
  20399. T3(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=R%Ops=WNMETL)
  20400. T4(Resp=N)
  20401. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20402. T6(Resp=N)
  20403. T7(Resp=N)
  20404. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  20405.  
  20406. # SunOS 5.9 Generic_117171-02 sun4u sparc SUNW,Sun-Fire-V440 SPARC
  20407. # SunOS 5.9 Generic_117171-17 sun4u sparc SUNW,Sun-Fire-V440
  20408. Fingerprint Sun Solaris 9
  20409. Class Sun | Solaris | 9 | general purpose
  20410. TSeq(Class=RI%gcd=<6%SI=<2B77E4&>160F%IPID=I%TS=100HZ)
  20411. T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
  20412. T2(Resp=N)
  20413. T3(Resp=Y%DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  20414. T4(DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  20415. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20416. T6(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  20417. T7(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=WNMETL)
  20418. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  20419.  
  20420. # Solaris 9 on a V120
  20421. Fingerprint Sun Solaris 9
  20422. Class Sun | Solaris | 9 | general purpose
  20423. TSeq(Class=RI%gcd=<8%SI=<9501A&>68E%IPID=I%TS=100HZ)
  20424. T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
  20425. T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  20426. T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
  20427. T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  20428. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20429. T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  20430. T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  20431. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  20432.  
  20433. # Sun Solaris 9 Beta through Release on SPARC
  20434. # solaris 9 i386
  20435. # Solaris 9 4/04 version (SPARC)
  20436. # Solaris 10
  20437. Fingerprint Sun Solaris 9 or 10
  20438. Class Sun | Solaris | 9 | general purpose
  20439. Class Sun | Solaris | 10 | general purpose
  20440. TSeq(Class=RI%gcd=<6%SI=<A927C&>116A%IPID=I%TS=100HZ)
  20441. T1(DF=Y%W=5B4|C0B7|801B|807A%ACK=S++%Flags=AS%Ops=NNTMNW)
  20442. T2(Resp=N)
  20443. T3(Resp=N)
  20444. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20445. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20446. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20447. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  20448. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  20449.  
  20450. Fingerprint Sun Solaris 9 with TCP_STRONG_ISS set to 2
  20451. Class Sun | Solaris | 9 | general purpose
  20452. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  20453. T1(DF=N|Y%W=C0B7|8000|807A%ACK=S++%Flags=AS%Ops=NNTMNW)
  20454. T2(Resp=N)
  20455. T3(Resp=N)
  20456. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20457. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  20458. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  20459. T7(Resp=N)
  20460. PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20461.  
  20462. Fingerprint Sun RSC (Remote System Control card) v1.14 (in Solaris 2.7)
  20463. Class Sun | SunOS || general purpose
  20464. T1(DF=N%W=2000%ACK=S++|O%Flags=ARS%Ops=MNW)
  20465. T2(Resp=N)
  20466. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
  20467. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  20468. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20469. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20470. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20471. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  20472.  
  20473. Fingerprint Sun SunOS 4.0.3
  20474. Class Sun | SunOS || general purpose
  20475. TSeq(Class=64K)
  20476. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  20477. T2(Resp=N)
  20478. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  20479. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  20480. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20481. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  20482. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20483. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  20484.  
  20485. # Sun SunOS 4.1.1 - 4.1.4 (or derivative), or GatorBox CS LocalTalk/Ethernet bridge
  20486. # GatorBox CS LocalTalk/Ethernet bridge running GatorShare version 3.0.3 (build X4) software
  20487. Fingerprint Sun SunOS 4.1.1 - 4.1.4 (or derivative)
  20488. Class Sun | SunOS || general purpose
  20489. Class Gatorbox | GatorShare || bridge
  20490. TSeq(Class=64K)
  20491. T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M)
  20492. T2(Resp=N)
  20493. T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=)
  20494. T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=)
  20495. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20496. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20497. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20498. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)
  20499.  
  20500. Fingerprint Sun SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI
  20501. Class Sun | SunOS || general purpose
  20502. TSeq(Class=64K)
  20503. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL)
  20504. T2(Resp=N)
  20505. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  20506. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  20507. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20508. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  20509. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20510. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  20511.  
  20512. Fingerprint Swissvoice IP 10S VoIP phone
  20513. Class Swissvoice | embedded || VoIP phone
  20514. TSeq(Class=64K%IPID=I%TS=U)
  20515. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  20516. T2(Resp=N)
  20517. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  20518. T4(Resp=N)
  20519. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20520. T6(Resp=N)
  20521. T7(Resp=N)
  20522. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  20523.  
  20524. # Symantec SGS 5310 Firewall
  20525. Fingerprint Symantec Gateway Security 5310 Firewall
  20526. Class Symantec | embedded || firewall
  20527. TSeq(Class=TR%gcd=<6%TS=U)
  20528. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
  20529. T2(Resp=N)
  20530. T3(Resp=N)
  20531. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20532. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20533. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20534. T7(Resp=N)
  20535. PU(Resp=N)
  20536.  
  20537. # Symantec Gateway Security model 5420 (Iwill mobo)
  20538. Fingerprint Symantec Gateway Security 5420 firewall
  20539. Class Symantec | embedded || firewall
  20540. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  20541. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  20542. T2(Resp=N)
  20543. T3(Resp=N)
  20544. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20545. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20546. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20547. T7(Resp=N)
  20548. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20549.  
  20550. Fingerprint Symantec Enterprise Firewall v7.0.4 (on Solaris 8)
  20551. Class Symantec | Solaris | 8 | firewall
  20552. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  20553. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=NNTNWM)
  20554. T2(Resp=N)
  20555. T3(Resp=N)
  20556. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20557. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20558. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20559. T7(Resp=N)
  20560.  
  20561. Fingerprint Symantec Enterprise Firewall 7.0 running on Windows 2000 SP2
  20562. Class Symantec | Windows | NT/2K/XP | firewall
  20563. TSeq(Class=TR%gcd=<6%IPID=I)
  20564. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  20565. T2(Resp=N)
  20566. T3(Resp=N)
  20567. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20568. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20569. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20570. T7(Resp=N)
  20571. PU(Resp=N)
  20572.  
  20573. Fingerprint Symbol/Spectrum24 Wireless AP
  20574. Class Symbol | embedded || WAP
  20575. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  20576. T1(Resp=N)
  20577. T2(Resp=N)
  20578. T3(Resp=N)
  20579. T4(Resp=N)
  20580. T5(DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=)
  20581. T6(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=)
  20582. T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=)
  20583. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20584.  
  20585. # http://www.systech.com/catalog/RCS3000Entry.html
  20586. # RCS/3182 - Firmware rev. 06D (Apr 26 2001 15:15:33) - OS ver. RCS_3000_BDNL Version 06F (May 18 2001 16:15:18)
  20587. Fingerprint Systech RCS/3182 Ethernet serial port server (firmware 06D)
  20588. Class Systech | embedded || specialized
  20589. TSeq(Class=64K%IPID=I%TS=U)
  20590. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  20591. T2(Resp=N)
  20592. T3(Resp=Y%DF=N%W=7FFC%ACK=O%Flags=A%Ops=)
  20593. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20594. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20595. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20596. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20597. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  20598.  
  20599. Fingerprint Tahoe OS 1.2.1 running on Tahoe router
  20600. Class Tahoe | Tahoe OS || router
  20601. TSeq(Class=RI%gcd=<8%SI=<A5A1E0&>6430%IPID=I%TS=U)
  20602. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=ME)
  20603. T2(Resp=N)
  20604. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=ASF%Ops=ME)
  20605. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20606. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20607. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20608. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20609. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20610.  
  20611. Fingerprint Tainet WANpro 2000i Broadband router
  20612. Class Tainet | embedded || broadband router
  20613. TSeq(Class=64K%IPID=I%TS=U)
  20614. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  20615. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  20616. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  20617. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  20618. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20619. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20620. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20621. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  20622.  
  20623. # Talaris 1794 Printstation, firmware version 4.3.2, released 6/21/93
  20624. Fingerprint Talaris 1794 Printstation
  20625. Class Talaris | embedded || printer
  20626. TSeq(Class=RI%gcd=<6%SI=<4010&>8F%IPID=BI%TS=U)
  20627. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  20628. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20629. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20630. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20631. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20632. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20633. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20634. PU(Resp=N)
  20635.  
  20636. Fingerprint Tally 9112 Printer
  20637. Class Tally | embedded || printer
  20638. TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
  20639. T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  20640. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20641. T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  20642. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  20643. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20644. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  20645. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20646. PU(Resp=N)
  20647.  
  20648. Fingerprint Tallycom+ Print Server
  20649. Class Tally | embedded || printer
  20650. TSeq(Class=i800%IPID=I%TS=U)
  20651. T1(DF=N%W=1C20%ACK=S++%Flags=AS%Ops=M)
  20652. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20653. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20654. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20655. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20656. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20657. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20658. PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20659.  
  20660. Fingerprint Tandberg X-terminal
  20661. Class Tandberg | embedded || X terminal
  20662. TSeq(Class=64K)
  20663. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  20664. T2(Resp=N)
  20665. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
  20666. T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
  20667. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20668. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20669. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20670. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  20671.  
  20672. Fingerprint Tandem NSK D39
  20673. Class Tandem | Tandem NSK || general purpose
  20674. TSeq(Class=64K%gcd=<6%SI=<14)
  20675. T1(DF=N%W=0|2000%ACK=S++%Flags=AR|AS%Ops=|M)
  20676. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20677. T3(Resp=Y%DF=N%W=0|2000%ACK=S++|O%Flags=AR|A%Ops=)
  20678. T4(DF=N%W=0|2000%ACK=O%Flags=R%Ops=)
  20679. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20680. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20681. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20682. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  20683.  
  20684. Fingerprint Tandem NSK D40
  20685. Class Tandem | Tandem NSK || general purpose
  20686. TSeq(Class=64K)
  20687. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  20688. T2(Resp=N)
  20689. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  20690. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  20691. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20692. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20693. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20694. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  20695.  
  20696. # Tektronix Phaser 350 firmware 3.3 (printer)
  20697. Fingerprint Tektronix Phaser 350 printer
  20698. Class Tektronix | embedded || printer
  20699. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20700. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20701. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  20702. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20703. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20704. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20705. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20706. PU(Resp=N)
  20707.  
  20708. Fingerprint Tektronix Phaser 560 printer
  20709. Class Tektronix | embedded || printer
  20710. TSeq(Class=RI%gcd=<6%SI=<8C8C0&>B05%IPID=I%TS=U)
  20711. T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=M)
  20712. T2(Resp=N)
  20713. T3(Resp=Y%DF=N%W=1%ACK=S++%Flags=AS%Ops=M)
  20714. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20715. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20716. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20717. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20718. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20719.  
  20720. # From a Tektronix Phaser 350
  20721. #  Tektronix Phaser printer with shared Ethernet card, firmware version 3.01
  20722. Fingerprint Tektronix Phaser printer
  20723. Class Tektronix | embedded || printer
  20724. TSeq(Class=RI%gcd=<F%SI=>888&<4444)
  20725. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  20726. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20727. T3(Resp=Y%DF=N%W=0|1000%ACK=S++|O%Flags=AR|AS%Ops=|M)
  20728. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20729. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20730. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20731. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20732. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20733.  
  20734. # Tektronix Phaser 860 Printer
  20735. # Tektronix Phaser 840
  20736. Fingerprint Tektronix Phaser printer
  20737. Class Tektronix | embedded || printer
  20738. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20739. T2(Resp=N)
  20740. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  20741. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20742. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20743. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20744. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20745. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20746.  
  20747. # Tektronix Phaser 360 Extended
  20748. # Tektronix Phaser 750
  20749. Fingerprint Tektronix/Xerox Phaser printer
  20750. Class Tektronix | embedded || printer
  20751. TSeq(Class=i800)
  20752. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME)
  20753. T2(Resp=N)
  20754. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
  20755. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20756. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20757. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20758. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20759. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20760.  
  20761. Fingerprint Telebit NetBlazer router version 3.0
  20762. Class Telebit | embedded || router
  20763. TSeq(Class=TD%gcd=<100004%SI=<3C)
  20764. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  20765. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20766. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
  20767. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20768. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20769. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20770. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20771. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20772.  
  20773. Fingerprint Telebit NetBlazer router Version 3.05
  20774. Class Telebit | embedded || router
  20775. TSeq(Class=TD%gcd=40000|80000|C0000%SI=<BB)
  20776. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  20777. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20778. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
  20779. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  20780. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20781. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  20782. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20783. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20784.  
  20785. # (Telebit router - 18 async/1 ether)
  20786. # Telebit NetBlazer router Version 3.1, patch level 13
  20787. Fingerprint Telebit NetBlazer router Version 3.1
  20788. Class Telebit | embedded || router
  20789. TSeq(Class=TD|TR%gcd=40000|80000|C0000|100000|200000%SI=<FF)
  20790. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  20791. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20792. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  20793. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20794. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20795. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20796. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20797. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20798.  
  20799. # Telindus 1124  ADSL router
  20800. Fingerprint Telindus 11xx ADSL Router
  20801. Class Telindus | embedded || broadband router
  20802. TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
  20803. T1(DF=N%W=1F40|3E80%ACK=S++%Flags=AS%Ops=M)
  20804. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  20805. T3(Resp=Y%DF=N%W=1F40|3E80%ACK=S++%Flags=AS%Ops=M)
  20806. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  20807. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  20808. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  20809. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  20810. PU(Resp=N)
  20811.  
  20812. Fingerprint Telocity (DirectTVDSL) Gateway x2 Model
  20813. Class Telocity | embedded || broadband router
  20814. TSeq(Class=64K%IPID=I%TS=U)
  20815. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=MNW)
  20816. T2(Resp=N)
  20817. T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
  20818. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  20819. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20820. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20821. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20822. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  20823.  
  20824. Fingerprint Telos Zephyr Xstream v2.71p ISDN/POTS/Ethernet audio transceiver
  20825. Class Telos | embedded || media device
  20826. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  20827. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20828. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  20829. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20830. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20831. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20832. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20833. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20834.  
  20835. # Signal Network Technology Co, Ltd, VoIP appliance model sp100x running firmware version SP100X3.0.1
  20836. Fingerprint CPV Telsey Broadband + voip residential gateway or Signal SP100x VoIP appliance
  20837. Class Telsey | embedded || broadband router
  20838. Class Signal | embedded || VoIP gateway
  20839. TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U)
  20840. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  20841. T2(Resp=N)
  20842. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  20843. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20844. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20845. T6(Resp=N)
  20846. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20847. PU(Resp=N)
  20848.  
  20849. Fingerprint Teltrend (aka Securicor 3net) Router
  20850. Class Teltrend | embedded || router
  20851. TSeq(Class=TD%gcd=388|710%SI=<F)
  20852. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  20853. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20854. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  20855. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  20856. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20857. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  20858. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20859. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20860.  
  20861. Fingerprint Terayon Tj715x cable modem
  20862. Class Terayon | embedded || broadband router
  20863. TSeq(Class=TD%gcd=<1364%SI=<1E%IPID=I%TS=U)
  20864. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
  20865. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20866. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  20867. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20868. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20869. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20870. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20871. PU(Resp=N)
  20872.  
  20873. Fingerprint Thales WebSentry HSM Crypto Accelerator
  20874. Class Thales | embedded || encryption accelerator
  20875. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  20876. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  20877. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  20878. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  20879. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  20880. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  20881. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  20882. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  20883. PU(Resp=N)
  20884.  
  20885. # Speed touch 500 Series ADSL Router(Linux embeded)
  20886. # Thomson SpeedTouch 510 Broadband Router, with firmware 4.2.7.16.0
  20887. # Thomson SpeedTouch 510 DSL Router: 0344EGGNP  4.2.3.0.0  LLT6AA4.230
  20888. # Thompson SpeedTouch 510 dsl router - software version  4.2.3.0.
  20889. # Firmware 4.2.3.0.0 on Thomson (ex-Alcatel) SpeedTouch 510v4/530 DSL modem.
  20890. # Thomson Speedtouch 530 ADSL modem/router, firmware 4.2.7.16.0, board ADNT-Q
  20891. Fingerprint Thomson Speed Touch 500 Series or 610i *DSL modem
  20892. Class Thomson | embedded || broadband router
  20893. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  20894. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  20895. T2(Resp=N)
  20896. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  20897. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  20898. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20899. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20900. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20901. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  20902.  
  20903. Fingerprint Thomson THG 520 Cable Modem
  20904. Class Thomson | embedded || broadband router
  20905. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  20906. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  20907. T2(Resp=N)
  20908. T3(Resp=N)
  20909. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20910. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20911. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20912. T7(Resp=N)
  20913. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  20914.  
  20915. # Toshiba DOCSIS Cable Modem: HW_REV: 7.1; SW_REV: 1.8.017
  20916. Fingerprint Toshiba DOCSIS Cable Modem
  20917. Class Toshiba | embedded || broadband router
  20918. TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U)
  20919. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  20920. T2(Resp=N)
  20921. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  20922. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20923. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20924. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20925. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20926. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  20927.  
  20928. Fingerprint Toshiba TR650 ISDN Router
  20929. Class Toshiba | embedded || broadband router
  20930. TSeq(Class=TD%gcd=<9%SI=<14)
  20931. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  20932. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20933. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  20934. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  20935. T5(Resp=N)
  20936. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  20937. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20938. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  20939.  
  20940. Fingerprint Toshiba estudio 4511 Multifunction Copier/Fax/Scanner/Printer
  20941. Class Toshiba | embedded || printer
  20942. TSeq(Class=RI%gcd=<6%SI=<4831A2C&>78B67%IPID=I%TS=U)
  20943. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  20944. T2(Resp=N)
  20945. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  20946. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20947. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20948. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20949. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20950. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  20951.  
  20952. # Treck Inc. TCP/IP stack (v2.1) on Orbacom T5 System Manager card (CPC-CAD)
  20953. Fingerprint Treck TCP/IP stack v2.1
  20954. Class Treck | Treck || general purpose
  20955. TSeq(Class=TD%gcd=<3D094%SI=<DC%IPID=I%TS=U)
  20956. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=ME)
  20957. T2(Resp=N)
  20958. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=ME)
  20959. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20960. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20961. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20962. T7(Resp=N)
  20963. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  20964.  
  20965. # http://www.turtlebeach.com/site/products/audiotron/producthome.asp
  20966. Fingerprint Turtle Beach AudioTron 100 network MP3 player or Microsoft Windows 98SE
  20967. Class Turtle Beach | embedded || media device
  20968. Class Microsoft | Windows | 95/98/ME | general purpose
  20969. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
  20970. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  20971. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  20972. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  20973. T4(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
  20974. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20975. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20976. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20977. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20978.  
  20979. # Turtle Beach AudioTron with firmware 3.0.0
  20980. Fingerprint Turtle Beach AudioTron network MP3 player
  20981. Class Turtle Beach | embedded || media device
  20982. TSeq(Class=TD%gcd=<68%SI=<14%IPID=BI%TS=U)
  20983. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  20984. T2(Resp=N)
  20985. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  20986. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20987. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20988. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  20989. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  20990. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  20991.  
  20992. # AudioTron with 3.0.26 Firmware
  20993. Fingerprint Turtle Beach AudioTron network MP3 player
  20994. Class Turtle Beach | embedded || media device
  20995. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=RPI|RD%TS=U)
  20996. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  20997. T2(Resp=N)
  20998. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  20999. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  21000. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21001. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21002. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21003. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21004.  
  21005. Fingerprint US Robotics Total Control NETServer Card
  21006. Class US Robotics | embedded || terminal server
  21007. TSeq(Class=C%Val=7F)
  21008. T1(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21009. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  21010. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21011. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  21012. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21013. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  21014. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  21015. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  21016.  
  21017. # U.S. Robotics Broadband Router (Model # 8000-02, Version V2.5)
  21018. Fingerprint US Robotics Broadband router (model #8000-02)
  21019. Class US Robotics | embedded || WAP
  21020. TSeq(Class=TD%gcd=<130%SI=<1E%IPID=BI%TS=U)
  21021. T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  21022. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  21023. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  21024. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  21025. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  21026. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  21027. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  21028. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21029.  
  21030. Fingerprint US Robotics USR8022 Broadband Wireless router (WAP)
  21031. Class US Robotics | embedded || WAP
  21032. TSeq(Class=TD|RI%gcd=<68%SI=<636%IPID=I%TS=U)
  21033. T1(DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
  21034. T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=)
  21035. T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=)
  21036. T4(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=)
  21037. T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
  21038. T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=)
  21039. T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=)
  21040. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21041.  
  21042. # UTStarcom F1000 wifi voip phone Phone OS: VxWorks (for Hornet VoWifi, ARM946ES (LE) Factory Firmware) version 5.5.1.: Kernel: WIND version 2.6. : Made on Apr  5 2005, 14:49:39.
  21043. Fingerprint UTStarcom F1000 wifi voip phone
  21044. Class UTStarcom | embedded || VoIP phone
  21045. TSeq(Class=TR%gcd=<6%IPID=I)
  21046. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  21047. T2(Resp=N)
  21048. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  21049. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21050. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21051. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21052. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21053. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  21054.  
  21055. Fingerprint MOTOROLA VANGUARD 320 IP router running OS version 5.4
  21056. Class Vanguard | embedded || router
  21057. TSeq(Class=TD%gcd=<6%SI=<1E)
  21058. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
  21059. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21060. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21061. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21062. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21063. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21064. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21065. PU(Resp=N)
  21066.  
  21067. Fingerprint Motorola Vanguard 320 multi-protocol network access device V5.5 - 5.6
  21068. Class Vanguard | embedded || router
  21069. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  21070. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
  21071. T2(Resp=N)
  21072. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21073. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21074. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21075. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21076. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21077. PU(Resp=N)
  21078.  
  21079. # Vega 400 SIP Version: 10.02.07.1
  21080. Fingerprint Vega 50/400
  21081. Class Vegastream | embedded || VoIP gateway
  21082. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  21083. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  21084. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21085. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  21086. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21087. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21088. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21089. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21090. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21091.  
  21092. Fingerprint VersaNet ISP-Accelerator(TM) Remote Access Server
  21093. Class VersaNet | embedded || terminal server
  21094. TSeq(Class=TD%gcd=<2004%SI=<14)
  21095. T1(DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
  21096. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
  21097. T3(Resp=Y%DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
  21098. T4(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
  21099. T5(DF=Y%W=0%ACK=S++%Flags=ARF%Ops=)
  21100. T6(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
  21101. T7(DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
  21102. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21103.  
  21104. Fingerprint Virtual Access LinXpeed Pro 120 router running Software 7.4.33CM
  21105. Class Virtual Access | embedded || router
  21106. TSeq(Class=C|TD%gcd=<10004%SI=<1E%IPID=I%TS=U)
  21107. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  21108. T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  21109. T3(Resp=Y|N%DF=Y%W=1000%ACK=O%Flags=AS%Ops=M)
  21110. T4(DF=Y%W=100%ACK=O%Flags=R%Ops=)
  21111. T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=)
  21112. T6(DF=Y%W=100%ACK=O%Flags=R%Ops=)
  21113. T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  21114. PU(Resp=N)
  21115.  
  21116. # Firebox 700 Firewall - Firebox Release: andromeda;  Driver version: 7.2.B1501;  Daemon version: 7.2.B1501;  Sys_B Version: 4.61.B742;  Sys_B Version: 4.61.B742
  21117. Fingerprint WatchGuard Firebox 700 firewall
  21118. Class WatchGuard | embedded || firewall
  21119. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  21120. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  21121. T2(Resp=N)
  21122. T3(Resp=N)
  21123. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21124. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21125. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21126. T7(Resp=N)
  21127. PU(Resp=N)
  21128.  
  21129. # Watchguard Firebox II version 7.00 build 2448
  21130. Fingerprint WatchGuard Firebox II version 7.00
  21131. Class WatchGuard | embedded || firewall
  21132. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  21133. T1(DF=N%W=3FE0%ACK=S++%Flags=BAS%Ops=ME)
  21134. T2(Resp=N)
  21135. T3(Resp=N)
  21136. T4(Resp=N)
  21137. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21138. T6(Resp=N)
  21139. T7(Resp=N)
  21140. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  21141.  
  21142. # Watchguard SOHO 6tc, Firewall 6.3.2 Feb 27 2004 build 1, Boot ROM 5.6
  21143. Fingerprint WatchGuard Firebox SOHO 6tc firewall
  21144. Class WatchGuard | embedded || firewall
  21145. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  21146. T1(DF=N%W=1540%ACK=S++%Flags=AS%Ops=M)
  21147. T2(Resp=N)
  21148. T3(Resp=Y%DF=N%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
  21149. T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=)
  21150. T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
  21151. T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=)
  21152. T7(Resp=N)
  21153. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21154.  
  21155. # Watchguard SoHo 6 TC Firewall (inside)
  21156. Fingerprint WatchGuard Firebox SOHO V.5-V.6 firewall
  21157. Class WatchGuard | embedded || firewall
  21158. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  21159. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  21160. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  21161. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  21162. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  21163. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  21164. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  21165. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  21166. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21167.  
  21168. Fingerprint WatchGuard Firebox X700
  21169. Class WatchGuard | embedded || firewall
  21170. TSeq(Class=RI|TR%gcd=<6%SI=<2FFF7A6%IPID=Z|I%TS=100HZ|U)
  21171. T1(DF=Y|N%W=16A0|3FE0%ACK=S++%Flags=AS|BAS%Ops=MNNTNW|ME)
  21172. T2(Resp=N)
  21173. T3(Resp=Y%DF=Y|N%W=16A0|3FE0%ACK=S++%Flags=AS|ASF%Ops=MNNTNW|ME)
  21174. T4(Resp=N)
  21175. T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  21176. T6(Resp=N)
  21177. T7(Resp=N)
  21178. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21179.  
  21180. Fingerprint WuT Web Thermometer
  21181. Class Wiesemann & Theis | embedded || specialized
  21182. TSeq(Class=TD%gcd=<6%SI=<14%IPID=I%TS=U)
  21183. T1(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  21184. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  21185. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  21186. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  21187. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  21188. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  21189. T7(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  21190. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21191.  
  21192. Fingerprint Wooksung TelePhoSee WVP-2100 teleconference system
  21193. Class Wooksung | embedded || telecom-misc
  21194. TSeq(Class=RI%gcd=<6%SI=<18A7BDA&>3F1C4%IPID=Z%TS=100HZ)
  21195. T1(DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW)
  21196. T2(Resp=N)
  21197. T3(Resp=Y%DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW)
  21198. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  21199. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  21200. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  21201. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  21202. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21203.  
  21204. Fingerprint WTI Internet Power Switch 1.01
  21205. Class WTI | embedded || power-device
  21206. TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U)
  21207. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  21208. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  21209. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21210. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  21211. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21212. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  21213. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  21214. PU(Resp=N)
  21215.  
  21216. Fingerprint WTI Network Power Switch v3.02
  21217. Class WTI | embedded || power-device
  21218. TSeq(Class=TD%gcd=<2A%SI=<1E%IPID=I%TS=U)
  21219. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
  21220. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  21221. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  21222. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  21223. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  21224. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  21225. T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  21226. PU(Resp=N)
  21227.  
  21228. Fingerprint Winterm WYSE System Version 4.2.077
  21229. Class WYSE | WYSE OS || terminal server
  21230. TSeq(Class=64K%IPID=I%TS=U)
  21231. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M)
  21232. T2(Resp=N)
  21233. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  21234. T4(DF=N%W=F000%ACK=O%Flags=R%Ops=)
  21235. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21236. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21237. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21238. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  21239.  
  21240. # WYSE OS Firmware V4.2.137
  21241. Fingerprint WYSE Winterm terminal server
  21242. Class WYSE | WYSE OS || terminal server
  21243. TSeq(Class=64K%IPID=I%TS=U)
  21244. T1(DF=N%W=7800%ACK=S++%Flags=AS%Ops=M)
  21245. T2(Resp=N)
  21246. T3(Resp=Y%DF=N%W=7800%ACK=O%Flags=A%Ops=)
  21247. T4(DF=N%W=7800%ACK=O%Flags=R%Ops=)
  21248. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21249. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21250. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21251. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  21252.  
  21253. Fingerprint XCD Xconnect Print Server, firmware version CC8S-3.58 (98.09.21)
  21254. Class XCD | embedded || print server
  21255. TSeq(Class=TD%gcd=<272A%SI=<1E)
  21256. T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  21257. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21258. T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  21259. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  21260. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21261. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  21262. T7(Resp=N)
  21263. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  21264.  
  21265. Fingerprint Dell Laser Printer 5100cn
  21266. Class Xerox | embedded || printer
  21267. TSeq(Class=64K%IPID=I%TS=U)
  21268. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=)
  21269. T2(Resp=N)
  21270. T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
  21271. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  21272. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21273. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21274. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21275. PU(DF=N%TOS=0%IPLEN=38%RIPTL=4E4%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  21276.  
  21277. Fingerprint Xerox 8830 Plotter
  21278. Class Xerox | embedded || printer
  21279. TSeq(Class=TD%gcd=1000%SI=1)
  21280. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  21281. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  21282. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  21283. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21284. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21285. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21286. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21287. PU(Resp=N)
  21288.  
  21289. Fingerprint Xerox Document Centre 440 w/ CentreWare Internet Services
  21290. Class Xerox | embedded || printer
  21291. TSeq(Class=64K%IPID=I%TS=U)
  21292. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  21293. T2(Resp=N)
  21294. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=)
  21295. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  21296. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21297. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21298. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21299. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  21300.  
  21301. Fingerprint Xerox Document Centre ColorSeries 50
  21302. Class Xerox | embedded || printer
  21303. TSeq(Class=i800%IPID=I%TS=U)
  21304. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=ME)
  21305. T2(Resp=N)
  21306. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
  21307. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21308. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21309. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21310. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21311. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21312.  
  21313. Fingerprint Xerox DocuPrint C55
  21314. Class Xerox | embedded || printer
  21315. TSeq(Class=TD%gcd=1000|2000|3000|4000%SI=<A)
  21316. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  21317. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  21318. T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  21319. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  21320. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  21321. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  21322. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  21323. PU(Resp=N)
  21324.  
  21325. Fingerprint Xerox Docuprint N2125 network printer
  21326. Class Xerox | embedded || printer
  21327. TSeq(Class=64K%IPID=I%TS=U)
  21328. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  21329. T2(Resp=N)
  21330. T3(Resp=N)
  21331. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  21332. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21333. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21334. T7(Resp=N)
  21335. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  21336.  
  21337. Fingerprint Xerox DocuPrint N24/N32/N40 Network Laser Printer
  21338. Class Xerox | embedded || printer
  21339. TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U)
  21340. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  21341. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  21342. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  21343. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21344. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21345. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21346. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21347. PU(Resp=N)
  21348.  
  21349. Fingerprint Xerox DocuPrint N40
  21350. Class Xerox | embedded || printer
  21351. TSeq(Class=TD%gcd=<2004%SI=<8C)
  21352. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  21353. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  21354. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  21355. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21356. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21357. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21358. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21359. PU(Resp=N)
  21360.  
  21361. Fingerprint xMach free distributed OS version 0.1 current
  21362. Class xMach | xMach || general purpose
  21363. TSeq(Class=64K%IPID=I%TS=2HZ)
  21364. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  21365. T2(Resp=N)
  21366. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  21367. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21368. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21369. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21370. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21371. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  21372.  
  21373. Fingerprint Xylan OmniSwitch 5x/9x Ethernet switch, Xylogics Annex-III Comm server R10.0, or Hitachi HI-UX/WE2
  21374. Class Xylan | embedded || switch
  21375. Class Xylogics | embedded || terminal server
  21376. Class Hitachi | HI-UX || general purpose
  21377. TSeq(Class=64K)
  21378. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  21379. T2(Resp=N)
  21380. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  21381. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  21382. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21383. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21384. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21385. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  21386.  
  21387. Fingerprint Xylogics Micro Annex ELS terminal server x7.1.8
  21388. Class Xylogics | embedded || terminal server
  21389. TSeq(Class=64K)
  21390. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
  21391. T2(Resp=N)
  21392. T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
  21393. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  21394. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21395. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21396. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21397. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  21398.  
  21399. Fingerprint Xylogics Remote Annex 4000 terminal server running LynxOS realtime OS
  21400. Class Xylogics | LynxOS || terminal server
  21401. TSeq(Class=64K)
  21402. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  21403. T2(Resp=N)
  21404. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  21405. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  21406. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21407. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21408. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21409. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  21410.  
  21411. Fingerprint Xyplex Network 9000 terminal server
  21412. Class Xyplex | embedded || terminal server
  21413. TSeq(Class=TD%gcd=<6%SI=<6)
  21414. T1(Resp=Y%DF=Y%W=100%ACK=S++%Flags=AS%Ops=M)
  21415. T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  21416. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21417. T4(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  21418. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  21419. T6(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  21420. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21421. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21422.  
  21423. # Fingerprint Xyplex Terminal Server/Xyplex hardware CSERV-20 11.00.00 ROM 410000/Xyplex software Terminal Server v6.0.4 (info frm SNMP)
  21424. Fingerprint Xyplex Terminal Server CSERV-20 software v6.0.4
  21425. Class Xyplex | embedded || terminal server
  21426. TSeq(Class=TD%gcd=<2714%SI=<258%IPID=I%TS=U)
  21427. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  21428. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21429. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21430. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21431. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21432. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21433. T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21434. PU(Resp=N)
  21435.  
  21436. Fingerprint Xyplex Terminal Server v6.0.2S5
  21437. Class Xyplex | embedded || terminal server
  21438. TSeq(Class=TD%gcd=1388%SI=<F)
  21439. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  21440. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21441. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21442. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21443. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21444. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21445. T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21446. PU(Resp=N)
  21447.  
  21448. Fingerprint Xyplex 1600 terminal server running MAXserver V6.0.2 firmware
  21449. Class Xyplex | MAXserver || terminal server
  21450. TSeq(Class=C|TD%gcd=<5%SI=<5)
  21451. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  21452. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21453. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21454. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21455. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21456. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21457. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21458. PU(Resp=N)
  21459.  
  21460. Fingerprint Xyplex Maxserver 1600 Terminal Server
  21461. Class Xyplex | MAXserver || terminal server
  21462. TSeq(Class=TD%gcd=<EA64%SI=<C8%IPID=I%TS=U)
  21463. T1(DF=N%W=0|100%ACK=S++%Flags=BAR|AS%Ops=|M)
  21464. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21465. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21466. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21467. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21468. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21469. T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  21470. PU(Resp=N)
  21471.  
  21472. Fingerprint Zcomax Wireless Access Point XI-1500
  21473. Class Zcomax | embedded || WAP
  21474. TSeq(Class=TD%gcd=<D24%SI=<14%IPID=I%TS=U)
  21475. T1(Resp=N)
  21476. T2(Resp=N)
  21477. T3(Resp=N)
  21478. T4(Resp=N)
  21479. T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
  21480. T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)
  21481. T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
  21482. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21483.  
  21484. # Zebra Technologies ZTC TLP2844-Z-200dpi
  21485. Fingerprint Zebra Technologies TLP2844-Z printer
  21486. Class Zebra | embedded || printer
  21487. TSeq(Class=C%Val=14001%IPID=I%TS=U)
  21488. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  21489. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21490. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21491. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21492. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21493. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21494. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21495. PU(Resp=N)
  21496.  
  21497. Fingerprint ZoomAir IG-4165 Wireless gateway (WAP)
  21498. Class ZoomAir | embedded || WAP
  21499. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  21500. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  21501. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  21502. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  21503. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  21504. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  21505. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  21506. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  21507. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21508.  
  21509. Fingerprint Hardware: ZyXel Prestige Broadband router
  21510. Class ZyXel | ZyNOS || broadband router
  21511. T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
  21512. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21513. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21514. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21515. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21516. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21517. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21518. PU(Resp=N)
  21519.  
  21520. Fingerprint ZyXel 944S Prestige router
  21521. Class ZyXel | ZyNOS || broadband router
  21522. T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
  21523. T2(Resp=N)
  21524. T3(Resp=N)
  21525. T4(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=)
  21526. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21527. T6(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=)
  21528. T7(Resp=N)
  21529. PU(Resp=N)
  21530.  
  21531. Fingerprint ZyXel P480 ISDN router running ZyNOS v2.42(O.00)
  21532. Class ZyXel | ZyNOS || broadband router
  21533. TSeq(Class=TD%gcd=<2004%SI=<1E)
  21534. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  21535. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21536. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21537. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21538. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21539. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21540. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21541. PU(Resp=N)
  21542.  
  21543. # ZyXel Prestige 642R-11 (analog ADSL router) ZyNOS F/W Version: V2.50(AJ.9)
  21544. Fingerprint ZyXel Prestige 642R-11 ASDL router running ZyNOS
  21545. Class ZyXel | ZyNOS || broadband router
  21546. TSeq(Class=TD%gcd=<F0004%SI=<14%IPID=I%TS=U)
  21547. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  21548. T2(Resp=N)
  21549. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21550. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21551. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21552. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21553. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21554. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21555.  
  21556. Fingerprint ZyXel Prestige 643 router
  21557. Class ZyXel | ZyNOS || broadband router
  21558. T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
  21559. T2(Resp=N)
  21560. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21561. T4(Resp=N)
  21562. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21563. T6(Resp=N)
  21564. T7(Resp=N)
  21565. PU(Resp=N)
  21566.  
  21567. # ZyXel Prestige 700 broadband router
  21568. # Netgear MR314 Cable/Wireless Router
  21569. Fingerprint ZyXel Prestige 700/Netgear MR314 Broadband router
  21570. Class ZyXel | ZyNOS || broadband router
  21571. T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
  21572. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21573. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21574. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21575. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21576. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21577. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21578. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21579.  
  21580. Fingerprint ZyXel Prestige 791R
  21581. Class ZyXel | ZyNOS || broadband router
  21582. TSeq(Class=i800%IPID=I%TS=U)
  21583. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  21584. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21585. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21586. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21587. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21588. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21589. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21590. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21591.  
  21592. # ZyXel P128imh or P480 router (ZyNOS)
  21593. # ZyNOS F/W Version: V2.50(AJ.7) | 2/28/2002
  21594. # ZyXel Prestige 645-R11 adsl router
  21595. # Intel Express 8100 Router ISDN
  21596. Fingerprint ZyXel ZyNOS based Broadband router (ZyNOS) or Intel Express ISDN router
  21597. Class ZyXel | ZyNOS || broadband router
  21598. Class Intel | embedded || broadband router
  21599. TSeq(Class=TD%gcd=1000|2000|5000|4000|6000|8000|A000|78000|1A4000%SI=<FF%IPID=I%TS=U)
  21600. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  21601. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21602. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21603. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21604. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21605. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21606. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21607. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21608.  
  21609. # ZyXel ZyWALL 1 running ZyNOS Version V3.60(WD.3) | 05/24/2004
  21610. Fingerprint ZyXel ZyWALL 1 firewall
  21611. Class ZyXel | ZyNOS || firewall
  21612. TSeq(Class=TD%gcd=<2004%SI=<46%IPID=I%TS=U)
  21613. T1(DF=N%W=B680%ACK=S++%Flags=AS%Ops=M)
  21614. T2(Resp=N)
  21615. T3(Resp=N)
  21616. T4(Resp=N)
  21617. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21618. T6(Resp=N)
  21619. T7(Resp=N)
  21620. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21621.  
  21622. # ZyXel Zywall 10W (Firmware V3.62(WH.7))
  21623. Fingerprint ZyXel Zywall 10W firewall
  21624. Class ZyXel | ZyNOS || firewall
  21625. TSeq(Class=TD%gcd=<2004%SI=<3C%IPID=I%TS=U)
  21626. T1(DF=N%W=5780%ACK=S++%Flags=AS%Ops=M)
  21627. T2(Resp=N)
  21628. T3(Resp=N)
  21629. T4(Resp=N)
  21630. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21631. T6(Resp=N)
  21632. T7(Resp=N)
  21633. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21634.  
  21635. # ZyXel ZyWALL 50 running ZyNOS V3.52(WC.2)C0 | 05/02/2003
  21636. Fingerprint ZyXel ZyWALL 50 (ZyNOS 3.52)
  21637. Class ZyXel | ZyNOS || firewall
  21638. TSeq(Class=TD%gcd=<F0004%SI=<1E%IPID=I%TS=U)
  21639. T1(DF=N%W=B680%ACK=S++%Flags=AS%Ops=M)
  21640. T2(Resp=N)
  21641. T3(Resp=N)
  21642. T4(Resp=N)
  21643. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21644. T6(Resp=N)
  21645. T7(Resp=N)
  21646. PU(Resp=N)
  21647.  
  21648. # ZyNOS version: V3.50(DT.5) | 07/06/2004 on a ZyXel ES-3024 switch
  21649. Fingerprint ZyXel switch ES-3024 ZyNOS V3.50
  21650. Class ZyXel | ZyNOS || switch
  21651. TSeq(Class=i800%IPID=I%TS=U)
  21652. T1(DF=N%W=5780%ACK=S++%Flags=AS%Ops=M)
  21653. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21654. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21655. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21656. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21657. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  21658. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  21659. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  21660.  
  21661. # ZyXel ZyAir B-4000 Wireless Lan Access Point with 4 port switch running ZyNOS
  21662. Fingerprint ZyXel ZyAir B-4000 Wireless Lan Access Point
  21663. Class ZyXel | ZyNOS || WAP
  21664. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  21665. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21666. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  21667. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  21668. T5(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  21669. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  21670. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  21671. PU(Resp=N)
  21672.