# Nmap OS Fingerprint List. -*- mode: fundamental; -*- # $Id: nmap.prints,v 1.7 2005/09/24 22:49:05 provos Exp $ # # Contributions to this database are welcome. If Nmap obtains a new # fingerprint (and test conditions are favorable), it will print out a # URL you can use to submit the fingerprint. If Nmap guesses wrong, # please send the full Nmap output and the exact destination host OS # name and version to fyodor@insecure.org . Thanks! # # By submitting fingerprints you are transfering any and all copyright # interest in the data to Fyodor so that he can modify it, relicense it, # incorporate it into programs, etc. # # This collection of fingerprint data is (C) 1998-2003 by # Insecure.Com LLC. This data is available for # free use by open source software under the terms of the GNU General # Public License. We also license the data to selected # commercial/proprietary vendors under less restrictive terms. # Contact sales@insecure.com for more information. # # TEST DESCRIPTION: # Tseq is the TCP sequenceability test # T1 is a SYN packet with a bunch of TCP options to open port # T2 is a NULL packet w/options to open port # T3 is a SYN|FIN|URG|PSH packet w/options to open port # T4 is an ACK to open port w/options # T5 is a SYN to closed port w/options # T6 is an ACK to closed port w/options # T7 is a FIN|PSH|URG to a closed port w/options # PU is a UDP packet to a closed port Fingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0 Class 2Wire | embedded || WAP TSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com Access Builder 4000 Switch Class 3Com | embedded || switch T1(DF=N%W=0|800%ACK=S++%Flags=AR|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint 3Com terminal server ESPL CS2100 Class 3Com | embedded || terminal server TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # 3Com NBX Superstack 3 IP PBX running firmware 4_1_11 # 3com NBX-100 (version R4_1_4) Phone System Processor Fingerprint 3Com NBX PBX Class 3Com | embedded || PBX TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint 3com Office Connect Router 810 Class 3Com | embedded || router TSeq(Class=TD%gcd=<186A4%SI=<14) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint 3Com OfficeConnect Remote 812 ADSL Router Class 3Com | embedded || broadband router TSeq(Class=TD%gcd=<C354%SI=<1E) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Switch 1100, 3300 Fingerprint 3Com SuperStack II switch (OS v 2.0) Class 3Com | embedded || switch TSeq(Class=C) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com SuperStack II switch SW/NBSI-CF,11.1.0.00S38 Class 3Com | embedded || switch TSeq(Class=TD%gcd=<68%SI=<3C) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com Netbuilder & Netbuilder II router OS v8.1 Class 3Com | embedded || router TSeq(Class=TD%gcd=32|64|96%SI=<FF) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) # 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1) Fingerprint 3Com Netbuilder Remote Office 222 router Class 3Com | embedded || router TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1) Class 3Com | embedded || router TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint 3Com Netbuilder II Router Ver 11.4.0.51 Class 3Com | embedded || router TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com NetBuilder-II, OS version SW/NB2M-BR-5.1.0.27 Class 3Com | embedded || router TSeq(Class=TD%gcd=32|64|96%SI=<F) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS|AP%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint 3Com NetBuilder & NetBuilder II OS v 9.3 Class 3Com | embedded || router TSeq(Class=TD%gcd=3C%SI=<FF) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) # 3COM Sharkfin/Tailfin Cable Modem boot code 01.00.003a main image 1.17 hardware 2.00 web 604 Fingerprint 3Com Sharkfin/Tailfin Cable Modem Class 3Com | embedded || broadband router TSeq(Class=TD%gcd=<D6DC%SI=<14%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint 3Com Sharkfin/Tailfin Cable Modem Class 3Com | embedded || broadband router TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint 4.3BSD-tahoe on a MicroVax III Class DEC | BSD-misc || general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Dell Powervault 132T Automated Tape Library Class Dell | embedded || storage-misc TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # DELL PowerVault 132T Library (Firmware 103D.GY001) Fingerprint Dell Powervault 132T Automated Tape Library Class Dell | embedded || storage-misc TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=578%ACK=O%Flags=A%Ops=) T4(DF=N%W=578%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Tested ACC Amazon 9.2.29, ACC Congo 9.2.35 Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator Class ACC | embedded || router TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Alteon Networks ACEswitch 180e Software Version 8.0.62.7 Class Alteon | embedded || load balancer TSeq(Class=RI%gcd=<14%SI=<D45BC&>85A%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Actiontec 1520 DSL gateway with GlobespanVirata chipset hardware version RD6700 BSP v1.1 (ISOS 8.2) / He100/2xx CSP v2.3, firmware version 8.2.0.16 Fingerprint Actiontec 1520 DSL gateway firmware 8.2.0.16 Class Actiontec | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U) T1(DF=N%W=1194%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=1194%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=1194%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Avaya G3 PBX version 8.3 Class Avaya | embedded || PBX TSeq(Class=RI%gcd=<6%SI=<652372&>89CC%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Avaya TN2302 Prowler/Medpro H.323 gateway HW03/FW022 Fingerprint Avaya TN2302 Prowler/Medpro H.323 gateway Class Avaya | embedded || telecom-misc TSeq(Class=TD%gcd=<6%SI=<14%IPID=I) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SMC Barricade Wireless Broadband Router (firmware R1.93e) # D-LINK DL-707 Cable/DSL Router Fingerprint SMC Barricade or D-Link DL-707 Wireless Broadband Router Class D-Link | embedded || WAP TSeq(Class=TD%gcd=<130%SI=<1E%IPID=RD|I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SMC Barricade Wireless Broadband Router (firmware R1.93e) Class SMC | embedded || WAP TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # SMC Barricade7004VBR Boot Code v1.05 # SMC 7004VBR broadband router - firmware v1.2 # SMC Wireless AP 7004WFW # SMC7004vwbr Barricade Wireless Cable/DSL Broadband Router Fingerprint SMC Barricade DSL Router/Modem/Wireless AP Class SMC | embedded || WAP TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SMC Barricade Router, firmware 1.94a Class SMC | embedded || WAP TSeq(Class=TD%gcd=<68%SI=<32%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Cisco 350 Access Point, software rev 12.02T1 # Accelerated Networks VoDSL - But what sort of device? Fingerprint SonicWall SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL, or Cisco 360 Access Point Class SonicWall | embedded || firewall Class Enterasys | embedded || switch Class Cisco | embedded || WAP TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Acorn RISC OS 3.60 (Acorn TCP/IP Stack 4.07) Class Acorn | Risc OS || general purpose TSeq(Class=TR) T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd) Class Acorn | Risc OS || general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # AGE Logic, Inc. IBM X-Station Fingerprint AGE Logic, Inc. IBM XStation Class IBM | embedded || X terminal TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge Class Aironet | embedded || bridge TSeq(Class=C%Val=0) T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps wireless access point Class Aironet | embedded || WAP TSeq(Class=TR%gcd=<6) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Aironet Wireless Bridge running firmware V5.0J Class Aironet | embedded || bridge TSeq(Class=C|TR) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=) T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint IBM AIX 3.2 Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2 Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2 running on RS/6000 Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2.3 running on RS6000 model 560 Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 3.2.5 (Bull HardWare) Class IBM | AIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.0 - 4.2 Class IBM | AIX | 4.X | general purpose TSeq(Class=64K) T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AIX 4.02.0001.0000 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AIX v4.2 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E) Fingerprint IBM AIX 4.1-4.1.5 Class IBM | AIX | 4.X | general purpose TSeq(Class=64K) T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX v4.1 running on a C10 Class IBM | AIX | 4.X | general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AIX 4.1 Class IBM | AIX | 4.X | general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.2 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR) T1(DF=N%W=FFAF|FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.2-4.3.3 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR) T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.2.X-4.3.3.0 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%IPID=I%TS=U) T1(DF=N|Y%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Fingerprint IBM AIX 4.3.3 on an RS/6000 H50 # Fingerprint IBM AIX 4.3.3 on a p660-6M1 # IBM AIX 4.3.3 ML10 Fingerprint IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/* Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0|F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM 8239 Token-Ring Stackable Hub Class IBM | embedded || hub TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4R2M0 Class IBM | OS/400 | V4 | general purpose TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4R5M0 Class IBM | OS/400 | V4 | general purpose T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IBM proprietary operating system for AS/400 systems (now known as "iSeries") Fingerprint IBM OS/400 V5R1M0 Class IBM | OS/400 | V5 | general purpose TSeq(Class=RI%gcd=<24%SI=<19DCD2&>6D3%IPID=I) T1(DF=N|Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V5R2M0 Class IBM | OS/400 | V5 | general purpose TSeq(Class=RI%gcd=<24%SI=<41D304&>7BC%IPID=I) T1(DF=N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # OS/400 V5R1M0 w/ C2134 + Autumn '02 Hiper, DB & Java Fingerprint IBM OS/400 V5R1M0 Class IBM | OS/400 | V5 | general purpose TSeq(Class=TD%gcd=<22222%SI=<14%IPID=I%TS=1000HZ) T1(DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Fingerprint IBM-RS/6000 7017-S80 AIX-Version 4.3.3.0 Fingerprint IBM AIX 4.3.3.0 on an IBM RS/* Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.3 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX Version 4.3 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1 on a p610-6C1 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Fingerprint IBM AIX 5.1.0.0 maintenance level 3 Fingerprint IBM AIX 5.1 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0|4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Alcatel 1000 ADSL (modem) Class Alcatel | embedded || broadband router TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Alcatel 1000 DSL Router Class Alcatel | embedded || broadband router TSeq(Class=RI%gcd=<5%SI=>AAA&<AAAAA) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Alcatel Advanced Reflexes IP Phone, Version: E/AT400/46.8 Class Alcatel | embedded || VoIP phone TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint Alcatel OmniStack switch version 4.3.3 GA Class Alcatel | embedded || switch TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Alcaltel Speed Touch Home running GV8BAA3.235 (992640) # Alcatel SpeedTouch Pro ADSL Router running NZ OS 3.281 # Alcatel Speed Touch Home ADSL Modem (POTS), Ver 3.2 Fingerprint Alcatel Speed Touch *DSL modem/router Class Alcatel | embedded || broadband router TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E|F%ULEN=134%DAT=E) # Alcaltel Speed Touch 510 *DSL router (uses THOMSON Unix embeded Version 4.0.0.9.0) Fingerprint Alcatel Speed Touch 510 *DSL modem/router Class Alcatel | embedded || broadband router TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub Class Allied Telesyn | embedded || hub TSeq(Class=C) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA Class Allied Telesyn | embedded || switch TSeq(Class=TD%gcd=FA|1F4%SI=<FFF) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Allied Telesyn AT-RP24i Rapier 24i version 2.3.1-04 # Ericsson Home internet Solution ver. 2.0 Fingerprint Allied Telesyn AT-RP24i switch or Ericcson HiS V2.0 Class Allied Telesyn | embedded || switch TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Alteon AceSwitch 110 (software 4.0.37) # Centillion C100 ATM Switch OS Version 2.0.2. Fingerprint Alteon AceSwitch 110 or Cantillion C100 ATM Switch Class Alteon | embedded || switch Class Cantillion | embedded || switch TSeq(Class=TD%gcd=<9C8%SI=<1E) T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Alteon ACEswitch 184 Software Version 8.0.49 Fingerprint Alteon ACEswitch 184 V. 8.0.49 Class Alteon | embedded || switch TSeq(Class=RI%gcd=<34%SI=<C698A&>215%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AmigaOS Miami 2.1-3.0 Class Amiga | AmigaOS || general purpose TSeq(Class=TR) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami 3.0 Class Amiga | AmigaOS || general purpose TSeq(Class=TR) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami 3.1-3.2 Class Amiga | AmigaOS || general purpose TSeq(Class=TR) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B Class Amiga | AmigaOS || general purpose TSeq(Class=TR) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m Class Amiga | AmigaOS || general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0c Class Amiga | AmigaOS || general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS AmiTCP/IP 4.3 Class Amiga | AmigaOS || general purpose TSeq(Class=64K) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AmigaOS AmiTCP/IP Genesis 4.6 Class Amiga | AmigaOS || general purpose TSeq(Class=64K) T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Amos 2.3A Class Alpha Micro | AMOS || general purpose TSeq(Class=i800%gcd=<6%SI=<14) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AOS/VS on a Data General mainframe Class Data General | AOS/VS || general purpose TSeq(Class=TD%gcd=32|64|96%SI=1) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Apollo Domain/OS SR10.4 Class Apollo | Domain/OS || general purpose TSeq(Class=TD|RI%gcd=<6%SI=<FF) T1(DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M) T4(DF=N%W=239C%ACK=O%Flags=R%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=O%Flags=R%Ops=) T7(DF=N%W=800%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint AOS/VS or VSII Class Data General | AOS/VS || general purpose TSeq(Class=TD%gcd=40|80|C0%SI=0) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint APC MasterSwitch Network Power Controller Class APC | embedded || power-device TSeq(Class=TR) T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint APC Web/SNMP UPS management card Class APC | embedded || power-device TSeq(Class=RI%gcd=<6%SI=<52FB700&>D46DF) T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Smart-UPS 3000RM Firmware: 92.14.I Fingerprint APC Smart-UPS 3000RM Class APC | embedded || power-device TSeq(Class=TD%gcd=<138C%SI=<DC%IPID=I) T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint ARESCOM NetDSL 1000NDS series ADSL router Class ARESCOM | embedded || broadband router TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint ARLAN BR2000E V5.0E Radio Bridge Class Arlan | embedded || bridge TSeq(Class=TR%gcd=<6) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Ascend DSLPipe DSL-50S-CELL DSL router Class Ascend | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<671E2&>114%IPID=I%TS=U) T1(DF=Y%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend P130 Router Class Ascend | embedded || router TSeq(Class=RI%gcd=<6%SI=>BBB&<BBBB) T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Ascend Max 1800 50Ap8+ or 2024 router Class Ascend | embedded || router TSeq(Class=TD%gcd=388|710|A98%SI=<F) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash - I think meant TAOS Fingerprint Ascend / Lucent MAX TNT Running TAOS version 8.0.1 w/ VoIP Hash Class Ascend | TAOS || terminal server TSeq(Class=RI%gcd=<6%SI=<14F46&>346) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Ascend/Lucent Max (HP,4000-6000) version 6.1.3 - 7.0.2+ Class Ascend | TAOS || terminal server TSeq(Class=RI%gcd=<6%SI=>1000) T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline 50 running 5.1A Firmware Class Ascend | embedded || router TSeq(Class=64K) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline 50 Class Ascend | embedded || router TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline 50 rev 4.6C Class Ascend | embedded || router TSeq(Class=TD%gcd=388|710%SI=<5) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend GRF Router running Ascend Embedded/OS 2.1 Class Ascend | Embedded/OS || router TSeq(Class=RI%gcd=<5%SI=>600) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Ascend P75 router Class Ascend | embedded || router TSeq(Class=RI%gcd=<6%SI=>500&<FFFF) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline P130 or 50 Class Ascend | embedded || router TSeq(Class=TD%gcd=388|710|A98%SI=<BB) T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend Pipeline 400/T1 (Software V 4.5B) Class Ascend | embedded || router TSeq(Class=TD%gcd=388|710|A98%SI=<FF) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ascend TNT OS +5.0Ap48+ Class Ascend | TAOS || terminal server TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Airport Extreme Base Station (WAP) Class Apple | embedded || WAP TSeq(Class=RI%gcd=<6%SI=<94160&>15CB%IPID=I%TS=2HZ) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # on Macintosh GS server Fingerprint Apple Mac OS 8.5.1 (Appleshare IP 6.0) Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 running on a PowerPC G3 (iMac) Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.6 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # MacOS 8.6 running WebStar http server Fingerprint Apple Mac OS 8.6 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Mac OS 9 on a Power Macintosh 7200/75 # iMac running Mac OS 9.1 Fingerprint Apple Mac OS 9 - 9.1 Class Apple | Mac OS | 9.X | general purpose TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Mac OS X Server 1.0 - 1.0-1 <-- should be 10.1.0? Fingerprint Apple Mac OS X Server 1.0-1.0-1 (Rhapsody 5.3 - 5.4) Class Apple | Mac OS X | 10.0.X | general purpose TSeq(Class=RI%gcd=<5%SI=>BBB&<FFFF) T1(W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(W=2000%ACK=O%Flags=R%Ops=) T5(W=0%ACK=S++%Flags=AR%Ops=) T6(W=0%ACK=O%Flags=R%Ops=) T7(W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Mac OS X 1.1-1.2 Fingerprint Apple Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3 Class Apple | Mac OS X | 10.0.X | general purpose TSeq(Class=RI%gcd=<5) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.1 - 10.1.4 Class Apple | Mac OS X | 10.1.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.1.4 (Darwin Kernel 5.4) on iMac Class Apple | Mac OS X | 10.1.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.1.5 Class Apple | Mac OS X | 10.1.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Mac OS 10.2.6, darwin kernel 6.6 Fingerprint Apple Mac OS X 10.1.5-10.2.6 Class Apple | Mac OS X | 10.1.X | general purpose Class Apple | Mac OS X | 10.2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Mac OS X 10.2.6 (Jaguar) Class Apple | Mac OS X | 10.2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Apple Newton MessagePad 2100, Newton OS 2.1 Class Apple | Newton OS || PDA T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=R%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=R%Ops=) T7(DF=N%W=1000%ACK=S%Flags=R%Ops=) PU(Resp=N) # Actually it is not constant seq class -- it just seems that way # because it takes so long to increment Fingerprint Apple Color LaserWriter 600 Printer Class Apple | embedded || printer TSeq(Class=C) T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=A28%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=800%ACK=O%Flags=R%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Color LaserWriter 600 Printer Class Apple | embedded || printer TSeq(Class=C) T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Color LaserWriter 12/660 PS (Model No. M3036) Class Apple | embedded || printer T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=C00%ACK=O%Flags=R%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple LaserWriter 16/600 PS, HP 6P, or HP 5 Printer Class Apple | embedded || printer TSeq(Class=C) T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) # The sequence prediction is never really true random, but sometimes it # has two unique "tracks" which make it look random to nmap. Here is a # real example: Sequence numbers: 5576001 25D001 5576001 25D001 Fingerprint Apple LaserWriter 8500 (PostScript version 3010.103) Class Apple | embedded || printer TSeq(Class=TR|C) T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Asante 6524-2G GigE switch Class Asante | embedded || switch TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Asante IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 )) Class Asante | embedded || switch TSeq(Class=C%Val=4090000) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Asante IntraSwitch 5324 Class Asante | embedded || switch TSeq(Class=C%Val=80000) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Asante IntraSwitch 62xx (6216M in this case) Firmware v2.05A (16-port managed switch) Fingerprint Asante IntraSwitch 6216M firmware v2.05A Class Asante | embedded || switch TSeq(Class=TD%gcd=<C28C%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AsanteHub 2072 Ethernet Hu Class Asante | embedded || hub TSeq(Class=C) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Asante FriendlyNet FR3004 Series Internet Hub Class Asante | embedded || hub TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Auspex Fileserver (AuspexOS 1.9.1/SunOS 4.1.4) Class Auspex | AuspexOS || fileserver TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Atari Mega STE running JIS-68k 3.0 Class Atari | Atari || general purpose TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86) T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AtheOS ( www.atheos.cx ) Class AtheOS | AtheOS || general purpose TSeq(Class=RI%gcd=<8%SI=<A78&>6) T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint AtheOS/Syllable 0.4.2 Class AtheOS | AtheOS || general purpose TSeq(Class=RI%gcd=<A%SI=<1BDA%IPID=I%TS=U) T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint ATT Unix SVR4.2 on a Lucent Definity voicemail system Class Lucent | BSD-misc || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Apple A/UX 3.1.1 SVR2 or OpenStep 4.2 Class Apple | A/UX || general purpose TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Axent Raptor Firewall running on Windows NT Class Axent | Windows | NT/2K/XP | firewall TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) # Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) Fingerprint AXIS or Meridian Data Network CD-ROM server Class AXIS | embedded || fileserver TSeq(Class=C) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=) T4(DF=N%W=200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS 540/542 print server v5.30 Jan 24 1997 Fingerprint AXIS 540/542 print server v5.30 Class AXIS | embedded || print server TSeq(Class=C) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Axis 540 e'net print server ver 5.48 Class AXIS | embedded || print server TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Axis 540 print server Class AXIS | embedded || print server T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Axis 2120 network camera Class AXIS | embedded || webcam TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint AXIS NetEye Camera Server V1.20 Class AXIS | embedded || webcam TSeq(Class=C) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # AXIS NetEye Camera Server V1.20 # Axis NPS 53X Printer Server V4.26 Jul 01 1995 # AXIS StorPoint CD-Rom server V 4.20 # AXIS Camera 200pV1.41 Fingerprint AXIS Stack -- CD-ROM Server or Print Server or Camera Server Class AXIS | embedded || fileserver Class AXIS | embedded || print server Class AXIS | embedded || webcam TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Axis 200+ Web Camera running OS v1.42 Class AXIS | embedded || webcam T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) # The AXIS 2100 Network Camera Operating System, Linux/CRIS, is based on the Linux 2.0 kernel with non-MMU CPU patches from uC-Linux. The HTTP server used is based on Boa. The source code for the Linux/CRIS kernel, Boa and more is available at http://developer.axis.com/. Fingerprint Axis 2100 Network Camera running Linux/CRIS v2.32 Class AXIS | Linux || webcam TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=) T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # AXIS 540+/542+ # AXIS 5400 print server Fingerprint AXIS Network Print Server Class AXIS | Linux || print server T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=) T4(DF=N%W=100%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99) # Bay Networks ASN Processor revision 9, SE100NM and SFNM modules Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9 Class Bay Networks | embedded || router T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Bay Networks BayStack 310T switch Class Bay Networks | embedded || switch TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=<F) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint BayStack 28115/ADV Fast Ethernet Switch Class Bay Networks | embedded || switch TSeq(Class=TD%gcd=<6%SI=<FF) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Baystack Instant Internet 400 SoHo Router Class Bay Networks | embedded || router TSeq(Class=RI%gcd=<24%SI=<4D33C&>C46) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S%Flags=R%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Running on a BeBox 66Mhz Fingerprint BeOS 4 - 4.5 Class Be | BeOS | 4.X | general purpose TSeq(Class=TD%gcd=1%SI=0) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint BeOS R5.03 Personal Edition Class Be | BeOS | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint BeOS 5.0.4 (BeOS 5 Pro + BONE 7a) Class Be | BeOS | 5.X | general purpose TSeq(Class=TD%gcd=<6%SI=<C8%IPID=I%TS=U) T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint BeOS 5.1d0/DANO on x86 Class Be | BeOS | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U) T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # F5 labs BigIp Load balancer. BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386 # F5 BIG-IP 540 loadbalancer. Fingerprint F5 Labs BigIp Load balancer Kernel 4.1.1PTF-03 (X86) Class F5 Labs | embedded || load balancer TSeq(Class=TR%gcd=<6) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint F5 Labs Big-IP load balancer kernel 4.2PTF-05a (X86) Class F5 Labs | embedded || load balancer TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint FiberLine WL-1200R1 (also known as InterEpoch IWE-1200A-1) Wireless Broadband Router (WAP) Class FiberLine | embedded || WAP TSeq(Class=TD%gcd=<8%SI=<14%IPID=I%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # XS SW Release 4.9.1 ISDN access router # Bintec BIANCA XM OS-Version 4.93 Fingerprint Bintec XS/XM ISDN access router V. 4.9.1-4.9.3 Class Bintec | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=>FF&<FFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=0%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Borderware 5.0 Firewall Class Borderware | embedded || firewall TSeq(Class=TR|RI%gcd=<204%SI=<14) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Borderware 5.2 firewall Class Borderware | embedded || firewall TSeq(Class=TR%gcd=<6) T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=N) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Borderware 6.0.2 firewall Class Borderware | embedded || firewall TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) # http://www.brixnetworks.com/products/brix1000.html Fingerprint Brix 1000 Verifier Class Brix Networks | embedded || specialized TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 2.0 - 2.1 Class BSDI | BSD/OS | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD) Class BSDI | BSD/OS | 3.X | general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 4.0-4.0.1 Class BSDI | BSD/OS | 4.X | general purpose TSeq(Class=RI%gcd=<A%SI=<1974A&>16F) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint BSDI BSD/OS 4.0.1 Class BSDI | BSD/OS | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<F85E8&>27A9) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # (rel. ID: 17908) Fingerprint CacheFlow 6000 web proxy running Security Gateway 2.1.0 Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<6%SI=<CB91C&>15C0%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint CacheOS (CacheFlow 2000 proxy cache) Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<5%SI=>1111) T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Canon GP 160 PF printer Class Canon | embedded || printer TSeq(Class=TD%gcd=<C04%SI=<1E%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Canon IR6000 printer Class Canon | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Canon photocopier/fax/scanner/printer GP30F Class Canon | embedded || printer TSeq(Class=TD%gcd=600%SI=0) T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Capellix 3000 Modular SAN Switch Class Capellix | embedded || storage-misc TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Chase IOLan Terminal Server Class Chase | embedded || terminal server T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(Resp=N) Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build) Class Checkpoint | Windows | NT/2K/XP | firewall TSeq(Class=RI%gcd=<6%SI=<18358&>3CB) T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Checkpoint Firewall-1 on Windows NT 4.0 Server SP4-SP5 Class Checkpoint | Windows | NT/2K/XP | firewall TSeq(Class=TD%gcd=<8%SI=<154) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Checkpoint Firewall-1/VPN-1 SecurePlatform NG, running FeaturePack 3 Fingerprint Checkpoint SecurePlatform NG FP3 Class Checkpoint | Windows | NT/2K/XP | firewall TSeq(Class=RI%gcd=<6%SI=<1C6F042&>48C8B%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1200 access point (WAP) running IOS 12.2(8) Class Cisco | IOS | 12.X | WAP TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco AIR-WGB340 V8.38 Workgroup Bridge 340 Fingerprint Cisco AIR-WGB340 V8.38 wireless workgroup bridge 340 Class Cisco | embedded || bridge TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1F4|1000%ACK=S++%Flags=AR|AS%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco WGB350 802.11b WorkGroup Bridge Class Cisco | embedded || bridge TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=5C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1) Class Cisco | embedded || broadband router TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router Class Cisco | embedded || broadband router TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=<F) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 766 non-IOS software 4.2(3.5) Class Cisco | embedded || broadband router TSeq(Class=TD%gcd=82000%SI=<F) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1538M HUB running Cisco 1538M EES (1.00.00) or Assured Access Technology ISAS Switch Release-2.3.0 or Thomson Multimedia RCA DCM245 Cable Modem Class RCA | embedded || broadband router Class Cisco | embedded || hub TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 2620 router running IOS 12.1(6) Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=<6%SI=<ABC2&>78%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Cisco 3600 router running IOS 12.2(6c) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 1720 router running 12.2.8T4 with IP/FW/PLUS/3DES feature set # CISCO 801 router running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1) Fingerprint Cisco 801/1720 router running IOS 12.2.8 Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 827 aDSL router running IOS 112.2(11) Class Cisco | IOS | 12.X | broadband router TSeq(Class=RI%gcd=<6%SI=<1B1F2&>24E%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Found on Cisco 1720/1750/2611/3640/AS5300 routers Fingerprint Cisco router running IOS 12.1.5-12.2.13a Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1601R router running IOS 12.1(5) Class Cisco | IOS | 12.X | router TSeq(Class=TD%gcd=<6%SI=<32%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 4500 router running IOS 11.2(2) Class Cisco | IOS | 11.X | router T1(DF=N%W=860%ACK=S++|O%Flags=AS|A%Ops=M|) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Cisco 7206 running IOS 11.1(24) Class Cisco | IOS | 11.X | router TSeq(Class=RI%gcd=<5%SI=<CCCC&>CC) T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Cache Engine Web Proxy Class Cisco | embedded || web proxy TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco CPA2500 (68030) or 2511 router Class Cisco | IOS || router TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(Resp=N) # Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5) # Cisco Catalyst 5500 with OS Version 6.3(5) # Alcatel Omni Switch/Router! Version 4.3.1 GA Fingerprint Cisco Catalyst 5500/6500 or Alcatel Omni Switch/Router Class Cisco | embedded || switch Class Alcatel | embedded || switch TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco AS5200 terminal server Class Cisco | embedded || terminal server TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 4006 Switch running NmpSW 7.4(2) Class Cisco | NmpSW || switch SInfo(V=3.00%P=i686-pc-linux-gnu%D=2/12%Time=3E4A758F%O=23%C=1) TSeq(Class=TR%IPID=I%TS=U) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # The "True Random" is bogus, it is because of sequences # from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869 Fingerprint Cisco Localdirector 430, running OS 2.1 Class Cisco | embedded || load balancer TSeq(Class=TR|C) T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL) T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL) T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco PIX 4.2(2) Internal Interface Class Cisco | PIX | 4.X | firewall TSeq(Class=C) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall running PIX 4.1(5) Class Cisco | PIX | 4.X | firewall TSeq(Class=C%Val=211E005F) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX v4.2 Firewall Class Cisco | PIX | 4.X | firewall TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 515 firewall running software 4.4(5) Class Cisco | PIX | 4.X | firewall TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 506 Firewall Class Cisco | PIX || firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall Version 6.1(2) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 515 or 525 running 6.1(4) - 6.2(1) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall Version 6.2(2) - 6.3 Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX Firewall Version 6.2(1) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) # Cisco 535 IOS 6.2 PIX running in failover mode... ie.. idle # PIX 506 running PIX IOS 6.2 Fingerprint Cisco Firewall (PIX 6.1.4 - 6.2.2) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco Secure PIX Firewall Version 5.0(2) Class Cisco | PIX | 5.X | firewall T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) # Cisco PIX running IOS 6.1(1) - Internal interface Fingerprint Cisco PIX w/IOS 6.1(1) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco PIX 501 firewall running PIX 6.1(1) Class Cisco | PIX | 6.X | firewall TSeq(Class=TR%IPID=I%TS=U) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T6(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) # Cisco 3640 router IOS 11.1(7)AX [KUONG(7)AX] # Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6 Fingerprint Cisco switch/router with IOS 11.1(7)-11.2(8.10) Class Cisco | IOS | 11.X | router Class Cisco | IOS | 11.X | switch TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF) T1(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 2501, 4500 Fingerprint Cisco 2501/4500 router with IOS Version 10.3(15) - 11.1(20) Class Cisco | IOS | 10.X | router Class Cisco | IOS | 11.X | router TSeq(Class=RI|TD%gcd=<6%SI=<2000) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IP Phone 7910 or 7940 Firmware 3.1 Class Cisco | embedded || VoIP phone TSeq(Class=TD%gcd=<1E004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=578%ACK=O%Flags=R%Ops=) T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=578%ACK=S%Flags=R%Ops=) T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IP phone (POS3-04-3-00, PC030301) Class Cisco | embedded || VoIP phone TSeq(Class=TD%gcd=<C004%SI=<14%IPID=I%TS=U) T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E8%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=3E8%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1) Class Cisco | IOS | 11.X | terminal server TSeq(Class=RI%gcd=<6%SI=>BBB) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 5200 router running IOS v12.0(15) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 4500-M router running IOS 11.3(6) IP Plus Class Cisco | IOS | 11.X | router TSeq(Class=RI|TD%gcd=1%SI=<FFF) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 1900 switch, Bay networks 350-450 switch, or Netopia DSL/ISDN router Class Cisco | embedded || switch Class Bay Networks | embedded || switch Class Netopia | embedded || broadband router TSeq(Class=TD%gcd=<6000%SI=<1E) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 2820 switch Management Console Class Cisco | embedded || switch TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N|Y) Fingerprint Cisco IOS 11.3 - 12.0(11) Class Cisco | IOS | 11.X | router Class Cisco | IOS | 12.X | router TSeq(Class=TD|RI%gcd=<6) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 1700 running IOS 12.0(7)T Fingerprint IOS 12.0(7)T (on a 1700 router) Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=<6%SI=<7A6C&>D%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS 12.0(21) (On a 2514 router) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco IOS 12.0(16a) Service Provider feature set # Cisco WS-C3508G-XL running 12.0(5)WC3 Fingerprint Cisco IOS 12.0(5)WC3 - 12.0(16a) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Catalyst 2950 switch running IOS 12.0(5.3)WC(1) Class Cisco | IOS | 12.X | switch TSeq(Class=TR%gcd=<6%IPID=C%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 827 ADSL router running IOS 12.1(1)XB1 Class Cisco | IOS | 12.X | broadband router TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 7206 router (IOS 11.1(17) Class Cisco | IOS | 11.X | router TSeq(Class=RI%gcd=<6%SI=>666) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 1600/3640/7513 Router (IOS 11.2(14)P) Class Cisco | IOS | 11.X | router TSeq(Class=RI%gcd=<6%SI=<11170) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco Local Director 420 version 2.1.1 Class Cisco | embedded || load balancer TSeq(Class=C) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL) PU(Resp=N) Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T Class Cisco | IOS | 11.X | router TSeq(Class=RI%gcd=<4%SI=<999&>CC) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # 25XX/45XX router, 29XX switch, RSP2 processor Fingerprint Cisco Router/Switch with IOS 11.2 Class Cisco | IOS | 11.X | router Class Cisco | IOS | 11.X | switch TSeq(Class=RI%gcd=<6%SI=<18000) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS 12.0(3.3)S (perhaps a 7200 router) Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # A Cisco ATA 186 is a little box that allows a standard POTS # telephone to be used as a voice-over-Ip phone. There is a # variation, the ATA 188 that has a pass-through port, much like the # Cisco 7960 phone. Fingerprint Cisco ATA 186 POTS<->VOIP phone gateway device Class Cisco | embedded || telecom-misc TSeq(Class=TD%gcd=<A0000%SI=<1E%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=ARF%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint Cisco 675 DSL router -- cbos 2.1 Class Cisco | CBOS || broadband router T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M) T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco 760 Series ISDN router (non IOS) or IBM Stackable Hub Class Cisco | embedded || broadband router Class IBM | embedded || hub TSeq(Class=TD|i800%gcd=<14004%SI=<14) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco ATA-186 or 7905 VoIP Phone Class Cisco | embedded || VoIP phone TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco CacheOS (1.1.0) Class Cisco | CacheOS || web proxy TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cisco Content Engine 505 Software V. 4.2.1 Class Cisco | Content Networking System || web proxy TSeq(Class=RI%gcd=<6%SI=<2D75904&>5AE06%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0|CC%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # running Application and Content Networking System Software 4.2.3 # Fingerprint Cisco Content Engine 560 Software V. 4.2.3 Fingerprint Cisco Content Engine 560 running Content Networking System V. 4.2.3 Class Cisco | Content Networking System || web proxy TSeq(Class=RI%gcd=<6%SI=<19440B6&>40ACE%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco uBR 7223 router Class Cisco | IOS || router TSeq(Class=TR%gcd=<6%IPID=C%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # 3COM 4924 gigabit switch ver 2.04 # Cisco VPN 3000 3.5 Fingerprint Cisco VPN 3000 or 3Com 4924 GigE Switch Class Cisco | embedded || encryption accelerator Class 3Com | embedded || switch TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco 3000 Series VPN Concentrator Class Cisco | embedded || encryption accelerator TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4) Class Cisco | embedded || router T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Intergraph CLiX R3.1 Vr.7.6.20 6480 Class Intergraph | CLiX || general purpose TSeq(Class=TD%gcd=<416%SI=<1E) T1(DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Cnet CNIG904B Internet Broadband Gateway firmware version 1.11 Class Cnet | embedded || broadband router TSeq(Class=TD%gcd=<F4%SI=<1D6%IPID=Z%TS=U) T1(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # CNT UltraNet EDGE (SAN Router) softwareversion 1.4.1.2 Fingerprint CNT UltraNet EDGE (SAN Router) V. 1.4.1.2 Class CNT | embedded || storage-misc TSeq(Class=TD%gcd=<61AC%SI=<1E%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cobalt Linux 4.0 (Fargo) Kernel 2.0.34C52_SK on MIPS or TEAMInternet Series 100 WebSense Class Cobalt | Linux | 2.0.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # corega BAR SW-4P [Part number:CG-BARSW4P] Fingerprint Corega BAR SW-4P Broadband Access Router Class Corega | embedded || broadband router T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Commodore 64 with TFE Ethernet Card (uIP TCP/IP stack) Class Commodore | embedded || game console TSeq(Class=C%Val=FFFFFFFF%IPID=RD%TS=U) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=APF%Ops=) T3(Resp=Y%DF=N%W=16D0|1CA%ACK=O%Flags=APF%Ops=) T4(DF=N%W=16D0|5B4%ACK=O%Flags=APF%Ops=) T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Commodore 64 with TFE Ethernet Card (Contiki) Class Commodore | embedded || game console TSeq(Class=TD%gcd=<18%SI=<1E%IPID=RD|I%TS=U) T1(DF=N%W=F4%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Tested against: 3 RISC Routers (2600i, 2800, and 3500R) all running # firmware 4.5 and two IntraPorts running 4.4.02. I'm told this also # applies to firmare 4.2 on RISC routers, but I have not checked. Fingerprint Compatible Systems (RISC Router, IntraPort) Class Compatible Systems | embedded || router TSeq(Class=TD%gcd=388|710|A98%SI=<6) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Computone Power Rack IntelliServer terminal server Release 1.5.4d Class Computone | embedded || terminal server TSeq(Class=TD%gcd=40%SI=0) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint ComOS based terminal server - Livingston PortMaster or U.S. Robotics/3Com Total Control Class Livingston | ComOS || terminal server Class 3Com | ComOS || terminal server T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2 Class Lucent | ComOS || terminal server T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Convex OS Release 10.1 Class Convex | ConvexOS || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cray UNICOS/mk 8.6 Class Cray | UNICOS | 8.X | general purpose TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1 Class Cray | UNICOS || general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL) T2(Resp=N) T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint UNICOS 10.0.0 on Cray 90 Class Cray | UNICOS | 10.X | general purpose TSeq(Class=RI%gcd=<F%SI=<22222&>2222) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL) T2(Resp=N) T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2 Class Cray | UNICOS || general purpose TSeq(Class=RI%gcd=<6%SI=>F) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL) T2(Resp=N) T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cyberguard 4.0 firewall Class Cyberguard | embedded || firewall TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Cyclades PathRouter V 1.2.4 Class Cyclades | Cyros || router TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12 Class Cyclades | Cyros || terminal server TSeq(Class=TD%gcd=30C382%SI=<BB) T1(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=218|0%ACK=S|S++%Flags=AR%Ops=|M) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRAS Remote Access Server v1.1.7 Class Cyclades | Cyras || terminal server TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRouter Class Cyclades | Cyras || router TSeq(Class=TD|RI%gcd=<618708%SI=<EEE47C) T1(DF=N%W=46%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=46%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cyclades PathRouter/PC Class Cyclades | Cyras || router TSeq(Class=RI|TD%gcd=<618708%SI=<1F343) T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06 Class Datavoice | embedded || CSUDSU TSeq(Class=RI%gcd=<6%SI=>18000) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # DECbrouter90T1 Runs Cisco IOS 10.2(5) # Cisco 1601, IOS 11.0 Fingerprint Cisco 1601 (IOS 11.0) or DECbrouter90T1 (Runs Cisco IOS 10.2(5)) Class Cisco | IOS | 11.X | router Class DEC | IOS | 10.X | router T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Cisco 12008 running IOS 12.0(18.6)S1 # Cisco 7206VXR running IOS 12.0(18)S Fingerprint Cisco router running IOS 12.0(18)S or 12.0(18)S1 Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Cisco IOS 12.0(5)WC5a on a catalyst 2900XL switch Class Cisco | IOS | 12.X | switch TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Cisco IOS 12.1(4) on a 2600 router Class Cisco | IOS | 12.X | router TSeq(Class=RI%gcd=<A%SI=<9772&>3A%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 3620 running IOS 12.2.1 # IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1) Fingerprint Cisco router running IOS 12.1(5)-12.2(7a) Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 2621 running IOS 12.2.8T # Cisco SOHO 77 running IOS 12.2(8)T Fingerprint Cisco router running IOS 12.2(8)T Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Cisco 7507 running 12.2(8)T5 Fingerprint Cisco IOS 12.2(8)T5 on a 7507 router Class Cisco | IOS | 12.X | router TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint DECNIS 600 V4.1.3B multiprotocol bridge/router Class DEC | embedded || router TSeq(Class=TD%gcd=30D4|C35%SI=<F) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # DECserver 700-16, Network Access SW V2.2 Fingerprint DECserver 700-16 terminal server, Network Access SW V2.2 Class DEC | embedded || terminal server TSeq(Class=64K) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=600%ACK=S++|O%Flags=AR|A%Ops=) T4(DF=N%W=600%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC VAX/VMS 5.3 on a MicroVAX II Class DEC | VMS || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC VAX/VMS v5.5, CMU-TEK TCP/IP stack Class DEC | VMS || general purpose TSeq(Class=RI%gcd=<6%SI=>BBBBB) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=64%ACK=O%Flags=AR%Ops=) T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=64%ACK=O%Flags=AR%Ops=) T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint DEC VAX 7000-610 or 4200/SPX OR 6000-430 Class DEC | VMS || general purpose TSeq(Class=64K) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1800%ACK=O%Flags=A%Ops=) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC VMS MultiNet V4.1(16) Class DEC | VMS || general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.1 Class DEC | OpenVMS | 6.X | general purpose TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS V6.1 on VAX 4000-105A Class DEC | OpenVMS | 6.X | general purpose TSeq(Class=64K) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.2 - 7.2-1 on VAX or AXP Class DEC | OpenVMS | 6.X | general purpose Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=1800%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS AXP 6.2 running Attachmate Pathway 3.1 TCP stack Class DEC | OpenVMS | 6.X | general purpose TSeq(Class=i800|64K) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.2/Alpha Class DEC | OpenVMS | 6.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=2200%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.2 Class DEC | OpenVMS | 6.X | general purpose TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=2200%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS Alpha 6.2 running DIGITAL TCP/IP Services (UCX) v4.0 Class DEC | OpenVMS | 6.X | general purpose TSeq(Class=64K) T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=) T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 6.2 Class DEC | OpenVMS | 6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<4D8%IPID=BI%TS=U) T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=AS%Ops=MWL) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Digital TCP/IP Services for OpenVMS Alpha Version V4.2 - ECO 4 on a AlphaServer 8400 5/625 running OpenVMS V6.2-1H3 Fingerprint DEC OpenVMS 6.2 Class DEC | OpenVMS | 6.X | general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI|TD%gcd=<6%SI=<BBBB) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MWL) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U) T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint DEC OpenVMS 7.1 Alpha running Digital's UCX v4.1ECO2 TCP/IP package Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=64K) T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=) T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package Class DEC | OpenVMS | 7.X | general purpose T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL) T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS V7.1 on VAX 6000-530 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint DEC VMS MultiNet V4.2(16)/ OpenVMS V7.1-2 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC VMS MultiNet V4.4 / OpenVMS V7.1 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6%TS=2HZ) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.1 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR) T1(DF=N%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2200%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A - ECO 1 on a AlphaServer DS20 500 MHz running OpenVMS V7.2-1 Fingerprint DEC OpenVMS 7.2 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<8%SI=<527E2&>543%IPID=I%TS=U) T1(DF=N%W=C3A5%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=C3A5%ACK=O%Flags=A%Ops=) T4(DF=N%W=C350%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.2 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<44%SI=<2670&>3B%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.3-1 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<6%SI=<56E82&>B37%IPID=I%TS=U) T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # DEC VAXVMS TCPIP V5.1-15 Full LP Installed Fingerprint DEC OpenVMS v7.3 on VAXStation 4000/60 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # OpenVMS 7.3 with TCP/IP 5.3 Fingerprint DEC OpenVMS 7.3 (Alpha) TCP/IP 5.3 Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint DEC OpenVMS 7.3 (Compaq TCP/IP 5.3) Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Digital Networks VNswitch 900 Class Digital Networks | embedded || switch TSeq(Class=TD%gcd=<4%SI=<4) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Digitel NetRouter NR3000 Class Digitel | embedded || router TSeq(Class=RI%gcd=<2004%SI=<10CC&>16) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Digitel NetRouter NR3100 Class Digitel | embedded || router TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Data General DG/UX Release R4.11MU02 Class Data General | DG/UX || general purpose TSeq(Class=TD%gcd=10000|20000|30000%SI=<F) T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Data General DG/UX Release R4.20MU02 Class Data General | DG/UX || general purpose TSeq(Class=TD%gcd=<20004%SI=<1E) T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # dgux DataGeneral_Server R4.20MU04 generic AViiON PentiumPro Fingerprint Data General DG/UX Release R4.20MU04 Class Data General | DG/UX || general purpose TSeq(Class=RI%gcd=<6%SI=<32CBC&>281) T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Data General DG/UX Release R4.20MU06 Class Data General | DG/UX || general purpose TSeq(Class=RI%gcd=<6%SI=<E21EE&>779%IPID=I%TS=U) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Digital Link DL2001 CSU/DSU Management Access Processor Class Digital Link | embedded || CSUDSU TSeq(Class=TD%gcd=<2780%SI=<14) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Digital UNIX OSF1 V 3.0,3.2,3.2C Class DEC | Digital UNIX | 3.X | general purpose TSeq(Class=64K) T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Digital UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F Class DEC | Digital UNIX | 4.X | general purpose TSeq(Class=RI|TD|64K%gcd=<6) # Boy, OSF1 comes in all colors! T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Draytek Vigor 2000 ISDN router Class Draytek | embedded || broadband router T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Draytek Vigor 2200e DSL router v2.1b Class Draytek | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<2D38FC2&>72E8A%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Fingerprint Draytek Vigor 2200e DSL Router v2.1a Class Draytek | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Integrated Lights Out remote configuration Board Class Compaq | embedded || specialized TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=O%Flags=R%Ops=) T2(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Proliant DL580 Integrated Lights-Out remote configuration board V1.06 14.5.2002 Fingerprint Compaq Proliant DL580 Integrated Lights-Out remote configuration board V1.06 Class Compaq | embedded || specialized TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U) T1(DF=N%W=400%ACK=O%Flags=R%Ops=) T2(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=) T4(DF=N%W=400%ACK=O%Flags=R%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Compaq iPAQ Connection Point (WAP) model CP-2W Rev1.00 # NetGear MR814 WAP Fingerprint WAP: Compaq iPAQ Connection Point or Netgear MR814 Class Compaq | embedded || WAP Class Netgear | embedded || WAP T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Compaq Tru64 UNIX (formerly Digital UNIX) 4.0e Class Compaq | Tru64 UNIX | 4.X | general purpose TSeq(Class=C) T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX 4.0e Class Compaq | Tru64 UNIX | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<7BE80&>DAF%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Compaq Tru64 UNIX 5.0 on AlphaServer # DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A on a DEC 4000 Model 610 running OpenVMS V7.2 Fingerprint Compaq Tru64 UNIX 5.0 or DEC OpenVMS 7.2 Class Compaq | Tru64 UNIX | 5.X | general purpose Class DEC | OpenVMS | 7.X | general purpose TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732) Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732) Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885) Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885) Class Compaq | Tru64 UNIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Quanterra OS/9 V2.4 on 68K (Quanterra Q4124 - 68030) Fingerprint Quanterra seismic data acquisition system running OS/9 V2.4 on 68K Class Quanterra | OS/9 || specialized TSeq(Class=i800) T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=) T4(DF=N%W=C000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint OSF1 5.0 Rev. 910 (AKA Compaq/Digital Tru64 Unix) TSeq(Class=RI%gcd=<6%SI=<E88&>11) Class Compaq | Tru64 UNIX | 5.X | general purpose T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OSF/1 V1.3A - 2.0 Class DEC | Digital UNIX | 1.X | general purpose Class DEC | Digital UNIX | 2.X | general purpose TSeq(Class=64K) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint DEC OSF1 (AKA Compaq/Digital Tru64 UNIX) Version 5.0.0 Class DEC | Digital UNIX | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint OSF/1 (AKA Compaq/Digital Tru64 UNIX) 5.60 Class DEC | Digital UNIX | 5.X | general purpose TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint DEC Digital UNIX OSF1 V 4.0-4.0F Class DEC | Digital UNIX | 4.X | general purpose TSeq(Class=C|RI%gcd=<6) T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint Sequent DYNIX/ptx 4.0 V4.4.6 i386 Class Sequent | DYNIX || general purpose TSeq(Class=RI%gcd=<6%SI=<2E4AA&>752%IPID=I%TS=U) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Sequent Dynix/PTX 4.4.2 Class Sequent | DYNIX || general purpose TSeq(Class=RI%gcd=<6%SI=<15E0&>23) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Software version VIK-1.35.020320j -- www.easytel.fi Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router Class Easytel | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Edimax BR-6004 broadband router Class Edimax | embedded || broadband router TSeq(Class=i800%IPID=I%TS=2HZ) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Edimax PS-901 Print Server model 1P/13E-9.5.12 Class Edimax | embedded || print server TSeq(Class=RI%gcd=<2004%SI=<12D4&>1C%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Eicon Diva1830 ISDN router running 1.5 firmware Class Eicon | embedded || broadband router TSeq(Class=TD%gcd=<20004%SI=<14%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M) T2(Resp=Y%DF=N%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M) T4(DF=N%W=1%ACK=O%Flags=R%Ops=) T5(DF=N%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1%ACK=O%Flags=R%Ops=) T7(DF=N%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # ELSA LANCOM DSL/10 Office 2.62.0002 Fingerprint ELSA LANCOM DSL/10 Office router v2.62.0002 Class Elsa | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # ELSA LANCOM DSL/I-1611 Office 2.70.0025 / 06.08.2002 http://www.lancom-systems.de/ # ELSA LANCOM DSL/I-1611 Office 2.50.0005 / 15.11.2001 Fingerprint ELSA LANCOM DSL/I-1611 Office router Class Elsa | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint EMC DART running on a Data Mover fileserver. Version T4.1.8.1 Class EMC | DART || fileserver TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint EMC IP4700 Filer Class EMC | DART || fileserver TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Enterasys XP-2400 switch running Enterasys E9.0.0.0 # Cabletron Smartswitch 6000 running Enterasys E8.2.0.0 Fingerprint Enterasys/Cabletron switch running Enterasys E8.2.0.0 - E9.0.0.0 Class Enterasys | embedded || switch TSeq(Class=RI%gcd=<6%SI=<7A31E&>10AD%IPID=I%TS=2HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20 Class Epson | embedded || printer T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=) T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98 Class Epson | embedded || printer TSeq(Class=TR) T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=) T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Ericsson HM220dp ADSL modem/router Class Ericsson | embedded || broadband router TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Exabyte X80 tape backup robot Class Exabyte | embedded || storage-misc TSeq(Class=TD%gcd=<6004%SI=<14%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0|0%ACK=S++|O%Flags=AS|AR%Ops=M|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Extreme Networks Alpine 3804 Switch running Extremeware 6.2.1 Class Extreme Networks | Extremeware || switch TSeq(Class=RI%gcd=<6%SI=<1598C&>223) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Extreme Networks Black Diamond switch Class Extreme Networks | embedded || switch TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Extreme Gigabit switch (unknown version) Class Extreme Networks | embedded || switch TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint NAT LANB/290 router Console Program V4.00 Class NAT | embedded || router TSeq(Class=TD%gcd=<80004%SI=<14) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint NCR server running MP-RAS SVR4 UNIX System Version 3 Class NCR | BSD-misc || general purpose TSeq(Class=RI%gcd=<6%SI=<31BA1E&>7F38) T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NCR S26 server (i386) running NCR MP-RAS SVR4 UNIX System Class NCR | BSD-misc || general purpose TSeq(Class=RI%gcd=<6%SI=<2BB718&>6FD5) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint F5 Labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86) Class F5 Labs | BSDI || load balancer TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Broadband Router (Farralon Netopia or Compatible Systems 900i) Class Netopia | embedded || broadband router Class Compatible Systems | embedded || router TSeq(Class=TD%gcd=388|710|A98%SI=<F) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint FastComm FRAD (Frame Relay Access Device) F9200-DS-DNI -- Ver. 4.2.3A Class FastComm | embedded || specialized TSeq(Class=TD|RI%gcd=<8%SI=<1E) T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=) T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Fore ForeThought 7.1.0 ATM switch Class Fore | embedded || switch TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Foundry 1500 OS Ver 7.2.06T51 # Foundry ServerIron XL 16 Port 7.3.06T12 Fingerprint Foundry Load Balancer OS Ver 7.2.X - 7.3.X Class Foundry | embedded || load balancer TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Foundry FastIron Edge Switch (load balancer) 2402 Class Foundry | embedded || load balancer TSeq(Class=RI%gcd=<6%SI=<3E418&>988%IPID=RD%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry FastIronII 4000 load balancer running 06.6.34T43 Class Foundry | IronWare || load balancer TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry NetIron load balancer OS Ver. 7.1.23T13 Class Foundry | IronWare || load balancer TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry Networks, Inc. Router/Load balancer, IronWare Version 06.5.12T43 Class Foundry | IronWare || load balancer TSeq(Class=C) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Foundry ServerIron XL load balancing IP Switch Version 06.0.00T12 Class Foundry | IronWare || load balancer TSeq(Class=C) T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Galacticomm WorldGroup BBS / Vircom TCP/IP stack Class Galacticomm | WorldGroup || BBS TSeq(Class=C) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Galacticomm WorldGroup BBS (MajorBBS) w/TCP/IP Class Galacticomm | WorldGroup || BBS TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&<BBBBBB) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Gandalf LanLine Router Class Gandalf | embedded || router TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Genius print server Class Genius | embedded || print server T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Gnat Box Light firewall v3.0.3 (from the inside interface) Class Global Technology Associates | embedded || firewall TSeq(Class=RI%gcd=<6%SI=<F708&>264) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Gauntlet 4.0a firewall on Solaris 2.5.1 Class Gauntlet | Solaris | 2.5.X | firewall TSeq(Class=RI%gcd=<6%SI=<10540A&>89C%IPID=I%TS=U) T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) # GNet BB0040 DSL router # SAR-703 Combined ADSL Modem/Router Fingerprint GNet BB0040 or SAR 703 DSL modem + router Class GNet | embedded || broadband router Class SAR | embedded || broadband router TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Compatible Systems ISDN/leased-line/dialup MicroRouter 900i v3.0.9 Class Compatible Systems | embedded || broadband router TSeq(Class=TD%gcd=388|710|A98%SI=<F) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Compatible Systems ISDN/leased-line/dialup Microrouter 2220R w/ firmware v4.5 Class Compatible Systems | embedded || broadband router TSeq(Class=TD%gcd=388|710|A98%SI=<14) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router Class FlowPoint | embedded || broadband router Class ASCOM | embedded || broadband router TSeq(Class=TD%gcd=<6%SI=<FF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Flowpoint 144 or 22XX DSL Router v3.0.8 # SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready Fingerprint DSL Router: Flowpoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1 Class FlowPoint | embedded || broadband router Class SpeedStream | embedded || broadband router TSeq(Class=TR%gcd=<6) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E) # speedstream router 5871 v4.0.1 Fingerprint Speedstream 5871 DSL router Class SpeedStream | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 2.2.1 - 4.1 Class FreeBSD | FreeBSD | 2.X | general purpose Class FreeBSD | FreeBSD | 3.X | general purpose Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<38E50&>906) T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M) T4(DF=N%W=4000|0|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E) Fingerprint FreeBSD 2.1.0 - 2.1.5 Class FreeBSD | FreeBSD | 2.X | general purpose TSeq(Class=64K) T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 2.2.1-STABLE Class FreeBSD | FreeBSD | 2.X | general purpose TSeq(Class=RI%gcd=<8%SI=<74A54&>1295) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 3.2-4.0 Class FreeBSD | FreeBSD | 3.X | general purpose Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<92D42&>1769) T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint FreeBSD 3.4-RELEASE Class FreeBSD | FreeBSD | 3.X | general purpose TSeq(Class=RI%gcd=<6%SI=<58AD4&>3BB) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.0-20000208-CURRENT Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<63074&>FC4) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.1.1 - 4.3 (X86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.3 - 4.4-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.3 - 4.4PRERELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002 Fingerprint FreeBSD 4.4-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.4 for i386 (IA-32) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=5B4|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.5-RELEASE (or -STABLE) (X86 # FreeBSD 4.6-RC Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) through 4.6-RC (X86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6 Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6-RC on Alpha Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # 4.6-RELEASE # 4.6-STABLE # 4.6.2-RELEASE-p6 Fingerprint FreeBSD 4.6 through 4.6.2 (July 2002) (X86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%IPID=I%TS=100HZ) T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6 Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8AAA2&>96A%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.6.2-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.7-RELEASE (X86) Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.8-RELEASE # 4.7-STABLE FreeBSD 4.7-STABLE #0: Tue Nov 19 16:13:55 2002 Fingerprint FreeBSD 4.6.2-RELEASE - 4.8-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.7-RELEASE-p3 FreeBSD 4.7-RELEASE-p3 #0: Wed Jan 8 21:31:21 CET 2003 i386 Fingerprint FreeBSD 4.7-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD-4.7-RELEASE-p3 on i386 Fingerprint FreeBSD-4.7-RELEASE-p3 Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.7-STABLE (Jan 2003) Fingerprint FreeBSD 4.7-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 4.7-RELEASE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.8-STABLE (June 2003) Fingerprint FreeBSD 4.8-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|1000HZ) T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # FreeBSD 4.8-STABLE (June 2003) Fingerprint FreeBSD 4.8-STABLE Class FreeBSD | FreeBSD | 4.X | general purpose T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002 Fingerprint FreeBSD 5.0-CURRENT (Apr 2002) Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # FreeBSD somehost.someplace 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Jan 29 12:31:51 CST 2003 i386 # FreeBSD 5.0-RELEASE Alpha Fingerprint FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003) Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.0-RELEASE (x86) Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.0-RELEASE Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.0-RELEASE Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeBSD 5.1-CURRENT (June 2003) on Sparc64 Class FreeBSD | FreeBSD | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint FreeSCO 0.27 (Linux kernel 2.0.38) Class FreeSCO | Linux | 2.0.X | router TSeq(Class=RI%gcd=<6%SI=<1F22A6E&>4E0A2%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint FreeSCO 0.27 (Linux kernel 2.0.38) Class FreeSCO | Linux | 2.0.X | router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint GNU Hurd 0.2 (GNUmach-1.2/Hurd-0.2) X86 Class GNU | Hurd || general purpose TSeq(Class=TD|i800%gcd=<3000%SI=<1E%IPID=I%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Hitachi HI-UX/MPP Class Hitachi | HI-UX || general purpose TSeq(Class=64K) T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=MNNTWL) T2(Resp=N) T3(Resp=Y%DF=N%W=FF5E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E) # HP Router 210 with OS 9.72 # Netgear RP114 DSL-Router with 4-Port Switch Fingerprint HP Advancestack Etherswitch 224T or 210 or Netgear RP114 DSL-Router w/Switch Class HP | embedded || switch Class Netgear | embedded || broadband router TSeq(Class=TD%SI=<20) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=400%ACK=O%Flags=R%Ops=) T5(DF=N%W=400%ACK=O%Flags=R%Ops=) T6(DF=N%W=400%ACK=O%Flags=R%Ops=) T7(DF=N%W=400%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Don't ask me what this is :) David says # it is "a Utah port of BSD to HP machines" Fingerprint HP-BSD 2.0 Class HP | BSD-misc || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint HP Deskjet 6127 printer Class HP | embedded || printer TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ) T1(DF=N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP Entria X station (running Netstation 7.x) Class HP | Netstation || X terminal TSeq(Class=64K) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HP j4813A ProCurve Switch 2524 # Copper Mountain Networks DSL Concentrator # Compaq Remote Insight Lights-Out remote console card # 3Com Home Wireless Gateway 3CRWE50194-E1, firmware 1.14 # TrueTime NTS-200 GPS Network Time Server # Compaq Lights Out Edition firmware v2.41 # 3Com NBX 25 (Phone System) Version: R1_0_3 Fingerprint Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com NBX 25 phone system or Home Wireless Gateway, or TrueTime NTP clock Class Copper Mountain | embedded || terminal server Class 3Com | embedded || WAP Class 3Com | embedded || telecom-misc Class TrueTime | embedded || specialized Class Compaq | embedded || specialized TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HP JetDirect printer/rint server Fingerprint HP printer w/JetDirect card Class HP | embedded || printer Class HP | embedded || print server TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=N%W=16D0|C90%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=|M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP printer w/JetDirect card Class HP | embedded || printer TSeq(Class=TD%gcd=<10%SI=<14%IPID=I%TS=U) T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP printer w/JetDirect card Class HP | embedded || printer TSeq(Class=TD%gcd=<6%SI=<F) T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # HP printer w/JetDirect card (Firmware Rev. H.06.00) Fingerprint HP printer w/JetDirect card Class HP | embedded || printer TSeq(Class=TD%gcd=<8%SI=<14) T1(DF=N%W=860|16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # JetDirect J6057A, firmware R.24.06, connected to an HP 2200 printer # JetDirect 610n (Model J4169A) firmware L.24.06 Fingerprint HP printer w/JetDirect card Class HP | embedded || printer TSeq(Class=RI%gcd=<6%SI=<AF762&>9E9%IPID=I%TS=2HZ) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint HP JetDirect J6057A Firmware Version R.22.09 in 4100mpf printer Class HP | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=O%Flags=A%Ops=) T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550 # HP LaserJet 2200 with JetDirect (J6057A) Fingerprint HP JetDirect Card in a LaserJet printer Class HP | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=) T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # 2100 Series, 4000 TN, 4000 PS, 8000 DN Fingerprint HP LaserJet printer/print server Class HP | embedded || printer Class HP | embedded || print server TSeq(Class=TD%gcd=<6%SI=<100) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP LaserJet 4000N Printer Class HP | embedded || printer TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP LaserJet 4100N printer Class HP | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=A%Ops=) T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint HP pritner w/JetDirect J2556b card Firmware A.05.32 Class HP | embedded || printer T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # This is a HP 5si printer with a Jetdirect Ethernet card model# J2556b Firmware A.05.32 Fingerprint HP printer w/JetDirect J2556b card (firmware A.05.32) Class HP | embedded || printer T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Jet Direct Model J3113A, Firmware Rev G.07.20 # HP Color LaserJet 4500N, Jet Direct J3113A/2100 Fingerprint HP Printer w/Jet Direct Class HP | embedded || printer T1(DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=M|) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP LaserJet 5 Class HP | embedded || printer TSeq(Class=TD%gcd=<6%SI=<FF) T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP Procurve Routing Switch 9304M Class HP | embedded || load balancer TSeq(Class=C) T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777 Class HP | HP-UX | 9.X | general purpose TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 9.01 - 9.07 Class HP | HP-UX | 9.X | general purpose TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # XXX: It crashed the machine again, but I got a full # scan this time. Fingerprint HP-UX B.10.01 A 9000/715 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K|TR) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0 Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1 Class HP | HP-UX | 10.X | general purpose TSeq(Class=RI%gcd=<6%SI=<18000) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 10.20 A 9000/715 or 9000/899 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.10.20 A 9000/750 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX release B.10.20 version A Class HP | HP-UX | 10.X | general purpose TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.10.20 9000/897 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0 Class HP | HP-UX | 10.X | general purpose TSeq(Class=64K) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2 Class HP | HP-UX | 10.X | general purpose TSeq(Class=RI%gcd=<6%SI=<18000) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # This is a wierd one Fingerprint HP-UX 11.00 Class HP | HP-UX | 11.X | general purpose TSeq(Class=TD%gcd=>20000%SI=<3) T1(Resp=N) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B11.00 U 9000/839 Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<10%SI=<2114C&>536) T1(Resp=N) T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP-UX B.11.00 A 9000/800 Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8E148&>846%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint HP-UX B.11.00 A 9000/785 Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<6%SI=<B108A&>630%IPID=I%TS=100HZ) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP9000 Model 804 K450 running HP/UX 11.00 # Mac OS9 Fingerprint Mac OS 9, or HP/UX 11.00 Class HP | HP-UX | 11.X | general purpose Class Apple | Mac OS | 9.X | general purpose TSeq(Class=RI%gcd=<6%SI=<4F254&>C95) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint HP MPE/iX 5.5 Class HP | MPE/iX || general purpose TSeq(Class=TD%gcd=<6%SI=<14) T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint HP MPE/iX 5.5 on HP 3000 Class HP | MPE/iX || general purpose TSeq(Class=TD%gcd=<6%SI=<1E%TS=U) T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=6000%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Huawei Quidway R2621 router running VRP 1.5.6(1) Class Huawei | VRP || router TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ) T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Hua Wei Quidway Router R2621E VRP 1.5.6 Class Huawei | VRP || router TSeq(Class=TD%gcd=<1E806%SI=<14%IPID=I%TS=2HZ) T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Hydra HydraWEB 5000 Class Hydra | embedded || load balancer TSeq(Class=RI%gcd=1|2|3|4%SI=<FFFF&>1111) T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM 2210 router Class IBM | embedded || router TSeq(Class=TD%gcd=<6%SI=<F) T1(DF=N%W=0|200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S|O|S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IBM 8210 Multiprotocol Switching Server for ATM networks, Model 3 (p/n 31L3 340), Fingerprint IBM 8210 Multiprotocol Switching Server/router for ATM networks Class IBM | embedded || router TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM 8222 hub Class IBM | embedded || hub TSeq(Class=TD%gcd=<6%SI=<1A4%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM 2210 Router MRS 2.x on Token Ring interface Class IBM | embedded || router TSeq(Class=TR%gcd=<6) T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR|R%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM 3494 Magnetic Tape Library Class IBM | embedded || storage-misc TSeq(Class=RI%gcd=<6%SI=<A5B22&>1A6E%IPID=I%TS=U) T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # IBM AIX v3.2.5 running on 8xPower-2 wide nodes # Fingerprint AIX Version 4 Fingerprint IBM AIX v3.2.5 - 4 Class IBM | AIX | 3.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 4.3.1 on a IBM RS/6000 R40 Class IBM | AIX | 4.X | general purpose TSeq(Class=TR%gcd=<6%TS=U) T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # IBM AIX 5L 5.1 # IBM AIX 5.1 ML00 Fingerprint IBM AIX 5.1 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1 - 5.2 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM AIX 5.1-5.2 on RS/6000 Class IBM | AIX | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint IBM Infoprint 12 Net-Printer Class IBM | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT Class IBM | embedded || switch Class Xylan | embedded || switch TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 V 2.1 Class IBM | OS/2 || general purpose TSeq(Class=64K) T1(DF=N%W=6FCC%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=6FCC%ACK=O%Flags=A%Ops=) T4(DF=N%W=7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 V.3 Class IBM | OS/2 || general purpose TSeq(Class=i800) T1(DF=N%W=7000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7000%ACK=O%Flags=A%Ops=) T4(DF=N%W=7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 Warp 4.0 Class IBM | OS/2 || general purpose TSeq(Class=i800) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=7000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta Class IBM | OS/2 || general purpose TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF) T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta Class IBM | OS/2 || general purpose TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF) T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint AS/400 running OS/400 R4.4 Class IBM | OS/400 | V4 | general purpose TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM AS400 running OS/400 5.1 Class IBM | OS/400 | V5 | general purpose TSeq(Class=TD%gcd=<6000%SI=<14%IPID=I) T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # added by Beat Rubischon <beat@rubis.ch> Fingerprint IBM AS/400 V3 and V4 Class IBM | OS/400 | V3 | general purpose Class IBM | OS/400 | V4 | general purpose TSeq(Class=RI%gcd=<6) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM VM/CMS (mainframe) Class IBM | VM/CMS || general purpose TSeq(Class=RI%gcd=64|C8%SI=>CC&<CCC) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint IBM VM/ESA 2.2.0 CMS Mainframe System Class IBM | VM/CMS || general purpose TSeq(Class=RI|TD%gcd=64|C8|12C|1F4|190%SI=<FFF) T1(DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # D-LINK DI-713P wireless router (firmware 2.60 build 6a) # 704P Ethernet Broadband Gateway Fingerprint D-Link 704P Broadband Gateway or DI-713P WAP Class D-Link | embedded || broadband router TSeq(Class=RI|TD%gcd=<68%SI=<3A2%IPID=I|BI%TS=U) T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DLink DI-604 ethernet router using firmware 1.62 build 2 Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DLink DI-604 ethernet router Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<2C0%SI=<14%IPID=BI%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9 Class D-Link | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled # Date: Oct 14 1997, Time: 09:35:04 (claims software version 2.04B3, # boot PROM version 2.21) Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21 Class D-Link | embedded || hub TSeq(Class=TD%gcd=1388%SI=0) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link DI-701, Version 2.22 Class D-Link | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=N) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint D-Link DI-713P Wireless Gateway (2.57 build 3a) Class D-Link | embedded || WAP TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=) T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # DLink DI-804 Cable/DSL Residential Gateway (with firmware v2.00B7) Fingerprint DLink DI-804 Cable/DSL Residential Gateway (firmware v2.00B7) Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<10%SI=<3C%IPID=I%TS=U) T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link DCS-1000 webcam with firmware 1.06 Class D-Link | embedded || webcam TSeq(Class=TD%gcd=<E0%SI=<14%IPID=I%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=ASF%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # D-Link DSL-300G+ version 7.1.0.30 ANNEXA (Oct 18 2002) R2.05.b4t9uk Fingerprint D-Link DSL-300G+ DSL modem Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<1731C%SI=<14%IPID=I%TS=U) T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint D-Link DSL-500 DSL modem Class D-Link | embedded || broadband router TSeq(Class=TD%gcd=<1FBD4%SI=<14%IPID=I%TS=U) T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint D-Link Print Server Class D-Link | embedded || print server TSeq(Class=TD%gcd=<72%SI=<1E) T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # DI-701 Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30 Fingerprint DI-701 Residential Gateway or KA9Q NOS - KO4KS-TNOS v. 2.30 Class D-Link | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=N) T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint D-Link DWL-5000AP WAP/BSP 1.3 Class D-Link | embedded || WAP TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # D-Link Wireless Access Point (WAP) DRC-1000AP - v3.2.28 # 3com 11Mpbs Wireless LAN Access Point 2000 (Firmware 1.2) Fingerprint wireless access point (WAP): D-Link DRC-1000AP or 3com Access Point 2000 Class D-Link | embedded || WAP TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Intel Corporation, ER9100 Express Router 9100 # Fingerprint by Ron van Daal (ronvdaal@syntonic.net) Fingerprint Intel Corporation, ER9100 Express Router 9100 Class Intel | embedded || router TSeq(Class=TD%gcd=10|20|30%SI=1) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Intel Express 510T switch Class Intel | embedded || switch TSeq(Class=TD%gcd=10|20|30%SI=<BB) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Intel InBusiness Print Station Class Intel | embedded || print server TSeq(Class=64K) T1(DF=N%W=424%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Intel NetportExpress 10 3-port print server Class Intel | embedded || print server TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Intel Netport Express PRO print server V04.33a Class Intel | embedded || print server TSeq(Class=TD%gcd=1%SI=0) T1(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Intel NetportExpress(tm) 10/100 3-port ROM: V05.10a Fingerprint Intel NetportExpress 10/100 3-port print server Class Intel | embedded || print server TSeq(Class=64K) T1(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME) T4(Resp=Y%DF=N%W=16D0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=R%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Intel NetportExpress XL print server Class Intel | embedded || print server TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Intel NetStructure 470T Switch Class Intel | embedded || switch TSeq(Class=TD%gcd=<7534%SI=<64%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Labtam MT300, X-Terminal Kernel Class Labtam | embedded || X terminal TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix ETS16 terminal server Version V3.4/5(961028) Class Lantronix | embedded || terminal server TSeq(Class=RI%gcd=<6%SI=<9D1C&>91%IPID=BI%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix ETS16P terminal server Version V3.5/2(970721) Class Lantronix | embedded || terminal server TSeq(Class=RI%gcd=<6%SI=<404C&>90) T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix EPS1 print server version V3.5/1(970325) Class Lantronix | embedded || print server TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF) T1(DF=N%W=E00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix EPS2 print server Version V3.5/2(970721) Class Lantronix | embedded || print server TSeq(Class=RI|TD%gcd=<6) T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620) Class Lantronix | embedded || terminal server TSeq(Class=RI%gcd=<6%SI=<9318E&>1688%IPID=BI%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620) Class Lantronix | embedded || terminal server TSeq(Class=RI%gcd=<8%SI=<404C&>8C%IPID=BI%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint LG Goldstream LR3100p router, software version 1.0-1.5 Class LG GoldStream | embedded || router TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint LG Goldstream LR3001f router, software version 4.0 Class LG GoldStream | embedded || router TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint Microbase VirtuOS v3.00b R.09 Class Microbase | VirtuOS || general purpose TSeq(Class=TD%gcd=<2120004%SI=<14%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MultiTech CommPlete Controller (terminal server) Class MultiTech | embedded || terminal server TSeq(Class=TR|RI%gcd=<6%SI=>FFFF) T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint MultiTech MultiVOIP Version 2.01A Firmware Class MultiTech | embedded || telecom-misc TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MultiTech standalone firewall box, version 3 Class MultiTech | embedded || firewall TSeq(Class=TD%gcd=<714%SI=<14) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) Fingerprint IBM MVS TCP/IP TCPMVS 3.2 Class IBM | MVS || general purpose TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2 Class IBM | MVS || general purpose TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200) T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) Fingerprint IBM MVS TCP/IP TCPOE 3.3 Class IBM | MVS || general purpose TSeq(Class=RI%gcd=<6%SI=<BB0) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM MVS Class IBM | MVS || general purpose TSeq(Class=RI%gcd=64|C8|12C|190) T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Innovaphone 200 V4.00 sr4 IP200[02-4283], Bootcode[205], HW[202] 2048/8192 # Innovaphone IP400 V4.00 hotfix IP400[02-4253], Bootcode[315], HW[102] 2048/4096 Fingerprint Innovaphone IP200/IP400 VOIP phone/gateway Class Innovaphone | embedded || telecom-misc TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U) T1(DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Bay Networks Instant Internet router Class Bay Networks | embedded || router TSeq(Class=TD%gcd=1000|2000|3000%SI=<BB) T1(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Intergraph Workstation (2000 Series) running CLiX R3.1 Class Intergraph | CLiX || general purpose TSeq(Class=TD%gcd=209|1048|E3F%SI=<5) T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # IPAD Model 5000 (see www.ipad-canada.com) # esoft IPAD, v.1.52 -- 64 line option on i86 hardware Fingerprint IPAD (Internet Protocol Adapter) Model 5000 or V.1.52 Class NetMatrix | embedded || general purpose TSeq(Class=TD|RI%gcd=1000|2000|3000%SI=<444) T1(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 5.2 Class SGI | IRIX | 5.X | general purpose TSeq(Class=64K) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=F000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 5.3 Class SGI | IRIX | 5.X | general purpose TSeq(Class=64K) T1(DF=N%W=EF2A|F000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=EF2A|F000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=EF2A|F000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.2 Class SGI | IRIX | 6.X | general purpose TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=1FA0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1FA0%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.2 - 6.5 Class SGI | IRIX | 6.X | general purpose TSeq(Class=TD|64K|RI%gcd=<6|3E8|7D0|BB8|FA0) T1(DF=N%W=EF2A|C000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A|C000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.2 - 6.5 Class SGI | IRIX | 6.X | general purpose TSeq(Class=i800) T1(DF=N%W=C000|EF2A%ACK=S++|O%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.4 - 6.5.3m # Lamont Granquist (again :) Class SGI | IRIX | 6.X | general purpose TSeq(Class=RI|TD%gcd=28|50|78|A0|C8|F0|140%SI=<3E8) T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.5 Class SGI | IRIX | 6.X | general purpose TSeq(Class=RI%gcd=10%SI=<2222) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.5 Origin2 Class SGI | IRIX | 6.X | general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # IP19/IP27/IP30/IP32 Fingerprint SGI IRIX 6.5-6.5.15m Class SGI | IRIX | 6.X | general purpose TSeq(Class=RI|64K|i800%gcd=<144%SI=<FFFF&>8%IPID=I%TS=2HZ) T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SGI IRIX 6.5.7f-6.5.8f Class SGI | IRIX | 6.X | general purpose TSeq(Class=64K) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint SGI IRIX 6.5.15m on SGI O2 Class SGI | IRIX | 6.X | general purpose TSeq(Class=TD%gcd=<104%SI=<1AE%IPID=I%TS=2HZ) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # SGI O2 running SGI IRIX 6.5.7f Fingerprint SGI IRIX 6.5.7f-6.5.8f Class SGI | IRIX | 6.X | general purpose TSeq(Class=64K) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # SGI IRIX 6.5.14, SGI O2 # SGI IRIX 6.5 IP32 Fingerprint SGI IRIX 6.5.14 Class SGI | IRIX | 6.X | general purpose TSeq(Class=RI%gcd=<C%SI=<13876&>257%IPID=I%TS=2HZ) T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Isolation Systems Infocrypt Enterprise Class Isolation | embedded || encryption accelerator TSeq(Class=C) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL traffic generation and analysis server Class Ixia | embedded || specialized TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Juniper Router running JUNOS Class Juniper | JUNOS || router TSeq(Class=RI%gcd=<5%SI=>FFF) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Juniper Networks JUNOS 5.3 on an Olive router Class Juniper | JUNOS || router TSeq(Class=RI%gcd=<6%SI=<ABEB4&>661%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Juniper Networks JUNOS 5.5R1.2 built 2002-09-28 Fingerprint Juniper Networks router JUNOS 5.5R1.2 Class Juniper | JUNOS || router TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # JUNOS <hostname> 5.6R1.3 JUNOS 5.6R1.3 #0: 2003-01-02 20:38:33 UTC -- This one was no Juniper Hardware Router but a JunOS installed on a simple i386 box. Fingerprint Juniper Networks JUNOS 5.6R1.3 routing software on X86 box Class Juniper | JUNOS || router TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # KA9Q is a networking OS used mostly by amateur radio operators for radio to # internet gateways. Fingerprint KA9Q amateur radio OS Class KA9Q | KA9Q || specialized TSeq(Class=TD%gcd=37000%SI=<1E) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # 3com OfficeConnect 812 ADSL router firmware 2.0.0 # Kentrox Datasmart 656 CSU/DSU or USR Netserver/16 Fingerprint Kentrox Datasmart 656 CSU/DSU, USR Netserver/16, or 3Com OfficeConnect ADSL router Class Kentrox | embedded || CSUDSU Class US Robotics | embedded || switch Class 3Com | embedded || broadband router TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=<A) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Kronos Time clock Class Kronos | embedded || specialized TSeq(Class=TD%gcd=<7C%SI=<32%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Kyocera IB-21 Printer NIC Class Kyocera | embedded || printer TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U) T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=100%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=100%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Lantronix LSB4 Ethernet Switch Class Lantronix | embedded || switch TSeq(Class=RI%gcd=<6%SI=>CCC&<FFFF) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint RoadLanner broadband router BRL-04FW 6.15.02r Build 0091 L:01 Class RoadLanner | embedded || broadband router TSeq(Class=TD%gcd=<6E004%SI=<14%IPID=I%TS=1000HZ) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Rockwell Spectrum 100 POTS switcher release 7.2 Class Rockwell | embedded || telecom-misc TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or # Trancell Webramp router or Xylan Omni Switch 3.2.X.X - 3.4.X.X # Epson Stylus Color 1520C with 100BTX-NIC from Epson # CISCO 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX # SonicWall firewall appliance 10meg firmware 3.3.1 Fingerprint Router/Switch/Printer/Firewall (LanPlex 2500/Cisco Catalyst 5505/CISCO 6509/Trancell Webramp/Xylan Omni Switch)/Epson Stylus (100BTX-NIC HP Secure Web Console, SonicWall firewall appliance 3.3.1) Class Cisco | embedded || switch Class Xylan | embedded || switch Class Epson | embedded || printer Class SonicWall | embedded || firewall Class Trancell | embedded || router TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Leunig ePower Switch b723 v5.2 Class Leunig | embedded || power-device TSeq(Class=TR) T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Lexmark M412n network printer Class Lexmark | embedded || printer TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ) T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Lexmark Optra S 1659 (MarkNetS) # Lexmark Optra S 2455 and SC 1275 Fingerprint Lexmark Optra S Printer Class Lexmark | embedded || printer TSeq(Class=TD%gcd=1393|2726|3AB9|4E4C|61DF%SI=<30) T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N|Y) # Lexmark Optra T612 (printer) running firmware 3.11.17 # Lexmark Optra S 2420 Fingerprint Lexmark Optra printer Class Lexmark | embedded || printer TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U) T1(DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Lexmark Marknet X2031e printer Class Lexmark | embedded || printer TSeq(Class=RI%gcd=<6%SI=<AFDAC&>16E0%IPID=I%TS=2HZ) T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Lexmark MarkNet XL Internal Printer Network Adapter on a Lexmark Optra LaserPrinter Fingerprint Lexmark Optra printer w/MarkNet XL Network Adapter Class Lexmark | embedded || printer TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1 Class Lexmark | embedded || printer TSeq(Class=TD%gcd=1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Lexmark T522 printer Class Lexmark | embedded || printer TSeq(Class=RI%gcd=<6%SI=<24E3426&>5E5DB%IPID=Z%TS=100HZ) T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Lexmark T522/T622 printer Class Lexmark | embedded || printer TSeq(Class=RI%gcd=<8%SI=<2C2D254&>387BA%IPID=Z%TS=100HZ) T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linksys BEFW11S4 802.11B WAP # Linksys BEFSR41 firmware ver. 1.40.2 Fingerprint Linksys BEFW11S4 WAP or BEFSR41 router Class Linksys | embedded || WAP Class Linksys | embedded || broadband router TSeq(Class=TD%gcd=<F4%SI=<500%IPID=Z%TS=U) T1(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00|400|800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000|C00|400|800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linksys EtherFast print server Class Linksys | embedded || print server T1(DF=N%W=0|C80%ACK=S++%Flags=AR|APS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Linksys EtherFast print server Class Linksys | embedded || print server TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Linksys WAP11 v2.6 firmware 1.06 Fingerprint Linksys WAP11 Wireless AP Class Linksys | embedded || WAP TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U) T1(DF=N%W=1200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1200%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linksys WAP11 wireless AP v2.2 firmware 1.06 # DLink DWL-900+ with Firmware Version 2.57, Wed, 30 Apr 2003 Fingerprint Linksys WAP11 or D-Link DWL-900+ wireless AP Class Linksys | embedded || WAP Class D-Link | embedded || WAP TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linksys WET-11 wireless ethernet bridge running firmware rev. 1.43 Fingerprint Linksys WET-11 wireless ethernet bridge Class Linksys | embedded || bridge TSeq(Class=RI%gcd=<6%SI=<2C30D0&>52F7%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Pitney Bowes DL550 photocopier # Konica IP Controller Internal Print Server Module for Konica Multi-Purpose Printer/Fax/Scanner, Model KCA_018823 Fingerprint Pitney Bowes photocopier, Konica printer/fax/scanner, or Toshiba E-Studio16 printer Class Pitney Bowes | embedded || printer Class Konica | embedded || printer Class Toshiba | embedded || printer T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint PS2 Linux 1.0 on Sony PS2 game console Class Sony | Linux || game console TSeq(Class=RI%gcd=<6%SI=<20E2FE8&>5428C%IPID=I%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNT) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) # fingerprint! Fingerprint Linux 1.0.9 Class Linux | Linux | 1.X | general purpose TSeq(Class=TD%gcd=30|60%SI=<F) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=ASF%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 1.2.8 - 1.2.13 Class Linux | Linux | 1.X | general purpose TSeq(Class=RI%gcd=<6%SI=<BBBB) T1(DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 1.2.13 Class Linux | Linux | 1.X | general purpose TSeq(Class=TD%gcd=1%SI=1C) T1(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 1.3.20 (X86) Class Linux | Linux | 1.X | general purpose T1(DF=N%W=77FF|0%ACK=S++%Flags=AS|BAR%Ops=ME|) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.0 Class Linux | Linux | 2.0.X | general purpose TSeq(Class=RI%gcd=<6) T1(DF=N%W=7C00%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=6%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.27 - 2.0.30 Class Linux | Linux | 2.0.X | general purpose TSeq(Class=TR) T1(DF=N%W=7C00|3C00%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7C00|3C00%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.32-34 Class Linux | Linux | 2.0.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # On very rare cases, I get a T2 response back -- weird Fingerprint Linux 2.0.32-34 Class Linux | Linux | 2.0.X | general purpose TSeq(Class=TR) T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.34-38 Class Linux | Linux | 2.0.X | general purpose TSeq(Class=TR) T1(DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=AS%Ops=ME|M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FDF|7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=ASF%Ops=|ME|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0|20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint Linux 2.0.39 Class Linux | Linux | 2.0.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=3FE0|0%ACK=S++%Flags=ARSF|AR%Ops=ME|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.0.35 (S.u.S.E. Linux 5.3 (i386) Class Linux | Linux | 2.0.X | general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.24 PowerPC Class Linux | Linux | 2.1.X | general purpose TSeq(Class=TR) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.76 Class Linux | Linux | 2.1.X | general purpose TSeq(Class=TR) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.1.88 Class Linux | Linux | 2.1.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7) T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.91 - 2.1.103 Class Linux | Linux | 2.1.X | general purpose TSeq(Class=RI%gcd=<6%SI=>7A000) T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.1.19 - 2.2.25 Class Linux | Linux | 2.1.X | general purpose Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<8%SI=>10000%IPID=I%TS=100HZ) T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=28|C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Linux 2.2.20 SMP Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<277C73C&>6371B%IPID=I%TS=100HZ) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) # SuSE Linux 6.3 (i386) - Kernel 2.2.13 Fingerprint Linux kernel 2.2.13 (SuSE; X86) Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<21DE76C&>2B4E4%IPID=I%TS=100HZ) T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.2.5 - 2.2.13 SMP Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<D49FAE&>2203C) T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E) Fingerprint Linux 2.2.12 - 2.2.19 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.2.13 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<E5F68C&>24CA0) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Linux 2.2.14 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7) T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E) Fingerprint Linux 2.2.19 - 2.2.20 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U) T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.2.19 on a DEC Alpha 233mhz Multia Fingerprint Linux 2.2.19 on a DEC Alpha Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E) # IPCop 1.20 dedicated firewall Linux distro old Pentium 1 hardware + 3C509B cards http://ipcop.org/ Fingerprint IPCop 1.20 Linux 2.2.2X-based firewall Class IPCop | Linux | 2.2.X | firewall TSeq(Class=RI%gcd=<6%SI=<95DBC&>116E%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Linux 2.2.21 SMP (X86) Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1921FE8&>404B1%IPID=I%TS=U) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.2.22 Class Linux | Linux | 2.2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<22AB988&>58BFF%IPID=I%TS=U) T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.12 Class Linux | Linux | 2.3.X | general purpose TSeq(Class=RI%gcd=<20%SI=>DDDD) T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.28-33 Class Linux | Linux | 2.3.X | general purpose TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3) T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.49 x86 Class Linux | Linux | 2.3.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E) T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86 Class Linux | Linux | 2.3.X | general purpose TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA) T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.6 as on Sharp Zaurus PDA Class Linux | Linux | 2.4.X | PDA TSeq(Class=RI%gcd=<6%SI=<1E74A9A&>4DF5C%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.4.0-test5 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8) T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E) # Cobalt Linux 6.0 Kernel 2.2.16c32_III on an i586 Fingerprint Linux kernel 2.2.16 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<23D760E&>5BBDD%IPID=Z) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.4.18 (x86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<5BA02C&>EA7B%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.4.19 (X86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<25CEE8A&>341B8%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++|O%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.4.0 - 2.5.20 Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.5.X | general purpose TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U) T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y|N%TOS=0|8|14|20|28|40|C0|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # Linux kernel 2.4.18 on Alpha EV4 # Linux Kernel 2.5.70 (X86) Fingerprint Linux Kernel 2.4.18 - 2.5.70 (X86) Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<20DBA72&>5419C%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20-4GB-athlon i686 # SuSE Linux 8.2 2.4.20-64GB-SMP Fingerprint Linux Kernel 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<22D7C86&>2AE00%IPID=I%TS=100HZ) T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.7 (zLinux on OS/390) Fingerprint Linux 2.4.7 (zLinux on OS/390) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<152381A&>3616E%IPID=Z%TS=100HZ) T1(DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Strangely enough, I have received several prints like this that claim a T2: Fingerprint Linux 2.4.16 - 2.4.18 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.4.0 - 2.5.20 w/o tcp_timestamps Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.5.X | general purpose TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U) T1(DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # linux kernel 2.4.20 (i586) Preemptible # Linux kernel 2.4.18 Fingerprint Linux kernel 2.4.18 - 2.4.20 (X86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<25C5808&>30578%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # I don't put "Gentoo" as the vendor for the classification because it # makes output ugly when there are a bunch of Linux matches due to # firewalling or similar problems. Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.18 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<1C15A06&>23F17%IPID=Z) T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20 (Gentoo 1.2; X86) # Linux Kernel 2.4.18-14 Fingerprint Linux 2.4.18 - 2.4.20 (X86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2B9C772&>6FA19%IPID=Z%TS=100HZ) T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux Kernel 2.4.18 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<21BFEA2&>46B9B%IPID=Z%TS=100HZ) T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.19 w/grsecurity patch Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2A492C6&>6C3F2%IPID=RD%TS=1000HZ) T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<18D4252&>3F8B9%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux kernel 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<14B7282&>11A94%IPID=Z%TS=100HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux 2.4.20-xfs-rmap15d-ptrace #1 Debian GNU/Linux Fingerprint Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<15580A6&>30FB7%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux kernel 2.4.20-gentoo-r5 w/grsecurity Fingerprint Linux 2.4.20 - 2.4.21 w/grsecurity.org patch Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.5.25 - 2.5.70 or Gentoo 1.2 Linux 2.4.19 rc1-rc7) Class Linux | Linux | 2.4.X | general purpose Class Linux | Linux | 2.5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ) T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Linux Kernel 2.4.3-2.10.1smp (RedHat 7.0.98 Wolverine) Fingerprint Linux Kernel 2.4.3 SMP (RedHat) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2E7A750&>76F8A%IPID=Z%TS=1000HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.7 (X86) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U) T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Linux 2.4.17 on HP 9000 s700 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Astaro Security Linux 4 (Kernel 2.4.19) Class Linux | Linux | 2.4.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # http://www.sics.se/~adam/lwip/ Fingerprint lwIP (Lightweight TCP/IP stack) version lwip-0.5.3-win32 Class lwIP | lwIP || general purpose TSeq(Class=TD%gcd=<6%SI=<3C%IPID=I%TS=U) T1(DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME) T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Not really constant -- just slow incrementation # This is an LCIII Fingerprint Apple Mac OS 7.1 Class Apple | Mac OS | 7.X | general purpose TSeq(Class=C) T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6 Class Apple | Mac OS | 7.X | general purpose TSeq(Class=C|TD) T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 7.5.5 - 9 Class Apple | Mac OS | 7.X | general purpose Class Apple | Mac OS | 8.X | general purpose Class Apple | Mac OS | 9.X | general purpose TSeq(Class=64K) T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.0 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0) T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8 running on an LC 475 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=TR) T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.1 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Apple Mac OS 8.5 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Apple Mac OS 8.6 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Apple Mac OS 8.6 Class Apple | Mac OS | 8.X | general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Apple Mac OS 9.2.2 Class Apple | Mac OS | 9.X | general purpose TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ) T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # HP-UX B.11.00 Fingerprint Apple Mac OS 9.04 or HP-UX B.11.00 Class Apple | Mac OS | 9.X | general purpose Class HP | HP-UX | 11.X | general purpose TSeq(Class=RI%gcd=<9%SI=>3FFF) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0|A0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Apple Mac OS X Server 1.2 (ppc) -- 1.2 == 10.1.2? Fingerprint Apple Mac OS X Server 10.1.2 (ppc) Class Apple | OS X | 10.1.X | general purpose TSeq(Class=RI%gcd=<6%SI=<199A9C&>4177) T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Magna SG10 intranet router Class Magna | embedded || router TSeq(Class=RI%gcd=<6%SI=<31AD68E&>5F62F%TS=100HZ) T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint FreeBSD 4.4-5 or Apple Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13) Class FreeBSD | FreeBSD | 4.X | general purpose Class Apple | Mac OS X | 10.0.X | general purpose TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ) T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Maxim-IC TiniOS DS80c400 Class Maxim-IC | TiniOS || general purpose TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint MegaBit Gear TE4111C modem Class Megabit | embedded || terminal server TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) Class Meridian | embedded || storage-misc TSeq(Class=TD%gcd=40000%SI=<A) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=) T4(DF=N%W=200%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Xylogics Micro Annex ELS terminal server x7.1.8 Class Xylogics | embedded || terminal server TSeq(Class=64K) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Microplex Print Server Class Microplex | embedded || print server TSeq(Class=C) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Microplex M205 Pocket Print Server v5.7 # IBM 6400 Printer - Network Printer Server Version 7.0.9.6 [ network card ] Fingerprint IBM 6400 printer or Microplex Pocket Print Server Class IBM | embedded || printer Class Microplex | embedded || print server TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint MiNT with MiNTnet 1.03 running on Atari TT Class Atari | Atari || game console TSeq(Class=TD%gcd=3E7%SI=0) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=N) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Minix 32-bit/Intel 2.0.0 Class Minix | Minix || general purpose TSeq(Class=RI|TD%gcd=1|2|3|457%SI=<FFF) T1(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=) T4(Resp=N) T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint minix v2.0.2 32bits Class Minix | Minix || general purpose T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=) T4(Resp=N) T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Minix 32-bit/Intel 2.0.3 Class Minix | Minix || general purpose T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint MiraPoint messaging server v3.1 Class MiraPoint | embedded || general purpose TSeq(Class=RI%gcd=<6%SI=<DCCC6&>C2B%IPID=I%TS=100HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Mirapoint messaging server M1000 (OS v 1.0.0) Class MiraPoint | embedded || general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=0%ULEN=134%DAT=E) # VxWorks Version: 5.3; Software Version: SB4100E-4.1.11-SCM05-NOSHELL; Hardware Version: 3 Fingerprint Motorola SurfBoard SB4100E Cable Modem Class Motorola | embedded || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Motorola SurfBoard 4401 provided by adelphia Fingerprint Motorola SurfBoard 4401 cable modem Class Motorola | embedded || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F|0%ULEN=134%DAT=E) Fingerprint Motorola System V/68 version R3V7 on a 68030 Class Motorola | BSD-misc || general purpose TSeq(Class=RI%gcd=<14%SI=<52F8&>C0) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint MOTOROLA VANGUARD 320 IP router running OS version 5.4 Class Vanguard | embedded || router TSeq(Class=TD%gcd=<6%SI=<1E) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Motorola Vanguard 320 multi-protocol network access device V5.5 - 5.6 Class Vanguard | embedded || router TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint MultiTech CommPlete (modem server) RAScard Class MultiTech | embedded || terminal server TSeq(Class=TD%gcd=388|710|A98%SI=<44) T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NEC UX/4800 Class NEC | UX/4800 || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # NCD X server (SNMP says: NCD16 server 2.3.0 03/12/91 downloaded) Fingerprint NCD X server (NCD16 server 2.3.0 03/12/91) Class NCD | embedded || X terminal TSeq(Class=64K) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=) T4(DF=N%W=800%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NCR MP-RAS 3.0.x Class NCR | BSD-misc || general purpose TSeq(Class=64K) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NCR MP-RAS 3.01 Class NCR | BSD-misc || general purpose TSeq(Class=i800) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NCSA Telnet (dos) Class Microsoft | DOS || general purpose TSeq(Class=C) T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # I'm not 100% sure this version is for DOS, just a guess Fingerprint NCSA Telnet 2.3.08 for the PC (DOS) Class Microsoft | DOS || general purpose TSeq(Class=C) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) PU(Resp=N) # Host information: @WorkStation (i960 based) X-terminal # Neoware (was HDS) NetOS V. 2.0.1 # Hewlett-Packard ENTRIA Model C3230A Server Version B.05.30 # Cisco 11151/Arrowpoint 150 Load Balancer Fingerprint Cisco 11151/Arrowpoint 150 load balancer, Neoware (was HDS) NetOS V. 2.0.1 or HP ENTRIA C3230A Class Neoware | NetOS || X terminal Class HP | embedded || X terminal Class Cisco | embedded || load balancer TSeq(Class=64K) T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetApp F360 or 760 Filer Class NetApp | Data OnTap || fileserver TSeq(Class=RI%gcd=<6%SI=<7CA10&>CA2%IPID=BI%TS=2HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint NetApp Data OnTap 6.1.2R3 on an F840 filer Class NetApp | Data OnTap || fileserver TSeq(Class=RI%gcd=<6%SI=<83FEA&>B28%IPID=BI%TS=2HZ) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # NetApp DataOnTap Release 6.3.1: Wed Nov 20 13:03:17 PST 2002 Fingerprint NetApp DataOnTap Release 6.3.1 Class NetApp | Data OnTap || fileserver TSeq(Class=RI%gcd=<6%SI=<44A20&>AE7%IPID=BI%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint NetApp NetCache C760 os 4.x Class NetApp | embedded || web proxy TSeq(Class=RI%gcd=<6%SI=<4E51740&>FAA%IPID=I%TS=2HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=5000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint NetApp NetCache running OS 5.4R2 Class NetApp | embedded || web proxy TSeq(Class=RI%gcd=<6%SI=<22AD62&>1619%IPID=BI%TS=100HZ) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetApp Data OnTap 3.1.6 or BSDi 1.1 Class NetApp | Data OnTap || fileserver TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetApp Data OnTap 5.1.2 - 5.3.5r2 Class NetApp | Data OnTap || fileserver TSeq(Class=RI%gcd=<6%SI=>BBB) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E) # NetCache 5.1D4 on a NetApp C1100 Box Fingerprint Network Appliance NetCache 5.1D4 Class NetApp | embedded || web proxy TSeq(Class=RI%gcd=<6%SI=<ABC02&>1371%IPID=BI%TS=2HZ) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) # Notes on NetBSD (written by Charles M. Hannum <root@ihack.net>): # * The set of options in a SYN-ACK depends on the state of the # `net.inet.tcp.rfc1323' flag. # * Releases prior to 1.3 did not randomize the ISS at all. # * Releases prior to 1.3 incorrectly added the IP header length to the IP # packet length when returning an ICMP unreachable. # * Releases prior to 1.3 calculated the window size slightly wrong. # * Releases prior to 1.3 returned a non-zero window size when sending a RST # in response to an ACK on a listening socket (thereby making them # susceptible to stealth scanning). # * Releases prior to 1.3H/1.3.4 did not return a response to the null flag # test (thereby making them susceptible to stealth scanning). # * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in # the encapsulated IP header when sending an ICMP reply. On little endian # machines the IP ID field was byte-swapped. The checksums were always # zeroed. # * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when # MTU discovery was enabled. Fingerprint NetBSD 1.0 i386 Class NetBSD | NetBSD || general purpose TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.0 little endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=64K) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.0 big endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=64K) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.1 - 1.2.1 litle endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.2 - 1.2.1 big endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3 - 1.3.3 little endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3 - 1.3.3 big endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NetBSD 1.3H-1.5 big endian arch Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # NetBSD 1.3I (after 19990119) # NetBSD 1.4 x86 # NetBSD 1.6L/Alpha # NetBSD 1.6 NetBSD 1.6 (GENERIC) #0 Sun Sep 8 2002 i386 Fingerprint NetBSD 1.3I through 1.6 Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=>18000) T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.5_ALPHA i386 Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<5CF5F1C&>EDF97) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.5.2 running on a Commodore Amiga (68040 processor) Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<7AAB142&>874A7%IPID=I%TS=2HZ) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD/Alpha 1.5.2 on a DEC 3000/300 LX Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<736B300&>106DED%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint NetBSD 1.6 BETA 4 i386 (20020630 snapshot) Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<6%SI=<76BC4C8&>A6C26%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=4801%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint NetBSD 1.6 Class NetBSD | NetBSD || general purpose TSeq(Class=RI%gcd=<8%SI=<601F422&>60539%IPID=I) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) # Netgear FM144P ProSafe Wireless Firewall with Print Server # Repotec IP515H Cable Router / Print Server Fingerprint Netgear FM144P/Repotec IP515H Router & Print Server Class Netgear | embedded || broadband router TSeq(Class=TD%gcd=<104%SI=<1E%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Netopia 4541 ADSL router v5.3.4 # Netopia R7100 SDSL router Fingerprint Netopia 4541/R7100 DSL router Class Netopia | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Netopia DSL router Class Netopia | embedded || broadband router TSeq(Class=TR) T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetScreen-100 Class NetScreen | embedded || firewall TSeq(Class=RI%gcd=<6%SI=<276A&>50) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(Resp=N) PU(Resp=N) Fingerprint NetSilicon NetARM running ThreadX 2.0 Class NetSilicon | ThreadX || specialized TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Nokia IPSO 3.2-3.2.1 releng 783-849 # IPSO 3.4-FCS4A releng 767 Running CheckPoint 4.1 SP6 # Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based) # Nokia IPSO 4.3.1-FCS5 Fingerprint Nokia IPSO 3.2-4.3.1-FCS5 Running checkpoint FW1 Class Checkpoint | IPSO || firewall TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319) T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Nokia IPSO 3.2 Running Checkpoint Firewall-1 # IPSO 3.5-FCS8 releng 1020 Running Checkpoint FW-1 NG FP2 Fingerprint Nokia IPSO 3.2-3.5 Running Checkpoint Firewall-1 or NG FP2 Class Checkpoint | IPSO || firewall TSeq(Class=RI%gcd=<6%SI=<E4656&>2476) T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E) # Nokia IPSO 3.6 FCS 6 releng 1061 01.21.2003-230310 i386 w/ CheckPoint FW-1 NG FP 2, SSL & DNS hotfix and SmartDefense Supplimental Fingerprint Nokia IPSO 3.6 running CheckPoint FW-1 NG FP2 Class Checkpoint | IPSO || firewall TSeq(Class=RI%gcd=<6%SI=<7A148&>A01%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # Nokia M1122 DSL Router (Nokia Mrouter rel-Gx1x2220.R08) Fingerprint Nokia M1122 DSL Router Class Nokia | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<1AF18&>43B%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Netopia R3100-I DSL Router Firmware version v4.7.2 Class Netopia | embedded || broadband router TSeq(Class=TD%gcd=<EA64%SI=<10E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetJet Version 3.0 - 4.0 Printer Class NetJet | embedded || printer TSeq(Class=TD%gcd=<4%SI=<4) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|800%ACK=S++%Flags=AR%Ops=|M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Netscreen 5XP firewall + vpn (OS 3.0.1r2) Class Netscreen | embedded || firewall TSeq(Class=TD%gcd=1000%SI=<FF) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Netscreen 5XP firewall+vpn (os 4.0.3r2.0) Class Netscreen | embedded || firewall TSeq(Class=TR%gcd=<6) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(Resp=N) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Network Systems router NS6614 (NSC 6600 series) Class Network Systems | embedded || router TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Nexland ISB Pro800 Turbo, Firmware version: V1 Rel 5U Fingerprint Nexland ISB Pro800 Turbo Cable/DSL router Class Nexland | embedded || broadband router TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # A NeXT Turbo, unknown version number Fingerprint NeXT Mach Class NeXT | Mach || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Nokia IP530 Network Appliance (IPSO 3.4-3.4.2) Class Nokia | IPSO || firewall TSeq(Class=RI%gcd=<8%SI=<85DD6&>987%IPID=I%TS=2HZ) T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) # Nortel/Alteon ACE Director 3 Hardware Revision: B Software Version 6.0.42 Fingerprint Nortel/Alteon ACE Director 3 Version 6.0.42-B Class Alteon | embedded || load balancer TSeq(Class=TR%gcd=<6%IPID=RD) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) # Nortel Networks BayStack 450-24T Versions: HW:RevL FW:V1.48 SW:v4.2.0.16 ISVN:2 Fingerprint Nortel Networks BayStack switch Class Nortel | embedded || switch TSeq(Class=RI%gcd=<6%SI=<762A&>C8%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Nortel CallPilot 100 voicemail system # 3com superstack 3 4300 (3c17100) Hardware Version: V4.0 Software Version: V1.12 # Cisco 1538M micro hub running latest firmware # HP TopTools Remote Control Card # Enterasys VH2402 Switch Firmware 2.05.02 # NTT East VoIP gateway of some sort ( http://www.ntt-east.co.jp/ced/goods/voip/index.html ) Fingerprint Nortel CallPilot 100 voicemail system, 3Com Superstack 3 switch, Enterasys switch, HP TopTools remote control card, or Cisco 1538M hub Class Nortel | embedded || telecom-misc Class NTT | embedded || telecom-misc Class 3Com | embedded || switch Class Cisco | embedded || hub Class Enterasys | embedded || switch Class HP | embedded || specialized TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) Fingerprint Nortel Networks CVX1800 RAS. Software version 2.02 Class Nortel | embedded || terminal server TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Nortel Networks Passport 8600 routing switch sw 3.3.0.0 Class Nortel | embedded || switch TSeq(Class=RI%gcd=<6%SI=<E1C8A&>113A%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Novell NetWare 3.12 or 386 TCP/IP Class Novell | Netware | 3.X | general purpose TSeq(Class=TD%gcd=<6B4A%SI=<1E) T1(DF=N%W=73F|F87|3F25%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS|ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 3.12 - 5.00 Class Novell | Netware | 3.X | general purpose Class Novell | Netware | 4.X | general purpose Class Novell | Netware | 5.X | general purpose TSeq(Class=TD%gcd=10|20|30|40%SI=<64) T1(DF=Y|N%W=7D0|8000|2000|1FFF|7FFF|8000|FFFF%ACK=S++%Flags=AS%Ops=M|ME) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=7D0|8000|2000|1FFE|7FFF|8000|FFFF%ACK=O|S++%Flags=AS|ASF%Ops=M|ME) T4(Resp=N) T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint NetWare 4.11 SP7- 5 SP3A BorderManager 3.5 Class Novell | Netware | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1843D74&>3E1D0) T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint NetWare 4.11 SP8a - Netware 5 SP4 Class Novell | Netware | 4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2DB195E&>74F88) T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.0 with Border Manager Class Novell | Netware | 5.X | general purpose TSeq(Class=RI%gcd=<5%SI=>BBBBB) T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Novell Netware 5.x Class Novell | Netware | 5.X | general purpose TSeq(Class=RI%gcd=<8%SI=<286248A&>1B465%IPID=I%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Netware 5.0 SP 3a Class Novell | Netware | 5.X | general purpose TSeq(Class=RI%gcd=<8%SI=<5641338&>DCCE9) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Novell Netware 5 Support Pack Revision 06 Server Version 5.00.09 Fingerprint Novell Netware 5.00.09 SP06 Class Novell | Netware | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1EDA0D4&>2F197%IPID=I%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=FFF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 4.11-5.0SP5 Class Novell | Netware | 4.X | general purpose Class Novell | Netware | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2B302C0&>6E8E8) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M) T4(Resp=N) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Netware 5.1 SP3 Class Novell | Netware | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2385886&>53F65%IPID=RPI|BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 5.1-6.0 Class Novell | Netware | 5.X | general purpose Class Novell | Netware | 6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2883446&>599C6%IPID=RD|RPI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell NetWare 5.1SP4 - 6.0 Class Novell | Netware | 5.X | general purpose Class Novell | Netware | 6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<253064A&>5F32F%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 5.1 SP5 with Groupwise Class Novell | Netware | 5.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Novell Netware 5.1 SP5 with Groupwise Fingerprint Novell Netware 5.1 SP5 Class Novell | Netware | 5.X | general purpose TSeq(Class=RI%gcd=<6%SI=<2378ABE&>57780%IPID=BI%TS=U) T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M|MEWN) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Novell Netware 6 SP1 Class Novell | Netware | 6.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Novell Netware 6sp2 running BM3.7 (with no service packs) Fingerprint Novell Netware 6 SP2 Class Novell | Netware | 6.X | general purpose TSeq(Class=RI%gcd=<6%SI=<30102C2&>766BA%IPID=BI%TS=U) T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) Fingerprint NSG 500 router. OS version 7.6.1 (http://www.nsg.ru) Class NSG | embedded || router TSeq(Class=TD%gcd=<14004%SI=<28%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenStep 4.0-4.2 or NeXTStep 1.0-3.3 (Intel) Class NeXT | NeXTStep || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenStep 4.1/NeXTStep 3.3 Class NeXT | NeXTStep || general purpose TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint NeXTStep/OpenStep 4.2/Intel Class NeXT | NeXTStep || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=F87%ACK=S++|O%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Okidata 7200 Printer Class Okidata | embedded || printer T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint OpenBSD 2.1 - 2.3/SPARC Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=>FF) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # This fingerprint had LAND patch installed Fingerprint OpenBSD 2.1/X86 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=>BBB) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenBSD 2.2 - 2.3 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint OpenBSD Post 2.4 (November 1998) - 2.5 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=>FFF&<BBBBB) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # With more info provided by Theo De Raadt # OpenBSD 2.6 Fingerprint OpenBSD 2.6-2.8 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<1869F6&>3E6B) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134|3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.6-2.8 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<AD084&>1B9B) T1(DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.6 with all available patches as of roughly Feb01 Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<4C22A&>C1A) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F|E%UCK=F|E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.7/SPARC or NFR IDS Appliance ( 12/10/00 ) Class OpenBSD | OpenBSD | 2.7 | general purpose TSeq(Class=RI%gcd=<6%SI=<8FC28&>16EC) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint OpenBSD 2.8 (X86) Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=TD|RI%gcd=<6%SI=<A8C&>1%IPID=RPI|BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 2.9-beta through release (X86) Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y|N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y|N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint OpenBSD 2.9-stable Class OpenBSD | OpenBSD | 2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # OpenBSD 3.0 (x86 or SPARC) # OpenBSD 3.3 (hppa) # OpenBSD 3.3 (GENERIC) i386 Fingerprint OpenBSD 3.0 or 3.3 Class OpenBSD | OpenBSD | 3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=2HZ) T1(DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=4000|FFFF%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.0-STABLE (X86) Class OpenBSD | OpenBSD | 3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.0 SPARC with pf scrub in all feature Class OpenBSD | OpenBSD | 3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U|2HZ) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.1 on an Alpha Class OpenBSD | OpenBSD | 3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.1 (X86) Class OpenBSD | OpenBSD | 3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.1 (X86) Class OpenBSD | OpenBSD | 3.X | general purpose T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint OpenBSD 3.2 with pf scrub and no-df Class OpenBSD | OpenBSD | 3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.2 (X86) Class OpenBSD | OpenBSD | 3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint OpenBSD 3.3 Class OpenBSD | OpenBSD | 3.X | general purpose TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Savin 9927 Copier Class Savin | embedded || printer TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=2000%ACK=O%Flags=UR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=1C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Sequent DYNIX/ptx(R) V4.2.1 Class Sequent | embedded || general purpose TSeq(Class=RI%gcd=<F%SI=>FF&<FFFFF) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Sequent DYNIX/ptx(R) V4.4.6 Class Sequent | embedded || general purpose TSeq(Class=RI|TD%gcd=<6%SI=<3FC) T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=A%Ops=) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens HiCom 300E business phone system Release 6.5 Class Siemens | embedded || VoIP phone TSeq(Class=RI%gcd=<6%SI=<5D131C&>4A3C%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # Siemens HICOM 300 Phone switch (PBX) (WAML LAN card) Fingerprint Siemens HICOM 300 Phone switch (PBX) Class Siemens | embedded || PBX TSeq(Class=64K) T1(DF=N%W=808%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=808%ACK=O%Flags=A%Ops=) T4(DF=N%W=808%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Siemens HICOM Phone switch (PBX) Class Siemens | embedded || PBX TSeq(Class=RI%gcd=<A%SI=<4184D0&>4EB3%IPID=I%TS=100HZ) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens RM200-C40 running ReliantUNIX-N 5.45 Class Siemens | ReliantUNIX || general purpose TSeq(Class=RI%gcd=<6%SI=<7DF64&>AAA%IPID=I%TS=2HZ) T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Siemens SINIX-N 5.43C3002 Class Siemens | SINIX || general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=NW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=NW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens SINIX-N 5.41C0005 Class Siemens | SINIX || general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=0%ULEN=134%DAT=E) Fingerprint SINIX-Y 5.43B0045 Class Siemens | SINIX || general purpose TSeq(Class=64K) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens SINIX-Y 5.43C4001 Class Siemens | SINIX || general purpose TSeq(Class=RI%gcd=<6%SI=<26E76&>625) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW) T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Siemens Speedstream 2602 DSL/Cable router Class Siemens | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<22E601A&>31AA1%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Smoothwall Linux-based firewall 2.2.23 Class Smoothwall | Linux | 2.2.X | firewall TSeq(Class=RI%gcd=<6%SI=<F1DA6&>474%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SonicWall/10 firewall Class SonicWall | embedded || firewall TSeq(Class=TR) T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=7FE0|7FDF%ACK=O|S++%Flags=A|ASF%Ops=ME) T4(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SonicWall SOHO-3 firewall Class SonicWall | embedded || firewall T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SonicWall SOHO-3 firewall Class SonicWall | embedded || firewall TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SonicWall/10 Firewall Class SonicWall | embedded || firewall TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SONY NewsOS 6.1.2 Class Sony | NewsOS || general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL) T2(Resp=N) T3(Resp=Y%DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Sega Dreamcast game console Class Sega | embedded || game console TSeq(Class=TD%gcd=<780%SI=<14) T1(DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint StackTools StackTos 1.0 embedded networking OS Class StackTools | StackTos || general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=A8%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Proxim Stratum MP FW: 7_8_18; managed via HTTP and only relevant data is (I guess) the firmware version: FW: 7_8_18 Fingerprint Proxim Stratum MP wireless bridge Class Proxim | embedded || bridge TSeq(Class=TD%gcd=<61AC%SI=<46%IPID=I%TS=1000HZ) T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Stratus VOS Release 14.3.1ae Class Stratus | VOS || general purpose T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) PU(Resp=N) Fingerprint Symantec Enterprise Firewall 7.0 running on Windows 2000 SP2 Class Symantec | Windows | NT/2K/XP | firewall TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(Resp=N) # http://www.systech.com/catalog/RCS3000Entry.html # RCS/3182 - Firmware rev. 06D (Apr 26 2001 15:15:33) - OS ver. RCS_3000_BDNL Version 06F (May 18 2001 16:15:18) Fingerprint Systech RCS/3182 ethernet serial port server (firmware 06D) Class Systech | embedded || specialized TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFC%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint IBM OS/390 V2R10 Class IBM | OS/390 | V2 | general purpose TSeq(Class=RI%gcd=<6%SI=<17C1E&>128%IPID=I%TS=1000HZ) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint IBM OS/390 V5R0M0 Class IBM | OS/390 | V5 | general purpose TSeq(Class=RI%gcd=<5%SI=>F&<BBBB) T1(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint IBM OS/400 V4 r4-5 Class IBM | OS/400 | V4 | general purpose TSeq(Class=RI%gcd=<C%SI=<C1C&>3%IPID=I%TS=1000HZ) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Packet Engines PowerRail 5200 router version 2.6.0r10 - 16 Sep, 1999 Class Packet Engines | embedded || router TSeq(Class=64K) T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Panasonic KX-HCM10 network camera Class Panasonic | embedded || webcam TSeq(Class=TD%gcd=<F4%SI=<1E%TS=U) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Packeteer IP-PacketShaper 2000 V3.1 Fingerprint pSOS embedded IP stack, such as Packeteer IP-PacketShaper 2000 V3.1 Class Packeteer | pSOS || load balancer TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Packeteer PacketShaper 4000 v4.1.3b2 2000-04-05 Class Packeteer | pSOS || load balancer TSeq(Class=64K) T1(DF=N%W=430%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Panasonic IP Technology Broadband Networking Gateway, KX-HGW200 Class Panasonic | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<27BE484&>16928%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(Resp=N) Fingerprint Panasonic panafax DX2000 SuperG3 fax machine Class Panasonic | embedded || printer TSeq(Class=TD|RI%gcd=<18%SI=<177A&>27) T1(Resp=N) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Pigtail Express VoIP phone (runs VxWorks) Class Pigtail | VxWorks || VoIP phone TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Bell Labs Plan9 Second Edition Class Bell Labs | Plan9 || general purpose TSeq(Class=TR) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Bell Labs Plan9 Release 4 (x86) Class Bell Labs | Plan9 || general purpose TSeq(Class=TR%gcd=<6) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Planet WAP 1950 Wireless Access Point Class Planet | embedded || WAP TSeq(Class=TD%gcd=<1C%SI=<14%IPID=I%TS=U) T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Polycom ViewStation 512K videoconferencing system Class Polycom | embedded || webcam TSeq(Class=C) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Polycom ViewStation Class Polycom | embedded || webcam TSeq(Class=C) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint PolyCom ViewStation video-conferencing system (firmware v7.2) Class PolyCom | embedded || webcam TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Proteon OpenRoute 2.1 on a RBX200 Router or IBM 2210 Router Class IBM | embedded || router Class Proteon | OpenRoute || router TSeq(Class=TD%gcd=<6%SI=<BB) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Proteon OpenRoute 3.0 gt series router Class Proteon | OpenRoute || router TSeq(Class=TD%gcd=1%SI=0) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint QMS Magicolor 2200 DeskLaser printer Class QMS | embedded || printer T1(DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint QNX 4.24 - 4.25 realtime embedded OS Class QNX | QNX || general purpose TSeq(Class=64K) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint QNX 6.00 realtime embedded x86 Class QNX | QNX || general purpose TSeq(Class=TD%gcd=<7D4%SI=<8C%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint Racal 7100 Host Security Module 1.05 / 5.05 Class Racal | embedded || encryption accelerator TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Radionics Ram IV Alarm System # Lantronix CoBox DR1-IAP serial device server Fingerprint Lantronix CoBox serial device server or Radionics Ram IV Alarm Class Lantronix | embedded || terminal server Class Radionics | embedded || specialized TSeq(Class=TD%gcd=<404%SI=<6E%IPID=I%TS=U) T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Raptor firewall 5.03 on NT 4 Class Raptor | embedded || firewall TSeq(Class=TR) T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=N) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Raptor Firewall 6 on Solaris 2.6 Class Raptor | Solaris | 2.X | firewall TSeq(Class=RI%gcd=<6%SI=<E5CB8&>24B0) T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint RCA/Thomson cable modem DCM-235/245 Class RCA | embedded || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Redback SMS 1000-2000 DSL Router Class Redback | embedded || broadband router TSeq(Class=RI%gcd=<4%SI=>1000&<FFFF) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Redback SMS500 Redback Networks AOS Release 5.0.4.0 PRODUCTION RELEASE Fingerprint Redback SMS500 Redback Networks router AOS Release 5.0.4.0 Class Redback | AOS || router TSeq(Class=RI%gcd=<6%SI=<56DF6&>337%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0|F%ULEN=134%DAT=E) # Redback SMS 1800 router AOS Release 5.0.3.8 # Redback Networks SMS 10000 AOS 6.0.5.0 # Thomson TMC 390 cable modem Fingerprint Redback SMS 1800/10000 router or Thomson TMC 390 cable modem Class Redback | AOS || router Class Thomson | embedded || broadband router TSeq(Class=RI%gcd=<6%SI=<7B6BA&>BA7%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Redback SMS 1800 router Class Redback | AOS || router TSeq(Class=RI%gcd=<6%SI=<4CA7C&>C2F) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint ReliantUNIX-Y 5.44 B0033 RM600 1/256 R10000 Class Siemens | ReliantUNIX || general purpose TSeq(Class=64K) T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Ricoh Aficio AP4500 Network Laser Printer Class Ricoh | embedded || printer TSeq(Class=C%Val=0) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ringdale RP21 Print server Class Ringdale | embedded || print server TSeq(Class=TR%gcd=<6) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=) T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SCO UNIX release 3.2 Class SCO | SCO UNIX || general purpose TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint SCO OpenServer Release 5 Class SCO | OpenServer || general purpose TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO OpenServer(TM) Release 5 Class SCO | OpenServer || general purpose TSeq(Class=RI%gcd=<6%SI=<34A71A&>86B6) T1(DF=N%W=1000|6000|111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO OpenServer 5.0.5 Class SCO | OpenServer || general purpose TSeq(Class=RI%gcd=<5%SI=>FFFF) T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Unisys LX/NX MCP 46.1/HMP 5.0 on an Unisys LX5120 Fingerprint Cray Unisys LX/NX MCP 46.1/HMP 5.0 on LX5120 Class Cray | Unisys || general purpose TSeq(Class=RI%gcd=<6%SI=<7868FCE&>CF0B8%IPID=I%TS=U) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint SCO UnixWare 2.01 Class SCO | UnixWare || general purpose TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 2.1 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=>FFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 2.1.2 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=>FFFF) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 7.0.0 or OpenServer 5.0.4-5.0.6 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<BB%SI=>FFFF) T1(W=60F4%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=) T4(W=0%ACK=O%Flags=R%Ops=) T5(W=0%ACK=S++%Flags=AR%Ops=) T6(W=0%ACK=O%Flags=R%Ops=) T7(W=0%ACK=S%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 7.1.0 x86 Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=<442BB8&>AE70) T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SCO UnixWare 7.1.0 - 7.1.1 (x86) Class SCO | UnixWare || general purpose TSeq(Class=RI%gcd=<6%SI=<403094&>8C71%IPID=I%TS=100HZ) T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SCO Open Desktop ( Same as SCO UNIX?) Fingerprint SCO Open Desktop 2.0 Class SCO | SCO UNIX || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Secure Computing Sidewinder firewall 3.2 update 4 Class Secure Computing | embedded || firewall TSeq(Class=RI%gcd=<5%SI=>FFF&<FFFFF) T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Secure Computing Sidewinder firewall 5.2.1.06 Class Secure Computing | embedded || firewall TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Secure Computing SECUREZone Firewall Version 2.0 Class Secure Computing | embedded || firewall TSeq(Class=TR%gcd=<6) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Sharp Digital Imager (copier) AR-507 Class Sharp | embedded || printer T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Shiva AccessPort Bridge/Router Software V 2.1.0 # 3Com HiPer Access Router Card hardware 1.0.0 software 4.1.59 Fingerprint Shiva AccessPort Bridge/Router Software V 2.1.0 or 3Com HiPer Access Router Card hardware V1.0.0 software V4.1.59 Class Shiva | embedded || router Class 3Com | embedded || router TSeq(Class=TD%gcd=<6%SI=<F) T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Shiva LanRover/8E Version 3.5 Class Shiva | embedded || terminal server TSeq(Class=64K) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Quantum Snap Server Network Storage Box Class Quantum | embedded || storage-misc TSeq(Class=i800) T1(Resp=Y%DF=N%W=4470%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=4470%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=4470%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Quantum Snap server 4100 Class Quantum | embedded || storage-misc TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2238%ACK=O%Flags=A%Ops=) T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Sun Remote System Console version 1.12 # Brocade Fibre Switch, Firmware 2.6.0 Fingerprint Brocade Fibre Switch or Sun Remote System Console Class Brocade | embedded || switch Class Sun | embedded || specialized TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.3 - 2.4 Class Sun | Solaris | 2.X | general purpose TSeq(Class=64K) T1(DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.4 w/most Sun patches (jumbo cluster patch, security patches, etc) Class Sun | Solaris | 2.X | general purpose TSeq(Class=64K) T1(DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.5, 2.5.1 Class Sun | Solaris | 2.X | general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y|N%W=2229|2332|4452|FFAF|8377|8EDA|879B%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # SunOS dabox 5.6 Generic_105181-30 sun4u sparc SUNW,Ultra-Enterprise Fingerprint Sun Solaris 2.6 (SPARC) Class Sun | Solaris | 2.X | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 7 (SPARC) Class Sun | Solaris | 2.X | general purpose Class Sun | Solaris | 7 | general purpose TSeq(Class=RI%gcd=<6%SI=<57A26&>DF1) T1(DF=Y%W=2297|2788|4431|8371|8F4D|ABCD|FFF7|FFFF|2297|212%ACK=S++%Flags=AS%Ops=NNTNWME) T2(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T3(Resp=N) T4(DF=Y|N%W=0%ACK=O%Flags=R%Ops=|WNMETL) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y|N%W=0%ACK=O|S%Flags=AR|R%Ops=|WNMETL) T7(DF=Y|N%W=0%ACK=S|O%Flags=AR|R%Ops=|WNMETL) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=F|E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 7 X86 Class Sun | Solaris | 2.X | general purpose Class Sun | Solaris | 7 | general purpose TSeq(Class=RI%gcd=<6) T1(DF=Y%W=2491|462B%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 Class Sun | Solaris | 2.X | general purpose TSeq(Class=RI%gcd=<6%SI=<512B6&>CE8) T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=NNTME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=0 Class Sun | Solaris | 2.X | general purpose Class Sun | Solaris | 7 | general purpose TSeq(Class=64K) T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=2 Class Sun | Solaris | 2.X | general purpose Class Sun | Solaris | 7 | general purpose TSeq(Class=TR%IPID=I%TS=100HZ) T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) Fingerprint Sun Solaris 8 early access beta through actual release Class Sun | Solaris | 8 | general purpose TSeq(Class=RI|TR%gcd=<8%SI=<FEC86&>E0F%IPID=I%TS=100HZ) T1(DF=Y%W=5B4|60DA|807A|B68%ACK=S++%Flags=AS%Ops=NNTNWM|NNTM) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # Trusted Solaris 8 - SunOS SunRayServer 5.8 TS8 sun4u sparc SUNW,Ultra-60 Fingerprint Sun Trusted Solaris 8 Class Sun | Solaris | 8 | general purpose TSeq(Class=RI%gcd=<8%SI=<AD48A&>109A%IPID=I%TS=100HZ) T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=138%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Sun Solaris 9 Beta through Release on SPARC # solaris 9 i386 Fingerprint Sun Solaris 9 Class Sun | Solaris | 9 | general purpose TSeq(Class=RI%gcd=<6%SI=<A927C&>116A%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7|807A%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) Fingerprint Sun Solaris 9 with TCP_STRONG_ISS set to 2 Class Sun | Solaris | 9 | general purpose TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) T1(DF=Y%W=C0B7|8000|807A%ACK=S++%Flags=AS%Ops=NNTMNW) T2(Resp=N) T3(Resp=N) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Convex SPP-UX 5.2.1 Class Convex | SPP-UX || general purpose TSeq(Class=64K) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=) T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint SPP-UX 5.x on a Convex SPP-1600 Class Convex | SPP-UX || general purpose TSeq(Class=C) T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T2(Resp=N) T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=R%Ops=) T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Sun SunOS 4.0.3 Class Sun | SunOS || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Sun SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI Class Sun | SunOS || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Sun SunOS 4.1.1 - 4.1.4 (or derivative) Class Sun | SunOS || general purpose TSeq(Class=64K) T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E) Fingerprint Sun RSC (Remote System Control card) v1.14 (in Solaris 2.7) Class Sun | SunOS || general purpose T1(DF=N%W=2000%ACK=S++|O%Flags=ARS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) # Ericsson Tigris Access Server V. 12.1.15 with 10.2 ISDN code # Integrated Access Platform, Software Version = 12.1.1.22 (ISDN Software Version 10.1) Fingerprint Ericsson Tigris Access Server Software V. 12.1.* Class Ericsson | embedded || terminal server TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Tahoe OS 1.2.1 running on Tahoe router Class Tahoe | Tahoe OS || router TSeq(Class=RI%gcd=<8%SI=<A5A1E0&>6430%IPID=I%TS=U) T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=ASF%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Tally 9112 Printer Class Tally | embedded || printer TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U) T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Tandberg X-terminal Class Tandberg | embedded || X terminal TSeq(Class=64K) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=) T4(DF=N%W=400%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) Fingerprint Tandem NSK D39 Class Tandem | Tandem NSK || general purpose TSeq(Class=64K%gcd=<6%SI=<14) T1(DF=N%W=0|2000%ACK=S++%Flags=AR|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|2000%ACK=S++|O%Flags=AR|A%Ops=) T4(DF=N%W=0|2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Tandem NSK D40 Class Tandem | Tandem NSK || general purpose TSeq(Class=64K) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Tektronix Phaser 350 firmware 3.3 (printer) Class Tektonix | embedded || printer T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Tektronix Phaser 360 Extended Fingerprint Tektronix Phaser 360 printer Class Tektonix | embedded || printer TSeq(Class=i800) T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # From a Tektronix Phaser 350 Fingerprint Tektronix Phaser(TM) printer with share ethernet card, firmware version 3.01 Class Tektonix | embedded || printer TSeq(Class=RI%gcd=<F%SI=>888&<4444) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0|1000%ACK=S++|O%Flags=AR|AS%Ops=|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Tektronix Phaser 560 printer Class Tektonix | embedded || printer TSeq(Class=RI%gcd=<6%SI=<8C8C0&>B05%IPID=I%TS=U) T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Telebit's NetBlazer 3.0 router Class Telebit | embedded || router TSeq(Class=TD%gcd=<100004%SI=<3C) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Telebit NetBlazer router Version 3.05 Class Telebit | embedded || router TSeq(Class=TD%gcd=40000|80000|C0000%SI=<BB) T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # (Telebit router - 18 async/1 ether) Fingerprint Telebit NetBlazer Version 3.1, patch level 13 Class Telebit | embedded || router TSeq(Class=TD|TR%gcd=40000|80000|C0000|100000|200000%SI=<FF) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Telindus 11xx ADSL Router Class Telindus | embedded || broadband router TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) PU(Resp=N) Fingerprint Telocity (DirectTVDSL) Gateway x2 Model Class Telocity | embedded || broadband router TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=) T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) Fingerprint Teltrend (aka Securicor 3net) Router Class Teltrend | embedded || router TSeq(Class=TD%gcd=388|710%SI=<F) T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC TOPS-20 Monitor 7(21733),KL-10 (DEC 2065) Class DEC | TOPS-20 || general purpose TSeq(Class=TD%gcd=<60004%SI=<1E%TS=U) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(Resp=N) Fingerprint DEC TOPS-20 Monitor 7(102540)-1,TD-1 Class DEC | TOPS-20 || general purpose TSeq(Class=TD%gcd=30000|60000|90000%SI=<BB) T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Toshiba TR650 ISDN Router Class Toshiba | embedded || broadband router TSeq(Class=TD%gcd=<9%SI=<14) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=N) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) # TurtleBeach Audiotron with firmware 3.0.0 Fingerprint TurtleBeach Audiotron network MP3 player Class Turtle Beach | embedded-misc || specialized TSeq(Class=TD%gcd=<68%SI=<14%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Audiotron with 3.0.26 Firmware Fingerprint TurtleBeach Audiotron network MP3 player Class Turtle Beach | embedded-misc || specialized TSeq(Class=TD%gcd=<68%SI=<1E%IPID=RPI|RD%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # http://www.turtlebeach.com/site/products/audiotron/producthome.asp Fingerprint Turtle Beach AudioTron 100 network MP3 player Class Turtle Beach | embedded-misc || specialized TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O|S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint DEC Ultrix 4.1 Class DEC | Ultrix || general purpose TSeq(Class=64K) T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Ultrix 4.2 - 4.5 Class DEC | Ultrix || general purpose TSeq(Class=64K) T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=|M) T2(Resp=N) T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint US Robotics USR8022 broadband wireless router (WAP) Class US Robotics | embedded || WAP TSeq(Class=TD|RI%gcd=<68%SI=<636%IPID=I%TS=U) T1(DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # U.S. Robotics Broadband Router (Model # 8000-02, Version V2.5) Fingerprint US Robotics broadband router (model #8000-02) Class US Robotics | embedded || WAP TSeq(Class=TD%gcd=<130%SI=<1E%IPID=BI%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint US Robotics Total Control NETServer Card Class US Robotics | embedded || terminal server TSeq(Class=C%Val=7F) T1(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint 3Com / USR TotalSwitch Firmware: 02.02.00R Class 3Com | embedded || switch TSeq(Class=C|TD%gcd=3D090%SI=0) T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint VersaNet ISP-Accelerator(TM) Remote Access Server Class VersaNet | embedded || terminal server TSeq(Class=TD%gcd=<2004%SI=<14) T1(DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=ARF%Ops=) T3(Resp=Y%DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(DF=Y%W=0%ACK=O%Flags=RF%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=ARF%Ops=) T6(DF=Y%W=0%ACK=O%Flags=RF%Ops=) T7(DF=Y%W=0%ACK=S%Flags=ARF%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Virtual Access LinXpeed Pro 120 router running Software 7.4.33CM Class Virtual Access | embedded || router TSeq(Class=C|TD%gcd=<10004%SI=<1E%IPID=I%TS=U) T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) T3(Resp=Y|N%DF=Y%W=1000%ACK=O%Flags=AS%Ops=M) T4(DF=Y%W=100%ACK=O%Flags=R%Ops=) T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=100%ACK=O%Flags=R%Ops=) T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=) PU(Resp=N) # HPJ2600A Ethernet hub or HP ProCurve Switch 4000M # Bay Networks MicroAnnex XL running firmware 10.0B Fingerprint VxWorks 5.3.x bases system (usually an ethernet hub or switch such as HP ProCurve) or Bay Networks MicroAnnex XL terminal server Class HP | VxWorks || switch Class Bay Networks | embedded || terminal server TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint WatchGuard Firebox SOHO V5.x firewall Class WatchGuard | embedded || firewall TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # VxWorks (for Destiny D8405 Pass 2 (Firmware build for Pass 1)) version 5.4.2. Fingerprint Minolta QMS Printer running VxWorks 5.4.2 Class Minolta | VxWorks || printer TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=6000%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Microsoft Windows 3.1 with Trumpet Winsock 2.0 revision B Class Microsoft | Windows | 3.X | general purpose TSeq(Class=TD%gcd=10000%SI=<FF) T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Windows for Workgroups 3.11 / TCP/IP-32 3.11b stack or Windows 98 Class Microsoft | Windows | 3.X | general purpose Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<F%SI=<F) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Win95 4.00.950B - IE 5 5.50.4807.2300 Fingerprint Microsoft Windows 95 4.00.950B Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<6%SI=<3C%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Windows NT 3.10 (Build 528) Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI|TD%gcd=<24%SI=<69A%IPID=I%TS=U) T1(DF=N%W=1400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows NT 3.51 SP5 Fingerprint Microsoft Windows NT 3.51 SP5, NT 4.0 or 95/98/98SE Class Microsoft | Windows | 95/98/ME | general purpose Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4%IPID=BI|RPI|RD%TS=U|0) T1(DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=A|AS%Ops=|M|MNWNNT) T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=AS%Ops=M|MNWNNT) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 98 4.10.2222.A # "Windows 98 Second Edition, patched up to date" (1/25/03) Fingerprint Microsoft Windows 98SE Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<A%SI=<46%IPID=RPI|RD|BI%TS=U) T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 98 Second Edition (build 2222) Fingerprint Microsoft Windows 98SE Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<6%SI=<46%IPID=RPI|RD|BI%TS=U) T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft PocketPC 3.0.11171 running on Compaq iPAQ 3870 Pocket PC Class Microsoft | Windows | PocketPC/CE | PDA TSeq(Class=TD%gcd=<6%SI=<104%IPID=BI) T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 95 4.00.950B (IE 5 5.00 2314.1003) Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<14%SI=<32%IPID=BI) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O|S%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98SE + IE5.5sp1 Class Microsoft | Windows | 95/98/ME | general purpose T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=2DA0|0%ACK=S++|O%Flags=AS|R%Ops=M|) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N|Y) Fingerprint Microsfot Windows 98SE with security patch A Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<6%SI=<AA%IPID=BI%TS=U) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98 4.10.1998 Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<6%SI=<78%IPID=BI%TS=U) T1(DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98 SP2 Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U) T1(DF=Y%W=270F%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=270F%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98SE 4.10.2222A Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73) T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT) T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD%gcd=<F4%SI=<3C%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S|S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 95/98/NT 4.0 or PocketPC Class Microsoft | Windows | 95/98/ME | general purpose Class Microsoft | Windows | PocketPC/CE | PDA TSeq(Class=TD|RI%gcd=1|2|3|4|5|8|A|14|1E|28|5A|17C%SI=<1F4) T1(DF=Y%W=2017|16D0|860|8000|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP5-SP6 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<DA16&>21A) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows NT4 Workstation SP6a # windows nt4 swith service pack 6 Fingerprint Microsoft Windows NT 4.0 Workstation SP6a Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<A%SI=<1A66C&>112%IPID=RPI|BI%TS=U) T1(DF=Y%W=4470|7210|AC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=4470|7210|AC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP6a Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<8D3CE&>1017%IPID=RPI|RD%TS=U) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows NT Version 4.0 (Build 1381 - Service Pack 6), Revised Service Pack 6a Fingerprint Microsoft Windows NT 4.0 Workstation SP6a Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD%gcd=<8%SI=<46%IPID=RPI|RD|BI%TS=U) T1(DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 Workstation SP6a Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD%gcd=<6%SI=<46%IPID=BI%TS=U) T1(DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 Server SP5-SP6 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<11784E&>2CA4) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 4.0 SP 6a + hotfixes Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<40132&>290%IPID=BI|RPI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) PU(Resp=N|Y) Fingerprint Microsoft Windows NT 4.0 Terminal Server Edition Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<BEF0&>1D4%IPID=BI%TS=U) T1(DF=N|Y%W=0|2017%ACK=S++%Flags=AR|AS%Ops=|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=0|2017%ACK=O|S++%Flags=AR|AS%Ops=|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # HP Journada running Windows CE 2.11 (Handheld/PC Pro 3.0) running on StrongARM 1100 Fingerprint HP Journada running Microsoft Windows CE 2.11 (Handheld/PC Pro 3.0 PDA) Class Microsoft | Windows | PocketPC/CE | PDA TSeq(Class=TD%gcd=<36%SI=<28%IPID=BI%TS=U) T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98 Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=RI%gcd=<6%SI=<FFF) T1(DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 98 SP1 Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=TD%gcd=<5%SI=<20) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows NT 5 Beta2 or Beta3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TD%gcd=<6%SI=<1000) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows.NET Enterprise Server (build 3615 beta) # windows .net standard server build 3604 # Microsoft Windows 2003 Standard Build V5.2.3790 build 3790 Fingerprint Microsoft Windows .NET Enterprise Server (build 3604-3790) Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows Server 2003, Enterprise Edition, Build 3790 # Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947) Fingerprint Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947) Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows Server 2003 Standard Edition Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|1000%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows Server 2003 Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=FB8B%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows Server 2003 Enterprise Edition (Trial Version downloaded from microsoft as at 06/03 Fingerprint Microsoft Windows Server 2003 Enterprise Edition Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows Server 2003, build 3790 Fingerprint Microsoft Windows Server 2003 Class Microsoft | Windows | 2003/.NET | general purpose TSeq(Class=TR%gcd=<6) T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows Millenium Edition v4.90.300 # Windows Me or Windows 2000 RC1 through final release # Microsoft Windows 2000 Advanced Server # Windows 2000 with SP2 and long fat pipe (RFC 1323) # Windows 2000 Professional servicepack 3 # Windows 2000 5.00.2195 Service Pack 2 and latest hotfixes # Windows 2000 Professional (x86) # Compaq ProLiant DL-380G2 running windows 2000 with SP3 and all the current patch sets (2/3/03) # Winodws XP professional version 2002 on PC Intel processor # Windows XP Build 2600 # XP Professional 5.1 (build 2600).. all patches up to June 20, 2002 # Fingerprint Windows XP Pro with all current updates to May 2002 # Windows 2000 Version 5.0 Build (2195: Service Pack 3) # Windows 2000 Advanced Server sp3 Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP Class Microsoft | Windows | 95/98/ME | general purpose Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<FFFFF&>49C%IPID=I%TS=0) T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|4470|8052|B5C9|B580|C000|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT) T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|4470|8052|B5C9|B580|C000|402E|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 2000 Server with service pack 3 and MS-Exchange 2000 Server Fingerprint Microsoft Windows 2000 Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<DF0C&>186%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=A%Ops=NNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows ME + all updates as of 1/1/03 Fingerprint Microsoft Windows Millennium Edition (Me) Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=RI%gcd=<8%SI=<1DA74&>117%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<25224&>22C%IPID=I) T1(DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows (XP Pro) version 5.1 (numero 260.xpsp2.030422-1633:service pack 1) Fingerprint Microsoft Windows 2000 Server SP3 or Windows XP Professional SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<24F5E&>47E%IPID=I%TS=U) T1(DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 version 5 build 2195 Service Pack 2 Fingerprint Microsoft Windows 2000 SP2 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<270D8&>4BF%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<255BC&>24F%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<230DC&>388%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2382B18&>5AE4C%IPID=Z%TS=U) T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1A748&>D9%IPID=I%TS=U) T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2425C&>383%IPID=I) T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<13EEB2&>2BD%IPID=I%TS=U) T1(DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Pro SP2 # Microsoft Windows XP Pro SP1 Fingerprint Microsoft Windows 2000 Professional SP2 or Windows XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<270D8&>3E9%IPID=I) T1(DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<269EE&>2EC%IPID=I) T1(DF=Y%W=111C|FC00|E01F|FF70%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=111C|FC00|E01F|FF70%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|D0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<28B54&>31B%IPID=I) T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows 2000 5.00.2195 with SP 3 Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=TR%gcd=<6%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<876AE&>98E) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # windows 2000 professional build 2195 service pack 3 Fingerprint Microsoft Windows 2000 Professional SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1BB0C&>2DC%IPID=I%TS=U) T1(DF=Y%W=9448%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=9448%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Advanced Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<206B6&>2E7%IPID=I) T1(DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows 2000 Advanced Server SP3, all available updates as of 11/13/02 Fingerprint Microsoft Windows 2000 Advanced Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<58066&>3E9%IPID=I) T1(DF=Y%W=402E|FFF0%ACK=S++%Flags=AS%Ops=MNNT|MNWNNT) T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T3(Resp=Y%DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL) T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows Millennium Edition (Me) Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I) T1(DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Professional Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<1C476&>472) T1(DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) # Microsoft Windows 2000 Build 2195 Service Pack 1 Fingerprint Microsoft Windows 2000 SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<220164&>80000%TS=U) T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Home Edition Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<23C4E&>330%IPID=I%TS=U) T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional or Windows 2000 Professional SP2+ Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<16%SI=<25AEE&>6B%IPID=I) T1(DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<15374&>110%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Microsoft Windows 2000 with service pack 3 # Microsoft Windows XP Pro with SP1 and latest Windows Update patches as of February 1st, 2003 Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000, or Windows XP Class Microsoft | Windows | NT/2K/XP | general purpose Class Microsoft | Windows | 95/98/ME | general purpose TSeq(Class=RI%gcd=<20%SI=<E92A&>240) T1(DF=Y%W=40E8|5B8E|7FFF|FAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=40E8|5B8E|7FFFFAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows 2000 Professional RC1 or Windows 2000 Advanced Server Beta3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<27D922&>65EE) T1(DF=Y%W=402E|2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=402E|2017%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional RC1+ through final release Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<2959A&>356%IPID=I) T1(DF=Y|N%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP SP1 (Build 2600.XP SP2.030422-1633:Service Pack 1) Fingerprint Microsoft Windows XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<18DEE&>24B%IPID=I) T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Microsoft Windows XP Version 5.1 (Build 2600.xpsp 1.020828-1920: Service Pack 1) > lateste +windows update patch too (1/31/03) # Windows 2000 with service pack 3 Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2461C&>3BA%IPID=I%TS=U) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # windows xp pro WITHOUT ANY service packs # windows xp sp1 Fingerprint Microsoft Windows XP Professional Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<2EBEE&>45E%IPID=I%TS=U) T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<C99A0A&>291F) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<9A6AA&>18A0%IPID=I%TS=U) T1(DF=Y%W=8820%ACK=S++|O%Flags=AS|A%Ops=M|) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=8820%ACK=S++|O%Flags=AS||A%Ops=M||) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows XP Pro Version 5.1 (Build 2600.xpsp2.030422-1633: Service Pack1) Fingerprint Microsoft Windows XP Professional SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<63826&>D28%IPID=I%TS=U) T1(DF=Y%W=AE4C%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=AE4C%ACK=S++%Flags=AS%Ops=MNW) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Microsoft Windows XP Pro SP1 # Microsoft Windows2000 advaned Server with Service pack3 Fingerprint Microsoft Windows XP Professional SP1 or Windows 2000 Advanced Server SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<8%SI=<272A4&>31E%IPID=I%TS=U) T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0|5C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional Version 5.1 Build 2600 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<32578&>18D%IPID=I) T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) # Windows XP Pro Build 2600.xpsp1.020828-1920 with Windows Services for Unix 3.0 installed # Windows 2000 Advanced Server with SP3 # Microsoft Windows 2000 Server version 5.0 build 2195 Service Pack 3 # Windows 2000 SP3 Fingerprint Microsoft Windows XP Professional SP1 or Windows 2000 SP3 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<57472&>68D%IPID=I) T1(DF=N|Y%W=0|FFF0%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N|Y%W=0|FFF0%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Windows XP Professional SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<14686&>1A0%IPID=I) T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Windows Xp Pro service pack 1 version 5.1 - Build 2600 Fingerprint Microsoft Windows XP Professional SP1 Class Microsoft | Windows | NT/2K/XP | general purpose TSeq(Class=RI%gcd=<6%SI=<3316C&>33B%IPID=I) T1(DF=Y%W=6270%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=6270%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Microsoft Xbox (modified) running evolutionX Class Microsoft | embedded || game console TSeq(Class=TD%gcd=<6%SI=<2E4%IPID=I%TS=U) T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) # Xbox V1.1 Running Evolution-X Dashboard v1.8.3752 Fingerprint Microsoft Xbox (modified) running evolutionX Class Microsoft | embedded || game console TSeq(Class=RI%gcd=<6%SI=<5A14&>20%IPID=I%TS=U) T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint Microsoft Xbox running Debian Linux 2.4.20 Class Linux | Linux | 2.4.X | general purpose TSeq(Class=RI%gcd=<6%SI=<FB5982&>2833E%IPID=Z%TS=100HZ) T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T2(Resp=N) T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=) T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=) PU(Resp=N) Fingerprint WNOS 5.0 on Microsoft DOS 6.22 Class Microsoft | DOS || general purpose TSeq(Class=TD%gcd=1000|2000|3000%SI=<7F) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(DF=N%W=400%ACK=O%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint WTI Network Power Switch v3.02 Class WTI | embedded || power-device TSeq(Class=TD%gcd=<2A%SI=<1E%IPID=I%TS=U) T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) T7(DF=N%W=800%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint XCD Xconnect print server, firmware version CC8S-3.58 (98.09.21) Class XCD | embedded || print server TSeq(Class=TD%gcd=<272A%SI=<1E) T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=S%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) Fingerprint Xerox 8830 Plotter Class Xerox | embedded || printer TSeq(Class=TD%gcd=1000%SI=1) T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Xerox Document Centre ColorSeries 50 Class Xerox | embedded || printer TSeq(Class=i800%IPID=I%TS=U) T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=ME) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Xerox Document Centre 440 w/ CentreWare Internet Services Class Xerox | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Xerox DocuPrint C55 Class Xerox | embedded || printer TSeq(Class=TD%gcd=1000|2000|3000|4000%SI=<A) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Xerox DocuPrint N24/N32/N40 Network Laser Printer Class Xerox | embedded || printer TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Xerox DocuPrint N40 Class Xerox | embedded || printer TSeq(Class=TD%gcd=<2004%SI=<8C) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=O%Flags=R%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=O%Flags=R%Ops=) PU(Resp=N) Fingerprint Xerox Docuprint N2125 network printer Class Xerox | embedded || printer TSeq(Class=64K%IPID=I%TS=U) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) T2(Resp=N) T3(Resp=N) T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint xMach free distributed OS version 0.1 current Class xMach | xMach || general purpose TSeq(Class=64K%IPID=I%TS=2HZ) T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Xylan OmniSwitch 5x/9x ethernet switch, Xylogics Annex-III Comm server R10.0, or Hitachi HI-UX/WE2 Class Xylan | embedded || switch Class Xylogics | embedded || terminal server Class Hitachi | HI-UX || general purpose TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Xyplex 1600 terminal server running MAXserver V6.0.2 firmware Class Xyplex | MAXserver || terminal server TSeq(Class=C|TD%gcd=<5%SI=<5) T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) PU(Resp=N) Fingerprint Xylogics Remote Annex 4000 terminal server running LynxOS realtime OS Class Xylogics | LynxOS || terminal server TSeq(Class=64K) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cabletron Systems SSR 8000 smart switch router System Software, Version 3.1.B.16 Class Cabletron | embedded || router TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715) T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) Fingerprint Cabletron Smart Switch Router 8600 Class Cabletron | embedded || router T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=N) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) # CasheFlow CacheOS (CacheFlow 500-5000 webcache) CFOS 2.1.08 - 2.2.1 Fingerprint CasheFlow CacheOS (CacheFlow 500-5000 web proxy cache) CFOS 2.1.08 - 2.2.1 Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<5%SI=>BBBB&<FFFFF) T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=) T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint CacheFlow CacheOS 3.1 on a model 6000 web proxy cache Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<6%SI=<6DE6416&>1C6E5%IPID=RPI%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Cacheflow 6x5 web proxy cache running CacheOS 3.1.19-4.1.05 Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<6%SI=<CF3F0&>16F5%IPID=I%TS=2HZ) T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) T2(Resp=N) T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint CacheFlow 6000 web proxy cache running CacheOS 4.1.05 Class CacheFlow | CacheOS || web proxy TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U) T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) Fingerprint CastleNet AR502/GlobespanVirata GS8100 (same thing) DSL router Class CastleNet | embedded || broadband router TSeq(Class=TR%gcd=<6%IPID=I%TS=U) T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) T6(Resp=N) T7(Resp=N) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # http://www.cayman.com/ Fingerprint Cayman 2E DSL/CABLE router Class Cayman | embedded || broadband router TSeq(Class=TR%gcd=<6) T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Chase IOLAN Terminal Server v3.5.02 CDi Class Chase | embedded || terminal server TSeq(Class=TD%gcd=<84%SI=<1E) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=) T2(Resp=N) T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # These boxes give goofy PU RIPTL results (like 3549 and 4801) so I removed # that test Fingerprint Chase IOLAN terminal server Class Chase | embedded || terminal server TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U) T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) Fingerprint Xyplex Network 9000 terminal server Class Xyplex | embedded || terminal server TSeq(Class=TD%gcd=<6%SI=<6) T1(Resp=Y%DF=Y%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=) T4(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=) PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint Xyplex Terminal Server v6.0.2S5 Class Xyplex | embedded || terminal server TSeq(Class=TD%gcd=1388%SI=<F) T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) PU(Resp=N) # Fingerprint Xyplex Terminal Server/Xyplex hardware CSERV-20 11.00.00 ROM 410000/Xyplex software Terminal Server v6.0.4 (info frm SNMP) Fingerprint Xyplex Terminal Server CSERV-20 software v6.0.4 Class Xyplex | embedded || terminal server TSeq(Class=TD%gcd=<2714%SI=<258%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=) PU(Resp=N) # Zero One Tech. Print Server 3000 # Hawking Print Server PN7117 # Zero One Tech Printserver ZOT-PS-11 (firmware 5.4.2049) # EUSSO Technologies UPS1211-B print server Fingerprint Print Server: Zero One Tech 3000, Hawking PN7117, or EUSSO UPS1211-B Class Hawking | embedded || print server Class Zero One | embedded || print server Class EUSSO | embedded || print server TSeq(Class=TD%gcd=<C004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint ZoomAir IG-4165 wireless gateway (WAP) Class ZoomAir | embedded || WAP TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # ZyXEL ZyWALL 50 running ZyNOS V3.52(WC.2)C0 | 05/02/2003 Fingerprint Zyxel XyWALL 50 (ZyNOS 3.52) Class Zyxel | ZyNOS || firewall TSeq(Class=TD%gcd=<F0004%SI=<1E%IPID=I%TS=U) T1(DF=N%W=B680%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=N) T4(Resp=N) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(Resp=N) T7(Resp=N) PU(Resp=N) #Zyxel P128imh or P480 router (ZyNOS) #ZyNOS F/W Version: V2.50(AJ.7) | 2/28/2002 #Intel Express 8100 Router ISDN Fingerprint Zyxel ZyNOS based broadband router (ZyNOS) or Intel Express ISDN router Class Zyxel | ZyNOS || broadband router Class Intel | embedded || broadband router TSeq(Class=TD%gcd=1000|2000|5000|4000|6000|8000|A000|78000|%SI=<FF%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) # Zyxel Prestige 642R-11 (analog ADSL router) ZyNOS F/W Version: V2.50(AJ.9) Fingerprint Zyxel Prestige 642R-11 ASDL router running ZyNOS Class Zyxel | ZyNOS || broadband router TSeq(Class=TD%gcd=<F0004%SI=<14%IPID=I%TS=U) T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) T2(Resp=N) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) Fingerprint ZyXEL P480 ISDN router running ZyNOS v2.42(O.00) Class Zyxel | ZyNOS || broadband router TSeq(Class=TD%gcd=<2004%SI=<1E) T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) Fingerprint Hardware: Zyxel Prestige broadband router Class Zyxel | ZyNOS || broadband router T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(Resp=N) # ZyXEL Prestige 700 broadband router # Netgear MA314 Cable/Wireless Router Fingerprint ZyXEL Prestige 700/Netgear MA314 broadband router Class Zyxel | ZyNOS || broadband router T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=) T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) T4(DF=N%W=0%ACK=O%Flags=R%Ops=) T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) T6(DF=N%W=0%ACK=O%Flags=R%Ops=) T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)