home *** CD-ROM | disk | FTP | other *** search
/ PC Welt 2006 March / PCWELT_3_2006.ISO / base / 05_common.mo / usr / share / nmap / nmap-os-fingerprints < prev    next >
Encoding:
Text File  |  2005-03-09  |  613.1 KB  |  17,049 lines
  1. # Nmap OS Fingerprint List. -*- mode: fundamental; -*-
  2. # $Id: nmap-os-fingerprints,v 1.141 2005/01/31 20:40:45 fyodor Exp $ 
  3. #
  4. # Contributions to this database are welcome.  If Nmap obtains a new
  5. # fingerprint (and test conditions are favorable), it will print out a
  6. # URL you can use to submit the fingerprint.  If Nmap guesses wrong,
  7. # please send the full Nmap output and the exact destination host OS
  8. # name and version to fyodor@insecure.org .  Thanks!
  9. #
  10. # By submitting fingerprints you are transfering any and all copyright
  11. # interest in the data to Fyodor so that he can modify it, relicense it,
  12. # incorporate it into programs, etc.
  13. #
  14. # This collection of fingerprint data is (C) 1998-2003 by
  15. # Insecure.Com LLC.  This data is available for
  16. # free use by open source software under the terms of the GNU General
  17. # Public License.  We also license the data to selected
  18. # commercial/proprietary vendors under less restrictive terms.
  19. # Contact sales@insecure.com for more information.
  20. #
  21. # TEST DESCRIPTION:
  22. # Tseq is the TCP sequenceability test
  23. # T1 is a SYN packet with a bunch of TCP options to open port
  24. # T2 is a NULL packet w/options to open port
  25. # T3 is a SYN|FIN|URG|PSH packet w/options to open port
  26. # T4 is an ACK to open port w/options
  27. # T5 is a SYN to closed port w/options
  28. # T6 is an ACK to closed port w/options
  29. # T7 is a FIN|PSH|URG to a closed port w/options
  30. # PU is a UDP packet to a closed port
  31.  
  32. Fingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0
  33. Class 2Wire | embedded || WAP
  34. TSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ)
  35. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  36. T2(Resp=N)
  37. T3(Resp=N)
  38. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  39. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  40. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  41. T7(Resp=N)
  42. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  43.  
  44. # 3Com Home Connect Cable Modem external with USB - Model 3CR29223
  45. Fingerprint 3Com Home Connect Cable Modem
  46. Class 3Com | embedded || broadband router
  47. TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)
  48. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  49. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  50. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  51. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  52. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  53. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  54. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  55. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  56.  
  57. Fingerprint 3Com OfficeConnect 812 aDSL router
  58. Class 3Com | embedded || broadband router
  59. TSeq(Class=TD%gcd=<C354%SI=<1E%IPID=I%TS=U)
  60. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  61. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  62. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  63. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  64. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  65. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  66. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  67. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  68.  
  69. Fingerprint 3Com OfficeConnect Remote 812 aDSL Router
  70. Class 3Com | embedded || broadband router
  71. TSeq(Class=TD%gcd=<C354%SI=<1E)
  72. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  73. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  74. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  75. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  76. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  77. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  78. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  79. PU(Resp=N)
  80.  
  81. # 3Com Sharkfin/Tailfin Cable Modem boot code 01.00.003a main image 1.17 hardware 2.00 web 604
  82. Fingerprint 3Com Sharkfin/Tailfin Cable Modem
  83. Class 3Com | embedded || broadband router
  84. TSeq(Class=TD%gcd=<D6DC%SI=<14%IPID=I%TS=U)
  85. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  86. T2(Resp=N)
  87. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  88. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  89. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  90. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  91. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  92. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  93.  
  94. Fingerprint 3Com Sharkfin/Tailfin Cable Modem
  95. Class 3Com | embedded || broadband router
  96. TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U)
  97. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  98. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  99. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  100. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  101. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  102. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  103. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  104. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  105.  
  106. # 3Com NBX Superstack 3 IP PBX running firmware 4_1_11
  107. # 3Com NBX-100 (version R4_1_4) Phone System Processor
  108. Fingerprint 3Com NBX PBX
  109. Class 3Com | embedded || PBX
  110. TSeq(Class=64K%IPID=I%TS=2HZ)
  111. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  112. T2(Resp=N)
  113. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  114. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  115. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  116. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  117. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  118. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  119.  
  120. # 3Com AccessBuilder Remote Office 500 with firmware V05.T4N
  121. Fingerprint 3Com AccessBuilder Remote Office 500 router
  122. Class 3Com | embedded || router
  123. TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
  124. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  125. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  126. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=AS%Ops=ME)
  127. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  128. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  129. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  130. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  131. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  132.  
  133. Fingerprint 3Com NetBuilder & NetBuilder II OS v 9.3
  134. Class 3Com | embedded || router
  135. TSeq(Class=TD%gcd=3C%SI=<FF)
  136. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  137. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  138. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  139. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  140. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  141. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  142. T7(Resp=N)
  143. PU(Resp=N)
  144.  
  145. Fingerprint 3Com Netbuilder & Netbuilder II router OS v8.1
  146. Class 3Com | embedded || router
  147. TSeq(Class=TD%gcd=32|64|96%SI=<FF)
  148. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  149. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  150. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  151. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  152. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  153. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  154. T7(Resp=N)
  155. PU(Resp=N)
  156.  
  157. Fingerprint 3Com Netbuilder II Router Ver 11.4.0.51
  158. Class 3Com | embedded || router
  159. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  160. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  161. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  162. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  163. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  164. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  165. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  166. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  167. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  168.  
  169. Fingerprint 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
  170. Class 3Com | embedded || router
  171. TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
  172. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  173. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  174. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  175. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  176. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  177. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  178. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  179. PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  180.  
  181. # 3Com Netbuilder Remote Office 222 (ESPL-310), Version 10.1 (SW/NBRO-AB,10.1)
  182. Fingerprint 3Com Netbuilder Remote Office 222 router
  183. Class 3Com | embedded || router
  184. TSeq(Class=TD%gcd=<68%SI=<14%IPID=I%TS=U)
  185. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  186. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  187. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  188. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  189. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  190. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  191. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  192. PU(DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  193.  
  194. Fingerprint 3Com NetBuilder-II, OS version SW/NB2M-BR-5.1.0.27
  195. Class 3Com | embedded || router
  196. TSeq(Class=TD%gcd=32|64|96%SI=<F)
  197. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS|AP%Ops=|M)
  198. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  199. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  200. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  201. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  202. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  203. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  204. PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  205.  
  206. # 3Com OfficeConnect Netbuilder router running 11.4.0.09
  207. Fingerprint 3Com OfficeConnect Netbuilder router
  208. Class 3Com | embedded || router
  209. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  210. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  211. T2(Resp=N)
  212. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  213. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  214. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  215. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  216. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  217. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  218.  
  219. Fingerprint 3Com / USR TotalSwitch Firmware: 02.02.00R
  220. Class 3Com | embedded || switch
  221. TSeq(Class=C|TD%gcd=3D090%SI=0)
  222. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  223. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  224. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  225. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  226. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  227. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  228. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  229. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  230.  
  231. Fingerprint 3Com Access Builder 4000 Switch
  232. Class 3Com | embedded || switch
  233. T1(DF=N%W=0|800%ACK=S++%Flags=AR|AS%Ops=|M)
  234. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  235. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  236. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  237. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  238. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  239. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  240. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  241.  
  242. # 3Com LANplex 6004 Extended Switching Software 7.0
  243. Fingerprint 3Com LANplex 6004 switch
  244. Class 3Com | embedded || switch
  245. TSeq(Class=64K%IPID=I%TS=U)
  246. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  247. T2(Resp=N)
  248. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  249. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  250. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  251. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  252. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  253. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  254.  
  255. # Switch 1100, 3300
  256. Fingerprint 3Com SuperStack II switch (OS v 2.0)
  257. Class 3Com | embedded || switch
  258. TSeq(Class=C)
  259. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  260. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  261. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  262. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  263. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  264. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  265. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  266. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  267.  
  268. Fingerprint 3Com SuperStack II switch SW/NBSI-CF,11.1.0.00S38
  269. Class 3Com | embedded || switch
  270. TSeq(Class=TD%gcd=<68%SI=<3C)
  271. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  272. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  273. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  274. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  275. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  276. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  277. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  278. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  279.  
  280. # 3Com SuperStack II RAS 1500 software version 2.5.0, 159
  281. Fingerprint 3Com SuperStack II RAS remote access server
  282. Class 3Com | embedded || terminal server
  283. TSeq(Class=TD%gcd=<320CC%SI=<14%IPID=I%TS=U)
  284. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  285. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  286. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  287. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  288. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  289. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  290. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  291. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  292.  
  293. Fingerprint 3Com terminal server ESPL CS2100
  294. Class 3Com | embedded || terminal server
  295. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  296. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  297. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  298. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  299. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  300. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  301. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  302. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  303. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  304.  
  305. # Datavoice TxPORT PRISM 3000 T1 CSU/DSU 6.22/2.06
  306. # 3Com 11Mpbs Wireless LAN Access Point 8000
  307. Fingerprint Datavoice 3Com WAP or TxPORT PRISM T1 CSU/DSU
  308. Class 3Com | embedded || WAP
  309. Class Datavoice | embedded || CSUDSU
  310. TSeq(Class=RI%gcd=<6%SI=>18000)
  311. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  312. T2(Resp=N)
  313. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  314. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  315. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  316. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  317. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  318. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  319.  
  320. # Tested ACC Amazon 9.2.29, ACC Congo 9.2.35
  321. Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator
  322. Class ACC | embedded || router
  323. TSeq(Class=64K)
  324. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  325. T2(Resp=N)
  326. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  327. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  328. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  329. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  330. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  331. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  332.  
  333. Fingerprint Acorn RISC OS 3.60 (Acorn TCP/IP Stack 4.07)
  334. Class Acorn | RISC OS || general purpose
  335. TSeq(Class=TR)
  336. T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  337. T2(Resp=N)
  338. T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
  339. T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=)
  340. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  341. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  342. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  343. PU(Resp=N)
  344.  
  345. Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd)
  346. Class Acorn | RISC OS || general purpose
  347. TSeq(Class=RI%gcd=<6)
  348. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  349. T2(Resp=N)
  350. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  351. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  352. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  353. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  354. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  355. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  356.  
  357. # Actiontec 1520 DSL gateway with GlobespanVirata chipset hardware version RD6700 BSP v1.1 (ISOS 8.2) / He100/2xx CSP v2.3, firmware version 8.2.0.16
  358. Fingerprint Actiontec 1520 DSL gateway firmware 8.2.0.16
  359. Class Actiontec | embedded || broadband router
  360. TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U)
  361. T1(DF=N%W=1194%ACK=S++%Flags=AS%Ops=ME)
  362. T2(Resp=Y%DF=N%W=1194%ACK=O%Flags=R%Ops=)
  363. T3(Resp=N)
  364. T4(DF=N%W=1194%ACK=O%Flags=R%Ops=)
  365. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  366. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  367. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  368. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  369.  
  370. Fingerprint Adtran Atlas 890 digital cross-connect device
  371. Class Adtran | embedded || telecom-misc
  372. TSeq(Class=TD%gcd=<714%SI=<1E%IPID=I%TS=U)
  373. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  374. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  375. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  376. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  377. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  378. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  379. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  380. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  381.  
  382. Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge
  383. Class Aironet | embedded || bridge
  384. TSeq(Class=C%Val=0)
  385. T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=)
  386. T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
  387. T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
  388. T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
  389. T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
  390. T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=)
  391. T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=)
  392. PU(Resp=N)
  393.  
  394. Fingerprint Aironet Wireless Bridge running firmware V5.0J
  395. Class Aironet | embedded || bridge
  396. TSeq(Class=C|TR)
  397. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  398. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  399. T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=)
  400. T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  401. T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  402. T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  403. T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  404. PU(Resp=N)
  405.  
  406. Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps wireless access point
  407. Class Aironet | embedded || WAP
  408. TSeq(Class=TR%gcd=<6)
  409. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  410. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  411. T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  412. T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  413. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  414. T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  415. T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  416. PU(Resp=N)
  417.  
  418. Fingerprint Alcatel 1000 ADSL (modem)
  419. Class Alcatel | embedded || broadband router
  420. TSeq(Class=64K)
  421. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  422. T2(Resp=N)
  423. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  424. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  425. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  426. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  427. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  428. PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  429.  
  430. Fingerprint Alcatel 1000 DSL Router
  431. Class Alcatel | embedded || broadband router
  432. TSeq(Class=RI%gcd=<5%SI=>AAA&<AAAAA)
  433. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  434. T2(Resp=N)
  435. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  436. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  437. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  438. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  439. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  440. PU(Resp=N)
  441.  
  442. # Alcatel Speed Touch Home running GV8BAA3.235 (992640)
  443. # Alcatel SpeedTouch Pro ADSL Router running NZ OS 3.281
  444. #  Alcatel Speed Touch Home ADSL Modem (POTS), Ver 3.2
  445. Fingerprint Alcatel Speed Touch *DSL modem/router
  446. Class Alcatel | embedded || broadband router
  447. TSeq(Class=64K%IPID=I%TS=2HZ)
  448. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  449. T2(Resp=N)
  450. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  451. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  452. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  453. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  454. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  455. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E|F%ULEN=134%DAT=E)
  456.  
  457. # Alcatel Speed Touch 510 *DSL router (uses THOMSON UNIX embedded Version 4.0.0.9.0)
  458. Fingerprint Alcatel Speed Touch 510 *DSL modem/router
  459. Class Alcatel | embedded || broadband router
  460. TSeq(Class=64K%IPID=I%TS=2HZ)
  461. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  462. T2(Resp=N)
  463. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  464. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  465. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  466. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  467. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  468. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  469.  
  470. Fingerprint Alcatel Speed Touch Pro aDSL modem
  471. Class Alcatel | embedded || broadband router
  472. TSeq(Class=64K%IPID=I%TS=2HZ)
  473. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  474. T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  475. T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  476. T4(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  477. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  478. T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  479. T7(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
  480. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  481.  
  482. Fingerprint Alcatel OmniStack switch version 4.3.3 GA
  483. Class Alcatel | embedded || switch
  484. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  485. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  486. T2(Resp=N)
  487. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  488. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  489. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  490. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  491. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  492. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  493.  
  494. # Advanced Reflexes IP Phone, Version: E/AT400/46.8
  495. # IBM x450 remote management console (lets you switch machine on/off, check temp, etc)
  496. Fingerprint Alcatel Advanced Reflexes IP Phone or IBM x450 remote management console
  497. Class Alcatel | embedded || VoIP phone
  498. Class IBM | embedded || remote management
  499. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  500. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  501. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  502. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  503. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  504. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  505. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  506. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  507. PU(Resp=N)
  508.  
  509. Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub
  510. Class Allied Telesyn | embedded || hub
  511. TSeq(Class=C)
  512. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  513. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  514. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  515. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  516. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  517. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  518. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  519. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  520.  
  521. Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA
  522. Class Allied Telesyn | embedded || switch
  523. TSeq(Class=TD%gcd=FA|1F4%SI=<FFF)
  524. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  525. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  526. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  527. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  528. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  529. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  530. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  531. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  532.  
  533. # Allied Telesyn Layer 3 Switch AT-8748XL Version 2.6.1
  534. # Allied Telesyn Rapier 24i
  535. Fingerprint Allied Telesyn AT-8748XL or Rapier 24i Switch
  536. Class Allied Telesyn | embedded || switch
  537. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  538. T1(DF=N%W=1F40%ACK=S++%Flags=AS%Ops=M)
  539. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  540. T3(Resp=Y%DF=N%W=1F40%ACK=S++%Flags=AS%Ops=M)
  541. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  542. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  543. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  544. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  545. PU(Resp=N)
  546.  
  547. # Allied Telesyn AT-RP24i Rapier 24i version 2.3.1-04
  548. # Ericsson Home internet Solution ver. 2.0
  549. Fingerprint Allied Telesyn AT-RP24i switch or Ericcson HiS V2.0
  550. Class Allied Telesyn | embedded || switch
  551. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  552. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  553. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  554. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  555. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  556. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  557. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  558. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  559. PU(Resp=N)
  560.  
  561. Fingerprint Amos 2.3A
  562. Class Alpha Micro | AMOS || general purpose
  563. TSeq(Class=i800%gcd=<6%SI=<14)
  564. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  565. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  566. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  567. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  568. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  569. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  570. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  571. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  572.  
  573. Fingerprint Alteon Networks ACEswitch 180e Software Version 8.0.62.7
  574. Class Alteon | embedded || load balancer
  575. TSeq(Class=RI%gcd=<14%SI=<D45BC&>85A%IPID=I%TS=U)
  576. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  577. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  578. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  579. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  580. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  581. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  582. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  583. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  584.  
  585. # Nortel/Alteon ACE Director 3 Hardware Revision: B Software Version 6.0.42
  586. Fingerprint Nortel/Alteon ACE Director 3 Version 6.0.42-B
  587. Class Alteon | embedded || load balancer
  588. TSeq(Class=TR%gcd=<6%IPID=RD)
  589. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  590. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  591. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  592. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  593. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  594. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  595. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  596. PU(Resp=N)
  597.  
  598. # Alteon AceSwitch 110 (software 4.0.37)
  599. # Centillion C100 ATM Switch OS Version 2.0.2.
  600. Fingerprint Alteon AceSwitch 110 or Cantillion C100 ATM Switch
  601. Class Alteon | embedded || switch
  602. Class Cantillion | embedded || switch
  603. TSeq(Class=TD%gcd=<9C8%SI=<1E)
  604. T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M)
  605. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  606. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  607. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  608. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  609. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  610. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  611. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  612.  
  613. # Alteon ACEswitch 184 Software Version 8.0.49
  614. Fingerprint Alteon ACEswitch 184 V. 8.0.49
  615. Class Alteon | embedded || switch
  616. TSeq(Class=RI%gcd=<34%SI=<C698A&>215%IPID=I%TS=U)
  617. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  618. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  619. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  620. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  621. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  622. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  623. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  624. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  625.  
  626. Fingerprint Amiga OS 3.5 (Miami TCP/IP Stack v3.1)
  627. Class Amiga | AmigaOS || general purpose
  628. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  629. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  630. T2(Resp=N)
  631. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  632. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  633. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  634. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  635. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  636. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  637.  
  638. Fingerprint AmigaOS 2.1 running AmiTCP4.3
  639. Class Amiga | AmigaOS || general purpose
  640. TSeq(Class=64K%TS=U)
  641. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
  642. T2(Resp=N)
  643. T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
  644. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  645. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  646. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  647. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  648. PU(DF=N%TOS=20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  649.  
  650. Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m
  651. Class Amiga | AmigaOS || general purpose
  652. TSeq(Class=TR%gcd=<6)
  653. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  654. T2(Resp=N)
  655. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  656. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  657. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  658. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  659. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  660. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  661.  
  662. Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0c
  663. Class Amiga | AmigaOS || general purpose
  664. TSeq(Class=TR%gcd=<6)
  665. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  666. T2(Resp=N)
  667. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  668. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  669. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  670. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  671. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  672. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  673.  
  674. Fingerprint AmigaOS AmiTCP/IP 4.3
  675. Class Amiga | AmigaOS || general purpose
  676. TSeq(Class=64K)
  677. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
  678. T2(Resp=N)
  679. T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
  680. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  681. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  682. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  683. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  684. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  685.  
  686. Fingerprint AmigaOS AmiTCP/IP Genesis 4.6
  687. Class Amiga | AmigaOS || general purpose
  688. TSeq(Class=64K)
  689. T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M)
  690. T2(Resp=N)
  691. T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=)
  692. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  693. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  694. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  695. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  696. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  697.  
  698. Fingerprint AmigaOS Miami 2.1-3.0
  699. Class Amiga | AmigaOS || general purpose
  700. TSeq(Class=TR)
  701. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  702. T2(Resp=N)
  703. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  704. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  705. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  706. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  707. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  708. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  709.  
  710. Fingerprint AmigaOS Miami 3.0
  711. Class Amiga | AmigaOS || general purpose
  712. TSeq(Class=TR)
  713. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  714. T2(Resp=N)
  715. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  716. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  717. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  718. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  719. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  720. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  721.  
  722. Fingerprint AmigaOS Miami 3.1-3.2
  723. Class Amiga | AmigaOS || general purpose
  724. TSeq(Class=TR)
  725. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  726. T2(Resp=N)
  727. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  728. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  729. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  730. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  731. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  732. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  733.  
  734. Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B
  735. Class Amiga | AmigaOS || general purpose
  736. TSeq(Class=TR)
  737. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  738. T2(Resp=N)
  739. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  740. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  741. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  742. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  743. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  744. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  745.  
  746. Fingerprint APC MasterSwitch Network Power Controller
  747. Class APC | embedded || power-device
  748. TSeq(Class=TR)
  749. T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  750. T2(Resp=N)
  751. T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  752. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  753. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  754. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  755. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  756. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  757.  
  758. # APC AP9617  network management card inside Matrix 5000 UPS
  759. Fingerprint APC network-enabled UPS
  760. Class APC | embedded || power-device
  761. TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ)
  762. T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  763. T2(Resp=N)
  764. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  765. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  766. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  767. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  768. T7(Resp=N)
  769. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  770.  
  771. # SmartUPS 3000RM Firmware: 92.14.I
  772. # APC PDU AOS v1.1.6
  773. Fingerprint APC UPS system
  774. Class APC | embedded || power-device
  775. TSeq(Class=TD%gcd=<F38C%SI=<DC%IPID=I)
  776. T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  777. T2(Resp=N)
  778. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  779. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  780. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  781. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  782. T7(Resp=N)
  783. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  784.  
  785. # APC AOS 2.2.7 (on APC AP7901 network management card)
  786. Fingerprint APC UPS System network management card (runs AOS)
  787. Class APC | embedded || power-device
  788. TSeq(Class=TD%gcd=<7A124%SI=<1E%IPID=I%TS=1000HZ)
  789. T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT)
  790. T2(Resp=N)
  791. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  792. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  793. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  794. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  795. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  796. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  797.  
  798. Fingerprint APC Web/SNMP UPS management card
  799. Class APC | embedded || power-device
  800. TSeq(Class=RI%gcd=<6%SI=<52FB700&>D46DF)
  801. T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  802. T2(Resp=N)
  803. T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME)
  804. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  805. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  806. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  807. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  808. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  809.  
  810. Fingerprint Apollo Domain/OS SR10.3.5
  811. Class Apollo | Domain/OS || general purpose
  812. TSeq(Class=RI|TD%gcd=<E%SI=<898%IPID=I%TS=U)
  813. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  814. T2(Resp=N)
  815. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  816. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  817. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  818. T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  819. T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  820. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  821.  
  822. Fingerprint Apollo Domain/OS SR10.4
  823. Class Apollo | Domain/OS || general purpose
  824. TSeq(Class=TD|RI%gcd=<6%SI=<FF)
  825. T1(DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
  826. T2(Resp=N)
  827. T3(Resp=Y%DF=N%W=239C%ACK=S++|O%Flags=AS%Ops=M)
  828. T4(DF=N%W=239C%ACK=O%Flags=R%Ops=)
  829. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  830. T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
  831. T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  832. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  833.  
  834. Fingerprint Apple A/UX 3.1.1 SVR2 or OpenStep 4.2
  835. Class Apple | A/UX || general purpose
  836. TSeq(Class=64K)
  837. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  838. T2(Resp=N)
  839. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  840. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  841. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  842. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  843. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  844. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  845.  
  846. Fingerprint Apple Color LaserWriter 12/660 PS (Model No. M3036)
  847. Class Apple | embedded || printer
  848. T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  849. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  850. T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=AR%Ops=)
  851. T4(DF=N%W=C00%ACK=O%Flags=R%Ops=)
  852. T5(Resp=N)
  853. T6(DF=N%W=C00%ACK=O%Flags=R%Ops=)
  854. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  855. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  856.  
  857. # Actually it is not constant seq class -- it just seems that way
  858. # because it takes so long to increment
  859. Fingerprint Apple Color LaserWriter 600 Printer
  860. Class Apple | embedded || printer
  861. TSeq(Class=C)
  862. T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  863. T2(Resp=N)
  864. T3(Resp=Y%DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  865. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  866. T5(Resp=N)
  867. T6(DF=N%W=800%ACK=O%Flags=R%Ops=)
  868. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  869. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  870.  
  871. Fingerprint Apple Color LaserWriter 600 Printer
  872. Class Apple | embedded || printer
  873. TSeq(Class=C)
  874. T1(DF=N%W=A28%ACK=S++%Flags=AS%Ops=M)
  875. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  876. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  877. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  878. T5(Resp=N)
  879. T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  880. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  881. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  882.  
  883. Fingerprint Apple LaserWriter 16/600 PS, HP 6P, or HP 5 Printer
  884. Class Apple | embedded || printer
  885. TSeq(Class=C)
  886. T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  887. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  888. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  889. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  890. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  891. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  892. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  893. PU(Resp=N)
  894.  
  895. # The sequence prediction is never really true random, but sometimes it
  896. # has two unique "tracks" which make it look random to nmap.  Here is a
  897. # real example:  Sequence numbers: 5576001 25D001 5576001 25D001
  898. Fingerprint Apple LaserWriter 8500 (PostScript version 3010.103)
  899. Class Apple | embedded || printer
  900. TSeq(Class=TR|C)
  901. T1(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  902. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  903. T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  904. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  905. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  906. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  907. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  908. PU(Resp=N)
  909.  
  910. # Apple AirPort Express (Apple Base Station V6.0)
  911. Fingerprint Apple AirPort Express WAP
  912. Class Apple | embedded || WAP
  913. TSeq(Class=RI%gcd=<6%SI=<A9830&>1000%TS=2HZ)
  914. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  915. T2(Resp=N)
  916. T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=AS%Ops=MNWNNT)
  917. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  918. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  919. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  920. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  921. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  922.  
  923. # Apple AirPort Extreme Base Station Firmware 5.1.1
  924. Fingerprint Apple Airport Extreme Base Station (WAP)
  925. Class Apple | embedded || WAP
  926. TSeq(Class=RI%gcd=<6%SI=<94160&>15CB%IPID=I%TS=2HZ)
  927. T1(DF=Y%W=2000|4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  928. T2(Resp=N)
  929. T3(Resp=Y%DF=Y%W=2000|4000%ACK=O%Flags=A%Ops=NNT)
  930. T4(DF=N%W=2000|4000%ACK=O%Flags=R%Ops=)
  931. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  932. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  933. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  934. PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  935.  
  936. # Mac OS X 1.1-1.2
  937. Fingerprint Apple Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3
  938. Class Apple | Mac OS X | 10.0.X | general purpose
  939. TSeq(Class=RI%gcd=<5)
  940. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  941. T2(Resp=N)
  942. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
  943. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  944. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  945. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  946. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  947. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  948.  
  949. # Mac OS X Server 1.0 - 1.0-1 <-- should be 10.1.0?
  950. Fingerprint Apple Mac OS X Server 1.0-1.0-1 (Rhapsody 5.3 - 5.4)
  951. Class Apple | Mac OS X | 10.0.X | general purpose
  952. TSeq(Class=RI%gcd=<5%SI=>BBB&<FFFF)
  953. T1(W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  954. T2(Resp=N)
  955. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  956. T4(W=2000%ACK=O%Flags=R%Ops=)
  957. T5(W=0%ACK=S++%Flags=AR%Ops=)
  958. T6(W=0%ACK=O%Flags=R%Ops=)
  959. T7(W=0%ACK=S%Flags=AR%Ops=)
  960. PU(TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  961.  
  962. Fingerprint Apple Mac OS X 10.1 - 10.1.4
  963. Class Apple | Mac OS X | 10.1.X | general purpose
  964. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  965. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  966. T2(Resp=N)
  967. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  968. T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  969. T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
  970. T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  971. T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  972. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  973.  
  974. Fingerprint Apple Mac OS X 10.1.4 (Darwin Kernel 5.4) on iMac
  975. Class Apple | Mac OS X | 10.1.X | general purpose
  976. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  977. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  978. T2(Resp=N)
  979. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  980. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  981. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  982. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  983. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  984. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  985.  
  986. Fingerprint Apple Mac OS X 10.1.5
  987. Class Apple | Mac OS X | 10.1.X | general purpose
  988. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  989. T1(DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  990. T2(Resp=N)
  991. T3(Resp=Y%DF=N|Y%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  992. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  993. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  994. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  995. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  996. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  997.  
  998. # Mac OS 10.2.6, Darwin kernel 6.6
  999. Fingerprint Apple Mac OS X 10.1.5-10.2.8
  1000. Class Apple | Mac OS X | 10.1.X | general purpose
  1001. Class Apple | Mac OS X | 10.2.X | general purpose
  1002. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1003. T1(DF=Y|N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1004. T2(Resp=N)
  1005. T3(Resp=Y%DF=Y|N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1006. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1007. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1008. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1009. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1010. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1011.  
  1012. # Apple Mac OS X Server 1.2 (ppc) -- 1.2 == 10.1.2?
  1013. Fingerprint Apple Mac OS X Server 10.1.2 (ppc)
  1014. Class Apple | Mac OS X | 10.1.X | general purpose
  1015. TSeq(Class=RI%gcd=<6%SI=<199A9C&>4177)
  1016. T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1017. T2(Resp=N)
  1018. T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT)
  1019. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  1020. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1021. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1022. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1023. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1024.  
  1025. Fingerprint Apple Mac OS X 10.2.6
  1026. Class Apple | Mac OS X | 10.2.X | general purpose
  1027. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1028. T2(Resp=N)
  1029. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  1030. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1031. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1032. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1033. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1034. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1035.  
  1036. Fingerprint Apple Mac OS X 10.2.6 (Jaguar)
  1037. Class Apple | Mac OS X | 10.2.X | general purpose
  1038. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1039. T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
  1040. T2(Resp=N)
  1041. T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT)
  1042. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1043. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1044. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1045. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1046. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1047.  
  1048. Fingerprint Apple Mac OS X 10.2.8 (Jaguar)
  1049. Class Apple | Mac OS X | 10.2.X | general purpose
  1050. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1051. T1(DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT)
  1052. T2(Resp=N)
  1053. T3(Resp=Y%DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT)
  1054. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1055. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1056. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1057. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1058. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1059.  
  1060. Fingerprint Apple Mac OS X 10.3.0 - 10.3.3
  1061. Class Apple | Mac OS X | 10.3.X | general purpose
  1062. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1063. T1(DF=Y%W=807A|C0B7|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  1064. T2(Resp=N)
  1065. T3(Resp=N)
  1066. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1067. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1068. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1069. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1070. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1071.  
  1072. Fingerprint Apple Mac OS X 10.3.3 (Panther)
  1073. Class Apple | Mac OS X | 10.3.X | general purpose
  1074. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  1075. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  1076. T2(Resp=N)
  1077. T3(Resp=N)
  1078. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1079. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1080. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1081. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1082. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  1083.  
  1084. Fingerprint Apple Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6
  1085. Class Apple | Mac OS | 7.X | general purpose
  1086. TSeq(Class=C|TD)
  1087. T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M)
  1088. T2(Resp=N)
  1089. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  1090. T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  1091. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  1092. T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  1093. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  1094. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1095.  
  1096. # Not really constant -- just slow incrementation
  1097. # This is an LCIII
  1098. Fingerprint Apple Mac OS 7.1
  1099. Class Apple | Mac OS | 7.X | general purpose
  1100. TSeq(Class=C)
  1101. T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M)
  1102. T2(Resp=N)
  1103. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  1104. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  1105. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1106. T6(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  1107. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1108. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1109.  
  1110. Fingerprint Apple Mac OS 7.5.5 - 9
  1111. Class Apple | Mac OS | 7.X | general purpose
  1112. Class Apple | Mac OS | 8.X | general purpose
  1113. Class Apple | Mac OS | 9.X | general purpose
  1114. TSeq(Class=64K)
  1115. T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1116. T2(Resp=N)
  1117. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1118. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1119. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1120. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1121. T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1122. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1123.  
  1124. Fingerprint Apple Mac OS 8 running on an LC 475
  1125. Class Apple | Mac OS | 8.X | general purpose
  1126. TSeq(Class=TR)
  1127. T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  1128. T2(Resp=N)
  1129. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  1130. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1131. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1132. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1133. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1134. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1135.  
  1136. Fingerprint Apple Mac OS 8.0
  1137. Class Apple | Mac OS | 8.X | general purpose
  1138. TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0)
  1139. T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1140. T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  1141. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1142. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1143. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1144. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1145. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1146. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1147.  
  1148. Fingerprint Apple Mac OS 8.1
  1149. Class Apple | Mac OS | 8.X | general purpose
  1150. TSeq(Class=64K)
  1151. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  1152. T2(Resp=N)
  1153. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  1154. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1155. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1156. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1157. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1158. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1159.  
  1160. Fingerprint Apple Mac OS 8.1
  1161. Class Apple | Mac OS | 8.X | general purpose
  1162. TSeq(Class=64K)
  1163. T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
  1164. T2(Resp=N)
  1165. T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL)
  1166. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1167. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1168. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1169. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1170. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1171.  
  1172. Fingerprint Apple Mac OS 8.1
  1173. Class Apple | Mac OS | 8.X | general purpose
  1174. TSeq(Class=64K)
  1175. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  1176. T2(Resp=N)
  1177. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL)
  1178. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1179. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1180. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1181. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1182. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1183.  
  1184. Fingerprint Apple Mac OS 8.1 running on a PowerPC G3 (iMac)
  1185. Class Apple | Mac OS | 8.X | general purpose
  1186. TSeq(Class=64K)
  1187. T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1188. T2(Resp=N)
  1189. T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1190. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1191. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1192. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1193. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1194. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1195.  
  1196. Fingerprint Apple Mac OS 8.5
  1197. Class Apple | Mac OS | 8.X | general purpose
  1198. TSeq(Class=64K)
  1199. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1200. T2(Resp=N)
  1201. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL)
  1202. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1203. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1204. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1205. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1206.  
  1207. # on Macintosh GS server
  1208. Fingerprint Apple Mac OS 8.5.1 (Appleshare IP 6.0)
  1209. Class Apple | Mac OS | 8.X | general purpose
  1210. TSeq(Class=64K)
  1211. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1212. T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1213. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1214. T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1215. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1216. T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1217. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1218. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1219.  
  1220. Fingerprint Apple Mac OS 8.6
  1221. Class Apple | Mac OS | 8.X | general purpose
  1222. TSeq(Class=64K)
  1223. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  1224. T2(Resp=N)
  1225. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  1226. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  1227. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1228. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1229. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1230. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1231.  
  1232. # Mac OS 8.6 running WebStar http server
  1233. Fingerprint Apple Mac OS 8.6
  1234. Class Apple | Mac OS | 8.X | general purpose
  1235. TSeq(Class=64K%IPID=I%TS=U)
  1236. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1237. T2(Resp=N)
  1238. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1239. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1240. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1241. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1242. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1243. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  1244.  
  1245. Fingerprint Apple Mac OS 8.6
  1246. Class Apple | Mac OS | 8.X | general purpose
  1247. TSeq(Class=64K)
  1248. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1249. T2(Resp=N)
  1250. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1251. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1252. T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
  1253. T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
  1254. T7(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  1255. PU(Resp=N)
  1256.  
  1257. Fingerprint Apple Mac OS 8.6
  1258. Class Apple | Mac OS | 8.X | general purpose
  1259. TSeq(Class=64K%IPID=I%TS=U)
  1260. T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1261. T2(Resp=N)
  1262. T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL)
  1263. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1264. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1265. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1266. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1267. PU(Resp=N)
  1268.  
  1269. #  Mac OS 9 on a Power Macintosh 7200/75
  1270. # iMac running Mac OS 9.1
  1271. Fingerprint Apple Mac OS 9 - 9.1
  1272. Class Apple | Mac OS | 9.X | general purpose
  1273. TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D)
  1274. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1275. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1276. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1277. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1278. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1279. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1280. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1281. PU(Resp=N)
  1282.  
  1283. # HP-UX B.11.00
  1284. Fingerprint Apple Mac OS 9.04 or HP-UX B.11.00
  1285. Class Apple | Mac OS | 9.X | general purpose
  1286. Class HP | HP-UX | 11.X | general purpose
  1287. TSeq(Class=RI%gcd=<9%SI=>3FFF)
  1288. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1289. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1290. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1291. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1292. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1293. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1294. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1295. PU(DF=Y%TOS=0|A0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1296.  
  1297. Fingerprint Apple Mac OS 9.2.2
  1298. Class Apple | Mac OS | 9.X | general purpose
  1299. TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ)
  1300. T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
  1301. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1302. T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT)
  1303. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1304. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1305. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1306. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1307. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1308.  
  1309. Fingerprint Apple MacOS 9.2.2
  1310. Class Apple | Mac OS | 9.X | general purpose
  1311. TSeq(Class=RI%gcd=<6%SI=<32EA6&>111%IPID=I%TS=1000HZ)
  1312. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1313. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1314. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  1315. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1316. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1317. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1318. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  1319. PU(DF=Y%TOS=40%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1320.  
  1321. Fingerprint Apple Newton MessagePad 2100, Newton OS 2.1
  1322. Class Apple | Newton OS || PDA
  1323. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1324. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=)
  1325. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1326. T4(DF=N%W=1000%ACK=S%Flags=R%Ops=)
  1327. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  1328. T6(DF=N%W=1000%ACK=S%Flags=R%Ops=)
  1329. T7(DF=N%W=1000%ACK=S%Flags=R%Ops=)
  1330. PU(Resp=N)
  1331.  
  1332. Fingerprint Arescom 800 series dsl router
  1333. Class Arescom | embedded || broadband router
  1334. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  1335. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  1336. T3(Resp=N)
  1337. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  1338. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  1339. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  1340. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  1341. PU(Resp=N)
  1342.  
  1343. Fingerprint Arescom NetDSL 1000NDS series ADSL router
  1344. Class Arescom | embedded || broadband router
  1345. TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
  1346. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  1347. T2(Resp=N)
  1348. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  1349. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  1350. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  1351. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  1352. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  1353. PU(Resp=N)
  1354.  
  1355. Fingerprint ARLAN BR2000E V5.0E Wireless Radio Bridge
  1356. Class Arlan | embedded || bridge
  1357. TSeq(Class=TR%gcd=<6)
  1358. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  1359. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  1360. T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  1361. T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  1362. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  1363. T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  1364. T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  1365. PU(Resp=N)
  1366.  
  1367. Fingerprint Asante FriendlyNet FR3004 Series Internet Hub
  1368. Class Asante | embedded || hub
  1369. TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U)
  1370. T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1371. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  1372. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1373. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  1374. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1375. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  1376. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  1377. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1378.  
  1379. Fingerprint AsanteHub 2072 Ethernet hub
  1380. Class Asante | embedded || hub
  1381. TSeq(Class=C)
  1382. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1383. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1384. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1385. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1386. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1387. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1388. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1389. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1390.  
  1391. Fingerprint Asante 6524-2G GigE switch
  1392. Class Asante | embedded || switch
  1393. TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U)
  1394. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1395. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1396. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1397. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1398. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1399. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1400. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1401. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1402.  
  1403. Fingerprint Asante IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 ))
  1404. Class Asante | embedded || switch
  1405. TSeq(Class=C%Val=4090000)
  1406. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1407. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1408. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1409. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1410. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1411. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1412. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1413. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1414.  
  1415. Fingerprint Asante IntraSwitch 5324
  1416. Class Asante | embedded || switch
  1417. TSeq(Class=C%Val=80000)
  1418. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1419. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1420. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1421. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1422. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1423. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1424. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1425. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1426.  
  1427. # Asante IntraSwitch 62xx (6216M in this case) Firmware v2.05A (16-port managed switch)
  1428. Fingerprint Asante IntraSwitch 6216M firmware v2.05A
  1429. Class Asante | embedded || switch
  1430. TSeq(Class=TD%gcd=<C28C%SI=<1E%IPID=I%TS=U)
  1431. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1432. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1433. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1434. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1435. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  1436. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1437. T7(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  1438. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1439.  
  1440. Fingerprint Ascend DSLPipe DSL-50S-CELL DSL router
  1441. Class Ascend | embedded || broadband router
  1442. TSeq(Class=RI%gcd=<6%SI=<671E2&>114%IPID=I%TS=U)
  1443. T1(DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
  1444. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1445. T3(Resp=Y%DF=Y%W=200%ACK=S++%Flags=AS%Ops=M)
  1446. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1447. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1448. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1449. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1450. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1451.  
  1452. Fingerprint Ascend Max 1800 50Ap8+ or 2024 router
  1453. Class Ascend | embedded || router
  1454. TSeq(Class=TD%gcd=388|710|A98%SI=<F)
  1455. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1456. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1457. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1458. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1459. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1460. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1461. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1462. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1463.  
  1464. Fingerprint Ascend P130 Router
  1465. Class Ascend | embedded || router
  1466. TSeq(Class=RI%gcd=<6%SI=>BBB&<BBBB)
  1467. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1468. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1469. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1470. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1471. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1472. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1473. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1474. PU(Resp=N)
  1475.  
  1476. Fingerprint Ascend P75 router
  1477. Class Ascend | embedded || router
  1478. TSeq(Class=RI%gcd=<6%SI=>500&<FFFF)
  1479. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1480. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1481. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1482. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1483. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1484. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1485. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1486. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1487.  
  1488. Fingerprint Ascend Pipeline 400/T1 (Software V 4.5B)
  1489. Class Ascend | embedded || router
  1490. TSeq(Class=TD%gcd=388|710|A98%SI=<FF)
  1491. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1492. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1493. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1494. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1495. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1496. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1497. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1498. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1499.  
  1500. Fingerprint Ascend Pipeline 50
  1501. Class Ascend | embedded || router
  1502. TSeq(Class=TD%gcd=<714%SI=<14)
  1503. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1504. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1505. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1506. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1507. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1508. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1509. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1510. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1511.  
  1512. Fingerprint Ascend Pipeline 50 rev 4.6C
  1513. Class Ascend | embedded || router
  1514. TSeq(Class=TD%gcd=388|710%SI=<5)
  1515. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1516. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1517. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1518. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1519. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1520. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1521. T7(Resp=N)
  1522. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1523.  
  1524. Fingerprint Ascend Pipeline 50 running 5.1A Firmware
  1525. Class Ascend | embedded || router
  1526. TSeq(Class=64K)
  1527. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1528. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1529. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1530. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1531. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1532. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1533. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1534. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1535.  
  1536. Fingerprint Ascend Pipeline P130 or 50
  1537. Class Ascend | embedded || router
  1538. TSeq(Class=TD%gcd=388|710|A98%SI=<BB)
  1539. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1540. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1541. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1542. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1543. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1544. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1545. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1546. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1547.  
  1548. Fingerprint Ascend GRF Router running Ascend Embedded/OS 2.1
  1549. Class Ascend | Embedded/OS || router
  1550. TSeq(Class=RI%gcd=<5%SI=>600)
  1551. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  1552. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1553. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  1554. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1555. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1556. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1557. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1558. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1559.  
  1560. # Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash - I think meant TAOS
  1561. Fingerprint Ascend / Lucent MAX TNT terminal server
  1562. Class Ascend | TAOS || terminal server
  1563. TSeq(Class=RI%gcd=<6%SI=<14F46&>346)
  1564. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
  1565. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1566. T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
  1567. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1568. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1569. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1570. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1571. PU(Resp=N)
  1572.  
  1573. # Ascend Mac 6000 Terminal access server (dialup access server)   Running TAOS 9.0.9
  1574. Fingerprint Ascend Mac 6000 Terminal access server
  1575. Class Ascend | TAOS || terminal server
  1576. TSeq(Class=RI%gcd=<6%SI=<919BA&>E5D%IPID=BI%TS=U)
  1577. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
  1578. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1579. T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME)
  1580. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1581. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1582. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1583. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1584. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1585.  
  1586. Fingerprint Ascend Max terminal server firmware 7.0.4
  1587. Class Ascend | TAOS || terminal server
  1588. TSeq(Class=RI%gcd=<6%SI=<14&>1000)
  1589. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  1590. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1591. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  1592. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1593. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1594. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1595. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1596. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1597.  
  1598. Fingerprint Ascend TNT OS +5.0Ap48+
  1599. Class Ascend | TAOS || terminal server
  1600. TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
  1601. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1602. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1603. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  1604. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1605. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1606. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1607. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1608. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1609.  
  1610. Fingerprint Ascend/Lucent Max (HP,4000-6000) version 6.1.3 - 7.0.2+
  1611. Class Ascend | TAOS || terminal server
  1612. TSeq(Class=RI%gcd=<6%SI=>1000)
  1613. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  1614. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1615. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  1616. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1617. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1618. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1619. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1620. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1621.  
  1622. Fingerprint MiNT with MiNTnet 1.03 running on Atari TT
  1623. Class Atari | Atari || game console
  1624. TSeq(Class=TD%gcd=3E7%SI=0)
  1625. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  1626. T2(Resp=N)
  1627. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  1628. T4(Resp=N)
  1629. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1630. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  1631. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1632. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1633.  
  1634. Fingerprint Atari Mega STE running JIS-68k 3.0
  1635. Class Atari | Atari || general purpose
  1636. TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86)
  1637. T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
  1638. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1639. T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW)
  1640. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1641. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1642. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1643. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1644. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1645.  
  1646. Fingerprint AtheOS ( www.atheos.cx )
  1647. Class AtheOS | AtheOS || general purpose
  1648. TSeq(Class=RI%gcd=<8%SI=<A78&>6)
  1649. T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1650. T2(Resp=N)
  1651. T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1652. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1653. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1654. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1655. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1656. PU(Resp=N)
  1657.  
  1658. Fingerprint AtheOS/Syllable 0.4.2
  1659. Class AtheOS | AtheOS || general purpose
  1660. TSeq(Class=RI%gcd=<A%SI=<1BDA%IPID=I%TS=U)
  1661. T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1662. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1663. T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M)
  1664. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1665. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1666. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1667. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1668. PU(Resp=N)
  1669.  
  1670. Fingerprint Auspex Fileserver (AuspexOS 1.9.1/SunOS 4.1.4)
  1671. Class Auspex | AuspexOS || fileserver
  1672. TSeq(Class=64K)
  1673. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  1674. T2(Resp=N)
  1675. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  1676. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  1677. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1678. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1679. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1680. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  1681.  
  1682. Fingerprint Avaya G3 PBX version 8.3
  1683. Class Avaya | embedded || PBX
  1684. TSeq(Class=RI%gcd=<6%SI=<652372&>89CC%IPID=I%TS=U)
  1685. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  1686. T2(Resp=N)
  1687. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  1688. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1689. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1690. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1691. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1692. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  1693.  
  1694. Fingerprint Avaya IP Office 403 PBX
  1695. Class Avaya | embedded || PBX
  1696. TSeq(Class=RI%gcd=<6%SI=<2B46872&>6EC4D%IPID=Z%TS=100HZ)
  1697. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  1698. T2(Resp=Y%DF=N%W=1111%ACK=S++%Flags=R%Ops=)
  1699. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  1700. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1701. T5(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
  1702. T6(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
  1703. T7(DF=N%W=1111%ACK=S++%Flags=R%Ops=)
  1704. PU(Resp=N)
  1705.  
  1706. # Avaya TN2302 Prowler/Medpro H.323 gateway HW03/FW022
  1707. Fingerprint Avaya TN2302 Prowler/Medpro H.323 gateway
  1708. Class Avaya | embedded || telecom-misc
  1709. TSeq(Class=TD%gcd=<6%SI=<14%IPID=I)
  1710. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1711. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1712. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1713. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1714. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1715. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1716. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1717. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1718.  
  1719. Fingerprint Avocent net KVM switch
  1720. Class Avocent | embedded || specialized
  1721. TSeq(Class=TR|RI|i800%gcd=<2004%SI=<40D8%IPID=I%TS=1000HZ)
  1722. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1723. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1724. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1725. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1726. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1727. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1728. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1729. PU(Resp=N)
  1730.  
  1731. Fingerprint Avocent CPS 1610 serial port server
  1732. Class Avocent | embedded || terminal server
  1733. TSeq(Class=RI%gcd=<14004%SI=<10C2%IPID=I%TS=1000HZ)
  1734. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1735. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1736. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  1737. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1738. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1739. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1740. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1741. PU(Resp=N)
  1742.  
  1743. Fingerprint Axent Raptor Firewall running on Windows NT
  1744. Class Axent | Windows | NT/2K/XP | firewall
  1745. TSeq(Class=TR)
  1746. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  1747. T2(Resp=N)
  1748. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  1749. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1750. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1751. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1752. T7(Resp=N)
  1753. PU(Resp=N)
  1754.  
  1755. # Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
  1756. Fingerprint AXIS or Meridian Data Network CD-ROM server
  1757. Class AXIS | embedded || fileserver
  1758. TSeq(Class=C)
  1759. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1760. T2(Resp=N)
  1761. T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
  1762. T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
  1763. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1764. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1765. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1766. PU(Resp=N)
  1767.  
  1768. # AXIS NetEye Camera Server V1.20
  1769. # Axis NPS 53X Printer Server V4.26 Jul 01 1995
  1770. # AXIS StorPoint CD-ROM server V 4.20
  1771. # AXIS Camera 200pV1.41
  1772. Fingerprint AXIS Stack -- CD-ROM Server or Print Server or Camera Server
  1773. Class AXIS | embedded || fileserver
  1774. Class AXIS | embedded || print server
  1775. Class AXIS | embedded || webcam
  1776. TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5)
  1777. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  1778. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1779. T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
  1780. T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
  1781. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1782. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1783. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1784. PU(Resp=N)
  1785.  
  1786. # AXIS StorPoint CD E100 CD-ROM Server V5.32 Jan 19 2001
  1787. Fingerprint AXIS StorPoint CD E100 CD-ROM Server
  1788. Class AXIS | embedded || fileserver
  1789. TSeq(Class=TD%gcd=<80004%SI=<14%IPID=I%TS=U)
  1790. T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME)
  1791. T2(Resp=N)
  1792. T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=)
  1793. T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=)
  1794. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1795. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1796. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1797. PU(Resp=N)
  1798.  
  1799. Fingerprint AXIs 540 Ethernet print server ver 5.48
  1800. Class AXIS | embedded || print server
  1801. TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U)
  1802. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1803. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1804. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1805. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1806. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1807. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1808. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1809. PU(Resp=N)
  1810.  
  1811. Fingerprint Axis 540 print server
  1812. Class AXIS | embedded || print server
  1813. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1814. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1815. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1816. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1817. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1818. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1819. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1820. PU(Resp=N)
  1821.  
  1822. # AXIS 540/542 print server v5.30 Jan 24 1997
  1823. Fingerprint AXIS 540/542 print server v5.30
  1824. Class AXIS | embedded || print server
  1825. TSeq(Class=C)
  1826. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  1827. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1828. T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=)
  1829. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1830. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1831. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1832. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1833. PU(Resp=N)
  1834.  
  1835. Fingerprint Axis 200+ Web Camera running OS v1.42
  1836. Class AXIS | embedded || webcam
  1837. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME)
  1838. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1839. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1840. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1841. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1842. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1843. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1844.  
  1845. Fingerprint Axis 2120 network camera
  1846. Class AXIS | embedded || webcam
  1847. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  1848. T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
  1849. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
  1850. T3(Resp=Y%DF=N%W=3FE0%ACK=S++%Flags=ASF%Ops=ME)
  1851. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  1852. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1853. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  1854. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  1855. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1856.  
  1857. Fingerprint AXIS NetEye Camera Server V1.20
  1858. Class AXIS | embedded || webcam
  1859. TSeq(Class=C)
  1860. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  1861. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1862. T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=)
  1863. T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=)
  1864. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1865. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1866. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1867. PU(Resp=N)
  1868.  
  1869. # AXIS 540+/542+
  1870. # AXIS 5400 print server
  1871. Fingerprint AXIS Network Print Server
  1872. Class AXIS | Linux || print server
  1873. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  1874. T2(Resp=N)
  1875. T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=)
  1876. T4(DF=N%W=100%ACK=O%Flags=R%Ops=)
  1877. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1878. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1879. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1880. PU(Resp=N)
  1881.  
  1882. # The AXIS 2100 Network Camera Operating System, Linux/CRIS, is based on the Linux 2.0 kernel with non-MMU CPU patches from uClinux. The HTTP server used is based on Boa. The source code for the Linux/CRIS kernel, Boa and more is available at http://developer.axis.com/.
  1883. Fingerprint Axis 2100 Network Camera running Linux/CRIS v2.32
  1884. Class AXIS | Linux || webcam
  1885. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  1886. T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
  1887. T2(Resp=N)
  1888. T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
  1889. T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  1890. T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
  1891. T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  1892. T7(Resp=N)
  1893. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1894.  
  1895. Fingerprint Barix Exstreamer network MP3 player
  1896. Class Barix | embedded || media device
  1897. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  1898. T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
  1899. T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1900. T3(Resp=Y%DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
  1901. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1902. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1903. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  1904. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  1905. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1906.  
  1907. # Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99)
  1908. # Bay Networks ASN Processor revision 9, SE100NM and SFNM modules
  1909. Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9
  1910. Class Bay Networks | embedded || router
  1911. T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW)
  1912. T2(Resp=N)
  1913. T3(Resp=N)
  1914. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1915. T5(Resp=N)
  1916. T6(Resp=N)
  1917. T7(Resp=N)
  1918. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1919.  
  1920. Fingerprint Bay Networks Instant Internet router
  1921. Class Bay Networks | embedded || router
  1922. TSeq(Class=TD%gcd=1000|2000|3000%SI=<BB)
  1923. T1(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
  1924. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1925. T3(Resp=Y%DF=N%W=1C84%ACK=S++%Flags=AS%Ops=M)
  1926. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1927. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1928. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1929. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1930. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  1931.  
  1932. Fingerprint Baystack Instant Internet 400 SoHo Router
  1933. Class Bay Networks | embedded || router
  1934. TSeq(Class=RI%gcd=<24%SI=<4D33C&>C46)
  1935. T1(Resp=N)
  1936. T2(Resp=N)
  1937. T3(Resp=N)
  1938. T4(Resp=N)
  1939. T5(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1940. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1941. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  1942. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1943.  
  1944. Fingerprint Bay Networks BayStack 310T switch
  1945. Class Bay Networks | embedded || switch
  1946. TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=<F)
  1947. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1948. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1949. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  1950. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1951. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1952. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  1953. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1954. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1955.  
  1956. Fingerprint BayStack 28115/ADV Fast Ethernet Switch
  1957. Class Bay Networks | embedded || switch
  1958. TSeq(Class=TD%gcd=<6%SI=<FF)
  1959. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  1960. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1961. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1962. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1963. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1964. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1965. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1966. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  1967.  
  1968. # Running on a BeBox 66Mhz
  1969. Fingerprint BeOS 4 - 4.5
  1970. Class Be | BeOS | 4.X | general purpose
  1971. TSeq(Class=TD%gcd=1%SI=0)
  1972. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  1973. T2(Resp=N)
  1974. T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  1975. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  1976. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1977. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  1978. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1979. PU(Resp=N)
  1980.  
  1981. Fingerprint BeOS 5.0.4 (BeOS 5 Pro + BONE 7a)
  1982. Class Be | BeOS | 5.X | general purpose
  1983. TSeq(Class=TD%gcd=<6%SI=<C8%IPID=I%TS=U)
  1984. T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  1985. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1986. T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  1987. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1988. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1989. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  1990. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  1991. PU(Resp=N)
  1992.  
  1993. Fingerprint BeOS 5.03 x86 with the BONE network stack
  1994. Class Be | BeOS | 5.X | general purpose
  1995. TSeq(Class=RI%gcd=<6%SI=<141E&>1F%IPID=I%TS=U)
  1996. T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  1997. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  1998. T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  1999. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2000. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2001. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2002. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2003. PU(Resp=N)
  2004.  
  2005. Fingerprint BeOS 5.1d0/DANO on x86
  2006. Class Be | BeOS | 5.X | general purpose
  2007. TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U)
  2008. T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  2009. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2010. T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW)
  2011. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2012. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2013. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2014. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2015. PU(Resp=N)
  2016.  
  2017. Fingerprint BeOS R5.03 Personal Edition
  2018. Class Be | BeOS | 5.X | general purpose
  2019. TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U)
  2020. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  2021. T2(Resp=N)
  2022. T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M)
  2023. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  2024. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2025. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2026. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2027. PU(Resp=N)
  2028.  
  2029. # Belkin DSL/Cable Router running firmware v1.03.08
  2030. Fingerprint Belkin DSL/Cable Router
  2031. Class Belkin | embedded || broadband router
  2032. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  2033. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  2034. T2(Resp=N)
  2035. T3(Resp=N)
  2036. T4(Resp=N)
  2037. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2038. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2039. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2040. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2041.  
  2042. Fingerprint Bell Labs Plan9 Fourth Edition
  2043. Class Bell Labs | Plan9 || general purpose
  2044. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2045. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MWN)
  2046. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2047. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MWN)
  2048. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2049. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2050. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2051. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2052. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2053.  
  2054. Fingerprint Bell Labs Plan9 Fourth Edition (x86)
  2055. Class Bell Labs | Plan9 || general purpose
  2056. TSeq(Class=TR%gcd=<6)
  2057. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  2058. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2059. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  2060. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2061. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2062. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2063. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2064. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2065.  
  2066. Fingerprint Bell Labs Plan9 Second Edition
  2067. Class Bell Labs | Plan9 || general purpose
  2068. TSeq(Class=TR)
  2069. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  2070. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2071. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  2072. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2073. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2074. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2075. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2076. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2077.  
  2078. Fingerprint BenQ Wireless Lan Router AWL700
  2079. Class BenQ | embedded || WAP
  2080. TSeq(Class=TD%gcd=<34%SI=<14%IPID=I%TS=U)
  2081. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  2082. T2(Resp=N)
  2083. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  2084. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2085. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2086. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2087. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2088. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2089.  
  2090. # Billion ADSL Router BIPAC 711CE
  2091. Fingerprint Billion ADSL router
  2092. Class Billion | embedded || broadband router
  2093. TSeq(Class=RI%gcd=<6%SI=<1315F78&>306D3%IPID=Z)
  2094. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
  2095. T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  2096. T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  2097. T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  2098. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2099. T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  2100. T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  2101. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2102.  
  2103. # Billion BIPAC-741GE V2 ADSL Router/Modem - Firmware 4.55 (HW: Helium 210-80 ADSL GE-A v1.00)
  2104. Fingerprint Billion BIPAC-741GE V2 aDSL Router
  2105. Class Billion | embedded || broadband router
  2106. TSeq(Class=RI%gcd=<6%SI=<DF2A&>137%IPID=I%TS=U)
  2107. T1(DF=Y%W=1194%ACK=S++%Flags=AS%Ops=ME)
  2108. T2(Resp=Y%DF=Y%W=1194%ACK=O%Flags=R%Ops=)
  2109. T3(Resp=N)
  2110. T4(DF=Y%W=1194%ACK=O%Flags=R%Ops=)
  2111. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2112. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2113. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2114. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2115.  
  2116. # BIANCA/BRICK-XS version V.6.2 Rev. 5 from 2003/05/26 00:00:00
  2117. Fingerprint BinTEC BIANCA/BRIK-XS broadband router V. 6.X
  2118. Class BinTec | embedded || broadband router
  2119. TSeq(Class=RI%gcd=<6%SI=<54E5C&>C09%IPID=I%TS=U)
  2120. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2121. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2122. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2123. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2124. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2125. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2126. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2127. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2128.  
  2129. Fingerprint BinTec BingoDSL Router Firmware version 7.1 Rev.1 Patch 11
  2130. Class BinTec | embedded || broadband router
  2131. TSeq(Class=RI%gcd=<8%SI=<240E&>1A%IPID=I%TS=U)
  2132. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2133. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2134. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2135. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2136. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2137. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2138. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2139. PU(Resp=N)
  2140.  
  2141. # XS SW Release 4.9.1 ISDN access router
  2142. # BinTec BIANCA XM OS version 4.93
  2143. Fingerprint BinTec XS/XM ISDN access router V. 4.9.1-4.9.3
  2144. Class BinTec | embedded || broadband router
  2145. TSeq(Class=RI%gcd=<6%SI=>FF&<FFF)
  2146. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2147. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2148. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  2149. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2150. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2151. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  2152. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2153. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=0%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  2154.  
  2155. Fingerprint Blue Coat Security Proxy Appliance
  2156. Class Blue Coat | embedded || web proxy
  2157. TSeq(Class=RI%gcd=<6%SI=<A4704&>780%IPID=I%TS=2HZ)
  2158. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2159. T2(Resp=N)
  2160. T3(Resp=N)
  2161. T4(Resp=N)
  2162. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2163. T6(Resp=N)
  2164. T7(Resp=N)
  2165. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2166.  
  2167. # Blue Coat SG6000 Series - SGOS 3.2.2.1
  2168. Fingerprint Blue Coat ProxySG (SGOS 3.2.2.1)
  2169. Class Blue Coat | SGOS || web proxy
  2170. TSeq(Class=RI%gcd=<6%SI=<43F10C&>4CBD%TS=2HZ)
  2171. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2172. T2(Resp=N)
  2173. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2174. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2175. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2176. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2177. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2178. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2179.  
  2180. # Blue Coat SGOS 2.0.09 (Release ID: 20047)
  2181. # Blue Coat SGOS 3.0.1.0 (Release ID: 20069)
  2182. Fingerprint Blue Coat Secure Gateway
  2183. Class Blue Coat | SGOS || web proxy
  2184. TSeq(Class=RI%gcd=<6%SI=<15654E&>1CC9%IPID=I%TS=2HZ)
  2185. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT)
  2186. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2187. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT)
  2188. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2189. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2190. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2191. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2192. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2193.  
  2194. Fingerprint Borderware 5.0 Firewall
  2195. Class Borderware | embedded || firewall
  2196. TSeq(Class=TR|RI%gcd=<204%SI=<14)
  2197. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  2198. T2(Resp=N)
  2199. T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
  2200. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2201. T5(Resp=N)
  2202. T6(Resp=N)
  2203. T7(Resp=N)
  2204. PU(Resp=N)
  2205.  
  2206. Fingerprint Borderware 5.2 firewall
  2207. Class Borderware | embedded || firewall
  2208. TSeq(Class=TR%gcd=<6)
  2209. T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
  2210. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  2211. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  2212. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  2213. T5(Resp=N)
  2214. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  2215. T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  2216. PU(Resp=N)
  2217.  
  2218. Fingerprint Borderware 6.0.2 firewall
  2219. Class Borderware | embedded || firewall
  2220. TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C)
  2221. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2222. T2(Resp=N)
  2223. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2224. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2225. T5(Resp=N)
  2226. T6(Resp=N)
  2227. T7(Resp=N)
  2228. PU(Resp=N)
  2229.  
  2230. Fingerprint Bosch Security Systems's Divar Digital Video Recorder Version 2.00
  2231. Class Bosch | embedded || webcam
  2232. TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ)
  2233. T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  2234. T2(Resp=N)
  2235. T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  2236. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2237. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2238. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2239. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2240. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2241.  
  2242. Fingerprint BreezeCOM BreezeACCESS wireless bridge
  2243. Class BreezeCOM | embedded || bridge
  2244. TSeq(Class=RI%gcd=<6%SI=<988&>4%IPID=I%TS=U)
  2245. T1(DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=)
  2246. T2(Resp=N)
  2247. T3(Resp=Y%DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=)
  2248. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2249. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2250. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2251. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2252. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2253.  
  2254. # http://www.brixnetworks.com/products/brix1000.html
  2255. Fingerprint Brix 1000 Verifier
  2256. Class Brix Networks | embedded || specialized
  2257. TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U)
  2258. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  2259. T2(Resp=N)
  2260. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  2261. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2262. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2263. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2264. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2265. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2266.  
  2267. Fingerprint BSDI BSD/OS 2.0 - 2.1
  2268. Class BSDI | BSD/OS | 2.X | general purpose
  2269. TSeq(Class=RI%gcd=<6%SI=>FFF)
  2270. T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  2271. T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2272. T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT)
  2273. T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=)
  2274. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2275. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2276. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2277. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2278.  
  2279. Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD)
  2280. Class BSDI | BSD/OS | 3.X | general purpose
  2281. TSeq(Class=RI%gcd=<6)
  2282. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2283. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2284. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  2285. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2286. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2287. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2288. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2289. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2290.  
  2291. Fingerprint BSDI BSD/OS 4.0-4.0.1
  2292. Class BSDI | BSD/OS | 4.X | general purpose
  2293. TSeq(Class=RI%gcd=<A%SI=<1974A&>16F)
  2294. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2295. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2296. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2297. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2298. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2299. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2300. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2301. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  2302.  
  2303. Fingerprint BSDI BSD/OS 4.0.1
  2304. Class BSDI | BSD/OS | 4.X | general purpose
  2305. TSeq(Class=RI%gcd=<6%SI=<F85E8&>27A9)
  2306. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2307. T2(Resp=N)
  2308. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  2309. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2310. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2311. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2312. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2313. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  2314.  
  2315. Fingerprint BSDI BSD/OS 4.2
  2316. Class BSDI | BSD/OS | 4.X | general purpose
  2317. TSeq(Class=RI%gcd=<6%SI=<F3E94&>1A4F%IPID=I%TS=2HZ)
  2318. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  2319. T2(Resp=N)
  2320. T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  2321. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2322. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2323. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2324. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2325. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2326.  
  2327. Fingerprint Cabletron Smart Switch Router 8600
  2328. Class Cabletron | embedded || router
  2329. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2330. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2331. T3(Resp=N)
  2332. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2333. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2334. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2335. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2336. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  2337.  
  2338. Fingerprint Cabletron Systems SSR 8000 smart switch router System Software, Version 3.1.B.16
  2339. Class Cabletron | embedded || router
  2340. TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715)
  2341. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2342. T2(Resp=N)
  2343. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  2344. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2345. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2346. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2347. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2348. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2349.  
  2350. # Cabletron SmartSwitch, Hardware Revision: 00R, Firmware Revision: 05.00.48, BOOTPROM Revision: 02.02.00
  2351. Fingerprint Cabletron SmartSwitch
  2352. Class Cabletron | embedded || switch
  2353. TSeq(Class=TD%gcd=<180004%SI=<1E%IPID=I%TS=U)
  2354. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2355. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2356. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2357. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2358. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2359. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2360. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2361. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2362.  
  2363. # Cabletron Switch model 6H202-24 Module Hardware Revision: 00A Module Firmware Revision: 05.05.11 Module BootPROM Revision: +03.06.04
  2364. Fingerprint Cabletron switch
  2365. Class Cabletron | embedded || switch
  2366. TSeq(Class=RI|TD%gcd=<404%SI=<263E%IPID=I%TS=U)
  2367. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2368. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2369. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2370. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2371. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2372. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2373. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2374. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2375.  
  2376. Fingerprint CacheFlow 6000 web proxy cache running CacheOS 4.1.05
  2377. Class CacheFlow | CacheOS || web proxy
  2378. TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U)
  2379. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  2380. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2381. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2382. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2383. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2384. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2385. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  2386. PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  2387.  
  2388. # (rel. ID: 17908)
  2389. Fingerprint CacheFlow 6000 web proxy running Security Gateway 2.1.0
  2390. Class CacheFlow | CacheOS || web proxy
  2391. TSeq(Class=RI%gcd=<6%SI=<CB91C&>15C0%IPID=I%TS=2HZ)
  2392. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2393. T2(Resp=N)
  2394. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT)
  2395. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2396. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2397. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2398. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2399. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2400.  
  2401. Fingerprint Cacheflow 6x5 web proxy cache running CacheOS 3.1.19-4.1.05
  2402. Class CacheFlow | CacheOS || web proxy
  2403. TSeq(Class=RI%gcd=<6%SI=<CF3F0&>16F5%IPID=I%TS=2HZ)
  2404. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  2405. T2(Resp=N)
  2406. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  2407. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2408. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2409. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2410. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2411. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2412.  
  2413. # CacheFlow CacheOS (CacheFlow 500-5000 web cache) CFOS 2.1.08 - 2.2.1
  2414. Fingerprint CacheFlow CacheOS (web proxy cache) CFOS 2.1.08 - 2.2.1
  2415. Class CacheFlow | CacheOS || web proxy
  2416. TSeq(Class=RI%gcd=<5%SI=>BBBB&<FFFFF)
  2417. T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  2418. T2(Resp=N)
  2419. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
  2420. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  2421. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2422. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2423. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2424. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2425.  
  2426. Fingerprint CacheFlow CacheOS 3.1 on a model 6000 web proxy cache
  2427. Class CacheFlow | CacheOS || web proxy
  2428. TSeq(Class=RI%gcd=<6%SI=<6DE6416&>1C6E5%IPID=RPI%TS=2HZ)
  2429. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  2430. T2(Resp=N)
  2431. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  2432. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2433. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2434. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2435. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2436. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2437.  
  2438. Fingerprint CacheOS (CacheFlow 2000 proxy cache)
  2439. Class CacheFlow | CacheOS || web proxy
  2440. TSeq(Class=RI%gcd=<5%SI=>1111)
  2441. T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M)
  2442. T2(Resp=N)
  2443. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
  2444. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  2445. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2446. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2447. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2448. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2449.  
  2450. Fingerprint Canon GP 160 PF printer
  2451. Class Canon | embedded || printer
  2452. TSeq(Class=TD%gcd=<C04%SI=<1E%IPID=I%TS=U)
  2453. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  2454. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  2455. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  2456. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  2457. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2458. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  2459. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  2460. PU(Resp=N)
  2461.  
  2462. Fingerprint Canon iR 2200 printer
  2463. Class Canon | embedded || printer
  2464. TSeq(Class=64K%IPID=I%TS=U)
  2465. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2466. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  2467. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  2468. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  2469. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2470. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  2471. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  2472. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2473.  
  2474. Fingerprint Canon iR6000 printer
  2475. Class Canon | embedded || printer
  2476. TSeq(Class=64K%IPID=I%TS=U)
  2477. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
  2478. T2(Resp=N)
  2479. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  2480. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2481. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2482. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2483. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2484. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2485.  
  2486. Fingerprint Canon iR7200 Printer
  2487. Class Canon | embedded || printer
  2488. TSeq(Class=64K%IPID=I%TS=U)
  2489. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  2490. T2(Resp=N)
  2491. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  2492. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2493. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2494. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2495. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2496. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2497.  
  2498. Fingerprint Canon photocopier/fax/scanner/printer GP30F
  2499. Class Canon | embedded || printer
  2500. TSeq(Class=TD%gcd=600%SI=0)
  2501. T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  2502. T2(Resp=N)
  2503. T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=)
  2504. T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=)
  2505. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2506. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2507. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2508. PU(Resp=N)
  2509.  
  2510. Fingerprint Capellix 3000 Modular SAN Switch
  2511. Class Capellix | embedded || storage-misc
  2512. TSeq(Class=64K%IPID=I%TS=U)
  2513. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2514. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  2515. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  2516. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  2517. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2518. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2519. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2520. PU(Resp=N)
  2521.  
  2522. Fingerprint CastleNet AR502/GlobespanVirata GS8100 (same thing) DSL router
  2523. Class CastleNet | embedded || broadband router
  2524. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2525. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  2526. T2(Resp=N)
  2527. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  2528. T4(Resp=N)
  2529. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  2530. T6(Resp=N)
  2531. T7(Resp=N)
  2532. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2533.  
  2534. # http://www.cayman.com/
  2535. Fingerprint Cayman 2E DSL/CABLE router
  2536. Class Cayman | embedded || broadband router
  2537. TSeq(Class=TR%gcd=<6)
  2538. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  2539. T2(Resp=N)
  2540. T3(Resp=N)
  2541. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2542. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2543. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2544. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2545. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2546.  
  2547. Fingerprint Cayman 3000 DSL Router
  2548. Class Cayman | embedded || broadband router
  2549. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  2550. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2551. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  2552. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  2553. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2554. T6(Resp=N)
  2555. T7(Resp=N)
  2556. PU(Resp=N)
  2557.  
  2558. Fingerprint Netopia Cayman 3346 DSL router
  2559. Class Cayman | embedded || broadband router
  2560. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2561. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2562. T2(Resp=N)
  2563. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2564. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2565. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2566. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2567. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2568. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2569.  
  2570. Fingerprint Chase IOLan Terminal Server
  2571. Class Chase | embedded || terminal server
  2572. T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  2573. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2574. T3(Resp=N)
  2575. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2576. T5(Resp=N)
  2577. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  2578. T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  2579. PU(Resp=N)
  2580.  
  2581. #  Chase/Perle IOLAN Terminal Server v3.5.02 CDi
  2582. Fingerprint Chase/Perle IOLAN Terminal Server
  2583. Class Chase | embedded || terminal server
  2584. TSeq(Class=TD%gcd=<84%SI=<1E)
  2585. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=)
  2586. T2(Resp=N)
  2587. T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
  2588. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2589. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2590. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2591. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2592. PU(Resp=N)
  2593.  
  2594. # These boxes give goofy PU RIPTL results (like 3549 and 4801) so I removed
  2595. # that test
  2596. Fingerprint Chase/Perle IOLAN terminal server
  2597. Class Chase | embedded || terminal server
  2598. TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U)
  2599. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=|M)
  2600. T2(Resp=N)
  2601. T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=)
  2602. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2603. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2604. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2605. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2606. PU(DF=N%TOS=0%IPLEN=38%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2607.  
  2608. # Nokia IPSO 3.2 Running Checkpoint Firewall-1
  2609. # IPSO 3.5-FCS8 releng 1020  Running Checkpoint FW-1 NG FP2
  2610. Fingerprint Nokia IPSO 3.2-3.5 Running Checkpoint Firewall-1 or NG FP2
  2611. Class Checkpoint | IPSO || firewall
  2612. TSeq(Class=RI%gcd=<6%SI=<E4656&>2476)
  2613. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2614. T2(Resp=N)
  2615. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2616. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2617. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2618. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2619. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2620. PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)
  2621.  
  2622. # Nokia IPSO 3.2-3.2.1 releng 783-849
  2623. # IPSO 3.4-FCS4A releng 767  Running CheckPoint 4.1 SP6
  2624. # Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based)
  2625. # Nokia IPSO 4.3.1-FCS5
  2626. Fingerprint Nokia IPSO 3.2-4.3.1-FCS5 Running checkpoint FW1
  2627. Class Checkpoint | IPSO || firewall
  2628. TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319)
  2629. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2630. T2(Resp=N)
  2631. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2632. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2633. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2634. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2635. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2636. PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  2637.  
  2638. # Nokia IPSO 3.6 FCS 6 releng 1061  01.21.2003-230310 i386 w/ CheckPoint FW-1 NG FP 2, SSL & DNS hotfix and SmartDefense Supplemental
  2639. Fingerprint Nokia IPSO 3.6 running CheckPoint FW-1 NG FP2
  2640. Class Checkpoint | IPSO || firewall
  2641. TSeq(Class=RI%gcd=<6%SI=<7A148&>A01%IPID=I%TS=2HZ)
  2642. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2643. T2(Resp=N)
  2644. T3(Resp=N)
  2645. T4(Resp=N)
  2646. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2647. T6(Resp=N)
  2648. T7(Resp=N)
  2649. PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  2650.  
  2651. Fingerprint Checkpoint Firewall-1 NG on Sun Solaris 8
  2652. Class Checkpoint | Solaris | 8 | firewall
  2653. TSeq(Class=RI%gcd=<6%SI=<6C82C&>E51%IPID=I%TS=100HZ)
  2654. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  2655. T2(Resp=N)
  2656. T3(Resp=N)
  2657. T4(Resp=N)
  2658. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2659. T6(Resp=N)
  2660. T7(Resp=N)
  2661. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2662.  
  2663. Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build)
  2664. Class Checkpoint | Windows | NT/2K/XP | firewall
  2665. TSeq(Class=RI%gcd=<6%SI=<18358&>3CB)
  2666. T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2667. T2(Resp=N)
  2668. T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT)
  2669. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  2670. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2671. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2672. T7(Resp=N)
  2673. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2674.  
  2675. Fingerprint Checkpoint Firewall-1 on Windows NT 4.0 Server SP4-SP5
  2676. Class Checkpoint | Windows | NT/2K/XP | firewall
  2677. TSeq(Class=TD%gcd=<8%SI=<154)
  2678. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  2679. T2(Resp=N)
  2680. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  2681. T4(Resp=N)
  2682. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2683. T6(Resp=N)
  2684. T7(Resp=N)
  2685. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  2686.  
  2687. # Checkpoint Firewall-1/VPN-1 SecurePlatform NG, running FeaturePack 3
  2688. Fingerprint Checkpoint SecurePlatform NG FP3
  2689. Class Checkpoint | Windows | NT/2K/XP | firewall
  2690. TSeq(Class=RI%gcd=<6%SI=<1C6F042&>48C8B%IPID=Z%TS=U)
  2691. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  2692. T2(Resp=N)
  2693. T3(Resp=N)
  2694. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2695. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  2696. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  2697. T7(Resp=N)
  2698. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2699.  
  2700. Fingerprint Cisco CacheOS (1.1.0)
  2701. Class Cisco | CacheOS || web proxy
  2702. TSeq(Class=64K)
  2703. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  2704. T2(Resp=N)
  2705. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  2706. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  2707. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2708. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2709. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2710. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  2711.  
  2712. Fingerprint Cisco 675 DSL router -- cbos 2.1
  2713. Class Cisco | CBOS || broadband router
  2714. T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M)
  2715. T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  2716. T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
  2717. T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
  2718. T5(Resp=N)
  2719. T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=)
  2720. T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  2721. PU(Resp=N)
  2722.  
  2723. Fingerprint Cisco ACNS 5.1 Content Engine
  2724. Class Cisco | Content Networking System || web proxy
  2725. TSeq(Class=RI%gcd=<6%SI=<BFC80E&>1EAE1%IPID=I%TS=U)
  2726. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  2727. T2(Resp=N)
  2728. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  2729. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2730. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2731. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2732. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2733. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2734.  
  2735. Fingerprint Cisco Content Engine 505 Software V. 4.2.1
  2736. Class Cisco | Content Networking System || web proxy
  2737. TSeq(Class=RI%gcd=<6%SI=<2D75904&>5AE06%IPID=I%TS=U)
  2738. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  2739. T2(Resp=N)
  2740. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  2741. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2742. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2743. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2744. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2745. PU(DF=N%TOS=C0|CC%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2746.  
  2747. # running Application and Content Networking System Software 4.2.3
  2748. # Fingerprint Cisco Content Engine 560 Software V. 4.2.3
  2749. Fingerprint Cisco Content Engine 560 running Content Networking System V. 4.2.3
  2750. Class Cisco | Content Networking System || web proxy
  2751. TSeq(Class=RI%gcd=<6%SI=<19440B6&>40ACE%IPID=I%TS=U)
  2752. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  2753. T2(Resp=N)
  2754. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME)
  2755. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2756. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2757. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2758. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2759. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2760.  
  2761. Fingerprint Cisco Accesspoint 1200
  2762. Class Cisco | embedded || bridge
  2763. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  2764. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  2765. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  2766. T3(Resp=Y%DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL)
  2767. T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  2768. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2769. T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL)
  2770. T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL)
  2771. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2772.  
  2773. # Cisco AIR-WGB340 V8.38 Workgroup Bridge 340
  2774. Fingerprint Cisco AIR-WGB340 V8.38 wireless workgroup bridge 340
  2775. Class Cisco | embedded || bridge
  2776. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2777. T1(DF=N%W=1F4|1000%ACK=S++%Flags=AR|AS%Ops=)
  2778. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  2779. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  2780. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  2781. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  2782. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  2783. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  2784. PU(Resp=N)
  2785.  
  2786. Fingerprint Cisco WGB350 Wireless WorkGroup Bridge
  2787. Class Cisco | embedded || bridge
  2788. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2789. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  2790. T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  2791. T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  2792. T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  2793. T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  2794. T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=)
  2795. T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=)
  2796. PU(DF=N%TOS=0%IPLEN=5C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2797.  
  2798. Fingerprint Cisco 760 Series ISDN router (non IOS) or IBM Stackable Hub
  2799. Class Cisco | embedded || broadband router
  2800. Class IBM | embedded || hub
  2801. TSeq(Class=TD|i800%gcd=<14004%SI=<14)
  2802. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2803. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2804. T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M)
  2805. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2806. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2807. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2808. T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=)
  2809. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2810.  
  2811. Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1)
  2812. Class Cisco | embedded || broadband router
  2813. TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U)
  2814. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2815. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2816. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2817. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2818. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2819. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2820. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2821. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2822.  
  2823. Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router
  2824. Class Cisco | embedded || broadband router
  2825. TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=<F)
  2826. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2827. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2828. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2829. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2830. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2831. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2832. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2833. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2834.  
  2835. Fingerprint Cisco 766 non-IOS software 4.2(3.5)
  2836. Class Cisco | embedded || broadband router
  2837. TSeq(Class=TD%gcd=82000%SI=<F)
  2838. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2839. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2840. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  2841. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2842. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2843. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2844. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2845. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2846.  
  2847. Fingerprint Cisco Soho 97 router running IOS 12.3(8)
  2848. Class Cisco | embedded || broadband router
  2849. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  2850. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  2851. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
  2852. T3(Resp=N)
  2853. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2854. T5(DF=N%W=0%ACK=S++%Flags=AR|BAR%Ops=)
  2855. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2856. T7(DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
  2857. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2858.  
  2859. Fingerprint Cisco 3000 Series VPN Concentrator
  2860. Class Cisco | embedded || encryption accelerator
  2861. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  2862. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2863. T2(Resp=N)
  2864. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2865. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2866. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2867. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2868. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2869. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  2870.  
  2871. # Cisco VPN 3005 running 4.1.2   
  2872. # Cisco VPN Series 3000 Concentrator running OS version 4.1.2
  2873. Fingerprint Cisco 3000-series VPN concentrator (OS ver 4.1.2)
  2874. Class Cisco | embedded || encryption accelerator
  2875. TSeq(Class=RI%gcd=<6%SI=<306F34E&>29F4D%IPID=I%TS=2HZ)
  2876. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2877. T2(Resp=N)
  2878. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2879. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2880. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2881. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2882. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2883. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2884.  
  2885. # 3Com 4924 gigabit switch ver 2.04
  2886. # Cisco VPN 3000 3.5
  2887. Fingerprint Cisco VPN 3000 or 3Com 4924 GigE Switch
  2888. Class Cisco | embedded || encryption accelerator
  2889. Class 3Com | embedded || switch
  2890. TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ)
  2891. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2892. T2(Resp=N)
  2893. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  2894. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2895. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2896. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2897. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2898. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2899.  
  2900. Fingerprint Cisco Local Director 420 version 2.1.1
  2901. Class Cisco | embedded || load balancer
  2902. TSeq(Class=C)
  2903. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2904. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL)
  2905. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2906. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  2907. T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL)
  2908. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  2909. T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL)
  2910. PU(Resp=N)
  2911.  
  2912. # The "True Random" is bogus, it is because of sequences
  2913. # from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869
  2914. # Cisco Localdirector 430, running OS 2.1
  2915. Fingerprint Cisco Localdirector load balancer
  2916. Class Cisco | embedded || load balancer
  2917. TSeq(Class=TR|C)
  2918. T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  2919. T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  2920. T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL)
  2921. T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
  2922. T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  2923. T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL)
  2924. T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  2925. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2926.  
  2927. # LocalDirector 430 Version 4.2.4
  2928. Fingerprint Cisco LocalDirector load balancer
  2929. Class Cisco | embedded || load balancer
  2930. TSeq(Class=RI%gcd=<6%SI=<2F240C&>789A%IPID=BI%TS=U)
  2931. T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  2932. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  2933. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  2934. T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  2935. T5(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  2936. T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  2937. T7(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  2938. PU(Resp=N)
  2939.  
  2940. Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4)
  2941. Class Cisco | embedded || router
  2942. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2943. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2944. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2945. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2946. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2947. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2948. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2949. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2950.  
  2951. # Cisco 1548M 10/100 Managed Switch (Firmware Version: v1.03.02)
  2952. Fingerprint Cisco 1548M managed switch
  2953. Class Cisco | embedded || switch
  2954. TSeq(Class=64K%IPID=I%TS=U)
  2955. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2956. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  2957. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  2958. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  2959. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2960. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2961. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2962. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  2963.  
  2964. Fingerprint Cisco Catalyst 1900 switch, Bay networks 350-450 switch,  or Netopia DSL/ISDN router
  2965. Class Cisco | embedded || switch
  2966. Class Bay Networks | embedded || switch
  2967. Class Netopia | embedded || broadband router
  2968. TSeq(Class=TD%gcd=<6000%SI=<1E)
  2969. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2970. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2971. T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2972. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2973. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2974. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2975. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2976. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  2977.  
  2978. Fingerprint Cisco Catalyst 2820 switch Management Console
  2979. Class Cisco | embedded || switch
  2980. TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U)
  2981. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2982. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  2983. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  2984. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2985. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2986. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  2987. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  2988. PU(Resp=N|Y)
  2989.  
  2990. # Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5)
  2991. # Cisco Catalyst 5500 with OS Version 6.3(5)
  2992. # Alcatel OmniSwitch/Router! Version 4.3.1 GA
  2993. Fingerprint Cisco Catalyst 5500/6500 or Alcatel OmniSwitch/Router
  2994. Class Cisco | embedded || switch
  2995. Class Alcatel | embedded || switch
  2996. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  2997. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  2998. T2(Resp=N)
  2999. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  3000. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3001. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3002. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3003. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3004. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3005.  
  3006. Fingerprint Cisco Catalyst switch
  3007. Class Cisco | embedded || switch
  3008. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3009. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3010. T2(Resp=N)
  3011. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3012. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3013. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3014. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3015. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3016. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3017.  
  3018. # LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or
  3019. # Trancell WebRamp router or Xylan OmniSwitch 3.2.X.X - 3.4.X.X
  3020. # Epson Stylus Color 1520C with 100BTX-NIC from Epson
  3021. # Cisco 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX
  3022. # SonicWall firewall appliance 10meg firmware 3.3.1
  3023. Fingerprint Router/Switch/Printer/Firewall (LanPlex 2500/Cisco Catalyst 5505/Cisco 6509/Trancell Webramp/Xylan OmniSwitch)/Epson Stylus (100BTX-NIC HP Secure Web Console, SonicWall firewall appliance 3.3.1)
  3024. Class Cisco | embedded || switch
  3025. Class Xylan | embedded || switch
  3026. Class Epson | embedded || printer
  3027. Class SonicWall | SonicOS || firewall
  3028. Class Trancell | embedded || router
  3029. TSeq(Class=64K)
  3030. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3031. T2(Resp=N)
  3032. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  3033. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3034. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3035. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3036. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3037. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3038.  
  3039. Fingerprint Cisco AS5200 terminal server
  3040. Class Cisco | embedded || terminal server
  3041. TSeq(Class=RI%gcd=<6%SI=>FFF)
  3042. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3043. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3044. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3045. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3046. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3047. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3048. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3049. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3050.  
  3051. # A Cisco ATA 186 is a little box that allows a standard POTS
  3052. # telephone to be used as a voice-over-IP phone.  There is a
  3053. # variation, the ATA 188 that has a pass-through port, much like the
  3054. # Cisco 7960 phone.
  3055. Fingerprint Cisco ATA 186 POTS<->VOIP phone gateway device
  3056. Class Cisco | embedded || VoIP adapter
  3057. TSeq(Class=TD%gcd=<A0000%SI=<1E%IPID=I%TS=U)
  3058. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  3059. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=ARF%Ops=)
  3060. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  3061. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  3062. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  3063. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  3064. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  3065. PU(Resp=N)
  3066.  
  3067. Fingerprint Cisco ATA 186 POTS<->VoIP phone gateway device
  3068. Class Cisco | embedded || VoIP adapter
  3069. T1(Resp=N)
  3070. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3071. T3(Resp=N)
  3072. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3073. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3074. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3075. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3076. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3077.  
  3078. Fingerprint Cisco 7960 SIP Phone running OS 4.2
  3079. Class Cisco | embedded || VoIP phone
  3080. TSeq(Class=TD%gcd=<2A004%SI=<28%IPID=I%TS=U)
  3081. T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M)
  3082. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3083. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3084. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3085. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3086. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3087. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3088. PU(Resp=N)
  3089.  
  3090. Fingerprint Cisco IP phone (POS3-04-3-00, PC030301)
  3091. Class Cisco | embedded || VoIP phone
  3092. TSeq(Class=TD%gcd=<C004%SI=<14%IPID=I%TS=U)
  3093. T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M)
  3094. T2(Resp=N)
  3095. T3(Resp=Y%DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
  3096. T4(DF=N%W=3E8%ACK=S++%Flags=AR%Ops=)
  3097. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3098. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3099. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3100. PU(Resp=N)
  3101.  
  3102. Fingerprint Cisco IP Phone 7910 or 7940 Firmware 3.1
  3103. Class Cisco | embedded || VoIP phone
  3104. TSeq(Class=TD%gcd=<1E004%SI=<1E%IPID=I%TS=U)
  3105. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  3106. T2(Resp=N)
  3107. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  3108. T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
  3109. T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3110. T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
  3111. T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3112. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3113.  
  3114. Fingerprint Cisco IP Phone 7960
  3115. Class Cisco | embedded || VoIP phone
  3116. TSeq(Class=TD%gcd=<2A004%SI=<1E%IPID=I%TS=U)
  3117. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  3118. T2(Resp=Y%DF=N%W=578%ACK=S%Flags=R%Ops=)
  3119. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3120. T4(DF=N%W=578%ACK=S%Flags=R%Ops=)
  3121. T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3122. T6(DF=N%W=578%ACK=S%Flags=R%Ops=)
  3123. T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  3124. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3125.  
  3126. # Cisco ATA 186 (analog telephone adaptor (VoIP)) firmware Rev. B0
  3127. # Cisco ATA 186 or 7905 VoIP Phone
  3128. # Cisco IP Phone 7905 Software Version 1.02.00
  3129. # Cisco IP Phone 7912 - Software Version 1.02.02(031217B) - Product ID CP-7912G
  3130. # Cisco VoIP Phone (commonly used by Vonage)
  3131. Fingerprint Cisco VoIP Phone
  3132. Class Cisco | embedded || VoIP phone
  3133. TSeq(Class=TD%gcd=<F004%SI=<1E%IPID=I%TS=U)
  3134. T1(DF=N%W=578|3E80%ACK=S++%Flags=AS%Ops=M)
  3135. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3136. T3(Resp=Y%DF=N%W=578|3E80%ACK=S++%Flags=AS%Ops=M)
  3137. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3138. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3139. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3140. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3141. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3142.  
  3143. Fingerprint Cisco Cache Engine Web Proxy
  3144. Class Cisco | embedded || web proxy
  3145. TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
  3146. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNW)
  3147. T2(Resp=N)
  3148. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=)
  3149. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  3150. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3151. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3152. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3153. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3154.  
  3155. # Cisco 2501, 2504, 4500
  3156. Fingerprint Cisco 2501/2504/4500 router with IOS Version 10.3(15) - 11.1(20)
  3157. Class Cisco | IOS | 10.X | router
  3158. Class Cisco | IOS | 11.X | router
  3159. TSeq(Class=RI|TD%gcd=<6%SI=<2000)
  3160. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3161. T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3162. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3163. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3164. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3165. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3166. T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3167. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3168.  
  3169. Fingerprint Cisco 1600/3640/7513 Router (IOS 11.2(14)P)
  3170. Class Cisco | IOS | 11.X | router
  3171. TSeq(Class=RI%gcd=<6%SI=<11170)
  3172. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3173. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  3174. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3175. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3176. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3177. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3178. T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  3179. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3180.  
  3181. # DECBrouter90T1 Runs Cisco IOS 10.2(5)
  3182. # Cisco 1601, IOS 11.0
  3183. Fingerprint Cisco 1601 (IOS 11.0) or DECbrouter90T1 (Runs Cisco IOS 10.2(5))
  3184. Class Cisco | IOS | 11.X | router
  3185. Class DEC | IOS | 10.X | router
  3186. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3187. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3188. T3(Resp=N)
  3189. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3190. T5(Resp=N)
  3191. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3192. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3193. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3194.  
  3195. Fingerprint Cisco 4500 router running IOS 11.2(2)
  3196. Class Cisco | IOS | 11.X | router
  3197. T1(DF=N%W=860%ACK=S++|O%Flags=AS|A%Ops=M|)
  3198. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3199. T3(Resp=N)
  3200. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3201. T5(Resp=N)
  3202. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3203. T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3204. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  3205.  
  3206. Fingerprint Cisco 4500-M router running IOS 11.3(6) IP Plus
  3207. Class Cisco | IOS | 11.X | router
  3208. TSeq(Class=RI|TD%gcd=1%SI=<FFF)
  3209. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  3210. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3211. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  3212. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3213. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3214. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3215. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3216. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3217.  
  3218. Fingerprint Cisco 7206 router (IOS 11.1(17)
  3219. Class Cisco | IOS | 11.X | router
  3220. TSeq(Class=RI%gcd=<6%SI=>666)
  3221. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3222. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3223. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3224. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3225. T5(Resp=N)
  3226. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3227. T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=)
  3228. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3229.  
  3230. Fingerprint Cisco 7206 running IOS 11.1(24)
  3231. Class Cisco | IOS | 11.X | router
  3232. TSeq(Class=RI%gcd=<5%SI=<CCCC&>CC)
  3233. T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3234. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3235. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3236. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3237. T5(Resp=N)
  3238. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3239. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3240. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3241.  
  3242. Fingerprint Cisco IOS 11.3 - 12.0(11)
  3243. Class Cisco | IOS | 11.X | router
  3244. Class Cisco | IOS | 12.X | router
  3245. TSeq(Class=TD|RI%gcd=<6)
  3246. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3247. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3248. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3249. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3250. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3251. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3252. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3253. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3254.  
  3255. Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T
  3256. Class Cisco | IOS | 11.X | router
  3257. TSeq(Class=RI%gcd=<4%SI=<999&>CC)
  3258. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3259. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3260. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3261. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3262. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3263. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3264. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3265. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3266.  
  3267. # 25XX/45XX router, 29XX switch, RSP2 processor
  3268. Fingerprint Cisco Router/Switch with IOS 11.2
  3269. Class Cisco | IOS | 11.X | router
  3270. Class Cisco | IOS | 11.X | switch
  3271. TSeq(Class=RI%gcd=<6%SI=<18000)
  3272. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3273. T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3274. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3275. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3276. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3277. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3278. T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3279. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3280.  
  3281. # Cisco 3640 router IOS 11.1(7)AX [KUONG(7)AX]
  3282. # Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6
  3283. Fingerprint Cisco switch/router with IOS 11.1(7)-11.2(8.10)
  3284. Class Cisco | IOS | 11.X | router
  3285. Class Cisco | IOS | 11.X | switch
  3286. TSeq(Class=RI%gcd=<6%SI=>BBB&<FFFF)
  3287. T1(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3288. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3289. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3290. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3291. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3292. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  3293. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3294. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3295.  
  3296. Fingerprint Cisco 2501/5260/5300 terminal server IOS 11.3.6(T1)
  3297. Class Cisco | IOS | 11.X | terminal server
  3298. TSeq(Class=RI%gcd=<6%SI=>BBB)
  3299. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3300. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3301. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3302. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3303. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3304. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3305. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3306. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3307.  
  3308. Fingerprint Cisco 827 ADSL router running IOS 112.2(11)
  3309. Class Cisco | IOS | 12.X | broadband router
  3310. TSeq(Class=RI%gcd=<6%SI=<1B1F2&>24E%IPID=Z%TS=U)
  3311. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3312. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3313. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3314. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3315. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3316. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3317. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3318. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  3319.  
  3320. Fingerprint Cisco 827 ADSL router running IOS 12.1(1)XB1
  3321. Class Cisco | IOS | 12.X | broadband router
  3322. TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U)
  3323. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3324. T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3325. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3326. T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3327. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3328. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3329. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3330. PU(Resp=N)
  3331.  
  3332. Fingerprint Cisco 1601 router running IOS 12.0(8)
  3333. Class Cisco | IOS | 12.X | router
  3334. TSeq(Class=RI%gcd=<6%SI=<B4DC&>8A%IPID=Z%TS=U)
  3335. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3336. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3337. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3338. T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3339. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3340. T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3341. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3342. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3343.  
  3344. Fingerprint Cisco 1601R router running IOS 12.1(5)
  3345. Class Cisco | IOS | 12.X | router
  3346. TSeq(Class=TD%gcd=<6%SI=<32%IPID=Z%TS=U)
  3347. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3348. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3349. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3350. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3351. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3352. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3353. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3354. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3355.  
  3356. # Cisco 2611 router running IOS 12.2(7a)
  3357. Fingerprint Cisco 2611 router running IOS 12.2(7a)
  3358. Class Cisco | IOS | 12.X | router
  3359. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3360. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3361. T2(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  3362. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3363. T4(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  3364. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3365. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3366. T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  3367. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3368.  
  3369. Fingerprint Cisco 2620 running IOS 12.2(19a)
  3370. Class Cisco | IOS | 12.X | router
  3371. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3372. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3373. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  3374. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3375. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  3376. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3377. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  3378. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  3379. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3380.  
  3381. Fingerprint Cisco 3600 router running IOS 12.2(6c)
  3382. Class Cisco | IOS | 12.X | router
  3383. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3384. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3385. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3386. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3387. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3388. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3389. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3390. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3391. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3392.  
  3393. # Cisco 4000 series, IOS 4500 Software (C4500-P-m), Version 12.0(10.3)S
  3394. Fingerprint Cisco 4000 Series running IOS 12.0(10.3)
  3395. Class Cisco | IOS | 12.X | router
  3396. TSeq(Class=RI|TD%gcd=<6%SI=<F50%IPID=Z%TS=U)
  3397. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
  3398. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3399. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3400. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3401. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3402. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3403. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3404. PU(Resp=N)
  3405.  
  3406. Fingerprint Cisco 5200 router running IOS v12.0(15)
  3407. Class Cisco | IOS | 12.X | router
  3408. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3409. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3410. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3411. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3412. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3413. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3414. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3415. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3416. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3417.  
  3418. Fingerprint Cisco 7200 router running IOS 12.1(14)E6
  3419. Class Cisco | IOS | 12.X | router
  3420. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3421. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3422. T2(Resp=N)
  3423. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3424. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3425. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3426. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3427. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3428. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3429.  
  3430. # Cisco 7204 IOS (tm) 7200 Software (C7200-IS-M), Version 12.1(19), RELEASE SOFTWARE (fc1)
  3431. Fingerprint Cisco 7204 router running IOS 12.1(19)
  3432. Class Cisco | IOS | 12.X | router
  3433. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3434. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3435. T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  3436. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3437. T4(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=)
  3438. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3439. T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
  3440. T7(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=)
  3441. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3442.  
  3443. # Cisco 7206 router running IOS Version 12.2(13)T8
  3444. Fingerprint Cisco 7206 router running IOS Version 12.2(13)T8
  3445. Class Cisco | IOS | 12.X | router
  3446. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3447. T1(DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
  3448. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3449. T3(Resp=Y%DF=N%W=109%ACK=S++%Flags=AS%Ops=ME)
  3450. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3451. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3452. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3453. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3454. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3455.  
  3456. # Cisco 837 router running IOS 12.3(11)T
  3457. Fingerprint Cisco 837 router running IOS 12.3(11)T
  3458. Class Cisco | IOS | 12.X | router
  3459. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3460. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3461. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3462. T3(Resp=N)
  3463. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3464. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3465. T6(DF=N%W=0%ACK=O%Flags=R|BR%Ops=)
  3466. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3467. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3468.  
  3469. Fingerprint Cisco IOS 12.0(21) (On a 2514 router)
  3470. Class Cisco | IOS | 12.X | router
  3471. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3472. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3473. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3474. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3475. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3476. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3477. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3478. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3479. PU(Resp=N)
  3480.  
  3481. Fingerprint Cisco IOS 12.0(3.3)S (perhaps a 7200 router)
  3482. Class Cisco | IOS | 12.X | router
  3483. TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
  3484. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  3485. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3486. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  3487. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3488. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3489. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3490. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3491. PU(Resp=N)
  3492.  
  3493. # Cisco IOS 12.0(16a) Service Provider feature set
  3494. # Cisco WS-C3508G-XL running 12.0(5)WC3
  3495. Fingerprint Cisco IOS 12.0(5)WC3 - 12.0(16a)
  3496. Class Cisco | IOS | 12.X | router
  3497. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3498. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3499. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3500. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3501. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3502. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3503. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3504. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3505. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3506.  
  3507. # Cisco 1700 running IOS 12.0(7)T
  3508. Fingerprint Cisco IOS 12.0(7)T (on a 1700 router)
  3509. Class Cisco | IOS | 12.X | router
  3510. TSeq(Class=RI%gcd=<6%SI=<7A6C&>D%IPID=Z%TS=U)
  3511. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3512. T2(Resp=N)
  3513. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3514. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3515. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3516. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3517. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3518. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3519.  
  3520. Fingerprint Cisco IOS 12.1(4) on a 2600 router
  3521. Class Cisco | IOS | 12.X | router
  3522. TSeq(Class=RI%gcd=<A%SI=<9772&>3A%IPID=Z%TS=U)
  3523. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3524. T2(Resp=N)
  3525. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3526. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3527. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3528. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3529. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3530. PU(Resp=N)
  3531.  
  3532. # Cisco 7507 running 12.2(8)T5
  3533. Fingerprint Cisco IOS 12.2(8)T5 on a 7507 router
  3534. Class Cisco | IOS | 12.X | router
  3535. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3536. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3537. T2(Resp=N)
  3538. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3539. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3540. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3541. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3542. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3543. PU(Resp=N)
  3544.  
  3545. # Cisco 1720 router running 12.2.8T4 with IP/FW/PLUS/3DES feature set
  3546. # Cisco 801 router running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1)
  3547. # Cisco Aironet 1100/1200/1400 access point running IOS 12.2.15
  3548. Fingerprint Cisco router or WAP running IOS 12.2
  3549. Class Cisco | IOS | 12.X | router
  3550. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3551. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3552. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3553. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3554. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3555. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3556. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3557. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3558. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3559.  
  3560. # Cisco 12008 running IOS 12.0(18.6)S1
  3561. # Cisco 7206VXR running IOS 12.0(18)S
  3562. Fingerprint Cisco router running IOS 12.0(18)S or 12.0(18)S1
  3563. Class Cisco | IOS | 12.X | router
  3564. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3565. T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME)
  3566. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3567. T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M)
  3568. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3569. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3570. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3571. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3572. PU(Resp=N)
  3573.  
  3574. # Cisco 800 running 12.1(5)
  3575. # Cisco 2620 router running IOS 12.1(6)
  3576. Fingerprint Cisco router running IOS 12.1
  3577. Class Cisco | IOS | 12.X | router
  3578. TSeq(Class=RI%gcd=<6%SI=<ABC2&>78%IPID=Z%TS=U)
  3579. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3580. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3581. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3582. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3583. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3584. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3585. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3586. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  3587.  
  3588. # Cisco 3620 running IOS 12.2.1
  3589. # IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1)
  3590. Fingerprint Cisco router running IOS 12.1(5)-12.2(7a)
  3591. Class Cisco | IOS | 12.X | router
  3592. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3593. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3594. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3595. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3596. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3597. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3598. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3599. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3600. PU(Resp=N)
  3601.  
  3602. # Found on Cisco 1720/1750/2611/3640/AS5300 routers
  3603. Fingerprint Cisco router running IOS 12.1.5-12.2.13a
  3604. Class Cisco | IOS | 12.X | router
  3605. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3606. T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3607. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3608. T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M)
  3609. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3610. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3611. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3612. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3613. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3614.  
  3615. # Cisco 2621 running IOS 12.2.8T
  3616. # Cisco SOHO 77 running IOS 12.2(8)T
  3617. Fingerprint Cisco router running IOS 12.2(8)T
  3618. Class Cisco | IOS | 12.X | router
  3619. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3620. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3621. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3622. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3623. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3624. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3625. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3626. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3627. PU(Resp=N)
  3628.  
  3629. # Cisco Router (1760) - IOS (tm) C1700 Software, Version 12.3(6)
  3630. # IOS (tm) 3700 Software (C3745-IS-M), Version 12.3(6), RELEASE SOFTWARE (fc3) 
  3631. #  Cisco 837 router running IOS 12.3.8T3
  3632. # CISCO C827 (MPC855T) processor (revision 0x501) with 23552K/1024K bytes of memory.
  3633. # Cisco 2611XM router running IOS 12.3(10)
  3634. # Cisco 831 running IOS Version 12.3(8)T3
  3635. Fingerprint Cisco router running IOS 12.3(6) - 12.3(10)
  3636. Class Cisco | IOS | 12.X | router
  3637. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3638. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3639. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=)
  3640. T3(Resp=N)
  3641. T4(DF=N%W=0%ACK=O%Flags=R|BR%Ops=)
  3642. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3643. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3644. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3645. PU(DF=N%TOS=0|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3646.  
  3647. # IOS (tm) SOHO91 Software (SOHO91-K9OY6-M), Version 12.3(2)XC, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) (Cisco SOHO 91 Secure router)
  3648. Fingerprint Cisco SOHO 91 secure router running IOS 12.3
  3649. Class Cisco | IOS | 12.X | router
  3650. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3651. T1(DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME)
  3652. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3653. T3(Resp=Y%DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME)
  3654. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3655. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3656. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3657. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3658. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3659.  
  3660. # Cisco Lightstream 1010 ATM Switch running IOS (tm) LS1010 WA4-5 Software (LS1010-WP-M), Version 12.1(23)E, RELEASE SOFTWARE (fc2)
  3661. # Cisco 6500 switch running IOS 12.1(23)E
  3662. Fingerprint Cisco switch running IOS 12.1(23)E
  3663. Class Cisco | IOS | 12.X | router
  3664. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3665. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL)
  3666. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3667. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ML)
  3668. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3669. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3670. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3671. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3672. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3673.  
  3674. # Cisco Catalyst 2924XL-EN running IOS 12.0(5)WC8
  3675. Fingerprint Cisco Catalyst 2924XL switch running IOS 12.0(5)
  3676. Class Cisco | IOS | 12.X | switch
  3677. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3678. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  3679. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3680. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM)
  3681. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3682. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3683. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3684. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3685. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3686.  
  3687. Fingerprint Cisco Catalyst 2950 switch running IOS 12.0(5.3)WC(1)
  3688. Class Cisco | IOS | 12.X | switch
  3689. TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
  3690. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3691. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3692. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3693. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3694. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3695. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3696. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3697. PU(Resp=N)
  3698.  
  3699. Fingerprint Cisco IOS 12.0(5)WC5a on a catalyst 2900XL switch
  3700. Class Cisco | IOS | 12.X | switch
  3701. TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ)
  3702. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
  3703. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3704. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML)
  3705. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3706. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3707. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3708. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3709. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3710.  
  3711. Fingerprint Cisco 1200 access point (WAP) running IOS 12.2(8)
  3712. Class Cisco | IOS | 12.X | WAP
  3713. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3714. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3715. T2(Resp=N)
  3716. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3717. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3718. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3719. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3720. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3721. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3722.  
  3723. # Cisco AP1220 IOS 12.2(11)JA1
  3724. Fingerprint Cisco AP1220 WAP running IOS 12.2(11)
  3725. Class Cisco | IOS | 12.X | WAP
  3726. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  3727. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3728. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3729. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3730. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3731. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3732. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3733. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3734. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3735.  
  3736. Fingerprint Cisco CPA2500 (68030) or 2511 router
  3737. Class Cisco | IOS || router
  3738. TSeq(Class=RI%gcd=<6%SI=>FFF)
  3739. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3740. T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3741. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  3742. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3743. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3744. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3745. T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=)
  3746. PU(Resp=N)
  3747.  
  3748. Fingerprint Cisco uBR 7223 router
  3749. Class Cisco | IOS || router
  3750. TSeq(Class=TR%gcd=<6%IPID=C%TS=U)
  3751. T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME)
  3752. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3753. T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M)
  3754. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3755. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3756. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3757. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3758. PU(Resp=N)
  3759.  
  3760. Fingerprint Cisco Catalyst 4006 Switch running NmpSW 7.4(2)
  3761. Class Cisco | NmpSW || switch
  3762. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3763. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3764. T2(Resp=N)
  3765. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3766. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  3767. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3768. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3769. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3770. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3771.  
  3772. Fingerprint Cisco PIX 4.2(2) Internal Interface
  3773. Class Cisco | PIX | 4.X | firewall
  3774. TSeq(Class=C)
  3775. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3776. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
  3777. T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL)
  3778. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  3779. T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
  3780. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  3781. T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
  3782. PU(Resp=N)
  3783.  
  3784. Fingerprint Cisco PIX 515 firewall running software 4.4(5)
  3785. Class Cisco | PIX | 4.X | firewall
  3786. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  3787. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3788. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  3789. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3790. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  3791. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  3792. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  3793. T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3794. PU(Resp=N)
  3795.  
  3796. Fingerprint Cisco PIX Firewall running PIX 4.1(5)
  3797. Class Cisco | PIX | 4.X | firewall
  3798. TSeq(Class=C%Val=211E005F)
  3799. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3800. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL)
  3801. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3802. T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  3803. T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL)
  3804. T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  3805. T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL)
  3806. PU(Resp=N)
  3807.  
  3808. Fingerprint Cisco PIX v4.2 Firewall
  3809. Class Cisco | PIX | 4.X | firewall
  3810. TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03)
  3811. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  3812. T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL)
  3813. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  3814. T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
  3815. T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL)
  3816. T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL)
  3817. T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL)
  3818. PU(Resp=N)
  3819.  
  3820. # Cisco PIX running IOS 6.1(1) - Internal interface
  3821. # Cisco PIX 520 firewall running PixOS 6.1(3)
  3822. # Secure PIX Firewall Version 5.2(2)
  3823. Fingerprint Cisco PIX Firewall (PixOS 5.2 - 6.1)
  3824. Class Cisco | PIX | 5.X | firewall
  3825. Class Cisco | PIX | 6.X | firewall
  3826. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3827. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3828. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3829. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR|AS%Ops=WNMETL|M)
  3830. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3831. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3832. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3833. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3834. PU(Resp=N)
  3835.  
  3836. Fingerprint Cisco Secure PIX Firewall Version 5.0(2)
  3837. Class Cisco | PIX | 5.X | firewall
  3838. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3839. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  3840. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3841. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  3842. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  3843. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  3844. T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3845. PU(Resp=N)
  3846.  
  3847. # Cisco 535 IOS 6.2 PIX running in failover mode... ie.. idle
  3848. # PIX 506 running PIX IOS 6.2
  3849. Fingerprint Cisco Firewall (PIX 6.1.4 - 6.2.2)
  3850. Class Cisco | PIX | 6.X | firewall
  3851. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3852. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3853. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  3854. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3855. T4(Resp=N)
  3856. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3857. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  3858. T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3859. PU(Resp=N)
  3860.  
  3861. Fingerprint Cisco PIX 501 firewall running PIX 6.1(1)
  3862. Class Cisco | PIX | 6.X | firewall
  3863. TSeq(Class=TR%IPID=I%TS=U)
  3864. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3865. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  3866. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3867. T4(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  3868. T5(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  3869. T6(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  3870. T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3871. PU(Resp=N)
  3872.  
  3873. Fingerprint Cisco PIX 515 or 525 Firewall running 6.1(4) - 6.2(1)
  3874. Class Cisco | PIX | 6.X | firewall
  3875. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3876. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3877. T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  3878. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3879. T4(Resp=N)
  3880. T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  3881. T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL)
  3882. T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3883. PU(Resp=N)
  3884.  
  3885. # Cisco PIX 501 Firewall running IOS 6.3(1)
  3886. # Cisco PIX Firewall IOS version 6.22
  3887. # Cisco PIX 515 version 6.3(1)
  3888. # Cisco PIX 501 Firewall running PIXOS 6.3.3
  3889. Fingerprint Cisco PIX Firewall running PIX 6.2 - 6.3.3
  3890. Class Cisco | PIX | 6.X | firewall
  3891. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3892. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3893. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3894. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3895. T4(Resp=N)
  3896. T5(DF=N%W=400||800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  3897. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  3898. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3899. PU(Resp=N)
  3900.  
  3901. Fingerprint Cisco PIX Firewall Version 6.1(2)
  3902. Class Cisco | PIX | 6.X | firewall
  3903. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3904. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3905. T2(Resp=N)
  3906. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3907. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  3908. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  3909. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  3910. T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3911. PU(Resp=N)
  3912.  
  3913. Fingerprint Cisco PIX Firewall Version 6.2(1)
  3914. Class Cisco | PIX | 6.X | firewall
  3915. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3916. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3917. T2(Resp=N)
  3918. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3919. T4(Resp=N)
  3920. T5(Resp=N)
  3921. T6(Resp=N)
  3922. T7(Resp=N)
  3923. PU(Resp=N)
  3924.  
  3925. Fingerprint Cisco PIX Firewall Version 6.2(2) - 6.3
  3926. Class Cisco | PIX | 6.X | firewall
  3927. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3928. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3929. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  3930. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3931. T4(Resp=N)
  3932. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  3933. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  3934. T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3935. PU(Resp=N)
  3936.  
  3937. Fingerprint Cisco PIX 506 Firewall
  3938. Class Cisco | PIX || firewall
  3939. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  3940. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  3941. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  3942. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3943. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  3944. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  3945. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  3946. T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  3947. PU(Resp=N)
  3948.  
  3949. # Sun Remote System Console version 1.12
  3950. # Brocade Fibre Switch, Firmware 2.6.0
  3951. # Cisco Aironet 340 WAP running v 12.03T of the firmware (and VxWorks OS)
  3952. Fingerprint Cisco Aironet WAP, Brocade Fibre Switch, or Sun Remote System Console
  3953. Class Cisco | vxworks || WAP
  3954. Class Brocade | embedded || switch
  3955. Class Sun | embedded || remote management
  3956. TSeq(Class=64K%IPID=I%TS=U)
  3957. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  3958. T2(Resp=N)
  3959. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  3960. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  3961. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3962. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3963. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3964. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  3965.  
  3966. Fingerprint Cnet CNIG904B Internet Broadband Gateway firmware version 1.11
  3967. Class Cnet | embedded || broadband router
  3968. TSeq(Class=TD%gcd=<F4%SI=<1D6%IPID=Z%TS=U)
  3969. T1(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  3970. T2(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
  3971. T3(Resp=Y%DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  3972. T4(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
  3973. T5(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  3974. T6(DF=N%W=C00|800|1000|400%ACK=S%Flags=AR%Ops=)
  3975. T7(DF=N%W=C00|800|1000|400%ACK=S++%Flags=AR%Ops=)
  3976. PU(Resp=N)
  3977.  
  3978. # CNT UltraNet EDGE (SAN Router) softwareversion 1.4.1.2
  3979. Fingerprint CNT UltraNet EDGE (SAN Router) V. 1.4.1.2
  3980. Class CNT | embedded || storage-misc
  3981. TSeq(Class=TD%gcd=<61AC%SI=<1E%IPID=I%TS=U)
  3982. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  3983. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  3984. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  3985. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3986. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3987. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3988. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3989. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  3990.  
  3991. Fingerprint Cobalt Linux 4.0 (Fargo) Kernel 2.0.34C52_SK on MIPS or TEAMInternet Series 100 WebSense
  3992. Class Cobalt | Linux | 2.0.X | general purpose
  3993. TSeq(Class=TR%gcd=<6)
  3994. T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  3995. T2(Resp=N)
  3996. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  3997. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  3998. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  3999. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4000. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4001. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  4002.  
  4003. Fingerprint Commodore 64 with TFE Ethernet Card (Contiki)
  4004. Class Commodore | embedded || game console
  4005. TSeq(Class=TD%gcd=<18%SI=<1E%IPID=RD|I%TS=U)
  4006. T1(DF=N%W=F4%ACK=S++%Flags=AS%Ops=M)
  4007. T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4008. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4009. T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4010. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4011. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4012. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4013. PU(Resp=N)
  4014.  
  4015. Fingerprint Commodore 64 with TFE Ethernet Card (uIP TCP/IP stack)
  4016. Class Commodore | embedded || game console
  4017. TSeq(Class=C%Val=FFFFFFFF%IPID=RD%TS=U)
  4018. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=)
  4019. T2(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=APF%Ops=)
  4020. T3(Resp=Y%DF=N%W=16D0|1CA%ACK=O%Flags=APF%Ops=)
  4021. T4(DF=N%W=16D0|5B4%ACK=O%Flags=APF%Ops=)
  4022. T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  4023. T6(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  4024. T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  4025. PU(Resp=N)
  4026.  
  4027. Fingerprint Compaq Inside Management Board
  4028. Class Compaq | embedded || remote management
  4029. TSeq(Class=64K%IPID=I%TS=2HZ)
  4030. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  4031. T2(Resp=N)
  4032. T3(Resp=N)
  4033. T4(Resp=N)
  4034. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4035. T6(Resp=N)
  4036. T7(Resp=N)
  4037. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4038.  
  4039. Fingerprint Compaq Integrated Lights Out remote configuration Board
  4040. Class Compaq | embedded || remote management
  4041. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  4042. T1(DF=N%W=800%ACK=O%Flags=R%Ops=)
  4043. T2(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
  4044. T3(Resp=Y%DF=N%W=800%ACK=O%Flags=R%Ops=)
  4045. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  4046. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  4047. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  4048. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  4049. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4050.  
  4051. # ProLiant DL580 Integrated Lights-Out remote configuration board V1.06 14.5.2002
  4052. Fingerprint Compaq ProLiant DL580 Integrated Lights-Out remote configuration board V1.06
  4053. Class Compaq | embedded || remote management
  4054. TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U)
  4055. T1(DF=N%W=400%ACK=O%Flags=R%Ops=)
  4056. T2(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
  4057. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=R%Ops=)
  4058. T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
  4059. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  4060. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  4061. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  4062. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4063.  
  4064. # Compaq iPAQ Connection Point (WAP) model CP-2W Rev1.00
  4065. # NetGear MR814 WAP
  4066. Fingerprint WAP: Compaq iPAQ Connection Point or Netgear MR814
  4067. Class Compaq | embedded || WAP
  4068. Class Netgear | embedded || WAP
  4069. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  4070. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4071. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  4072. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4073. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4074. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4075. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4076. PU(Resp=N)
  4077.  
  4078. Fingerprint Compaq Tru64 UNIX (formerly DIGITAL UNIX) 4.0e
  4079. Class Compaq | Tru64 UNIX | 4.X | general purpose
  4080. TSeq(Class=C)
  4081. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4082. T2(Resp=N)
  4083. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  4084. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4085. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4086. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4087. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4088. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4089.  
  4090. Fingerprint Compaq Tru64 UNIX 4.0e
  4091. Class Compaq | Tru64 UNIX | 4.X | general purpose
  4092. TSeq(Class=RI%gcd=<6%SI=<7BE80&>DAF%IPID=I%TS=U)
  4093. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  4094. T2(Resp=N)
  4095. T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=)
  4096. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4097. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4098. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4099. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4100. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4101.  
  4102. # OSF1 V4.0 1530 alpha
  4103. # Tru64 4.0F (Alpha), Patch Kit 8, Kernel Build 1229
  4104. Fingerprint Tru64 UNIX 4.0f - 4.0g
  4105. Class Compaq | Tru64 UNIX | 4.X | general purpose
  4106. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4107. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4108. T2(Resp=N)
  4109. T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4110. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4111. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4112. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4113. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4114. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4115.  
  4116. # Compaq Tru64 UNIX 5.0 on AlphaServer
  4117. # DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A on a DEC 4000 Model 610 running OpenVMS V7.2
  4118. Fingerprint Compaq Tru64 UNIX 5.0 or DEC OpenVMS 7.2
  4119. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4120. Class DEC | OpenVMS | 7.X | general purpose
  4121. TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C)
  4122. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4123. T2(Resp=N)
  4124. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
  4125. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4126. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4127. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4128. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4129. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4130.  
  4131. Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
  4132. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4133. TSeq(Class=TR%gcd=<6%TS=U)
  4134. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4135. T2(Resp=N)
  4136. T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4137. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4138. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4139. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4140. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4141. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4142.  
  4143. Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732)
  4144. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4145. TSeq(Class=TR%gcd=<6%TS=U)
  4146. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4147. T2(Resp=N)
  4148. T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4149. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4150. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4151. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4152. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4153. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4154.  
  4155. Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
  4156. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4157. TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U)
  4158. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4159. T2(Resp=N)
  4160. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  4161. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4162. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4163. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4164. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4165. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4166.  
  4167. Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885)
  4168. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4169. TSeq(Class=TR%gcd=<6%TS=U)
  4170. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4171. T2(Resp=N)
  4172. T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4173. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4174. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4175. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4176. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4177. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4178.  
  4179. # HP Tru64 UNIX v5.1B: OSF1 V5.1 2650 alpha
  4180. Fingerprint HP Tru64 UNIX v5.1B
  4181. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4182. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4183. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4184. T2(Resp=N)
  4185. T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  4186. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4187. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4188. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4189. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4190. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4191.  
  4192. Fingerprint OSF1 5.0 Rev. 910 (AKA Compaq/DIGITAL Tru64 UNIX)
  4193. Class Compaq | Tru64 UNIX | 5.X | general purpose
  4194. TSeq(Class=RI%gcd=<6%SI=<E88&>11)
  4195. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4196. T2(Resp=N)
  4197. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=)
  4198. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4199. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4200. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4201. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4202. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4203.  
  4204. Fingerprint Compaq T1010 Thin Client Windows CE 2.12
  4205. Class Compaq | Windows | PocketPC/CE | terminal
  4206. TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI%TS=U)
  4207. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  4208. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4209. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  4210. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  4211. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4212. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  4213. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4214. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4215.  
  4216. Fingerprint Compatible Systems ISDN/leased-line/dialup Microrouter 2220R w/ firmware v4.5
  4217. Class Compatible Systems | embedded || broadband router
  4218. TSeq(Class=TD%gcd=388|710|A98%SI=<14)
  4219. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  4220. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4221. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  4222. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4223. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4224. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4225. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4226. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  4227.  
  4228. Fingerprint Compatible Systems ISDN/leased-line/dialup MicroRouter 900i v3.0.9
  4229. Class Compatible Systems | embedded || broadband router
  4230. TSeq(Class=TD%gcd=388|710|A98%SI=<F)
  4231. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  4232. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4233. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  4234. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4235. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4236. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4237. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4238. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  4239.  
  4240. # Tested against: 3 RISC Routers (2600i, 2800, and 3500R) all running
  4241. # firmware 4.5 and two IntraPorts running 4.4.02.  I'm told this also
  4242. # applies to firmware 4.2 on RISC routers, but I have not checked.
  4243. Fingerprint Compatible Systems (RISC Router, IntraPort)
  4244. Class Compatible Systems | embedded || router
  4245. TSeq(Class=TD%gcd=388|710|A98%SI=<6)
  4246. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  4247. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4248. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  4249. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  4250. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4251. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  4252. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4253. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  4254.  
  4255. # Compex CGX3224 Switch, Firmware version CGX1.53
  4256. Fingerprint Compex CGX3224 Switch
  4257. Class Compex | embedded || switch
  4258. TSeq(Class=64K%IPID=I%TS=U)
  4259. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  4260. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4261. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  4262. T4(DF=N%W==400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4263. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4264. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4265. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4266. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4267.  
  4268. Fingerprint CompUSA Broadband Router
  4269. Class CompUSA | embedded || broadband router
  4270. TSeq(Class=RI|TR%gcd=<6%SI=<7FCAA42%IPID=I%TS=U)
  4271. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  4272. T2(Resp=N)
  4273. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  4274. T4(DF=N%W=101F%ACK=O%Flags=R%Ops=)
  4275. T5(DF=N%W=101F%ACK=S++%Flags=AR%Ops=)
  4276. T6(DF=N%W=101F%ACK=O%Flags=R%Ops=)
  4277. T7(DF=N%W=101F%ACK=S++%Flags=AR%Ops=)
  4278. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  4279.  
  4280. Fingerprint Computone Power Rack IntelliServer terminal server Release 1.5.4d
  4281. Class Computone | embedded || terminal server
  4282. TSeq(Class=TD%gcd=40%SI=0)
  4283. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  4284. T2(Resp=N)
  4285. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
  4286. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4287. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4288. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4289. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4290. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  4291.  
  4292. # Conexant ADSL Router Firmware 2.33a (FreeBSD)
  4293. Fingerprint Conexant ADSL Router
  4294. Class Conexant | embedded || broadband router
  4295. TSeq(Class=RI%gcd=<6%SI=<1B50D00&>45EAE%IPID=Z%TS=100HZ)
  4296. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4297. T2(Resp=N)
  4298. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  4299. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  4300. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4301. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4302. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4303. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  4304.  
  4305. # Contiki 1.2-devel0 on Ethernut (Atmel AVR ATmega128 with RTL8019as Ethernet chip)
  4306. Fingerprint Contiki 1.2-devel0 embedded OS on Ethernut card
  4307. Class Contiki | Contiki || specialized
  4308. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  4309. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4310. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4311. T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4312. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4313. T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4314. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4315. PU(Resp=N)
  4316.  
  4317. Fingerprint Convex OS Release 10.1
  4318. Class Convex | ConvexOS || general purpose
  4319. TSeq(Class=64K)
  4320. T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=)
  4321. T2(Resp=N)
  4322. T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=)
  4323. T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=)
  4324. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4325. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4326. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4327. PU(Resp=N)
  4328.  
  4329. Fingerprint Convex SPP-UX 5.2.1
  4330. Class Convex | SPP-UX || general purpose
  4331. TSeq(Class=64K)
  4332. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  4333. T2(Resp=N)
  4334. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  4335. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4336. T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=)
  4337. T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=)
  4338. T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=)
  4339. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4340.  
  4341. Fingerprint SPP-UX 5.x on a Convex SPP-1600
  4342. Class Convex | SPP-UX || general purpose
  4343. TSeq(Class=C)
  4344. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  4345. T2(Resp=N)
  4346. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN)
  4347. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4348. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4349. T6(DF=N%W=C00%ACK=S%Flags=R%Ops=)
  4350. T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  4351. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4352.  
  4353. # HP j4813A ProCurve Switch 2524
  4354. # Copper Mountain Networks DSL Concentrator
  4355. # Compaq Remote Insight Lights-Out remote console card
  4356. # 3Com Home Wireless Gateway 3CRWE50194-E1, firmware 1.14
  4357. # TrueTime NTS-200 GPS Network Time Server
  4358. # Compaq Lights Out Edition firmware v2.41
  4359. # 3Com NBX 25 (Phone System) Version: R1_0_3
  4360. Fingerprint Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com NBX 25 phone system or Home Wireless Gateway, or TrueTime NTP clock
  4361. Class Copper Mountain | embedded || terminal server
  4362. Class 3Com | embedded || WAP
  4363. Class 3Com | embedded || telecom-misc
  4364. Class TrueTime | embedded || specialized
  4365. Class Compaq | embedded || remote management
  4366. TSeq(Class=64K%IPID=I%TS=U)
  4367. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  4368. T2(Resp=N)
  4369. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  4370. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  4371. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4372. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4373. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4374. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4375.  
  4376. # Corega BAR SW-4P  [Part number:CG-BARSW4P]
  4377. Fingerprint Corega BAR SW-4P Broadband Access Router
  4378. Class Corega | embedded || broadband router
  4379. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  4380. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4381. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4382. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4383. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4384. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4385. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4386. PU(Resp=N)
  4387.  
  4388. Fingerprint UNICOS 10.0.0 on Cray 90
  4389. Class Cray | UNICOS | 10.X | general purpose
  4390. TSeq(Class=RI%gcd=<F%SI=<22222&>2222)
  4391. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL)
  4392. T2(Resp=N)
  4393. T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT)
  4394. T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4395. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4396. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  4397. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4398. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4399.  
  4400. Fingerprint Cray UNICOS/mk 8.6
  4401. Class Cray | UNICOS | 8.X | general purpose
  4402. TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1)
  4403. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  4404. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4405. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  4406. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4407. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4408. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4409. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4410. PU(Resp=N)
  4411.  
  4412. Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1
  4413. Class Cray | UNICOS || general purpose
  4414. TSeq(Class=RI%gcd=<6)
  4415. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL)
  4416. T2(Resp=N)
  4417. T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT)
  4418. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  4419. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4420. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4421. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4422. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4423.  
  4424. Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2
  4425. Class Cray | UNICOS || general purpose
  4426. TSeq(Class=RI%gcd=<6%SI=>F)
  4427. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL)
  4428. T2(Resp=N)
  4429. T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT)
  4430. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4431. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4432. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4433. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4434. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4435.  
  4436. # Unisys LX/NX MCP 46.1/HMP 5.0 on an Unisys LX5120
  4437. Fingerprint Cray Unisys LX/NX MCP 46.1/HMP 5.0 on LX5120
  4438. Class Cray | Unisys || general purpose
  4439. TSeq(Class=RI%gcd=<6%SI=<7868FCE&>CF0B8%IPID=I%TS=U)
  4440. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  4441. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4442. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  4443. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4444. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4445. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4446. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4447. PU(Resp=N)
  4448.  
  4449. Fingerprint Cyberguard 4.0 firewall
  4450. Class Cyberguard | embedded || firewall
  4451. TSeq(Class=RI%gcd=<6%SI=>FFFF)
  4452. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  4453. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4454. T3(DF=N%W=1000%ACK=O%Flags=A%Ops=)
  4455. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4456. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4457. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4458. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4459. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  4460.  
  4461. # Cyberguard Firewall 5.2 on Firestar 500 (proprietary Unixware version)
  4462. Fingerprint Cyberguard Firewall 5.2
  4463. Class Cyberguard | embedded || firewall
  4464. TSeq(Class=RI%gcd=<6%SI=<5FE3BC&>A86A%IPID=RD%TS=U)
  4465. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  4466. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4467. T3(Resp=N)
  4468. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4469. T5(DF=N%W=0%ACK=O|S++%Flags=R|AR%Ops=)
  4470. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4471. T7(Resp=N)
  4472. PU(Resp=N)
  4473.  
  4474. Fingerprint Cyclades PathRouter
  4475. Class Cyclades | Cyras || router
  4476. TSeq(Class=TD|RI%gcd=<618708%SI=<EEE47C)
  4477. T1(DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
  4478. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4479. T3(Resp=Y%DF=N%W=46%ACK=S++%Flags=AS%Ops=M)
  4480. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4481. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4482. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4483. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4484. PU(Resp=N)
  4485.  
  4486. Fingerprint Cyclades PathRouter/PC
  4487. Class Cyclades | Cyras || router
  4488. TSeq(Class=RI|TD%gcd=<618708%SI=<1F343)
  4489. T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  4490. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4491. T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  4492. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4493. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4494. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4495. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4496. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  4497.  
  4498. Fingerprint Cyclades PathRAS Remote Access Server v1.1.7
  4499. Class Cyclades | Cyras || terminal server
  4500. TSeq(Class=RI%gcd=<6%SI=>BBBBB)
  4501. T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  4502. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4503. T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  4504. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4505. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4506. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4507. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4508. PU(Resp=N)
  4509.  
  4510. Fingerprint Cyclades PathRouter V 1.2.4
  4511. Class Cyclades | Cyros || router
  4512. TSeq(Class=RI%gcd=<6%SI=>BBBBB)
  4513. T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
  4514. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4515. T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M)
  4516. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4517. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4518. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  4519. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4520. PU(Resp=N)
  4521.  
  4522. Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12
  4523. Class Cyclades | Cyros || terminal server
  4524. TSeq(Class=TD%gcd=30C382%SI=<BB)
  4525. T1(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  4526. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4527. T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M)
  4528. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  4529. T5(Resp=Y%DF=N%W=218|0%ACK=S|S++%Flags=AR%Ops=|M)
  4530. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  4531. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4532. PU(Resp=N)
  4533.  
  4534. # D-Link Internetwork Operating System Software 2630 Series Software, Version 1.3.1J (FULL), RELEASE SOFTWARE
  4535. Fingerprint D-Link 2630 broadband router
  4536. Class D-Link | embedded || broadband router
  4537. TSeq(Class=TD%gcd=<2DC04%SI=<1E%IPID=I%TS=U)
  4538. T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=M)
  4539. T2(Resp=N)
  4540. T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=M)
  4541. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4542. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4543. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4544. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4545. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4546.  
  4547. # D-Link DI-713P wireless router (firmware 2.60 build 6a)
  4548. # 704P Ethernet Broadband Gateway
  4549. Fingerprint D-Link 704P Broadband Gateway or DI-713P WAP
  4550. Class D-Link | embedded || broadband router
  4551. TSeq(Class=RI|TD%gcd=<68%SI=<3A2%IPID=I|BI%TS=U)
  4552. T1(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  4553. T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
  4554. T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  4555. T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
  4556. T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  4557. T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=)
  4558. T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  4559. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4560.  
  4561. Fingerprint D-Link DI-604 broadband router
  4562. Class D-Link | embedded || broadband router
  4563. TSeq(Class=RI%gcd=<68%SI=<13A6&>16%IPID=BI%TS=U)
  4564. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  4565. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4566. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4567. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4568. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4569. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4570. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4571. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4572.  
  4573. Fingerprint D-Link DI-604 Ethernet router
  4574. Class D-Link | embedded || broadband router
  4575. TSeq(Class=TD%gcd=<2C0%SI=<14%IPID=BI%TS=U)
  4576. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4577. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  4578. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4579. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  4580. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4581. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  4582. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4583. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4584.  
  4585. Fingerprint D-Link DI-701, Version 2.22
  4586. Class D-Link | embedded || broadband router
  4587. TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1)
  4588. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  4589. T2(Resp=N)
  4590. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  4591. T4(Resp=N)
  4592. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  4593. T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  4594. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  4595. PU(Resp=N)
  4596.  
  4597. Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9
  4598. Class D-Link | embedded || broadband router
  4599. TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U)
  4600. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4601. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  4602. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4603. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  4604. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4605. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  4606. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  4607. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4608.  
  4609. # D-Link DI-804 Cable/DSL Residential Gateway (with firmware v2.00B7)
  4610. # DI-804 Broadband Router with Firmware 2.01
  4611. Fingerprint D-Link DI-804 Cable/DSL Residential Gateway
  4612. Class D-Link | embedded || broadband router
  4613. TSeq(Class=TD|TR%gcd=<10%SI=<3C%IPID=I%TS=U)
  4614. T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  4615. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4616. T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  4617. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4618. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4619. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4620. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4621. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4622.  
  4623. # D-Link DI-804HV 4-Port Broadband VPN Router
  4624. # US-Robotics Wireless Router : Revision Number : Model#8022, Version V4.2, CheckSum# B719
  4625. Fingerprint D-Link DI-804HV VPN Router or US-Robotics 8022 WAP
  4626. Class D-Link | embedded || broadband router
  4627. Class US Robotics | embedded || WAP
  4628. TSeq(Class=TD%gcd=<3EC%SI=<1E%IPID=I%TS=U)
  4629. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4630. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4631. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4632. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4633. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4634. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4635. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4636. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4637.  
  4638. # D-Link DSL-300G+ version 7.1.0.30 AnnexA  (Oct 18 2002) R2.05.b4t9uk
  4639. Fingerprint D-Link DSL-300G+ DSL modem
  4640. Class D-Link | embedded || broadband router
  4641. TSeq(Class=TD%gcd=<1731C%SI=<14%IPID=I%TS=U)
  4642. T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  4643. T2(Resp=N)
  4644. T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  4645. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  4646. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4647. T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  4648. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4649. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4650.  
  4651. Fingerprint D-Link DSL-500 DSL modem
  4652. Class D-Link | embedded || broadband router
  4653. TSeq(Class=TD%gcd=<1FBD4%SI=<14%IPID=I%TS=U)
  4654. T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  4655. T2(Resp=N)
  4656. T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  4657. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  4658. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4659. T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4660. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4661. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4662.  
  4663. Fingerprint D-Link DSL-500 DSL modem
  4664. Class D-Link | embedded || broadband router
  4665. TSeq(Class=TD%gcd=<EA64%SI=<14%IPID=I%TS=U)
  4666. T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  4667. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4668. T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  4669. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  4670. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  4671. T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  4672. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  4673. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4674.  
  4675. # DI-701 Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30
  4676. Fingerprint DI-701 Residential Gateway or KA9Q NOS - KO4KS-TNOS v. 2.30
  4677. Class D-Link | embedded || broadband router
  4678. TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00)
  4679. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  4680. T2(Resp=N)
  4681. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  4682. T4(Resp=N)
  4683. T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  4684. T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  4685. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  4686. PU(Resp=N)
  4687.  
  4688. # D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled
  4689. # Date: Oct 14 1997, Time: 09:35:04  (claims software version 2.04B3,
  4690. # boot PROM version 2.21)
  4691. Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21
  4692. Class D-Link | embedded || hub
  4693. TSeq(Class=TD%gcd=1388%SI=0)
  4694. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  4695. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4696. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4697. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4698. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4699. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4700. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4701. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4702.  
  4703. # D-Link Print Server Model DP-101P+
  4704. Fingerprint D-Link Print Server
  4705. Class D-Link | embedded || print server
  4706. TSeq(Class=TD%gcd=<374%SI=<1E)
  4707. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  4708. T2(Resp=N)
  4709. T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M)
  4710. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4711. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4712. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4713. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4714. PU(Resp=N)
  4715.  
  4716. Fingerprint D-Link VoIP Gateway GS-104SH
  4717. Class D-Link | embedded || telecom-misc
  4718. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4719. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME)
  4720. T2(Resp=N)
  4721. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME)
  4722. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  4723. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  4724. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  4725. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  4726. PU(Resp=N)
  4727.  
  4728. # D-Link DI-604 Ethernet router using firmware 1.62 build 2
  4729. # DI-707P router
  4730. # Sitecom - Broadband Home Station - Firmware R1.96c
  4731. # SMC Barricade Broadband Router with firmware R1.96h2 - internal interface
  4732. Fingerprint Broadband router or WAP: D-Link DI-series, Sitecom BHS WAP, or SMC Barricade
  4733. Class D-Link | embedded || WAP
  4734. TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=BI%TS=U)
  4735. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4736. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4737. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4738. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4739. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4740. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4741. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4742. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4743.  
  4744. # D-Link DI-713P - Firmware version 2.60 build 2
  4745. Fingerprint D-Link DI-713P WAP
  4746. Class D-Link | embedded || WAP
  4747. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  4748. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4749. T2(Resp=N)
  4750. T3(Resp=N)
  4751. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4752. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4753. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4754. T7(Resp=N)
  4755. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4756.  
  4757. Fingerprint D-Link DI-713P Wireless Gateway (2.57 build 3a)
  4758. Class D-Link | embedded || WAP
  4759. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4760. T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
  4761. T2(Resp=N)
  4762. T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M)
  4763. T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  4764. T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=)
  4765. T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  4766. T7(Resp=N)
  4767. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4768.  
  4769. # D-Link DI-774 - Firmware Version: 2.27
  4770. Fingerprint D-Link DI-774 WAP
  4771. Class D-Link | embedded || WAP
  4772. TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
  4773. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  4774. T2(Resp=N)
  4775. T3(Resp=N)
  4776. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  4777. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4778. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4779. T7(Resp=N)
  4780. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4781.  
  4782. Fingerprint D-Link DWL-5000AP WAP/BSP 1.3
  4783. Class D-Link | embedded || WAP
  4784. TSeq(Class=64K%IPID=I%TS=U)
  4785. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNW)
  4786. T2(Resp=N)
  4787. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  4788. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  4789. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4790. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4791. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4792. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4793.  
  4794. # SMC Barricade Wireless Broadband Router (firmware R1.93e)
  4795. # D-Link DL-707 Cable/DSL Router
  4796. # USR8022 Wireless Cable/DSL Router with firmware V3.1
  4797. # Tonze IP-W314E  22 Mbps Wireless All-In-One Broadband Router
  4798. Fingerprint D-Link, SMC, Tonze, or US Robotics wireless broadband router
  4799. Class D-Link | embedded || WAP
  4800. TSeq(Class=TD%gcd=<130%SI=<1E%IPID=RD|I%TS=U)
  4801. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4802. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4803. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4804. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4805. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4806. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  4807. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  4808. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4809.  
  4810. # D-Link Wireless Access Point (WAP) DRC-1000AP - v3.2.28
  4811. # 3Com 11Mpbs Wireless LAN Access Point 2000 (Firmware 1.2)
  4812. Fingerprint wireless access point (WAP): D-Link DRC-1000AP or 3Com Access Point 2000
  4813. Class D-Link | embedded || WAP
  4814. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  4815. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  4816. T2(Resp=N)
  4817. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  4818. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4819. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4820. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4821. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4822. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  4823.  
  4824. Fingerprint D-Link DCS-1000 webcam with firmware 1.06
  4825. Class D-Link | embedded || webcam
  4826. TSeq(Class=TD%gcd=<E0%SI=<14%IPID=I%TS=U)
  4827. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  4828. T2(Resp=N)
  4829. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=ASF%Ops=M)
  4830. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4831. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4832. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4833. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4834. PU(Resp=N)
  4835.  
  4836. Fingerprint D-Link dcs-5300w Wireless WebCam
  4837. Class D-Link | embedded || webcam
  4838. TSeq(Class=TD%gcd=<18%SI=<64%IPID=I%TS=U)
  4839. T1(Resp=N)
  4840. T2(Resp=N)
  4841. T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=)
  4842. T4(Resp=N)
  4843. T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
  4844. T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=)
  4845. T7(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=)
  4846. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  4847.  
  4848. # Dlink DVC-1100 Wireless Broadband VideoPhone (Application Version 4.0.0.155, Boot Loader Version 2.0.0.2, App Loader Version 1.0.300.102)
  4849. Fingerprint D-Link DVC-1000 Wireless Broadband VideoPhone
  4850. Class D-Link | embedded || webcam
  4851. TSeq(Class=64K%IPID=I%TS=U)
  4852. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  4853. T2(Resp=N)
  4854. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
  4855. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4856. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4857. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4858. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4859. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4860.  
  4861. Fingerprint AOS/VS on a Data General mainframe
  4862. Class Data General | AOS/VS || general purpose
  4863. TSeq(Class=TD%gcd=32|64|96%SI=1)
  4864. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  4865. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4866. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  4867. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4868. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4869. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4870. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4871. PU(Resp=Y%DF=N%TOS=0%IPLEN=54%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  4872.  
  4873. Fingerprint AOS/VS or VSII
  4874. Class Data General | AOS/VS || general purpose
  4875. TSeq(Class=TD%gcd=40|80|C0%SI=0)
  4876. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  4877. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4878. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  4879. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  4880. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  4881. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4882. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4883. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  4884.  
  4885. Fingerprint Data General DG/UX Release R4.11MU02
  4886. Class Data General | DG/UX || general purpose
  4887. TSeq(Class=TD%gcd=10000|20000|30000%SI=<F)
  4888. T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
  4889. T2(Resp=N)
  4890. T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
  4891. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  4892. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4893. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4894. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4895. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4896.  
  4897. Fingerprint Data General DG/UX Release R4.20MU02
  4898. Class Data General | DG/UX || general purpose
  4899. TSeq(Class=TD%gcd=<20004%SI=<1E)
  4900. T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
  4901. T2(Resp=N)
  4902. T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
  4903. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  4904. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4905. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4906. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4907. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4908.  
  4909. # DG/UX DataGeneral_Server R4.20MU04 generic AViiON Pentium Pro
  4910. Fingerprint Data General DG/UX Release R4.20MU04
  4911. Class Data General | DG/UX || general purpose
  4912. TSeq(Class=RI%gcd=<6%SI=<32CBC&>281)
  4913. T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M)
  4914. T2(Resp=N)
  4915. T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=)
  4916. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  4917. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4918. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4919. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4920. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4921.  
  4922. Fingerprint Data General DG/UX Release R4.20MU06
  4923. Class Data General | DG/UX || general purpose
  4924. TSeq(Class=RI%gcd=<6%SI=<E21EE&>779%IPID=I%TS=U)
  4925. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
  4926. T2(Resp=N)
  4927. T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=)
  4928. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  4929. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4930. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4931. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4932. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4933.  
  4934. Fingerprint 4.3BSD-tahoe on a MicroVax III
  4935. Class DEC | BSD-misc || general purpose
  4936. TSeq(Class=64K%IPID=I%TS=U)
  4937. T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=)
  4938. T2(Resp=N)
  4939. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  4940. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  4941. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4942. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4943. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4944. PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  4945.  
  4946. Fingerprint DEC OSF/1 V1.3A - 2.0
  4947. Class DEC | DIGITAL UNIX | 1.X | general purpose
  4948. Class DEC | DIGITAL UNIX | 2.X | general purpose
  4949. TSeq(Class=64K)
  4950. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  4951. T2(Resp=N)
  4952. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
  4953. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4954. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4955. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4956. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4957. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4958.  
  4959. Fingerprint DIGITAL UNIX OSF1 V 3.0,3.2,3.2C
  4960. Class DEC | DIGITAL UNIX | 3.X | general purpose
  4961. TSeq(Class=64K)
  4962. T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW)
  4963. T2(Resp=N)
  4964. T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=)
  4965. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4966. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4967. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4968. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4969. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4970.  
  4971. Fingerprint DEC DIGITAL UNIX OSF1 V 4.0-4.0F
  4972. Class DEC | DIGITAL UNIX | 4.X | general purpose
  4973. TSeq(Class=C|RI%gcd=<6)
  4974. T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW)
  4975. T2(Resp=N)
  4976. T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=)
  4977. T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=)
  4978. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4979. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4980. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4981. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  4982.  
  4983. Fingerprint DIGITAL UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F
  4984. Class DEC | DIGITAL UNIX | 4.X | general purpose
  4985. TSeq(Class=RI|TD|64K%gcd=<6)  # Boy, OSF1 comes in all colors!
  4986. T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW)
  4987. T2(Resp=N)
  4988. T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=)
  4989. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  4990. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  4991. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  4992. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  4993. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  4994.  
  4995. Fingerprint DEC OSF1 (AKA Compaq/DIGITAL Tru64 UNIX) Version 5.0.0
  4996. Class DEC | DIGITAL UNIX | 5.X | general purpose
  4997. TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U)
  4998. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  4999. T2(Resp=N)
  5000. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=)
  5001. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5002. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5003. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5004. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5005. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5006.  
  5007. Fingerprint OSF/1 (AKA Compaq/DIGITAL Tru64 UNIX) 5.60
  5008. Class DEC | DIGITAL UNIX | 5.X | general purpose
  5009. TSeq(Class=64K)
  5010. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW)
  5011. T2(Resp=N)
  5012. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  5013. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5014. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5015. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5016. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5017. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5018.  
  5019. Fingerprint DECNIS 600 V4.1.3B multiprotocol bridge/router
  5020. Class DEC | embedded || router
  5021. TSeq(Class=TD%gcd=30D4|C35%SI=<F)
  5022. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  5023. T2(Resp=N)
  5024. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  5025. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5026. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5027. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5028. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5029. PU(Resp=N)
  5030.  
  5031. # DECserver 700-16, Network Access SW V2.2
  5032. Fingerprint DECserver 700-16 terminal server, Network Access SW V2.2
  5033. Class DEC | embedded || terminal server
  5034. TSeq(Class=64K)
  5035. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  5036. T2(Resp=N)
  5037. T3(Resp=Y%DF=N%W=600%ACK=S++|O%Flags=AR|A%Ops=)
  5038. T4(DF=N%W=600%ACK=O%Flags=R%Ops=)
  5039. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5040. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5041. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5042. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5043.  
  5044. Fingerprint DEC OpenVMS 6.1
  5045. Class DEC | OpenVMS | 6.X | general purpose
  5046. TSeq(Class=64K)
  5047. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|MWN)
  5048. T2(Resp=N)
  5049. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5050. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5051. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5052. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5053. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5054. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5055.  
  5056. Fingerprint DEC OpenVMS 6.2
  5057. Class DEC | OpenVMS | 6.X | general purpose
  5058. TSeq(Class=TR)
  5059. T1(Resp=Y%DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  5060. T2(Resp=N)
  5061. T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  5062. T4(Resp=Y%DF=N%W=2200%ACK=O%Flags=R%Ops=)
  5063. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5064. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5065. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5066. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5067.  
  5068. Fingerprint DEC OpenVMS 6.2
  5069. Class DEC | OpenVMS | 6.X | general purpose
  5070. TSeq(Class=RI%gcd=<6%SI=<4D8%IPID=BI%TS=U)
  5071. T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
  5072. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  5073. T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=AS%Ops=MWL)
  5074. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5075. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5076. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5077. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5078. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5079.  
  5080. # DIGITAL TCP/IP Services for OpenVMS Alpha Version V4.2 - ECO 4 on a AlphaServer 8400 5/625 running OpenVMS V6.2-1H3
  5081. Fingerprint DEC OpenVMS 6.2
  5082. Class DEC | OpenVMS | 6.X | general purpose
  5083. TSeq(Class=64K%IPID=I%TS=U)
  5084. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MWN)
  5085. T2(Resp=N)
  5086. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  5087. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5088. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5089. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5090. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5091. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5092.  
  5093. Fingerprint DEC OpenVMS 6.2 - 7.2-1 on VAX or AXP
  5094. Class DEC | OpenVMS | 6.X | general purpose
  5095. Class DEC | OpenVMS | 7.X | general purpose
  5096. TSeq(Class=TR%gcd=<6)
  5097. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  5098. T2(Resp=N)
  5099. T3(Resp=Y%DF=Y|N%W=1800%ACK=O%Flags=A%Ops=NNT)
  5100. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  5101. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5102. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5103. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5104. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5105.  
  5106. Fingerprint DEC OpenVMS 6.2/Alpha
  5107. Class DEC | OpenVMS | 6.X | general purpose
  5108. TSeq(Class=TR%gcd=<6)
  5109. T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  5110. T2(Resp=N)
  5111. T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  5112. T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  5113. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5114. T6(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  5115. T7(Resp=N)
  5116. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%UCK=0%ULEN=134%DAT=E)
  5117.  
  5118. Fingerprint DEC OpenVMS Alpha 6.2 running DIGITAL TCP/IP Services (UCX) v4.0
  5119. Class DEC | OpenVMS | 6.X | general purpose
  5120. TSeq(Class=64K)
  5121. T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
  5122. T2(Resp=N)
  5123. T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
  5124. T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
  5125. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5126. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5127. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5128. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5129.  
  5130. Fingerprint DEC OpenVMS AXP 6.2 running Attachmate Pathway 3.1 TCP stack
  5131. Class DEC | OpenVMS | 6.X | general purpose
  5132. TSeq(Class=i800|64K)
  5133. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  5134. T2(Resp=N)
  5135. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=)
  5136. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5137. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5138. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5139. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5140. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5141.  
  5142. Fingerprint DEC OpenVMS V6.1 on VAX 4000-105A
  5143. Class DEC | OpenVMS | 6.X | general purpose
  5144. TSeq(Class=64K)
  5145. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  5146. T2(Resp=N)
  5147. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=)
  5148. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  5149. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5150. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5151. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5152. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5153.  
  5154. Fingerprint DEC OpenVMS 7.1
  5155. Class DEC | OpenVMS | 7.X | general purpose
  5156. TSeq(Class=TR)
  5157. T1(DF=N%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  5158. T2(Resp=N)
  5159. T3(Resp=Y%DF=N%W=2200%ACK=O%Flags=A%Ops=NNT)
  5160. T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  5161. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5162. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5163. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5164. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5165.  
  5166. Fingerprint DEC OpenVMS 7.1 Alpha running DIGITAL's UCX v4.1ECO2 TCP/IP package
  5167. Class DEC | OpenVMS | 7.X | general purpose
  5168. TSeq(Class=64K)
  5169. T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN)
  5170. T2(Resp=N)
  5171. T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
  5172. T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
  5173. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5174. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5175. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5176. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5177.  
  5178. Fingerprint DEC OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package
  5179. Class DEC | OpenVMS | 7.X | general purpose
  5180. TSeq(Class=RI|TD%gcd=<6%SI=<BBBB)
  5181. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MWL)
  5182. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  5183. T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MWL)
  5184. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5185. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5186. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5187. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5188. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5189.  
  5190. # DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A - ECO 1 on a AlphaServer DS20 500 MHz running OpenVMS V7.2-1
  5191. Fingerprint DEC OpenVMS 7.2
  5192. Class DEC | OpenVMS | 7.X | general purpose
  5193. TSeq(Class=RI%gcd=<8%SI=<527E2&>543%IPID=I%TS=U)
  5194. T1(DF=N%W=C3A5%ACK=S++%Flags=AS%Ops=MNW)
  5195. T2(Resp=N)
  5196. T3(Resp=Y%DF=N%W=C3A5%ACK=O%Flags=A%Ops=)
  5197. T4(DF=N%W=C350%ACK=O%Flags=R%Ops=)
  5198. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5199. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5200. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5201. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5202.  
  5203. Fingerprint DEC OpenVMS 7.2
  5204. Class DEC | OpenVMS | 7.X | general purpose
  5205. TSeq(Class=RI%gcd=<44%SI=<2670&>3B%IPID=I%TS=U)
  5206. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  5207. T2(Resp=N)
  5208. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  5209. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5210. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5211. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5212. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5213. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5214.  
  5215. # The OS was running on a GS1280 Alpha server
  5216. Fingerprint DEC OpenVMS 7.3
  5217. Class DEC | OpenVMS | 7.X | general purpose
  5218. TSeq(Class=TR%gcd=<6%TS=U)
  5219. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M)
  5220. T2(Resp=N)
  5221. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  5222. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5223. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5224. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5225. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5226. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5227.  
  5228. # OpenVMS 7.3 with TCP/IP 5.3
  5229. Fingerprint DEC OpenVMS 7.3 (Alpha) TCP/IP 5.3
  5230. Class DEC | OpenVMS | 7.X | general purpose
  5231. TSeq(Class=TR%gcd=<6%TS=U)
  5232. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  5233. T2(Resp=N)
  5234. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  5235. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5236. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5237. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5238. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5239. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  5240.  
  5241. Fingerprint DEC OpenVMS 7.3 (Compaq TCP/IP 5.3)
  5242. Class DEC | OpenVMS | 7.X | general purpose
  5243. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5244. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  5245. T2(Resp=N)
  5246. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  5247. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5248. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5249. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5250. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5251. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5252.  
  5253. Fingerprint DEC OpenVMS 7.3-1
  5254. Class DEC | OpenVMS | 7.X | general purpose
  5255. TSeq(Class=RI%gcd=<6%SI=<56E82&>B37%IPID=I%TS=U)
  5256. T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW)
  5257. T2(Resp=N)
  5258. T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=)
  5259. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5260. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5261. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5262. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5263. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5264.  
  5265. Fingerprint DEC OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2
  5266. Class DEC | OpenVMS | 7.X | general purpose
  5267. TSeq(Class=64K)
  5268. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN)
  5269. T2(Resp=N)
  5270. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5271. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5272. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5273. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5274. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5275. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5276.  
  5277. Fingerprint DEC OpenVMS V7.1 on VAX 6000-530
  5278. Class DEC | OpenVMS | 7.X | general purpose
  5279. TSeq(Class=64K%gcd=<6%SI=<14)
  5280. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=)
  5281. T2(Resp=N)
  5282. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  5283. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  5284. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5285. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5286. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5287. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5288.  
  5289. Fingerprint DEC OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package
  5290. Class DEC | OpenVMS | 7.X | general purpose
  5291. T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL)
  5292. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  5293. T3(Resp=N)
  5294. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5295. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5296. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5297. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5298. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5299.  
  5300. # DEC VAXVMS TCPIP V5.1-15  Full LP Installed
  5301. Fingerprint DEC OpenVMS v7.3 on VAXStation 4000/60
  5302. Class DEC | OpenVMS | 7.X | general purpose
  5303. TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U)
  5304. T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW)
  5305. T2(Resp=N)
  5306. T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=)
  5307. T4(Resp=N)
  5308. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5309. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5310. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5311. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5312.  
  5313. Fingerprint DEC OpenVMS VAX V7.3, Process Software MultiNet V5.0
  5314. Class DEC | OpenVMS | 7.X | general purpose
  5315. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  5316. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  5317. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5318. T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  5319. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5320. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5321. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5322. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5323. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5324.  
  5325. Fingerprint DEC OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4
  5326. Class DEC | OpenVMS | 7.X | general purpose
  5327. TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U)
  5328. T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL)
  5329. T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=)
  5330. T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL)
  5331. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5332. T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5333. T6(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  5334. T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=)
  5335. PU(Resp=N)
  5336.  
  5337. Fingerprint DEC VMS MultiNet V4.2(16)/ OpenVMS V7.1-2
  5338. Class DEC | OpenVMS | 7.X | general purpose
  5339. TSeq(Class=TR%gcd=<6)
  5340. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  5341. T2(Resp=N)
  5342. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
  5343. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  5344. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5345. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5346. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5347. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5348.  
  5349. Fingerprint DEC VMS MultiNet V4.4 / OpenVMS V7.1
  5350. Class DEC | OpenVMS | 7.X | general purpose
  5351. TSeq(Class=TR%gcd=<6%TS=2HZ)
  5352. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  5353. T2(Resp=N)
  5354. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
  5355. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  5356. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5357. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5358. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5359. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5360.  
  5361. Fingerprint DEC TOPS-20 Monitor 7(102540)-1,TD-1
  5362. Class DEC | TOPS-20 || general purpose
  5363. TSeq(Class=TD%gcd=30000|60000|90000%SI=<BB)
  5364. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  5365. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5366. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5367. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5368. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5369. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5370. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5371. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5372.  
  5373. Fingerprint DEC TOPS-20 Monitor 7(21733),KL-10 (DEC 2065)
  5374. Class DEC | TOPS-20 || general purpose
  5375. TSeq(Class=TD%gcd=<60004%SI=<1E%TS=U)
  5376. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  5377. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  5378. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  5379. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  5380. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5381. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  5382. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  5383. PU(Resp=N)
  5384.  
  5385. Fingerprint DEC Ultrix 4.1
  5386. Class DEC | Ultrix || general purpose
  5387. TSeq(Class=64K)
  5388. T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=)
  5389. T2(Resp=N)
  5390. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  5391. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5392. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5393. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5394. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5395. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5396.  
  5397. Fingerprint DEC Ultrix 4.2 - 4.5
  5398. Class DEC | Ultrix || general purpose
  5399. TSeq(Class=64K)
  5400. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=|M)
  5401. T2(Resp=N)
  5402. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  5403. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5404. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5405. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5406. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5407. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5408.  
  5409. Fingerprint DEC OpenVMS 7.3-1 w/Multinet 4.4
  5410. Class DEC | VMS || general purpose
  5411. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  5412. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT)
  5413. T2(Resp=N)
  5414. T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT)
  5415. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  5416. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5417. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5418. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5419. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5420.  
  5421. Fingerprint DEC VAX 7000-610 or 4200/SPX OR 6000-430
  5422. Class DEC | VMS || general purpose
  5423. TSeq(Class=64K)
  5424. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  5425. T2(Resp=N)
  5426. T3(Resp=Y%DF=N%W=1800%ACK=O%Flags=A%Ops=)
  5427. T4(DF=N%W=1800%ACK=O%Flags=R%Ops=)
  5428. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5429. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5430. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5431. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5432.  
  5433. Fingerprint DEC VAX/VMS 5.3 on a MicroVAX II
  5434. Class DEC | VMS || general purpose
  5435. TSeq(Class=64K)
  5436. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5437. T2(Resp=N)
  5438. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5439. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5440. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5441. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5442. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5443. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5444.  
  5445. # VMS 5.5-2 on VAX (VaxStation 4)
  5446. Fingerprint DEC VAX/VMS 5.5-2
  5447. Class DEC | VMS || general purpose
  5448. TSeq(Class=64K%IPID=I%TS=U)
  5449. T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=M)
  5450. T2(Resp=N)
  5451. T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=)
  5452. T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=)
  5453. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5454. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5455. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5456. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  5457.  
  5458. Fingerprint DEC VAX/VMS v5.5, CMU-TEK TCP/IP stack
  5459. Class DEC | VMS || general purpose
  5460. TSeq(Class=RI%gcd=<6%SI=>BBBBB)
  5461. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  5462. T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=)
  5463. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  5464. T4(DF=N%W=64%ACK=O%Flags=AR%Ops=)
  5465. T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
  5466. T6(DF=N%W=64%ACK=O%Flags=AR%Ops=)
  5467. T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=)
  5468. PU(Resp=N)
  5469.  
  5470. Fingerprint DEC VMS MultiNet V4.1(16)
  5471. Class DEC | VMS || general purpose
  5472. TSeq(Class=TR%gcd=<6)
  5473. T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT)
  5474. T2(Resp=N)
  5475. T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  5476. T4(DF=N%W=2200%ACK=O%Flags=R%Ops=)
  5477. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5478. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5479. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5480. PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5481.  
  5482. Fingerprint Dell  Tape Library MSL6030
  5483. Class Dell | embedded || storage-misc
  5484. TSeq(Class=TD%gcd=<2004%SI=<1D6%IPID=I%TS=1000HZ)
  5485. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  5486. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5487. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  5488. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5489. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5490. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5491. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5492. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5493.  
  5494. Fingerprint Dell Powervault 132T Automated Tape Library
  5495. Class Dell | embedded || storage-misc
  5496. TSeq(Class=64K%IPID=I%TS=U)
  5497. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
  5498. T2(Resp=N)
  5499. T3(Resp=N)
  5500. T4(Resp=N)
  5501. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5502. T6(Resp=N)
  5503. T7(Resp=N)
  5504. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5505.  
  5506. # Dell PowerVault 132T Library (Firmware 103D.GY001)
  5507. Fingerprint Dell Powervault 132T Automated Tape Library
  5508. Class Dell | embedded || storage-misc
  5509. TSeq(Class=64K%IPID=I%TS=U)
  5510. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW)
  5511. T2(Resp=N)
  5512. T3(Resp=Y%DF=N%W=578%ACK=O%Flags=A%Ops=)
  5513. T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
  5514. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5515. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5516. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5517. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  5518.  
  5519. # Dell 3324 PowerConnect Switch with firmware version 1.1.0.42
  5520. Fingerprint Dell 3324 PowerConnect Switch
  5521. Class Dell | embedded || switch
  5522. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5523. T1(DF=N%W=200|800%ACK=S++%Flags=AS%Ops=)
  5524. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5525. T3(Resp=Y%DF=N%W=200|800%ACK=S++%Flags=AS%Ops=)
  5526. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5527. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5528. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5529. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5530. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5531.  
  5532. Fingerprint Digital Link DL2001 CSU/DSU Management Access Processor
  5533. Class Digital Link | embedded || CSUDSU
  5534. TSeq(Class=TD%gcd=<2780%SI=<14)
  5535. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5536. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5537. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5538. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5539. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5540. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5541. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5542. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5543.  
  5544. Fingerprint Digital Networks VNswitch 900
  5545. Class Digital Networks | embedded || switch
  5546. TSeq(Class=TD%gcd=<4%SI=<4)
  5547. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
  5548. T2(Resp=N)
  5549. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5550. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5551. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5552. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5553. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5554. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5555.  
  5556. Fingerprint Digitel NetRouter NR3000
  5557. Class Digitel | embedded || router
  5558. TSeq(Class=RI%gcd=<2004%SI=<10CC&>16)
  5559. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  5560. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5561. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  5562. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5563. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5564. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5565. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5566. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5567.  
  5568. Fingerprint Digitel NetRouter NR3100
  5569. Class Digitel | embedded || router
  5570. TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U)
  5571. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  5572. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5573. T3(Resp=N)
  5574. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5575. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5576. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5577. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5578. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5579.  
  5580. Fingerprint Draytek Vigor 2000 ISDN router
  5581. Class Draytek | embedded || broadband router
  5582. T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  5583. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5584. T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M)
  5585. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5586. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5587. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5588. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5589. PU(Resp=N)
  5590.  
  5591. # 
  5592. Fingerprint Draytek Vigor 2200e DSL router v2.1a
  5593. Class Draytek | embedded || broadband router
  5594. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5595. T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
  5596. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5597. T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=ME)
  5598. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5599. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5600. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5601. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5602. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5603.  
  5604. Fingerprint Draytek Vigor 2200e DSL router v2.1b
  5605. Class Draytek | embedded || broadband router
  5606. TSeq(Class=RI%gcd=<6%SI=<2D38FC2&>72E8A%IPID=Z%TS=100HZ)
  5607. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  5608. T2(Resp=N)
  5609. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  5610. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5611. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5612. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5613. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5614. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  5615.  
  5616. # Software version VIK-1.35.020320j -- www.easytel.fi
  5617. Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router
  5618. Class Easytel | embedded || broadband router
  5619. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5620. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  5621. T2(Resp=N)
  5622. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  5623. T4(Resp=N)
  5624. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  5625. T6(Resp=N)
  5626. T7(Resp=N)
  5627. PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5628.  
  5629. Fingerprint Edimax BR-6004 broadband router
  5630. Class Edimax | embedded || broadband router
  5631. TSeq(Class=i800%IPID=I%TS=2HZ)
  5632. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5633. T2(Resp=N)
  5634. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5635. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5636. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5637. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5638. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5639.  
  5640. Fingerprint Edimax PS-901 Print Server model 1P/13E-9.5.12
  5641. Class Edimax | embedded || print server
  5642. TSeq(Class=RI%gcd=<2004%SI=<12D4&>1C%IPID=I%TS=U)
  5643. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  5644. T2(Resp=N)
  5645. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  5646. T4(Resp=N)
  5647. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5648. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5649. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5650. PU(Resp=N)
  5651.  
  5652. Fingerprint Efficient Networks/SpeedStream DSL router
  5653. Class Efficient Networks | embedded || broadband router
  5654. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5655. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  5656. T2(Resp=N)
  5657. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  5658. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5659. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5660. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5661. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5662. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5663.  
  5664. Fingerprint Eicon Diva1830 ISDN router running 1.5 firmware
  5665. Class Eicon | embedded || broadband router
  5666. TSeq(Class=TD%gcd=<20004%SI=<14%IPID=I%TS=U)
  5667. T1(DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
  5668. T2(Resp=Y%DF=N%W=1%ACK=S%Flags=AR%Ops=)
  5669. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M)
  5670. T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
  5671. T5(DF=N%W=1%ACK=S++%Flags=AR%Ops=)
  5672. T6(DF=N%W=1%ACK=O%Flags=R%Ops=)
  5673. T7(DF=N%W=1%ACK=S%Flags=AR%Ops=)
  5674. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5675.  
  5676. # ELSA LANCOM 1100 Office, Firmware 2.50.0005 / 15.11.2001
  5677. Fingerprint ELSA LANCOM 1100 office router
  5678. Class Elsa | embedded || broadband router
  5679. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5680. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
  5681. T2(Resp=N)
  5682. T3(Resp=N)
  5683. T4(Resp=N)
  5684. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5685. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5686. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5687. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5688.  
  5689. #  Lancom (Elsa) DSL I-10 Office Firmware 3.2
  5690. Fingerprint ELSA LANCOM DSL I-10 Office router
  5691. Class Elsa | embedded || broadband router
  5692. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5693. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
  5694. T2(Resp=N)
  5695. T3(Resp=N)
  5696. T4(Resp=N)
  5697. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5698. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5699. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5700. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5701.  
  5702. Fingerprint ELSA LANCOM DSL I-10 Office router
  5703. Class Elsa | embedded || broadband router
  5704. TSeq(Class=TR%gcd=<6%IPID=I)
  5705. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=WNMETL)
  5706. T2(Resp=N)
  5707. T3(Resp=N)
  5708. T4(Resp=N)
  5709. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5710. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5711. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5712. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5713.  
  5714. # LANCOM DSL/10 Office DSL router with firmware v3.22
  5715. Fingerprint ELSA LANCOM DSL/10 Office DSL router
  5716. Class Elsa | embedded || broadband router
  5717. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5718. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
  5719. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5720. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5721. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5722. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5723. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5724. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5725. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5726.  
  5727. # ELSA LANCOM DSL/10 Office router 2.62.0002
  5728. Fingerprint ELSA LANCOM DSL/10 office router
  5729. Class Elsa | embedded || broadband router
  5730. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5731. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=M)
  5732. T2(Resp=N)
  5733. T3(Resp=N)
  5734. T4(Resp=N)
  5735. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5736. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5737. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5738. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5739.  
  5740. Fingerprint ELSA LANCOM DSL/10 office router
  5741. Class Elsa | embedded || broadband router
  5742. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5743. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  5744. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  5745. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5746. T5(Resp=N)
  5747. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5748. T7(Resp=N)
  5749. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5750.  
  5751. # ELSA LANCOM DSL/I-1611 Office 2.70.0025 / 06.08.2002 http://www.lancom-systems.de/
  5752. # ELSA LANCOM DSL/I-1611 Office 2.50.0005 / 15.11.2001
  5753. Fingerprint ELSA LANCOM DSL/I-1611 Office router
  5754. Class Elsa | embedded || broadband router
  5755. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5756. T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=)
  5757. T2(Resp=N)
  5758. T3(Resp=N)
  5759. T4(Resp=N)
  5760. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5761. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5762. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5763. PU(Resp=N)
  5764.  
  5765. Fingerprint EMC DART running on a Data Mover fileserver. Version T4.1.8.1
  5766. Class EMC | DART || fileserver
  5767. TSeq(Class=64K%IPID=I%TS=2HZ)
  5768. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  5769. T2(Resp=N)
  5770. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  5771. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5772. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5773. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5774. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5775. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5776.  
  5777. Fingerprint EMC IP4700 Filer
  5778. Class EMC | DART || fileserver
  5779. TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ)
  5780. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  5781. T2(Resp=N)
  5782. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  5783. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  5784. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5785. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5786. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5787. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5788.  
  5789. # Enterasys XSR-1805 Software Version 6.0.0.0, Built Sep 14 2003, 11:09:28
  5790. Fingerprint Enterasys XSR-1805 Security Route
  5791. Class Enterasys | embedded || firewall
  5792. TSeq(Class=RI%gcd=<6%SI=<55280&>B75%IPID=I%TS=2HZ)
  5793. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  5794. T2(Resp=N)
  5795. T3(Resp=N)
  5796. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5797. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5798. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5799. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5800. PU(Resp=N)
  5801.  
  5802. # Enterasys XP-2400 switch running Enterasys E9.0.0.0
  5803. # Cabletron Smartswitch 6000 running Enterasys E8.2.0.0
  5804. Fingerprint Enterasys/Cabletron switch running Enterasys E8.2.0.0 - E9.0.0.0
  5805. Class Enterasys | embedded || switch
  5806. TSeq(Class=RI%gcd=<6%SI=<7A31E&>10AD%IPID=I%TS=2HZ)
  5807. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5808. T2(Resp=N)
  5809. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  5810. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  5811. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5812. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5813. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5814. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5815.  
  5816. Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98
  5817. Class Epson | embedded || printer
  5818. TSeq(Class=TR)
  5819. T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  5820. T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5821. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=)
  5822. T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5823. T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5824. T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5825. T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5826. PU(Resp=N)
  5827.  
  5828. Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20
  5829. Class Epson | embedded || printer
  5830. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  5831. T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5832. T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
  5833. T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5834. T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5835. T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5836. T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  5837. PU(Resp=N)
  5838.  
  5839. Fingerprint Ericsson HM220dp ADSL modem/router
  5840. Class Ericsson | embedded || broadband router
  5841. TSeq(Class=TD%gcd=<50000%SI=<1E%IPID=I%TS=U)
  5842. T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  5843. T2(Resp=N)
  5844. T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  5845. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  5846. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  5847. T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  5848. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  5849. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  5850.  
  5851. # Ericsson Tigris Access Server V. 12.1.15 with 10.2 ISDN code
  5852. # Integrated Access Platform, Software Version  = 12.1.1.22 (ISDN Software Version 10.1)
  5853. Fingerprint Ericsson Tigris Access Server Software V. 12.1.*
  5854. Class Ericsson | embedded || terminal server
  5855. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  5856. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  5857. T2(Resp=N)
  5858. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  5859. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5860. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5861. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5862. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5863. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5864.  
  5865. Fingerprint Exabyte X80 tape backup robot
  5866. Class Exabyte | embedded || storage-misc
  5867. TSeq(Class=TD%gcd=<6004%SI=<14%IPID=I%TS=U)
  5868. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  5869. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5870. T3(Resp=Y%DF=N%W=16D0|0%ACK=S++|O%Flags=AS|AR%Ops=M|)
  5871. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5872. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5873. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5874. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5875. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5876.  
  5877. Fingerprint Extreme Gigabit switch (unknown version)
  5878. Class Extreme Networks | embedded || switch
  5879. TSeq(Class=64K)
  5880. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5881. T2(Resp=N)
  5882. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5883. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5884. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5885. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5886. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5887. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5888.  
  5889. Fingerprint Extreme Networks Black Diamond switch
  5890. Class Extreme Networks | embedded || switch
  5891. TSeq(Class=64K%gcd=<6%SI=<14)
  5892. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  5893. T2(Resp=N)
  5894. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5895. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5896. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5897. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5898. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5899. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5900.  
  5901. Fingerprint Extreme Networks Alpine 3804 Switch running Extremeware 6.2.1
  5902. Class Extreme Networks | Extremeware || switch
  5903. TSeq(Class=RI%gcd=<6%SI=<1598C&>223)
  5904. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5905. T2(Resp=N)
  5906. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  5907. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  5908. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5909. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5910. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5911. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  5912.  
  5913. Fingerprint F5 Labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86)
  5914. Class F5 Labs | BSDI || load balancer
  5915. TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4)
  5916. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5917. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5918. T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT)
  5919. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5920. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5921. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5922. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5923. PU(Resp=N)
  5924.  
  5925. # F5 labs BIG-IP Load balancer.  BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386
  5926. # F5 BIG-IP 540 loadbalancer.
  5927. Fingerprint F5 Labs BIG-IP Load balancer Kernel 4.1.1PTF-03 (x86)
  5928. Class F5 Labs | embedded || load balancer
  5929. TSeq(Class=TR%gcd=<6)
  5930. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5931. T2(Resp=N)
  5932. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5933. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5934. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5935. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5936. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  5937. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  5938.  
  5939. Fingerprint F5 Labs BIG-IP load balancer kernel 4.2PTF-05a (x86)
  5940. Class F5 Labs | embedded || load balancer
  5941. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  5942. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  5943. T2(Resp=N)
  5944. T3(Resp=N)
  5945. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5946. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5947. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5948. T7(Resp=N)
  5949. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5950.  
  5951. Fingerprint FastComm FRAD (Frame Relay Access Device) F9200-DS-DNI -- Ver. 4.2.3A
  5952. Class FastComm | embedded || specialized
  5953. TSeq(Class=TD|RI%gcd=<8%SI=<1E)
  5954. T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=)
  5955. T2(Resp=N)
  5956. T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=)
  5957. T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=)
  5958. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5959. T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=)
  5960. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5961. PU(Resp=N)
  5962.  
  5963. # Fiber Line Wireless Broadband DSL Router, type: 802.11g, hardware release: R1.03SRM firmware version: V1.96.1g
  5964. Fingerprint FiberLine Wireless DSL router
  5965. Class FiberLine | embedded || broadband router
  5966. TSeq(Class=RI%gcd=<6%SI=<23C9F22&>5B99B%IPID=Z%TS=1000HZ)
  5967. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  5968. T2(Resp=N)
  5969. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  5970. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  5971. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5972. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5973. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5974. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  5975.  
  5976. Fingerprint FiberLine WL-1200R1 (also known as InterEpoch IWE-1200A-1) Wireless Broadband Router (WAP)
  5977. Class FiberLine | embedded || WAP
  5978. TSeq(Class=TD%gcd=<8%SI=<14%IPID=I%TS=U)
  5979. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
  5980. T2(Resp=N)
  5981. T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME)
  5982. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5983. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5984. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5985. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5986. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  5987.  
  5988. # FlowPoint 144 or 22XX DSL Router v3.0.8
  5989. # SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready
  5990. Fingerprint DSL Router: FlowPoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1
  5991. Class FlowPoint | embedded || broadband router
  5992. Class SpeedStream | embedded || broadband router
  5993. TSeq(Class=TR%gcd=<6)
  5994. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5995. T2(Resp=N)
  5996. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  5997. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  5998. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  5999. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6000. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6001. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E)
  6002.  
  6003. Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router
  6004. Class FlowPoint | embedded || broadband router
  6005. Class ASCOM | embedded || broadband router
  6006. TSeq(Class=TD%gcd=<6%SI=<FF)
  6007. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6008. T2(Resp=N)
  6009. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  6010. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6011. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6012. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6013. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6014. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6015.  
  6016. Fingerprint Fore ForeThought 7.1.0 ATM switch
  6017. Class Fore | embedded || switch
  6018. TSeq(Class=64K%IPID=I%TS=U)
  6019. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  6020. T2(Resp=N)
  6021. T3(Resp=N)
  6022. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6023. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6024. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6025. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6026. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6027.  
  6028. Fingerprint Foundry FastIron Edge Switch (load balancer) 2402
  6029. Class Foundry | embedded || load balancer
  6030. TSeq(Class=RI%gcd=<6%SI=<3E418&>988%IPID=RD%TS=U)
  6031. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  6032. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6033. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6034. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6035. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6036. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6037. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6038. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6039.  
  6040. # Foundry 1500 OS Ver 7.2.06T51
  6041. # Foundry ServerIron XL 16 Port 7.3.06T12
  6042. Fingerprint Foundry Load Balancer OS Ver 7.2.X - 7.3.X
  6043. Class Foundry | embedded || load balancer
  6044. TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U)
  6045. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  6046. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6047. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6048. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6049. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6050. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6051. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6052. PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  6053.  
  6054. Fingerprint Foundry Networks Biglron 8000 load balancer
  6055. Class Foundry | embedded || load balancer
  6056. TSeq(Class=RI%gcd=<6%SI=<4C464&>294%IPID=I%TS=U)
  6057. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  6058. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6059. T3(Resp=N)
  6060. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6061. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6062. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6063. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6064. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6065.  
  6066. Fingerprint Foundry FastIronII 4000 load balancer running 06.6.34T43
  6067. Class Foundry | IronWare || load balancer
  6068. TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U)
  6069. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  6070. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6071. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6072. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6073. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6074. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6075. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6076. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6077.  
  6078. Fingerprint Foundry NetIron load balancer OS Ver. 7.1.23T13
  6079. Class Foundry | IronWare || load balancer
  6080. TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U)
  6081. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  6082. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6083. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6084. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6085. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6086. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6087. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6088. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6089.  
  6090. Fingerprint Foundry Networks, Inc. Router/Load balancer, IronWare Version 06.5.12T43
  6091. Class Foundry | IronWare || load balancer
  6092. TSeq(Class=C)
  6093. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M)
  6094. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  6095. T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  6096. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  6097. T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  6098. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  6099. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  6100. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6101.  
  6102. Fingerprint Foundry ServerIron XL load balancing IP Switch Version 06.0.00T12
  6103. Class Foundry | IronWare || load balancer
  6104. TSeq(Class=C)
  6105. T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M)
  6106. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  6107. T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  6108. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  6109. T5(Resp=N)
  6110. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  6111. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  6112. PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  6113.  
  6114. Fingerprint FreeBSD 2.1.0 - 2.1.5
  6115. Class FreeBSD | FreeBSD | 2.X | general purpose
  6116. TSeq(Class=64K)
  6117. T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
  6118. T2(Resp=N)
  6119. T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT)
  6120. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  6121. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6122. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6123. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6124. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6125.  
  6126. Fingerprint FreeBSD 2.2.1 - 4.1
  6127. Class FreeBSD | FreeBSD | 2.X | general purpose
  6128. Class FreeBSD | FreeBSD | 3.X | general purpose
  6129. Class FreeBSD | FreeBSD | 4.X | general purpose
  6130. TSeq(Class=RI%gcd=<8%SI=<38E50&>906)
  6131. T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  6132. T2(Resp=N)
  6133. T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M)
  6134. T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
  6135. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6136. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6137. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6138. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E)
  6139.  
  6140. Fingerprint FreeBSD 2.2.1-STABLE
  6141. Class FreeBSD | FreeBSD | 2.X | general purpose
  6142. TSeq(Class=RI%gcd=<8%SI=<74A54&>1295)
  6143. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6144. T2(Resp=N)
  6145. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6146. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6147. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6148. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6149. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6150. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  6151.  
  6152. Fingerprint FreeBSD 3.2-4.0
  6153. Class FreeBSD | FreeBSD | 3.X | general purpose
  6154. Class FreeBSD | FreeBSD | 4.X | general purpose
  6155. TSeq(Class=RI%gcd=<6%SI=<92D42&>1769)
  6156. T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M)
  6157. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6158. T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  6159. T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=)
  6160. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6161. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6162. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6163. PU(Resp=N)
  6164.  
  6165. Fingerprint FreeBSD 3.4-RELEASE
  6166. Class FreeBSD | FreeBSD | 3.X | general purpose
  6167. TSeq(Class=RI%gcd=<6%SI=<58AD4&>3BB)
  6168. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6169. T2(Resp=N)
  6170. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6171. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6172. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6173. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6174. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6175. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6176.  
  6177. Fingerprint FreeBSD 4.0-20000208-CURRENT
  6178. Class FreeBSD | FreeBSD | 4.X | general purpose
  6179. TSeq(Class=RI%gcd=<6%SI=<63074&>FC4)
  6180. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6181. T2(Resp=N)
  6182. T3(Resp=N)
  6183. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6184. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6185. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6186. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6187. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6188.  
  6189. Fingerprint FreeBSD 4.1.1 - 4.3 (x86)
  6190. Class FreeBSD | FreeBSD | 4.X | general purpose
  6191. TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U)
  6192. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6193. T2(Resp=N)
  6194. T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6195. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6196. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6197. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6198. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6199. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6200.  
  6201. Fingerprint FreeBSD 4.10-STABLE
  6202. Class FreeBSD | FreeBSD | 4.X | general purpose
  6203. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=M)
  6204. T2(Resp=N)
  6205. T3(Resp=N)
  6206. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6207. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6208. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6209. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6210. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6211.  
  6212. # FreeBSD 4.3-RC
  6213. # FreeBSD 4.2-RELEASE i386
  6214. Fingerprint FreeBSD 4.2 - 4.3-RC (X86)
  6215. Class FreeBSD | FreeBSD | 4.X | general purpose
  6216. TSeq(Class=RI%gcd=<6%SI=<B23B8&>CD3%IPID=I%TS=100HZ)
  6217. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6218. T2(Resp=N)
  6219. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6220. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6221. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6222. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6223. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6224. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6225.  
  6226. Fingerprint FreeBSD 4.3 - 4.4-RELEASE
  6227. Class FreeBSD | FreeBSD | 4.X | general purpose
  6228. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6229. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6230. T2(Resp=N)
  6231. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6232. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6233. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6234. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6235. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6236. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  6237.  
  6238. Fingerprint FreeBSD 4.3 - 4.4PRERELEASE
  6239. Class FreeBSD | FreeBSD | 4.X | general purpose
  6240. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  6241. T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6242. T2(Resp=N)
  6243. T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6244. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6245. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6246. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6247. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6248. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  6249.  
  6250. Fingerprint FreeBSD 4.4 for i386 (IA-32)
  6251. Class FreeBSD | FreeBSD | 4.X | general purpose
  6252. TSeq(Class=TR%gcd=<6)
  6253. T1(DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  6254. T2(Resp=N)
  6255. T3(Resp=Y%DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  6256. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6257. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6258. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6259. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6260. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6261.  
  6262. Fingerprint FreeBSD 4.4-5 or Apple Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13)
  6263. Class FreeBSD | FreeBSD | 4.X | general purpose
  6264. Class Apple | Mac OS X | 10.0.X | general purpose
  6265. TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ)
  6266. T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  6267. T2(Resp=N)
  6268. T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT)
  6269. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6270. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6271. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6272. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6273. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6274.  
  6275. # FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002
  6276. Fingerprint FreeBSD 4.4-STABLE
  6277. Class FreeBSD | FreeBSD | 4.X | general purpose
  6278. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  6279. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6280. T2(Resp=N)
  6281. T3(Resp=N)
  6282. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6283. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6284. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6285. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6286. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6287.  
  6288. # FreeBSD 4.5-RELEASE (or -STABLE) (x86)
  6289. # FreeBSD 4.6-RC
  6290. Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) through 4.6-RC (x86)
  6291. Class FreeBSD | FreeBSD | 4.X | general purpose
  6292. TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
  6293. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6294. T2(Resp=N)
  6295. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6296. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6297. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6298. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6299. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6300. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6301.  
  6302. Fingerprint FreeBSD 4.6
  6303. Class FreeBSD | FreeBSD | 4.X | general purpose
  6304. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  6305. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6306. T2(Resp=N)
  6307. T3(Resp=N)
  6308. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6309. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6310. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6311. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6312. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6313.  
  6314. Fingerprint FreeBSD 4.6
  6315. Class FreeBSD | FreeBSD | 4.X | general purpose
  6316. TSeq(Class=RI%gcd=<6%SI=<8AAA2&>96A%IPID=I%TS=U)
  6317. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6318. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  6319. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  6320. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  6321. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6322. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  6323. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  6324. PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6325.  
  6326. # 4.6-RELEASE
  6327. # 4.6-STABLE
  6328. # 4.6.2-RELEASE-p6
  6329. Fingerprint FreeBSD 4.6 through 4.6.2 (July 2002) (x86)
  6330. Class FreeBSD | FreeBSD | 4.X | general purpose
  6331. TSeq(Class=TR%IPID=I%TS=100HZ)
  6332. T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6333. T2(Resp=N)
  6334. T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6335. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6336. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6337. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6338. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6339. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6340.  
  6341. Fingerprint FreeBSD 4.6-RC on Alpha
  6342. Class FreeBSD | FreeBSD | 4.X | general purpose
  6343. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  6344. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6345. T2(Resp=N)
  6346. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6347. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6348. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6349. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6350. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6351. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6352.  
  6353. Fingerprint FreeBSD 4.6.2-RELEASE
  6354. Class FreeBSD | FreeBSD | 4.X | general purpose
  6355. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  6356. T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6357. T2(Resp=N)
  6358. T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6359. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6360. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6361. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6362. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6363. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6364.  
  6365. # FreeBSD 4.8-RELEASE
  6366. # 4.7-STABLE FreeBSD 4.7-STABLE #0: Tue Nov 19 16:13:55 2002
  6367. Fingerprint FreeBSD 4.6.2-RELEASE - 4.8-RELEASE
  6368. Class FreeBSD | FreeBSD | 4.X | general purpose
  6369. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  6370. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6371. T2(Resp=N)
  6372. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6373. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6374. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6375. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6376. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6377. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6378.  
  6379. # FreeBSD 4.7-RELEASE
  6380. # FreeBSD 4.8-RELEASE-p13
  6381. Fingerprint FreeBSD 4.7 - 4.8-RELEASE
  6382. Class FreeBSD | FreeBSD | 4.X | general purpose
  6383. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  6384. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6385. T2(Resp=N)
  6386. T3(Resp=N)
  6387. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6388. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6389. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6390. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6391. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6392.  
  6393. # FreeBSD 4.7-RELEASE-p3 FreeBSD 4.7-RELEASE-p3 #0: Wed Jan 8 21:31:21 CET 2003 i386
  6394. Fingerprint FreeBSD 4.7-RELEASE
  6395. Class FreeBSD | FreeBSD | 4.X | general purpose
  6396. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  6397. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6398. T2(Resp=N)
  6399. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6400. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6401. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6402. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6403. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6404. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6405.  
  6406. Fingerprint FreeBSD 4.7-RELEASE through 4.8-RELEASE (x86)
  6407. Class FreeBSD | FreeBSD | 4.X | general purpose
  6408. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6409. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
  6410. T2(Resp=N)
  6411. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
  6412. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6413. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6414. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6415. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6416. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6417.  
  6418. # FreeBSD 4.7-RELEASE-p3 on i386
  6419. Fingerprint FreeBSD 4.7-RELEASE-p3
  6420. Class FreeBSD | FreeBSD | 4.X | general purpose
  6421. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  6422. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6423. T2(Resp=N)
  6424. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6425. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6426. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6427. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6428. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6429. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6430.  
  6431. # FreeBSD 4.7-STABLE (Jan 2003)
  6432. Fingerprint FreeBSD 4.7-STABLE
  6433. Class FreeBSD | FreeBSD | 4.X | general purpose
  6434. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  6435. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M)
  6436. T2(Resp=N)
  6437. T3(Resp=N)
  6438. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6439. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6440. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6441. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6442. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6443.  
  6444. # FreeBSD 4.9-PRERELEASE alpha
  6445. # FreeBSD 4.8-RELEASE on DEC Alpha
  6446. # FreeBSD 4.9-STABLE (platform unspecified)
  6447. Fingerprint FreeBSD 4.8-RELEASE through 4.9-STABLE
  6448. Class FreeBSD | FreeBSD | 4.X | general purpose
  6449. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  6450. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6451. T2(Resp=N)
  6452. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6453. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6454. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6455. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6456. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6457. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6458.  
  6459. # FreeBSD 4.8-STABLE (June 2003)
  6460. Fingerprint FreeBSD 4.8-STABLE
  6461. Class FreeBSD | FreeBSD | 4.X | general purpose
  6462. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|1000HZ)
  6463. T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  6464. T2(Resp=N)
  6465. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6466. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6467. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6468. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6469. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6470. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6471.  
  6472. # FreeBSD 4.8-STABLE (June 2003)
  6473. Fingerprint FreeBSD 4.8-STABLE
  6474. Class FreeBSD | FreeBSD | 4.X | general purpose
  6475. T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  6476. T2(Resp=N)
  6477. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6478. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6479. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6480. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6481. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6482. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6483.  
  6484. Fingerprint FreeBSD 4.8-STABLE - 4.9-PRERELEASE
  6485. Class FreeBSD | FreeBSD | 4.X | general purpose
  6486. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  6487. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6488. T2(Resp=N)
  6489. T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6490. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6491. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6492. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6493. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6494. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6495.  
  6496. # FreeBSD 5.0-RELEASE x86
  6497. # sparc64 running FreeBSD 5.1-RELEASE
  6498. # FreeBSD 4.9-STABLE FreeBSD 4.9-STABLE  i386
  6499. Fingerprint FreeBSD 4.9 - 5.1
  6500. Class FreeBSD | FreeBSD | 4.X | general purpose
  6501. Class FreeBSD | FreeBSD | 5.X | general purpose
  6502. TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ)
  6503. T1(DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6504. T2(Resp=N)
  6505. T3(Resp=Y%DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6506. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6507. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6508. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6509. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6510. PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6511.  
  6512. #  FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002
  6513. Fingerprint FreeBSD 5.0-CURRENT (Apr 2002)
  6514. Class FreeBSD | FreeBSD | 5.X | general purpose
  6515. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  6516. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6517. T2(Resp=N)
  6518. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6519. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6520. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6521. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6522. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6523. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6524.  
  6525. Fingerprint FreeBSD 5.0-RELEASE
  6526. Class FreeBSD | FreeBSD | 5.X | general purpose
  6527. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6528. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  6529. T2(Resp=N)
  6530. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  6531. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6532. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6533. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6534. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6535. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6536.  
  6537. Fingerprint FreeBSD 5.0-RELEASE
  6538. Class FreeBSD | FreeBSD | 5.X | general purpose
  6539. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  6540. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6541. T2(Resp=N)
  6542. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6543. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6544. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6545. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6546. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6547. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6548.  
  6549. # FreeBSD somehost.someplace 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Jan 29 12:31:51 CST 2003 i386
  6550. # FreeBSD 5.0-RELEASE Alpha
  6551. Fingerprint FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003)
  6552. Class FreeBSD | FreeBSD | 5.X | general purpose
  6553. TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ)
  6554. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6555. T2(Resp=N)
  6556. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6557. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6558. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6559. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6560. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6561. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6562.  
  6563. Fingerprint FreeBSD 5.1-CURRENT (June 2003) on Sparc64
  6564. Class FreeBSD | FreeBSD | 5.X | general purpose
  6565. TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
  6566. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6567. T2(Resp=N)
  6568. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6569. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6570. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6571. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6572. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6573. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6574.  
  6575. Fingerprint FreeBSD 5.1-RELEASE (x86)
  6576. Class FreeBSD | FreeBSD | 5.X | general purpose
  6577. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  6578. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6579. T2(Resp=N)
  6580. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6581. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6582. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6583. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6584. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6585. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6586.  
  6587. Fingerprint FreeBSD 5.2-CURRENT (Jan 2004) on x86
  6588. Class FreeBSD | FreeBSD | 5.X | general purpose
  6589. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6590. T2(Resp=N)
  6591. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6592. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6593. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6594. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6595. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6596. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6597.  
  6598. # FreeBSD 5.2-CURRENT (Jun 25, 2004) on x86 running pf as firewall with "scrub in all"
  6599. # FreeBSD 5.3-Beta2 (x86)
  6600. Fingerprint FreeBSD 5.2-CURRENT - 5.3-BETA2 (x86) with pf scrub all
  6601. Class FreeBSD | FreeBSD | 5.X | general purpose
  6602. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  6603. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6604. T2(Resp=N)
  6605. T3(Resp=N)
  6606. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6607. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6608. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6609. T7(Resp=N)
  6610. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6611.  
  6612. # FreeBSD 5.2.1 running on Ultra5 spac64
  6613. Fingerprint FreeBSD 5.2.1 (SPARC)
  6614. Class FreeBSD | FreeBSD | 5.X | general purpose
  6615. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6616. T2(Resp=N)
  6617. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  6618. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6619. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6620. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6621. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6622. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6623.  
  6624. Fingerprint FreeSCO 0.27 (Linux 2.0.38)
  6625. Class FreeSCO | Linux | 2.0.X | router
  6626. TSeq(Class=RI%gcd=<6%SI=<1F22A6E&>4E0A2%IPID=Z%TS=100HZ)
  6627. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  6628. T2(Resp=N)
  6629. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  6630. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6631. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6632. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6633. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6634. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6635.  
  6636. Fingerprint FreeSCO 0.27 (Linux 2.0.38)
  6637. Class FreeSCO | Linux | 2.0.X | router
  6638. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  6639. T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
  6640. T2(Resp=N)
  6641. T3(Resp=N)
  6642. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6643. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6644. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6645. T7(Resp=N)
  6646. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6647.  
  6648. Fingerprint Galacticomm WorldGroup BBS (MajorBBS) w/TCP/IP
  6649. Class Galacticomm | WorldGroup || BBS
  6650. TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&<BBBBBB)
  6651. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  6652. T2(Resp=N)
  6653. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  6654. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6655. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6656. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6657. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6658. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  6659.  
  6660. Fingerprint Galacticomm WorldGroup BBS / Vircom TCP/IP stack
  6661. Class Galacticomm | WorldGroup || BBS
  6662. TSeq(Class=C)
  6663. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  6664. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6665. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  6666. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6667. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6668. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6669. T7(Resp=N)
  6670. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6671.  
  6672. Fingerprint Gandalf LanLine Router
  6673. Class Gandalf | embedded || router
  6674. TSeq(Class=TD%gcd=<714%SI=<14)
  6675. T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  6676. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6677. T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M)
  6678. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  6679. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6680. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  6681. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6682. PU(Resp=N)
  6683.  
  6684. Fingerprint Gauntlet 4.0a firewall on Solaris 2.5.1
  6685. Class Gauntlet | Solaris | 2.5.X | firewall
  6686. TSeq(Class=RI%gcd=<6%SI=<10540A&>89C%IPID=I%TS=U)
  6687. T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME)
  6688. T2(Resp=N)
  6689. T3(Resp=N)
  6690. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6691. T5(Resp=N)
  6692. T6(Resp=N)
  6693. T7(Resp=N)
  6694. PU(Resp=N)
  6695.  
  6696. Fingerprint Genius print server
  6697. Class Genius | embedded || print server
  6698. T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
  6699. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6700. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  6701. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  6702. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6703. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  6704. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6705. PU(Resp=N)
  6706.  
  6707. Fingerprint Gnat Box Light firewall v3.0.3 (from the inside interface)
  6708. Class Global Technology Associates | embedded || firewall
  6709. TSeq(Class=RI%gcd=<6%SI=<F708&>264)
  6710. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6711. T2(Resp=N)
  6712. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6713. T4(Resp=N)
  6714. T5(Resp=N)
  6715. T6(Resp=N)
  6716. T7(Resp=N)
  6717. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  6718.  
  6719. # GNet BB0040 DSL router
  6720. # SAR-703 Combined ADSL Modem/Router
  6721. Fingerprint GNet BB0040 or SAR 703 DSL modem + router
  6722. Class GNet | embedded || broadband router
  6723. Class SAR | embedded || broadband router
  6724. TSeq(Class=TD%gcd=<EA64%SI=<1E%IPID=I%TS=U)
  6725. T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  6726. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6727. T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M)
  6728. T4(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  6729. T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  6730. T6(DF=Y%W=0%ACK=S%Flags=R%Ops=)
  6731. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6732. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  6733.  
  6734. Fingerprint GNU Hurd 0.2 (GNUmach-1.2/Hurd-0.2) x86
  6735. Class GNU | Hurd || general purpose
  6736. TSeq(Class=TD|i800%gcd=<3000%SI=<1E%IPID=I%TS=100HZ)
  6737. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  6738. T2(Resp=N)
  6739. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  6740. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6741. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6742. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6743. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6744. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6745.  
  6746. Fingerprint Grandstream HT-286 POTS<->VoIP phone gateway device
  6747. Class Grandstream | embedded || VoIP adapter
  6748. TSeq(Class=C%Val=66559055%IPID=I%TS=U)
  6749. T1(Resp=N)
  6750. T2(Resp=Y%DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
  6751. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  6752. T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
  6753. T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=)
  6754. T6(DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=)
  6755. T7(DF=Y%W=400%ACK=S++%Flags=AR%Ops=)
  6756. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6757.  
  6758. Fingerprint Grandstream IP Phone
  6759. Class GrandStream | embedded || VoIP phone
  6760. TSeq(Class=C%IPID=I%TS=U)
  6761. T1(Resp=N)
  6762. T2(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
  6763. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  6764. T4(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
  6765. T5(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=)
  6766. T6(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=)
  6767. T7(DF=Y%W=C00%ACK=S++%Flags=AR%Ops=)
  6768. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6769.  
  6770. Fingerprint GrandStream IP Phone (BudgeTone-100)
  6771. Class GrandStream | embedded || VoIP phone
  6772. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  6773. T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=)
  6774. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  6775. T4(DF=Y%W=1000|C00%ACK=S++%Flags=AR%Ops=)
  6776. T5(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=)
  6777. T6(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  6778. T7(DF=Y%W=800|C00|400%ACK=S++%Flags=AR%Ops=)
  6779. PU(Resp=N)
  6780.  
  6781. Fingerprint Grandstream.com BudgeTone 101 IP Phone
  6782. Class GrandStream | embedded || VoIP phone
  6783. TSeq(Class=C%IPID=I%TS=U)
  6784. T1(Resp=N)
  6785. T2(Resp=Y%DF=Y%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
  6786. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M)
  6787. T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=)
  6788. T5(DF=Y%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
  6789. T6(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=)
  6790. T7(DF=Y%W=C00|800|1000%ACK=S++%Flags=AR%Ops=)
  6791. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6792.  
  6793. Fingerprint PalmOS 5.2.1 on Handspring Treo
  6794. Class Handspring | PalmOS | 5.X | PDA
  6795. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  6796. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6797. T2(Resp=N)
  6798. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  6799. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  6800. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6801. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  6802. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  6803. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  6804.  
  6805. # Hawking PS12U Embedded Print Server  (Firmware Version :    6.09.17H (2003/04/18 16:55:07)
  6806. Fingerprint Hawking PS12U Embedded Print Server
  6807. Class Hawking | embedded || print server
  6808. TSeq(Class=TD%gcd=78000|F0000%SI=<14%IPID=I%TS=U)
  6809. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  6810. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6811. T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  6812. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6813. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6814. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6815. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6816. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6817.  
  6818. # Zero One Tech. Print Server 3000
  6819. # Hawking Print Server PN7117
  6820. # Zero One Tech Printserver ZOT-PS-11 (firmware 5.4.2049)
  6821. # EUSSO Technologies UPS1211-B print server
  6822. Fingerprint Print Server: Zero One Tech 3000, Hawking PN7117, or EUSSO UPS1211-B
  6823. Class Hawking | embedded || print server
  6824. Class Zero One | embedded || print server
  6825. Class EUSSO | embedded || print server
  6826. TSeq(Class=TD%gcd=<C004%SI=<1E%IPID=I%TS=U)
  6827. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  6828. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6829. T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  6830. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6831. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6832. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6833. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6834. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6835.  
  6836. Fingerprint Hitachi HI-UX/MPP
  6837. Class Hitachi | HI-UX || general purpose
  6838. TSeq(Class=64K)
  6839. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=MNNTWL)
  6840. T2(Resp=N)
  6841. T3(Resp=Y%DF=N%W=FF5E%ACK=O%Flags=A%Ops=NNT)
  6842. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6843. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6844. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6845. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6846. PU(TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  6847.  
  6848. # Don't ask me what this is :)  David says
  6849. # it is "a Utah port of BSD to HP machines"
  6850. Fingerprint HP-BSD 2.0
  6851. Class HP | BSD-misc || general purpose
  6852. TSeq(Class=64K)
  6853. T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  6854. T2(Resp=N)
  6855. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  6856. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6857. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6858. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  6859. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6860. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6861.  
  6862. Fingerprint HP Procurve Routing Switch 9304M
  6863. Class HP | embedded || load balancer
  6864. TSeq(Class=C)
  6865. T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=M)
  6866. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  6867. T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  6868. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  6869. T5(Resp=N)
  6870. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  6871. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  6872. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6873.  
  6874. # HP LaserJet 1300N with JetDirect 200m LIO card
  6875. Fingerprint HP printer w/JetDirect card
  6876. Class HP | embedded || print server
  6877. TSeq(Class=RI%gcd=<6%SI=<8C9B0&>1295%IPID=I%TS=2HZ)
  6878. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  6879. T2(Resp=N)
  6880. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  6881. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  6882. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6883. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6884. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6885. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6886.  
  6887. Fingerprint HP Deskjet 6127 printer
  6888. Class HP | embedded || printer
  6889. TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ)
  6890. T1(DF=N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
  6891. T2(Resp=N)
  6892. T3(Resp=Y%DF=N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT)
  6893. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6894. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6895. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6896. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6897. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6898.  
  6899. # HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550
  6900. # HP LaserJet 2200 with JetDirect (J6057A)
  6901. Fingerprint HP JetDirect Card in a LaserJet printer
  6902. Class HP | embedded || printer
  6903. TSeq(Class=64K%IPID=I%TS=U)
  6904. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW)
  6905. T2(Resp=N)
  6906. T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=)
  6907. T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=)
  6908. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6909. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6910. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6911. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6912.  
  6913. Fingerprint HP LaserJet 4000N Printer
  6914. Class HP | embedded || printer
  6915. TSeq(Class=TD%gcd=<6%SI=<1E)
  6916. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  6917. T2(Resp=N)
  6918. T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  6919. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6920. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6921. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6922. T7(Resp=N)
  6923. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6924.  
  6925. Fingerprint HP LaserJet 4100N printer
  6926. Class HP | embedded || printer
  6927. TSeq(Class=64K%IPID=I%TS=U)
  6928. T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=MNW)
  6929. T2(Resp=N)
  6930. T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=A%Ops=)
  6931. T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
  6932. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6933. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  6934. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6935. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  6936.  
  6937. Fingerprint HP LaserJet 5
  6938. Class HP | embedded || printer
  6939. TSeq(Class=TD%gcd=<6%SI=<FF)
  6940. T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M)
  6941. T2(Resp=N)
  6942. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6943. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6944. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6945. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6946. T7(Resp=N)
  6947. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  6948.  
  6949. # 2100 Series, 4000 TN, 4000 PS, 8000 DN
  6950. Fingerprint HP LaserJet printer/print server
  6951. Class HP | embedded || printer
  6952. Class HP | embedded || print server
  6953. TSeq(Class=TD%gcd=<6%SI=<100)
  6954. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  6955. T2(Resp=N)
  6956. T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS%Ops=M)
  6957. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6958. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6959. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6960. T7(Resp=N)
  6961. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6962.  
  6963. # Jet Direct Model J3113A, Firmware Rev G.07.20
  6964. # HP Color LaserJet 4500N, Jet Direct J3113A/2100
  6965. Fingerprint HP printer w/Jet Direct
  6966. Class HP | embedded || printer
  6967. T1(DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=M|)
  6968. T2(Resp=N)
  6969. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6970. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6971. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6972. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6973. T7(Resp=N)
  6974. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  6975.  
  6976. # HP JetDirect printer/print server
  6977. # HP JetDirect J3111A, firmware G.05.35
  6978. Fingerprint HP printer w/JetDirect card
  6979. Class HP | embedded || printer
  6980. TSeq(Class=TD%gcd=<6%SI=<1E)
  6981. T1(DF=N%W=16D0|C90%ACK=S++%Flags=AS%Ops=M)
  6982. T2(Resp=N)
  6983. T3(Resp=Y%DF=N%W=16D0|0%ACK=S++%Flags=AS|AR%Ops=|M)
  6984. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6985. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6986. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6987. T7(Resp=N)
  6988. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|F%UCK=E%ULEN=134%DAT=E)
  6989.  
  6990. Fingerprint HP printer w/JetDirect card
  6991. Class HP | embedded || printer
  6992. TSeq(Class=TD%gcd=<10%SI=<14%IPID=I%TS=U)
  6993. T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
  6994. T2(Resp=N)
  6995. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6996. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6997. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  6998. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  6999. T7(Resp=N)
  7000. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7001.  
  7002. Fingerprint HP printer w/JetDirect card
  7003. Class HP | embedded || printer
  7004. TSeq(Class=TD%gcd=<6%SI=<F)
  7005. T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
  7006. T2(Resp=N)
  7007. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7008. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7009. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7010. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7011. T7(Resp=N)
  7012. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7013.  
  7014. # HP printer w/JetDirect card (Firmware Rev. H.06.00)
  7015. Fingerprint HP printer w/JetDirect card
  7016. Class HP | embedded || printer
  7017. TSeq(Class=TD%gcd=<8%SI=<14)
  7018. T1(DF=N%W=860|16D0%ACK=S++%Flags=AS%Ops=M)
  7019. T2(Resp=N)
  7020. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7021. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7022. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7023. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7024. T7(Resp=N)
  7025. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7026.  
  7027. # JetDirect J6057A, firmware R.24.06, connected to an HP 2200 printer
  7028. # JetDirect 610n (Model J4169A) firmware L.24.06
  7029. # HP Color LaserJet 4600 Model Number: J6057A Firmware Rev: R.25.09
  7030. Fingerprint HP printer w/JetDirect card
  7031. Class HP | embedded || printer
  7032. TSeq(Class=RI%gcd=<6%SI=<AF762&>9E9%IPID=I%TS=2HZ)
  7033. T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
  7034. T2(Resp=N)
  7035. T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT)
  7036. T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=)
  7037. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7038. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7039. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7040. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7041.  
  7042. # HP JetDirect J6057A Firmware Version R.22.09 in 4100mpf printer
  7043. Fingerprint HP printer w/JetDirect card
  7044. Class HP | embedded || printer
  7045. TSeq(Class=64K%IPID=I%TS=U)
  7046. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  7047. T2(Resp=N)
  7048. T3(Resp=Y%DF=N%W=16D0%ACK=O%Flags=A%Ops=)
  7049. T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
  7050. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7051. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7052. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7053. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7054.  
  7055. # This is a HP 5si printer with a JetDirect Ethernet card model# J2556b Firmware A.05.32
  7056. Fingerprint HP printer w/JetDirect J2556b card (firmware A.05.32)
  7057. Class HP | embedded || printer
  7058. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7059. T2(Resp=N)
  7060. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7061. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7062. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7063. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7064. T7(Resp=N)
  7065. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7066.  
  7067. Fingerprint HP printer w/JetDirect J2556b card firmware A.05.32
  7068. Class HP | embedded || printer
  7069. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7070. T2(Resp=N)
  7071. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7072. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7073. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7074. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7075. T7(Resp=N)
  7076. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7077.  
  7078. # HP iLO (Integrated Lights Out) Firmware Version 1.20 (12/04/2002)
  7079. Fingerprint HP Integrated Lights Out remote configuration Board
  7080. Class HP | embedded || remote management
  7081. TSeq(Class=TD%gcd=<A0%SI=<1E%IPID=I%TS=U)
  7082. T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  7083. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  7084. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  7085. T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  7086. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  7087. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  7088. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  7089. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7090.  
  7091. # HP Router 210 with OS 9.72
  7092. # Netgear RP114 DSL-Router with 4-Port Switch
  7093. Fingerprint HP Advancestack Etherswitch 224T or 210 or Netgear RP114 DSL-Router w/Switch
  7094. Class HP | embedded || switch
  7095. Class Netgear | embedded || broadband router
  7096. TSeq(Class=TD%SI=<20)
  7097. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  7098. T2(Resp=N)
  7099. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  7100. T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
  7101. T5(DF=N%W=400%ACK=O%Flags=R%Ops=)
  7102. T6(DF=N%W=400%ACK=O%Flags=R%Ops=)
  7103. T7(DF=N%W=400%ACK=O%Flags=R%Ops=)
  7104. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7105.  
  7106. Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2
  7107. Class HP | HP-UX | 10.X | general purpose
  7108. TSeq(Class=RI%gcd=<6%SI=<18000)
  7109. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  7110. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7111. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  7112. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7113. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7114. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7115. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7116. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7117.  
  7118. Fingerprint HP-UX 10.20 A 9000/715 or 9000/899
  7119. Class HP | HP-UX | 10.X | general purpose
  7120. TSeq(Class=64K)
  7121. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M)
  7122. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7123. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  7124. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7125. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7126. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7127. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7128. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7129.  
  7130. Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0
  7131. Class HP | HP-UX | 10.X | general purpose
  7132. TSeq(Class=64K)
  7133. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  7134. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7135. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  7136. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7137. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7138. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7139. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7140. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7141.  
  7142. # XXX: It crashed the machine again, but I got a full
  7143. # scan this time.
  7144. Fingerprint HP-UX B.10.01 A 9000/715
  7145. Class HP | HP-UX | 10.X | general purpose
  7146. TSeq(Class=64K|TR)
  7147. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  7148. T2(Resp=N)
  7149. T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=)
  7150. T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=)
  7151. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7152. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7153. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7154. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7155.  
  7156. Fingerprint HP-UX B.10.20 9000/897
  7157. Class HP | HP-UX | 10.X | general purpose
  7158. TSeq(Class=64K)
  7159. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  7160. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7161. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  7162. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7163. T5(Resp=N)
  7164. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7165. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7166. PU(Resp=N)
  7167.  
  7168. Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1
  7169. Class HP | HP-UX | 10.X | general purpose
  7170. TSeq(Class=RI%gcd=<6%SI=<18000)
  7171. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  7172. T2(Resp=N)
  7173. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  7174. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  7175. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7176. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7177. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7178. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7179.  
  7180. Fingerprint HP-UX B.10.20 A 9000/750
  7181. Class HP | HP-UX | 10.X | general purpose
  7182. TSeq(Class=64K%IPID=I%TS=U)
  7183. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  7184. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  7185. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  7186. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  7187. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7188. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL)
  7189. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  7190. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7191.  
  7192. # HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0
  7193. Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0
  7194. Class HP | HP-UX | 10.X | general purpose
  7195. TSeq(Class=64K)
  7196. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  7197. T2(Resp=N)
  7198. T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=)
  7199. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  7200. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7201. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7202. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7203. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7204.  
  7205. Fingerprint HP-UX release B.10.20 version A
  7206. Class HP | HP-UX | 10.X | general purpose
  7207. TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
  7208. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  7209. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7210. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7211. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7212. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7213. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7214. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7215. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7216.  
  7217. # HP-UX B.11.00
  7218. # HP-UX B.11.11
  7219. Fingerprint HP-UX 11
  7220. Class HP | HP-UX | 11.X | general purpose
  7221. TSeq(Class=RI%gcd=<6%SI=<A7B0C&>C6E%IPID=I%TS=100HZ)
  7222. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7223. T2(Resp=N)
  7224. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7225. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7226. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7227. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7228. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7229. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7230.  
  7231. Fingerprint HP-UX 11 w/tcp_isn_passphrase
  7232. Class HP | HP-UX | 11.X | general purpose
  7233. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  7234. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7235. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7236. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7237. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7238. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7239. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7240. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7241. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7242.  
  7243. # This is a weird one
  7244. Fingerprint HP-UX 11.00
  7245. Class HP | HP-UX | 11.X | general purpose
  7246. TSeq(Class=TD%gcd=>20000%SI=<3)
  7247. T1(Resp=N)
  7248. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7249. T3(Resp=N)
  7250. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7251. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7252. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7253. T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7254. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7255.  
  7256. # HP-UX test01 B.11.11 U 9000/800 1277844053 unlimited-user license
  7257. Fingerprint HP-UX 11.11
  7258. Class HP | HP-UX | 11.X | general purpose
  7259. TSeq(Class=RI%gcd=<6%SI=<C7A6A&>ABA%IPID=I%TS=100HZ)
  7260. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7261. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7262. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7263. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7264. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7265. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7266. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7267. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7268.  
  7269. Fingerprint HP-UX B.11.00 A 9000/785
  7270. Class HP | HP-UX | 11.X | general purpose
  7271. TSeq(Class=RI%gcd=<6%SI=<B108A&>630%IPID=I%TS=100HZ)
  7272. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7273. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7274. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7275. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7276. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7277. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7278. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7279. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7280.  
  7281. Fingerprint HP-UX B.11.00 A 9000/800
  7282. Class HP | HP-UX | 11.X | general purpose
  7283. TSeq(Class=RI%gcd=<6%SI=<8E148&>846%IPID=I%TS=100HZ)
  7284. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7285. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7286. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7287. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7288. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7289. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7290. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  7291. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  7292.  
  7293. Fingerprint HP-UX B11.00 U 9000/839
  7294. Class HP | HP-UX | 11.X | general purpose
  7295. TSeq(Class=RI%gcd=<10%SI=<2114C&>536)
  7296. T1(Resp=N)
  7297. T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  7298. T3(Resp=N)
  7299. T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  7300. T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=)
  7301. T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=)
  7302. T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=)
  7303. PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7304.  
  7305. # HP9000 Model 804 K450 running HP-UX 11.00
  7306. # Mac OS9
  7307. Fingerprint Mac OS 9, or HP-UX 11.00
  7308. Class HP | HP-UX | 11.X | general purpose
  7309. Class Apple | Mac OS | 9.X | general purpose
  7310. TSeq(Class=RI%gcd=<6%SI=<4F254&>C95)
  7311. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7312. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7313. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT)
  7314. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7315. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7316. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7317. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7318. PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7319.  
  7320. # HP-UX 7.0 B 9000/375
  7321. Fingerprint HP-UX 7.0
  7322. Class HP | HP-UX | 7.X | general purpose
  7323. TSeq(Class=64K%IPID=I%TS=U)
  7324. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  7325. T2(Resp=N)
  7326. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  7327. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7328. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7329. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7330. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7331. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  7332.  
  7333. Fingerprint HP-UX 9.01 - 9.07
  7334. Class HP | HP-UX | 9.X | general purpose
  7335. TSeq(Class=64K)
  7336. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  7337. T2(Resp=N)
  7338. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  7339. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  7340. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7341. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7342. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7343. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7344.  
  7345. Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777
  7346. Class HP | HP-UX | 9.X | general purpose
  7347. TSeq(Class=64K)
  7348. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
  7349. T2(Resp=N)
  7350. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  7351. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  7352. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7353. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7354. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7355. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7356.  
  7357. Fingerprint HP MPE/iX 5.5
  7358. Class HP | MPE/iX || general purpose
  7359. TSeq(Class=TD%gcd=<6%SI=<14)
  7360. T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
  7361. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7362. T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M)
  7363. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7364. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7365. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7366. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7367. PU(Resp=N)
  7368.  
  7369. Fingerprint HP MPE/iX 5.5 on HP 3000
  7370. Class HP | MPE/iX || general purpose
  7371. TSeq(Class=TD%gcd=<6%SI=<1E%TS=U)
  7372. T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=M)
  7373. T2(Resp=N)
  7374. T3(Resp=Y%DF=N%W=6000%ACK=S++%Flags=AS%Ops=M)
  7375. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7376. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7377. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  7378. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  7379. PU(Resp=N)
  7380.  
  7381. Fingerprint HP Entria X station (running Netstation 7.x)
  7382. Class HP | Netstation || X terminal
  7383. TSeq(Class=64K)
  7384. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  7385. T2(Resp=N)
  7386. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  7387. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  7388. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7389. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7390. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7391. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7392.  
  7393. #  HPJ2600A Ethernet hub or HP ProCurve Switch 4000M
  7394. # Bay Networks MicroAnnex XL running firmware 10.0B
  7395. Fingerprint VxWorks 5.3.x bases system (usually an Ethernet hub or switch such as HP ProCurve) or Bay Networks MicroAnnex XL terminal server
  7396. Class HP | VxWorks || switch
  7397. Class Bay Networks | embedded || terminal server
  7398. TSeq(Class=64K)
  7399. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  7400. T2(Resp=N)
  7401. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  7402. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  7403. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7404. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7405. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7406. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7407.  
  7408. Fingerprint Huawei Quidway R2621 router running VRP 1.5.6(1)
  7409. Class Huawei | VRP || router
  7410. TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ)
  7411. T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
  7412. T2(Resp=N)
  7413. T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
  7414. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  7415. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7416. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7417. T7(Resp=N)
  7418. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7419.  
  7420. Fingerprint Huawei Quidway Router R2621E VRP 1.5.6
  7421. Class Huawei | VRP || router
  7422. TSeq(Class=TD%gcd=<1E806%SI=<14%IPID=I%TS=2HZ)
  7423. T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT)
  7424. T2(Resp=N)
  7425. T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT)
  7426. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  7427. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7428. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7429. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7430. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7431.  
  7432. Fingerprint Hydra HydraWEB 5000
  7433. Class Hydra | embedded || load balancer
  7434. TSeq(Class=RI%gcd=1|2|3|4%SI=<FFFF&>1111)
  7435. T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  7436. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7437. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  7438. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7439. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7440. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7441. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7442. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7443.  
  7444. Fingerprint IBM AIX 3.2
  7445. Class IBM | AIX | 3.X | general purpose
  7446. TSeq(Class=64K)
  7447. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  7448. T2(Resp=N)
  7449. T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
  7450. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7451. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7452. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7453. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7454. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7455.  
  7456. Fingerprint IBM AIX 3.2
  7457. Class IBM | AIX | 3.X | general purpose
  7458. TSeq(Class=64K)
  7459. T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M)
  7460. T2(Resp=N)
  7461. T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=)
  7462. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  7463. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7464. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7465. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7466. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7467.  
  7468. Fingerprint IBM AIX 3.2 running on RS/6000
  7469. Class IBM | AIX | 3.X | general purpose
  7470. TSeq(Class=64K)
  7471. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7472. T2(Resp=N)
  7473. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT)
  7474. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7475. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7476. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7477. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7478. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7479.  
  7480. Fingerprint IBM AIX 3.2.3 running on RS6000 model 560
  7481. Class IBM | AIX | 3.X | general purpose
  7482. TSeq(Class=64K)
  7483. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  7484. T2(Resp=N)
  7485. T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=)
  7486. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7487. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7488. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7489. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7490. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7491.  
  7492. Fingerprint IBM AIX 3.2.5 (Bull HardWare)
  7493. Class IBM | AIX | 3.X | general purpose
  7494. TSeq(Class=64K)
  7495. T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M)
  7496. T2(Resp=N)
  7497. T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=)
  7498. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7499. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7500. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7501. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7502. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7503.  
  7504. # IBM AIX v3.2.5 running on 8xPower-2 wide nodes
  7505. # Fingerprint IBM AIX Version 4
  7506. Fingerprint IBM AIX v3.2.5 - 4
  7507. Class IBM | AIX | 3.X | general purpose
  7508. TSeq(Class=TR%gcd=<6)
  7509. T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  7510. T2(Resp=N)
  7511. T3(Resp=N)
  7512. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7513. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7514. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7515. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7516. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7517.  
  7518. Fingerprint IBM AIX 4.0 - 4.2
  7519. Class IBM | AIX | 4.X | general purpose
  7520. TSeq(Class=64K)
  7521. T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M)
  7522. T2(Resp=N)
  7523. T3(Resp=N)
  7524. T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=)
  7525. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7526. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7527. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7528. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  7529.  
  7530. Fingerprint IBM AIX 4.02.0001.0000
  7531. Class IBM | AIX | 4.X | general purpose
  7532. TSeq(Class=TR)
  7533. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  7534. T2(Resp=N)
  7535. T3(Resp=N)
  7536. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7537. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7538. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7539. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7540. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  7541.  
  7542. Fingerprint IBM AIX 4.1
  7543. Class IBM | AIX | 4.X | general purpose
  7544. TSeq(Class=64K%gcd=<6%SI=<14)
  7545. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  7546. T2(Resp=N)
  7547. T3(Resp=N)
  7548. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7549. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7550. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7551. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7552. PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7553.  
  7554. Fingerprint IBM AIX 4.1-4.1.5
  7555. Class IBM | AIX | 4.X | general purpose
  7556. TSeq(Class=64K)
  7557. T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
  7558. T2(Resp=N)
  7559. T3(Resp=N)
  7560. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7561. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7562. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7563. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7564. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7565.  
  7566. Fingerprint IBM AIX 4.2
  7567. Class IBM | AIX | 4.X | general purpose
  7568. TSeq(Class=TR)
  7569. T1(DF=N%W=FFAF|FFFF%ACK=S++%Flags=AS%Ops=M)
  7570. T2(Resp=N)
  7571. T3(Resp=N)
  7572. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7573. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7574. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7575. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7576. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7577.  
  7578. Fingerprint IBM AIX 4.2-4.3.3
  7579. Class IBM | AIX | 4.X | general purpose
  7580. TSeq(Class=TR)
  7581. T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT)
  7582. T2(Resp=N)
  7583. T3(Resp=N)
  7584. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7585. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7586. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7587. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7588. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7589.  
  7590. Fingerprint IBM AIX 4.2.X-4.3.3.0
  7591. Class IBM | AIX | 4.X | general purpose
  7592. TSeq(Class=TR%IPID=I%TS=U)
  7593. T1(DF=N|Y%W=3F25%ACK=S++%Flags=AS%Ops=M)
  7594. T2(Resp=N)
  7595. T3(Resp=N)
  7596. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7597. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7598. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7599. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7600. PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7601.  
  7602. Fingerprint IBM AIX 4.3
  7603. Class IBM | AIX | 4.X | general purpose
  7604. TSeq(Class=TR%gcd=<6)
  7605. T1(DF=Y%W=5B4|F87%ACK=S++%Flags=AS%Ops=M)
  7606. T2(Resp=N)
  7607. T3(Resp=N)
  7608. T4(DF=N%W=1000|4000%ACK=O%Flags=R%Ops=)
  7609. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7610. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7611. T7(Resp=N)
  7612. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E)
  7613.  
  7614. Fingerprint IBM AIX 4.3.1 on a IBM RS/6000 R40
  7615. Class IBM | AIX | 4.X | general purpose
  7616. TSeq(Class=TR%gcd=<6%TS=U)
  7617. T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  7618. T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  7619. T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  7620. T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  7621. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7622. T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  7623. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  7624. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7625.  
  7626. # Fingerprint IBM AIX 4.3.3 on an RS/6000 H50
  7627. # Fingerprint IBM AIX 4.3.3 on a p660-6M1
  7628. # IBM AIX 4.3.3 ML10
  7629. Fingerprint IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/*
  7630. Class IBM | AIX | 4.X | general purpose
  7631. TSeq(Class=TR%gcd=<6)
  7632. T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  7633. T2(Resp=N)
  7634. T3(Resp=N)
  7635. T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=)
  7636. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7637. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7638. T7(Resp=N)
  7639. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0|F%UCK=0%ULEN=134%DAT=E)
  7640.  
  7641. # Fingerprint IBM-RS/6000 7017-S80, AIX Version 4.3.3.0
  7642. Fingerprint IBM AIX 4.3.3.0 on an IBM RS/*
  7643. Class IBM | AIX | 4.X | general purpose
  7644. TSeq(Class=TR%gcd=<6%TS=U)
  7645. T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M)
  7646. T2(Resp=N)
  7647. T3(Resp=N)
  7648. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7649. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7650. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7651. T7(Resp=N)
  7652. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7653.  
  7654. Fingerprint IBM AIX v4.1 running on a C10
  7655. Class IBM | AIX | 4.X | general purpose
  7656. TSeq(Class=64K)
  7657. T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  7658. T2(Resp=N)
  7659. T3(Resp=N)
  7660. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7661. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7662. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7663. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7664. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  7665.  
  7666. Fingerprint IBM AIX v4.2
  7667. Class IBM | AIX | 4.X | general purpose
  7668. TSeq(Class=TR%gcd=<6)
  7669. T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT)
  7670. T2(Resp=N)
  7671. T3(Resp=N)
  7672. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7673. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7674. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7675. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7676. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E)
  7677.  
  7678. Fingerprint IBM AIX Version 4.3
  7679. Class IBM | AIX | 4.X | general purpose
  7680. TSeq(Class=TR%gcd=<6)
  7681. T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M)
  7682. T2(Resp=N)
  7683. T3(Resp=N)
  7684. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7685. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7686. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7687. T7(Resp=N)
  7688. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  7689.  
  7690. Fingerprint IBM AIX 5.1
  7691. Class IBM | AIX | 5.X | general purpose
  7692. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7693. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7694. T2(Resp=N)
  7695. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7696. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7697. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7698. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7699. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7700. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7701.  
  7702. # Fingerprint IBM AIX 5.1.0.0 maintenance level 3
  7703. Fingerprint IBM AIX 5.1
  7704. Class IBM | AIX | 5.X | general purpose
  7705. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7706. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7707. T2(Resp=N)
  7708. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  7709. T4(DF=N%W=0|4000%ACK=O%Flags=R%Ops=)
  7710. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7711. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7712. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7713. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7714.  
  7715. # IBM AIX 5L 5.1
  7716. # IBM AIX 5.1 ML00
  7717. Fingerprint IBM AIX 5.1
  7718. Class IBM | AIX | 5.X | general purpose
  7719. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7720. T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
  7721. T2(Resp=N)
  7722. T3(Resp=Y%DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M)
  7723. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7724. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7725. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7726. T7(Resp=N)
  7727. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7728.  
  7729. Fingerprint IBM AIX 5.1
  7730. Class IBM | AIX | 5.X | general purpose
  7731. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7732. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M)
  7733. T2(Resp=N)
  7734. T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M)
  7735. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  7736. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7737. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7738. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7739. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7740.  
  7741. Fingerprint IBM AIX 5.1 - 5.2
  7742. Class IBM | AIX | 5.X | general purpose
  7743. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7744. T1(DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M)
  7745. T2(Resp=N)
  7746. T3(Resp=Y%DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M)
  7747. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7748. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7749. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7750. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7751. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7752.  
  7753. # IBM AIX 5.1 on pSeries LPAR
  7754. # AIX 2 5 000B8CDC4C00 IBM AIX 5.2L Update 2
  7755. Fingerprint IBM AIX 5.1 - 5.2
  7756. Class IBM | AIX | 5.X | general purpose
  7757. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  7758. T1(DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7759. T2(Resp=N)
  7760. T3(Resp=Y%DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  7761. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7762. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7763. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7764. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7765. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7766.  
  7767. Fingerprint IBM AIX 5.1 on a p610-6C1
  7768. Class IBM | AIX | 5.X | general purpose
  7769. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  7770. T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
  7771. T2(Resp=N)
  7772. T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT)
  7773. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7774. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7775. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7776. T7(Resp=N)
  7777. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7778.  
  7779. Fingerprint IBM AIX 5.1-5.2
  7780. Class IBM | AIX | 5.X | general purpose
  7781. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7782. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  7783. T2(Resp=N)
  7784. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  7785. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7786. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7787. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7788. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7789. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7790.  
  7791. # IBM AIX 5.2 (Maintenance Level 1) on RS/6000
  7792. Fingerprint IBM AIX 5.2 (on RS/6000)
  7793. Class IBM | AIX | 5.X | general purpose
  7794. TSeq(Class=TR%gcd=<6%TS=2HZ)
  7795. T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  7796. T2(Resp=N)
  7797. T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  7798. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7799. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7800. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7801. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7802. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7803.  
  7804. # AIX 5.2-003
  7805. Fingerprint IBM AIX 5.2.3
  7806. Class IBM | AIX | 5.X | general purpose
  7807. TSeq(Class=TR%gcd=<6%TS=2HZ)
  7808. T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  7809. T2(Resp=N)
  7810. T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT)
  7811. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7812. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7813. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7814. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7815. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  7816.  
  7817. Fingerprint IBM 8222 hub
  7818. Class IBM | embedded || hub
  7819. TSeq(Class=TD%gcd=<6%SI=<1A4%IPID=I%TS=U)
  7820. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  7821. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7822. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  7823. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7824. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7825. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7826. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7827. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7828.  
  7829. Fingerprint IBM 8239 Token-Ring Stackable Hub
  7830. Class IBM | embedded || hub
  7831. TSeq(Class=64K%IPID=I%TS=U)
  7832. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  7833. T2(Resp=N)
  7834. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  7835. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  7836. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7837. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7838. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7839. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7840.  
  7841. # Microplex M205 Pocket Print Server v5.7
  7842. # IBM 6400 Printer - Network Printer Server Version 7.0.9.6 [ network card ]
  7843. Fingerprint IBM 6400 printer or Microplex Pocket Print Server
  7844. Class IBM | embedded || printer
  7845. Class Microplex | embedded || print server
  7846. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  7847. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  7848. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7849. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  7850. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7851. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7852. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  7853. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7854. PU(Resp=N)
  7855.  
  7856. Fingerprint IBM Infoprint 12 Net-Printer
  7857. Class IBM | embedded || printer
  7858. TSeq(Class=64K%IPID=I%TS=U)
  7859. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  7860. T2(Resp=N)
  7861. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=)
  7862. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  7863. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7864. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7865. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7866. PU(Resp=N)
  7867.  
  7868. Fingerprint IBM Remote Supervisor Adapter II
  7869. Class IBM | embedded || remote management
  7870. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  7871. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  7872. T2(Resp=N)
  7873. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  7874. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  7875. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  7876. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  7877. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  7878. PU(Resp=N)
  7879.  
  7880. Fingerprint IBM 2210 router
  7881. Class IBM | embedded || router
  7882. TSeq(Class=TD%gcd=<6%SI=<F)
  7883. T1(DF=N%W=0|200%ACK=S++%Flags=AS%Ops=ML)
  7884. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7885. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7886. T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
  7887. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7888. T6(DF=N%W=0%ACK=S|O|S++%Flags=R%Ops=)
  7889. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7890. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7891.  
  7892. Fingerprint IBM 2210 Router MRS 2.x on Token Ring interface
  7893. Class IBM | embedded || router
  7894. TSeq(Class=TR%gcd=<6)
  7895. T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  7896. T2(Resp=N)
  7897. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  7898. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7899. T5(DF=N%W=0%ACK=S++%Flags=AR|R%Ops=)
  7900. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  7901. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7902. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7903.  
  7904. # IBM 8210 Multiprotocol Switching Server for ATM networks, Model 3 (p/n 31L3  340),
  7905. Fingerprint IBM 8210 Multiprotocol Switching Server/router for ATM networks
  7906. Class IBM | embedded || router
  7907. TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U)
  7908. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  7909. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7910. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7911. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7912. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7913. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7914. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7915. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7916.  
  7917. Fingerprint Proteon OpenRoute 2.1 on a RBX200 Router or IBM 2210 Router
  7918. Class IBM | embedded || router
  7919. Class Proteon | OpenRoute || router
  7920. TSeq(Class=TD%gcd=<6%SI=<BB)
  7921. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  7922. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7923. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7924. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  7925. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7926. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  7927. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7928. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  7929.  
  7930. Fingerprint IBM 3494 Magnetic Tape Library
  7931. Class IBM | embedded || storage-misc
  7932. TSeq(Class=RI%gcd=<6%SI=<A5B22&>1A6E%IPID=I%TS=U)
  7933. T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW)
  7934. T2(Resp=N)
  7935. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  7936. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  7937. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7938. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7939. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7940. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7941.  
  7942. Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT
  7943. Class IBM | embedded || switch
  7944. Class Xylan | embedded || switch
  7945. TSeq(Class=64K)
  7946. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  7947. T2(Resp=N)
  7948. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  7949. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  7950. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7951. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7952. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7953. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  7954.  
  7955. # AGE Logic, Inc. IBM X-Station
  7956. Fingerprint AGE Logic, Inc. IBM XStation
  7957. Class IBM | embedded || X terminal
  7958. TSeq(Class=64K)
  7959. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  7960. T2(Resp=N)
  7961. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  7962. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  7963. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7964. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7965. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7966. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  7967.  
  7968. Fingerprint IBM MVS
  7969. Class IBM | MVS || general purpose
  7970. TSeq(Class=RI%gcd=64|C8|12C|190)
  7971. T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M)
  7972. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7973. T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|)
  7974. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7975. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7976. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7977. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7978. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  7979.  
  7980. Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2
  7981. Class IBM | MVS || general purpose
  7982. TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200)
  7983. T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
  7984. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7985. T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M)
  7986. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7987. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7988. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  7989. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7990.  
  7991. Fingerprint IBM MVS TCP/IP TCPMVS 3.2
  7992. Class IBM | MVS || general purpose
  7993. TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E)
  7994. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  7995. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  7996. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  7997. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  7998. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  7999. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8000. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8001. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  8002.  
  8003. Fingerprint IBM MVS TCP/IP TCPOE 3.3
  8004. Class IBM | MVS || general purpose
  8005. TSeq(Class=RI%gcd=<6%SI=<BB0)
  8006. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  8007. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8008. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  8009. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8010. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8011. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8012. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8013. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8014.  
  8015. Fingerprint IBM OS/2 V 2.1
  8016. Class IBM | OS/2 || general purpose
  8017. TSeq(Class=64K)
  8018. T1(DF=N%W=6FCC%ACK=S++%Flags=AS%Ops=M)
  8019. T2(Resp=N)
  8020. T3(Resp=Y%DF=N%W=6FCC%ACK=O%Flags=A%Ops=)
  8021. T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
  8022. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8023. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8024. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8025. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8026.  
  8027. Fingerprint IBM OS/2 V.3
  8028. Class IBM | OS/2 || general purpose
  8029. TSeq(Class=i800)
  8030. T1(DF=N%W=7000%ACK=S++%Flags=AS%Ops=M)
  8031. T2(Resp=N)
  8032. T3(Resp=Y%DF=N%W=7000%ACK=O%Flags=A%Ops=)
  8033. T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
  8034. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8035. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8036. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8037. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8038.  
  8039. Fingerprint IBM OS/2 Warp 4.0
  8040. Class IBM | OS/2 || general purpose
  8041. TSeq(Class=i800)
  8042. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
  8043. T2(Resp=N)
  8044. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  8045. T4(DF=N%W=7000%ACK=O%Flags=R%Ops=)
  8046. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8047. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8048. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8049. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8050.  
  8051. Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
  8052. Class IBM | OS/2 || general purpose
  8053. TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
  8054. T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  8055. T2(Resp=N)
  8056. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  8057. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  8058. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8059. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8060. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8061. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8062.  
  8063. Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta
  8064. Class IBM | OS/2 || general purpose
  8065. TSeq(Class=RI%gcd=<6%SI=<FFFF&>FF)
  8066. T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  8067. T2(Resp=N)
  8068. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  8069. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  8070. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8071. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8072. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8073. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8074.  
  8075. Fingerprint OS/2 Warp Server for eBusiness 4.52
  8076. Class IBM | OS/2 || general purpose
  8077. TSeq(Class=RI%gcd=<8%SI=<5A9A6&>633%IPID=I%TS=U)
  8078. T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW)
  8079. T2(Resp=N)
  8080. T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=)
  8081. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8082. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8083. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8084. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8085. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8086.  
  8087. Fingerprint IBM OS/390 V2R10
  8088. Class IBM | OS/390 | V2 | general purpose
  8089. TSeq(Class=RI%gcd=<6%SI=<17C1E&>128%IPID=I%TS=1000HZ)
  8090. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8091. T2(Resp=N)
  8092. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8093. T4(Resp=N)
  8094. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8095. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8096. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8097. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  8098.  
  8099. Fingerprint IBM OS/390 V5R0M0
  8100. Class IBM | OS/390 | V5 | general purpose
  8101. TSeq(Class=RI%gcd=<5%SI=>F&<BBBB)
  8102. T1(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8103. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8104. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8105. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  8106. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8107. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  8108. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8109. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8110.  
  8111. # added by Beat Rubischon <beat@rubis.ch>
  8112. Fingerprint IBM AS/400 V3 and V4
  8113. Class IBM | OS/400 | V3 | general purpose
  8114. Class IBM | OS/400 | V4 | general purpose
  8115. TSeq(Class=RI%gcd=<6)
  8116. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  8117. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8118. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  8119. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8120. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8121. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8122. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8123. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8124.  
  8125. Fingerprint IBM OS/400 V3
  8126. Class IBM | OS/400 | V3 | general purpose
  8127. TSeq(Class=RI%gcd=<8%SI=<3411C4&>5977%TS=1000HZ)
  8128. T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT)
  8129. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8130. T3(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT)
  8131. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8132. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8133. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8134. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8135. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8136.  
  8137. Fingerprint IBM AS/400 running OS/400 R4.4
  8138. Class IBM | OS/400 | V4 | general purpose
  8139. TSeq(Class=TD%gcd=<6%SI=<1E)
  8140. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8141. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8142. T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8143. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8144. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8145. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8146. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8147. PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8148.  
  8149. Fingerprint IBM OS/400 V4 r4-5
  8150. Class IBM | OS/400 | V4 | general purpose
  8151. TSeq(Class=RI%gcd=<C%SI=<C1C&>3%IPID=I%TS=1000HZ)
  8152. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8153. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8154. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8155. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8156. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8157. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8158. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8159. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8160.  
  8161. Fingerprint IBM OS/400 V4R2M0
  8162. Class IBM | OS/400 | V4 | general purpose
  8163. TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U)
  8164. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  8165. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8166. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  8167. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8168. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8169. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8170. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8171. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8172.  
  8173. Fingerprint IBM OS/400 V4R5
  8174. Class IBM | OS/400 | V4 | general purpose
  8175. TSeq(Class=C%IPID=I%TS=1000HZ)
  8176. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8177. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8178. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8179. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8180. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8181. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8182. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8183. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8184.  
  8185. Fingerprint IBM OS/400 V4R5M0
  8186. Class IBM | OS/400 | V4 | general purpose
  8187. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8188. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8189. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8190. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8191. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8192. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8193. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8194. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8195.  
  8196. Fingerprint IBM AS/400 running OS/400 5.1
  8197. Class IBM | OS/400 | V5 | general purpose
  8198. TSeq(Class=TD%gcd=<6000%SI=<14%IPID=I)
  8199. T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8200. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8201. T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8202. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8203. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8204. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8205. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8206. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8207.  
  8208. # IBM proprietary operating system for AS/400 systems (now known as "iSeries")
  8209. # Fingerprint OS/400 V5R2
  8210. # IBM OS/400 V5R1M0
  8211. Fingerprint IBM OS/400 V5R1 - V5R2
  8212. Class IBM | OS/400 | V5 | general purpose
  8213. TSeq(Class=RI%gcd=<24%SI=<19DCD2&>6D3%IPID=I)
  8214. T1(DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8215. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8216. T3(Resp=Y%DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8217. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8218. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8219. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8220. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8221. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8222.  
  8223. # OS/400 V5R1M0 w/ C2134 + Autumn '02 Hiper, DB & Java
  8224. Fingerprint IBM OS/400 V5R1M0
  8225. Class IBM | OS/400 | V5 | general purpose
  8226. TSeq(Class=TD%gcd=<22222%SI=<14%IPID=I%TS=1000HZ)
  8227. T1(DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8228. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8229. T3(Resp=Y%DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  8230. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8231. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8232. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8233. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8234. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8235.  
  8236. Fingerprint IBM OS/400 V5R2M0
  8237. Class IBM | OS/400 | V5 | general purpose
  8238. TSeq(Class=RI%gcd=<24%SI=<41D304&>7BC%IPID=I)
  8239. T1(DF=N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
  8240. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8241. T3(Resp=Y%DF=N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT)
  8242. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8243. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8244. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8245. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8246. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8247.  
  8248. Fingerprint IBM VM/CMS (mainframe)
  8249. Class IBM | VM/CMS || general purpose
  8250. TSeq(Class=RI%gcd=64|C8%SI=>CC&<CCC)
  8251. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  8252. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8253. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  8254. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8255. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8256. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8257. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8258. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8259.  
  8260. Fingerprint IBM VM/ESA 2.2.0 CMS Mainframe System
  8261. Class IBM | VM/CMS || general purpose
  8262. TSeq(Class=RI|TD%gcd=64|C8|12C|1F4|190%SI=<FFF)
  8263. T1(DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
  8264. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8265. T3(Resp=Y%DF=N%W=2000|8000%ACK=S++%Flags=AS%Ops=M)
  8266. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8267. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8268. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8269. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8270. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8271.  
  8272. # innovaphone 200 V4.00 sr4 IP200[02-4283], Bootcode[205], HW[202] 2048/8192
  8273. # innovaphone IP400 V4.00 hotfix IP400[02-4253], Bootcode[315], HW[102] 2048/4096
  8274. Fingerprint innovaphone IP200/IP400 VOIP phone/gateway
  8275. Class innovaphone | embedded || telecom-misc
  8276. TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
  8277. T1(DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
  8278. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8279. T3(Resp=Y%DF=N%W=FA0|2800%ACK=S++%Flags=AS%Ops=M)
  8280. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8281. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8282. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8283. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8284. PU(Resp=N)
  8285.  
  8286. # Intel NetStructure 3110 VPN Gateway V6.90p7
  8287. Fingerprint Intel NetStructure 3110 VPN Gateway
  8288. Class Intel | embedded || firewall
  8289. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  8290. T1(Resp=N)
  8291. T2(Resp=N)
  8292. T3(Resp=N)
  8293. T4(Resp=N)
  8294. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  8295. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8296. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8297. PU(Resp=N)
  8298.  
  8299. Fingerprint Intel InBusiness Print Station
  8300. Class Intel | embedded || print server
  8301. TSeq(Class=64K)
  8302. T1(DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  8303. T2(Resp=N)
  8304. T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  8305. T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=)
  8306. T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  8307. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8308. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8309. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8310.  
  8311. Fingerprint Intel NetportExpress 10 3-port print server
  8312. Class Intel | embedded || print server
  8313. TSeq(Class=64K%IPID=I%TS=U)
  8314. T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  8315. T2(Resp=N)
  8316. T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  8317. T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=)
  8318. T5(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  8319. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8320. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8321. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8322.  
  8323. # Intel NetportExpress(tm) 10/100 3-port ROM: V05.10a
  8324. Fingerprint Intel NetportExpress 10/100 3-port print server
  8325. Class Intel | embedded || print server
  8326. TSeq(Class=64K)
  8327. T1(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  8328. T2(Resp=N)
  8329. T3(Resp=Y%DF=N%W=424%ACK=S++%Flags=AS%Ops=ME)
  8330. T4(Resp=Y%DF=N%W=16D0%ACK=O%Flags=R%Ops=)
  8331. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=R%Ops=)
  8332. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  8333. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  8334. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8335.  
  8336. Fingerprint Intel NetportExpress PRO print server V04.33a
  8337. Class Intel | embedded || print server
  8338. TSeq(Class=TD%gcd=1%SI=0)
  8339. T1(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  8340. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  8341. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=)
  8342. T4(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  8343. T5(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  8344. T6(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  8345. T7(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  8346. PU(Resp=N)
  8347.  
  8348. Fingerprint Intel NetportExpress XL print server
  8349. Class Intel | embedded || print server
  8350. TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U)
  8351. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  8352. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8353. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  8354. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8355. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8356. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8357. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8358. PU(Resp=N)
  8359.  
  8360. # Intel Corporation, ER9100 Express Router 9100
  8361. # Fingerprint by Ron van Daal (ronvdaal@syntonic.net)
  8362. Fingerprint Intel ER9100 Express Router 9100
  8363. Class Intel | embedded || router
  8364. TSeq(Class=TD%gcd=10|20|30%SI=1)
  8365. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  8366. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8367. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  8368. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8369. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8370. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8371. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8372. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8373.  
  8374. Fingerprint Intel Express 510T switch
  8375. Class Intel | embedded || switch
  8376. TSeq(Class=TD%gcd=10|20|30%SI=<BB)
  8377. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  8378. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8379. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  8380. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8381. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8382. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8383. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8384. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8385.  
  8386. Fingerprint Intel Express 510T switch
  8387. Class Intel | embedded || switch
  8388. TSeq(Class=i800%IPID=I%TS=U)
  8389. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  8390. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8391. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  8392. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8393. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8394. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8395. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8396. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8397.  
  8398. Fingerprint Intel NetStructure 470T Switch
  8399. Class Intel | embedded || switch
  8400. TSeq(Class=TD%gcd=<7534%SI=<64%IPID=I%TS=U)
  8401. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  8402. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8403. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  8404. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8405. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8406. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8407. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8408. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8409.  
  8410. Fingerprint Intergraph CLiX R3.1 Vr.7.6.20 6480
  8411. Class Intergraph | CLiX || general purpose
  8412. TSeq(Class=TD%gcd=<416%SI=<1E)
  8413. T1(DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
  8414. T2(Resp=N)
  8415. T3(Resp=Y%DF=N%W=73F%ACK=S++%Flags=AS%Ops=ME)
  8416. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8417. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8418. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8419. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8420. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  8421.  
  8422. Fingerprint Intergraph Workstation (2000 Series) running CLiX R3.1
  8423. Class Intergraph | CLiX || general purpose
  8424. TSeq(Class=TD%gcd=209|1048|E3F%SI=<5)
  8425. T1(DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  8426. T2(Resp=N)
  8427. T3(Resp=Y%DF=N%W=848%ACK=S++%Flags=AS%Ops=ME)
  8428. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8429. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8430. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8431. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8432. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  8433.  
  8434. # IPCop 1.20 dedicated firewall Linux distro old Pentium 1 hardware + 3C509B cards http://ipcop.org/
  8435. Fingerprint IPCop 1.20 Linux 2.2.2X-based firewall
  8436. Class IPCop | Linux | 2.2.X | firewall
  8437. TSeq(Class=RI%gcd=<6%SI=<95DBC&>116E%IPID=I%TS=100HZ)
  8438. T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW)
  8439. T2(Resp=N)
  8440. T3(Resp=N)
  8441. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8442. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8443. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8444. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8445. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  8446.  
  8447. # IQinVison IQeye3 Version V2.1/1(030123)
  8448. Fingerprint IQinVison IQeye3 webcam
  8449. Class IQinVision | embedded || webcam
  8450. TSeq(Class=RI%gcd=<6%SI=<5168&>B3%IPID=I%TS=U)
  8451. T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M)
  8452. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8453. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8454. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8455. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8456. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8457. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8458. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8459.  
  8460. # IronPort AsyncOS 3.7.1-001 running on C60 platform
  8461. Fingerprint IronPort C60 email security appliance
  8462. Class IronPort | AsyncOS || specialized
  8463. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  8464. T1(DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT)
  8465. T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  8466. T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  8467. T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL)
  8468. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  8469. T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  8470. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL)
  8471. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8472.  
  8473. Fingerprint Isolation Systems Infocrypt Enterprise
  8474. Class Isolation | embedded || encryption accelerator
  8475. TSeq(Class=C)
  8476. T1(Resp=N)
  8477. T2(Resp=N)
  8478. T3(Resp=N)
  8479. T4(Resp=N)
  8480. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  8481. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  8482. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL)
  8483. PU(Resp=N)
  8484.  
  8485. Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL traffic generation and analysis server
  8486. Class Ixia | embedded || specialized
  8487. TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI)
  8488. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  8489. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8490. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  8491. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8492. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8493. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8494. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8495. PU(Resp=N)
  8496.  
  8497. Fingerprint Juniper Networks JUNOS 5.3 on an Olive router
  8498. Class Juniper | JUNOS || router
  8499. TSeq(Class=RI%gcd=<6%SI=<ABEB4&>661%IPID=I%TS=100HZ)
  8500. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8501. T2(Resp=N)
  8502. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8503. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8504. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8505. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8506. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8507. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8508.  
  8509. # JUNOS <hostname> 5.6R1.3 JUNOS 5.6R1.3 #0: 2003-01-02 20:38:33 UTC -- This one was no Juniper Hardware Router but a JunOS installed on a simple i386 box.
  8510. Fingerprint Juniper Networks JUNOS 5.6R1.3 routing software on x86 box
  8511. Class Juniper | JUNOS || router
  8512. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  8513. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8514. T2(Resp=N)
  8515. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8516. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8517. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8518. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8519. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8520. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8521.  
  8522. # Juniper Networks JUNOS 5.5R1.2 built 2002-09-28
  8523. Fingerprint Juniper Networks router JUNOS 5.5R1.2
  8524. Class Juniper | JUNOS || router
  8525. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  8526. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8527. T2(Resp=N)
  8528. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8529. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8530. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8531. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8532. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8533. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8534.  
  8535. Fingerprint Juniper Router running JUNOS
  8536. Class Juniper | JUNOS || router
  8537. TSeq(Class=RI%gcd=<5%SI=>FFF)
  8538. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8539. T2(Resp=N)
  8540. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  8541. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  8542. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8543. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8544. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8545. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8546.  
  8547. # KA9Q is a networking OS used mostly by amateur radio operators for radio to
  8548. # internet gateways.
  8549. Fingerprint KA9Q amateur radio OS
  8550. Class KA9Q | KA9Q || specialized
  8551. TSeq(Class=TD%gcd=37000%SI=<1E)
  8552. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
  8553. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8554. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL)
  8555. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8556. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8557. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8558. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8559. PU(Resp=N)
  8560.  
  8561. # 3Com OfficeConnect 812 ADSL router firmware 2.0.0
  8562. # Kentrox DataSMART 656 CSU/DSU or USR NETServer/16
  8563. Fingerprint Kentrox DataSMART 656 CSU/DSU, USR NETserver/16, or 3Com OfficeConnect ADSL router
  8564. Class Kentrox | embedded || CSUDSU
  8565. Class US Robotics | embedded || switch
  8566. Class 3Com | embedded || broadband router
  8567. TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=<A)
  8568. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  8569. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8570. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  8571. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8572. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8573. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8574. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8575. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8576.  
  8577. # Konica-Minolta magicolor2300DL printer controller f/w 02.83S engine f/w 4131.50G1.0900
  8578. Fingerprint Konica-Minolta magicolor2300DL printer controller
  8579. Class Konica | embedded || printer
  8580. TSeq(Class=64K%IPID=I%TS=2HZ)
  8581. T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=MNWNNT)
  8582. T2(Resp=N)
  8583. T3(Resp=Y%DF=N%W=1%ACK=O%Flags=A%Ops=NNT)
  8584. T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
  8585. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8586. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8587. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8588. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8589.  
  8590. Fingerprint Kronos Time clock
  8591. Class Kronos | embedded || specialized
  8592. TSeq(Class=TD%gcd=<7C%SI=<32%IPID=I%TS=U)
  8593. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  8594. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  8595. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  8596. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  8597. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  8598. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  8599. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  8600. PU(Resp=N)
  8601.  
  8602. Fingerprint Kyocera FS-1700+ printer
  8603. Class Kyocera | embedded || printer
  8604. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  8605. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  8606. T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  8607. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AF|AR%Ops=)
  8608. T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  8609. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  8610. T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  8611. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  8612. PU(Resp=N)
  8613.  
  8614. Fingerprint Kyocera IB-21 Printer NIC
  8615. Class Kyocera | embedded || printer
  8616. TSeq(Class=TD%gcd=<20006%SI=<14%IPID=I%TS=U)
  8617. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  8618. T2(Resp=Y%DF=N%W=100%ACK=S%Flags=AR%Ops=)
  8619. T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AR%Ops=)
  8620. T4(DF=N%W=100%ACK=S%Flags=AR%Ops=)
  8621. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8622. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8623. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8624. PU(Resp=N)
  8625.  
  8626. # Kyocera SB-4e Printer-Interface in an Kyocera FS-800 laser printer
  8627. Fingerprint Kyocera SB-4e printer NIC
  8628. Class Kyocera | embedded || printer
  8629. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  8630. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  8631. T2(Resp=N)
  8632. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  8633. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8634. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8635. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8636. T7(Resp=N)
  8637. PU(Resp=N)
  8638.  
  8639. Fingerprint Labtam MT300, X-Terminal Kernel
  8640. Class Labtam | embedded || X terminal
  8641. TSeq(Class=64K)
  8642. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  8643. T2(Resp=N)
  8644. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  8645. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  8646. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8647. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8648. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8649. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  8650.  
  8651. Fingerprint Lantronix LSB4 Ethernet Switch
  8652. Class Lantronix | embedded || switch
  8653. TSeq(Class=RI%gcd=<6%SI=>CCC&<FFFF)
  8654. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  8655. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8656. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8657. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8658. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8659. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8660. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8661. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8662.  
  8663. # Radionics Ram IV Alarm System
  8664. # Lantronix CoBox DR1-IAP serial device server
  8665. Fingerprint Lantronix CoBox serial device server or Radionics RAM IV Alarm
  8666. Class Lantronix | embedded || terminal server
  8667. Class Radionics | embedded || specialized
  8668. TSeq(Class=TD%gcd=<404%SI=<6E%IPID=I%TS=U)
  8669. T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M)
  8670. T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8671. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8672. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8673. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8674. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8675. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8676. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8677.  
  8678. Fingerprint Lantronix ETS16 terminal server Version V3.4/5(961028)
  8679. Class Lantronix | embedded || terminal server
  8680. TSeq(Class=RI%gcd=<6%SI=<9D1C&>91%IPID=BI%TS=U)
  8681. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  8682. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8683. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8684. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8685. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8686. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8687. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8688. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8689.  
  8690. Fingerprint Lantronix ETS16P terminal server Version V3.5/2(970721)
  8691. Class Lantronix | embedded || terminal server
  8692. TSeq(Class=RI%gcd=<6%SI=<404C&>90)
  8693. T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M)
  8694. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8695. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8696. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8697. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8698. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8699. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8700. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8701.  
  8702. Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
  8703. Class Lantronix | embedded || terminal server
  8704. TSeq(Class=RI%gcd=<6%SI=<9318E&>1688%IPID=BI%TS=U)
  8705. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  8706. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8707. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8708. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8709. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8710. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8711. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8712. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8713.  
  8714. Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620)
  8715. Class Lantronix | embedded || terminal server
  8716. TSeq(Class=RI%gcd=<8%SI=<404C&>8C%IPID=BI%TS=U)
  8717. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  8718. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8719. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8720. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8721. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8722. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8723. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8724. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8725.  
  8726. Fingerprint Lantronix EPS1 print server version V3.5/1(970325)
  8727. Class Lantronix | Punix || print server
  8728. TSeq(Class=RI%gcd=<6%SI=>FF&<FFFF)
  8729. T1(DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
  8730. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8731. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8732. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8733. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8734. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8735. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8736. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8737.  
  8738. # Lantronix EPS1 Printer Server running Punix version  2.9/342(930813)
  8739. Fingerprint Lantronix EPS1 Printer Server
  8740. Class Lantronix | Punix || print server
  8741. TSeq(Class=RI%gcd=<6%SI=<10018&>8F%IPID=BI%TS=U)
  8742. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  8743. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8744. T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=)
  8745. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8746. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8747. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8748. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8749. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8750.  
  8751. Fingerprint Lantronix EPS2 print server Version V3.5/2(970721)
  8752. Class Lantronix | Punix || print server
  8753. TSeq(Class=RI|TD%gcd=<6)
  8754. T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M)
  8755. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8756. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8757. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8758. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8759. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8760. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8761. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8762.  
  8763. # Lantronix ETS16 Version V3.1/2(940207) / [Punix version 2.9/379(940207)]
  8764. Fingerprint Lantronix ETS16 terminal server
  8765. Class Lantronix | Punix || terminal server
  8766. TSeq(Class=RI%gcd=<6%SI=<41E9C&>AD%IPID=RPI|BI%TS=U)
  8767. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  8768. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8769. T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=)
  8770. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8771. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8772. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8773. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8774. PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  8775.  
  8776. Fingerprint Leunig ePower Switch b723 v5.2
  8777. Class Leunig | embedded || power-device
  8778. TSeq(Class=TR)
  8779. T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  8780. T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  8781. T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  8782. T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=)
  8783. T5(Resp=N)
  8784. T6(Resp=N)
  8785. T7(Resp=N)
  8786. PU(Resp=N)
  8787.  
  8788. Fingerprint Lexmark M412n network printer
  8789. Class Lexmark | embedded || printer
  8790. TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ)
  8791. T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
  8792. T2(Resp=N)
  8793. T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
  8794. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  8795. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8796. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8797. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8798. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8799.  
  8800. Fingerprint Lexmark Marknet X2031e printer
  8801. Class Lexmark | embedded || printer
  8802. TSeq(Class=RI%gcd=<6%SI=<AFDAC&>16E0%IPID=I%TS=2HZ)
  8803. T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT)
  8804. T2(Resp=N)
  8805. T3(Resp=N)
  8806. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  8807. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8808. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8809. T7(Resp=N)
  8810. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8811.  
  8812. # Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1
  8813. # Lexmark Optra Lx+ Network Printer, firmware
  8814. Fingerprint Lexmark Optra network printer
  8815. Class Lexmark | embedded || printer
  8816. TSeq(Class=TD%gcd=388|1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20)
  8817. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  8818. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8819. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  8820. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  8821. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8822. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  8823. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8824. PU(Resp=N)
  8825.  
  8826. # Lexmark Optra T612 (printer) running firmware 3.11.17
  8827. # Lexmark Optra S 2420
  8828. Fingerprint Lexmark Optra printer
  8829. Class Lexmark | embedded || printer
  8830. TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
  8831. T1(DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
  8832. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8833. T3(Resp=Y%DF=N%W=3F2%ACK=S++%Flags=AS%Ops=M)
  8834. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8835. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8836. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8837. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8838. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  8839.  
  8840. # Lexmark MarkNet XL Internal Printer Network Adapter on a Lexmark Optra LaserPrinter
  8841. Fingerprint Lexmark Optra printer w/MarkNet XL Network Adapter
  8842. Class Lexmark | embedded || printer
  8843. TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U)
  8844. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  8845. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8846. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  8847. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8848. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8849. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8850. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8851. PU(Resp=N)
  8852.  
  8853. #  Lexmark Optra S 1659 (MarkNetS)
  8854. #  Lexmark Optra S 2455 and SC 1275
  8855. # Lexmark S 1855 Firmware 1.9.14 Bootcode revision 7.3
  8856. Fingerprint Lexmark Optra S Printer
  8857. Class Lexmark | embedded || printer
  8858. TSeq(Class=TD%gcd=>1000%SI=<30)
  8859. T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
  8860. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8861. T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M)
  8862. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8863. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8864. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  8865. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8866. PU(Resp=N|Y)
  8867.  
  8868. # Lexmark T520 printer, firmware 54.30.39
  8869. Fingerprint Lexmark T520 printer
  8870. Class Lexmark | embedded || printer
  8871. TSeq(Class=RI%gcd=<6%SI=<3651E88&>8AEFD%IPID=Z%TS=100HZ)
  8872. T1(DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW)
  8873. T2(Resp=N)
  8874. T3(Resp=Y%DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW)
  8875. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8876. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8877. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8878. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8879. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8880.  
  8881. Fingerprint Lexmark T522 printer
  8882. Class Lexmark | embedded || printer
  8883. TSeq(Class=RI%gcd=<6%SI=<24E3426&>5E5DB%IPID=Z%TS=100HZ)
  8884. T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
  8885. T2(Resp=N)
  8886. T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
  8887. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8888. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8889. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8890. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8891. PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8892.  
  8893. Fingerprint Lexmark T522/T622 printer
  8894. Class Lexmark | embedded || printer
  8895. TSeq(Class=RI%gcd=<8%SI=<2C2D254&>387BA%IPID=Z%TS=100HZ)
  8896. T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
  8897. T2(Resp=N)
  8898. T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW)
  8899. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8900. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8901. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  8902. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  8903. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8904.  
  8905. Fingerprint LG Goldstream LR3001f router, software version 4.0
  8906. Class LG GoldStream | embedded || router
  8907. TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
  8908. T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
  8909. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  8910. T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
  8911. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  8912. T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  8913. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  8914. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  8915. PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  8916.  
  8917. Fingerprint LG Goldstream LR3100p router, software version 1.0-1.5
  8918. Class LG GoldStream | embedded || router
  8919. TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U)
  8920. T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M)
  8921. T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  8922. T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M)
  8923. T4(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  8924. T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=)
  8925. T6(DF=Y%W=1%ACK=O%Flags=R%Ops=)
  8926. T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=)
  8927. PU(Resp=N)
  8928.  
  8929. Fingerprint Liebert Intellislot SNMP/Web Card (power devices, air conditioning, etc.)
  8930. Class Liebert | embedded || specialized
  8931. TSeq(Class=TD%gcd=<32DC4%SI=<14%IPID=I%TS=U)
  8932. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
  8933. T2(Resp=N)
  8934. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
  8935. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8936. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8937. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8938. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8939. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8940.  
  8941. # "This device listens on all TCP and all UDP ports, so OS
  8942. #  fingerprints are not that excellent. Actually there's not even an OS
  8943. #  running on it, it simply translates monitoring data into SNMP OIDs. It
  8944. #  can also be used to control the unit by setting specific OIDs."
  8945. Fingerprint Liebert-Hiross HiSNMP A/C controlling unit
  8946. Class Liebert-Hiross | embedded || specialized
  8947. T1(DF=Y%W=2000%ACK=S++%Flags=BAS%Ops=M)
  8948. T2(Resp=N)
  8949. T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=UAPSF%Ops=M)
  8950. T4(Resp=N)
  8951. T5(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
  8952. T6(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
  8953. T7(DF=Y%W=2000%ACK=S%Flags=R%Ops=)
  8954. PU(Resp=N)
  8955.  
  8956. # Linksys WET-11 wireless Ethernet bridge running firmware rev. 1.43
  8957. Fingerprint Linksys WET-11 wireless Ethernet bridge
  8958. Class Linksys | embedded || bridge
  8959. TSeq(Class=RI%gcd=<6%SI=<2C30D0&>52F7%IPID=I%TS=U)
  8960. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  8961. T2(Resp=N)
  8962. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  8963. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8964. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  8965. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8966. T7(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  8967. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8968.  
  8969. Fingerprint Linksys WGA54G Wireless Game Adapter (bridge)
  8970. Class Linksys | embedded || bridge
  8971. TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
  8972. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MM)
  8973. T2(Resp=N)
  8974. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  8975. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  8976. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  8977. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  8978. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  8979. PU(Resp=N)
  8980.  
  8981. # Linksys EtherFast Cable/DSL Router with 4-port switch BEFSR41 ver. 3; firmware: 1.44.3, FEB 13 2003
  8982. Fingerprint Linksys BEFSR41 broadband router
  8983. Class Linksys | embedded || broadband router
  8984. TSeq(Class=TD%gcd=<18%SI=<1E%IPID=Z%TS=U)
  8985. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  8986. T2(Resp=N)
  8987. T3(Resp=N)
  8988. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  8989. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  8990. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  8991. T7(Resp=N)
  8992. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  8993.  
  8994. # Linksys/Cisco BEFSR41 V3 Etherfast Cable/DSL Router (Firmware 1.04.17)
  8995. Fingerprint Linksys BEFSR41 V3 Etherfast cable/DSL router
  8996. Class Linksys | embedded || broadband router
  8997. T1(Resp=N)
  8998. T2(Resp=N)
  8999. T3(Resp=Y%DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  9000. T4(Resp=N)
  9001. T5(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=)
  9002. T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=)
  9003. T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
  9004. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9005.  
  9006. # Linksys BEFVP41 VPN Router - Firmware Version 1.41.1, Sep 04 2003
  9007. Fingerprint Linksys BEFVP41 VPN Router
  9008. Class Linksys | embedded || broadband router
  9009. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  9010. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  9011. T2(Resp=N)
  9012. T3(Resp=N)
  9013. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9014. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9015. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  9016. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9017. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9018.  
  9019. Fingerprint Linksys EtherFast print server
  9020. Class Linksys | embedded || print server
  9021. T1(DF=N%W=0|C80%ACK=S++%Flags=AR|APS%Ops=|M)
  9022. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9023. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  9024. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9025. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9026. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9027. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9028. PU(Resp=N)
  9029.  
  9030. Fingerprint Linksys EtherFast print server
  9031. Class Linksys | embedded || print server
  9032. TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
  9033. T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
  9034. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9035. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=APS%Ops=M)
  9036. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9037. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9038. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9039. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9040. PU(Resp=N)
  9041.  
  9042. Fingerprint Linksys PSUS4 USB Printserver and switch
  9043. Class Linksys | embedded || print server
  9044. TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
  9045. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  9046. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9047. T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M)
  9048. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9049. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9050. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9051. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9052. PU(Resp=N)
  9053.  
  9054. Fingerprint Linksys WPS54GU2 wireless print server
  9055. Class Linksys | embedded || print server
  9056. TSeq(Class=TD%gcd=<1A866%SI=<1E%IPID=I%TS=U)
  9057. T1(DF=N%W=111C%ACK=S++%Flags=APS|A%Ops=M|)
  9058. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9059. T3(Resp=Y%DF=N%W=111C|0%ACK=S++|O%Flags=APS|AR%Ops=M|)
  9060. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9061. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9062. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  9063. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9064. PU(Resp=N)
  9065.  
  9066. # Linksys Wireless-B router/switch/802.11b access point (device model BEFW11S4 V4)
  9067. # Linksys BEFSR81v2 Router with firmware 2.45.10
  9068. Fingerprint Linksys BEFW11S4 or BEFSR81 WAP
  9069. Class Linksys | embedded || WAP
  9070. TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U)
  9071. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  9072. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  9073. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9074. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  9075. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9076. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  9077. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9078. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9079.  
  9080. # Linksys BEFW11S4 802.11B WAP
  9081. # Linksys BEFSR41 firmware ver. 1.40.2
  9082. Fingerprint Linksys BEFW11S4 WAP or BEFSR41 router
  9083. Class Linksys | embedded || WAP
  9084. Class Linksys | embedded || broadband router
  9085. TSeq(Class=TD|RI%gcd=<400%SI=<62C%IPID=Z|RD%TS=U)
  9086. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9087. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  9088. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9089. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  9090. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9091. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  9092. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  9093. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9094.  
  9095. # Linksys WAP11 v2.6 firmware 1.06
  9096. Fingerprint Linksys WAP11 Wireless AP
  9097. Class Linksys | embedded || WAP
  9098. TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
  9099. T1(DF=N%W=1200%ACK=S++%Flags=AS%Ops=M)
  9100. T2(Resp=N)
  9101. T3(Resp=Y%DF=N%W=1200%ACK=O%Flags=A%Ops=)
  9102. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  9103. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9104. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9105. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9106. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9107.  
  9108. # Planet embedded WAP-1965
  9109. # Linksys WAP11 wireless AP v2.2 firmware 1.06
  9110. # D-Link DWL-900+ with Firmware Version 2.57, Wed, 30 Apr 2003
  9111. # D-Link DWL - 2000 AP (WAP) firmware 2.04
  9112. Fingerprint Linksys, D-Link, or Planet WAP
  9113. Class Linksys | embedded || WAP
  9114. Class D-Link | embedded || WAP
  9115. TSeq(Class=TD%gcd=<1F502%SI=<1E%IPID=I%TS=U)
  9116. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  9117. T2(Resp=N)
  9118. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  9119. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  9120. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9121. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9122. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9123. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  9124.  
  9125. # fingerprint!
  9126. Fingerprint Linux 1.0.9
  9127. Class Linux | Linux | 1.X | general purpose
  9128. TSeq(Class=TD%gcd=30|60%SI=<F)
  9129. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  9130. T2(Resp=N)
  9131. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=ASF%Ops=M)
  9132. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9133. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9134. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9135. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9136. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9137.  
  9138. Fingerprint Linux 1.2.13
  9139. Class Linux | Linux | 1.X | general purpose
  9140. TSeq(Class=TD%gcd=1%SI=1C)
  9141. T1(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
  9142. T2(Resp=N)
  9143. T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
  9144. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9145. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9146. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9147. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9148. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9149.  
  9150. Fingerprint Linux 1.2.8 - 1.2.13
  9151. Class Linux | Linux | 1.X | general purpose
  9152. TSeq(Class=RI%gcd=<6%SI=<BBBB)
  9153. T1(DF=N%W=37FF%ACK=S++%Flags=AS%Ops=ME)
  9154. T2(Resp=N)
  9155. T3(Resp=Y%DF=N%W=37FF%ACK=S++%Flags=ASF%Ops=ME)
  9156. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9157. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9158. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9159. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9160. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9161.  
  9162. Fingerprint Linux 1.3.20 (x86)
  9163. Class Linux | Linux | 1.X | general purpose
  9164. T1(DF=N%W=77FF|0%ACK=S++%Flags=AS|BAR%Ops=ME|)
  9165. T2(Resp=N)
  9166. T3(Resp=N)
  9167. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9168. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9169. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9170. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9171. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9172.  
  9173. Fingerprint Linux 2.0.0
  9174. Class Linux | Linux | 2.0.X | general purpose
  9175. TSeq(Class=RI%gcd=<6)
  9176. T1(DF=N%W=7C00%ACK=S++%Flags=BAS%Ops=ME)
  9177. T2(Resp=N)
  9178. T3(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=ASF%Ops=ME)
  9179. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9180. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9181. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9182. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9183. PU(DF=N%TOS=6%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9184.  
  9185. Fingerprint Linux 2.0.27 - 2.0.30
  9186. Class Linux | Linux | 2.0.X | general purpose
  9187. TSeq(Class=TR)
  9188. T1(DF=N%W=7C00|3C00%ACK=S++%Flags=BAS%Ops=ME)
  9189. T2(Resp=N)
  9190. T3(Resp=Y%DF=N%W=7C00|3C00%ACK=S++%Flags=ASF%Ops=ME)
  9191. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9192. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9193. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9194. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9195. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9196.  
  9197. Fingerprint Linux 2.0.32-34
  9198. Class Linux | Linux | 2.0.X | general purpose
  9199. TSeq(Class=TR%gcd=<6)
  9200. T1(DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=BAS%Ops=ME)
  9201. T2(Resp=N)
  9202. T3(Resp=Y%DF=N%W=200|212|7FE0|3FE0|3FF0%ACK=S++%Flags=ASF%Ops=ME)
  9203. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9204. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9205. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9206. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9207. PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9208.  
  9209. # On very rare cases, I get a T2 response back -- weird
  9210. Fingerprint Linux 2.0.32-34
  9211. Class Linux | Linux | 2.0.X | general purpose
  9212. TSeq(Class=TR)
  9213. T1(DF=N%W=7FE0%ACK=S++%Flags=BAS%Ops=ME)
  9214. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9215. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  9216. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9217. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9218. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9219. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9220. PU(DF=N%TOS=C0|A0|0|60%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9221.  
  9222. Fingerprint Linux 2.0.34-38
  9223. Class Linux | Linux | 2.0.X | general purpose
  9224. TSeq(Class=TR)
  9225. T1(DF=N%W=7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=AS%Ops=ME|M)
  9226. T2(Resp=N)
  9227. T3(Resp=Y%DF=N%W=7FDF|7FE0|7FF0|3FE0|3FF0|2200%ACK=S++%Flags=ASF%Ops=|ME|M)
  9228. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9229. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9230. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9231. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9232. PU(DF=N%TOS=C0|A0|0|20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  9233.  
  9234. Fingerprint Linux 2.0.35 (S.u.S.E. Linux 5.3 (i386)
  9235. Class Linux | Linux | 2.0.X | general purpose
  9236. TSeq(Class=TR%gcd=<6)
  9237. T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=ME)
  9238. T2(Resp=N)
  9239. T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=ASF%Ops=ME)
  9240. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9241. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9242. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9243. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9244. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9245.  
  9246. Fingerprint Linux 2.0.39
  9247. Class Linux | Linux | 2.0.X | general purpose
  9248. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9249. T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME)
  9250. T2(Resp=N)
  9251. T3(Resp=Y%DF=N%W=3FE0|0%ACK=S++%Flags=ARSF|AR%Ops=ME|)
  9252. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9253. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9254. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9255. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9256. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9257.  
  9258. Fingerprint Linux 2.1.19 - 2.2.25
  9259. Class Linux | Linux | 2.1.X | general purpose
  9260. Class Linux | Linux | 2.2.X | general purpose
  9261. TSeq(Class=RI%gcd=<8%SI=>10000%IPID=I%TS=100HZ)
  9262. T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
  9263. T2(Resp=N)
  9264. T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW)
  9265. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9266. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9267. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9268. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9269. PU(DF=N%TOS=28|C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  9270.  
  9271. Fingerprint Linux 2.1.24 PowerPC
  9272. Class Linux | Linux | 2.1.X | general purpose
  9273. TSeq(Class=TR)
  9274. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  9275. T2(Resp=N)
  9276. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  9277. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9278. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9279. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9280. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9281. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9282.  
  9283. Fingerprint Linux 2.1.76
  9284. Class Linux | Linux | 2.1.X | general purpose
  9285. TSeq(Class=TR)
  9286. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
  9287. T2(Resp=N)
  9288. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME)
  9289. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9290. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9291. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9292. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9293. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9294.  
  9295. Fingerprint Linux 2.1.88
  9296. Class Linux | Linux | 2.1.X | general purpose
  9297. TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7)
  9298. T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME)
  9299. T2(Resp=N)
  9300. T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|)
  9301. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9302. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9303. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9304. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9305. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9306.  
  9307. Fingerprint Linux 2.1.91 - 2.1.103
  9308. Class Linux | Linux | 2.1.X | general purpose
  9309. TSeq(Class=RI%gcd=<6%SI=>7A000)
  9310. T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW)
  9311. T2(Resp=N)
  9312. T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW)
  9313. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9314. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9315. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  9316. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9317. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9318.  
  9319. Fingerprint Linux 2.2.12 - 2.2.25
  9320. Class Linux | Linux | 2.2.X | general purpose
  9321. TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U)
  9322. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
  9323. T2(Resp=N)
  9324. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW)
  9325. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9326. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9327. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9328. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9329. PU(DF=N%TOS=0|60|A0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9330.  
  9331. Fingerprint Linux 2.2.13
  9332. Class Linux | Linux | 2.2.X | general purpose
  9333. TSeq(Class=RI%gcd=<6%SI=<E5F68C&>24CA0)
  9334. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9335. T2(Resp=N)
  9336. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9337. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9338. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9339. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9340. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9341. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  9342.  
  9343. # SuSE Linux 6.3 (i386) - Kernel 2.2.13
  9344. Fingerprint Linux 2.2.13 (SuSE; x86)
  9345. Class Linux | Linux | 2.2.X | general purpose
  9346. TSeq(Class=RI%gcd=<6%SI=<21DE76C&>2B4E4%IPID=I%TS=100HZ)
  9347. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
  9348. T2(Resp=N)
  9349. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT)
  9350. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9351. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9352. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9353. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9354. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9355.  
  9356. Fingerprint Linux 2.2.14
  9357. Class Linux | Linux | 2.2.X | general purpose
  9358. TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7)
  9359. T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9360. T2(Resp=N)
  9361. T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9362. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9363. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9364. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9365. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9366. PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)
  9367.  
  9368. Fingerprint Linux 2.2.16C37_III on Sun Cobalt
  9369. Class Linux | Linux | 2.2.X | general purpose
  9370. TSeq(Class=RI%gcd=<6%SI=<2021DA2&>3CBCC%IPID=I%TS=100HZ)
  9371. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9372. T2(Resp=N)
  9373. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9374. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9375. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9376. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9377. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9378. PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9379.  
  9380. # Linux 2.2.19-6.2.1ensim-3.1.5-2 (RedHat 7.2)
  9381. Fingerprint Linux 2.2.19
  9382. Class Linux | Linux | 2.2.X | general purpose
  9383. TSeq(Class=RI%gcd=<6%SI=<242483C&>5C202%IPID=I%TS=100HZ)
  9384. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9385. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9386. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9387. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9388. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9389. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9390. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9391. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9392.  
  9393. Fingerprint Linux 2.2.19 (Alpha)
  9394. Class Linux | Linux | 2.2.X | general purpose
  9395. TSeq(Class=RI%gcd=<6%SI=<1409420&>3348D%IPID=I%TS=1000HZ)
  9396. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9397. T2(Resp=N)
  9398. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9399. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9400. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9401. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9402. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9403. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9404.  
  9405. Fingerprint Linux 2.2.19 - 2.2.20
  9406. Class Linux | Linux | 2.2.X | general purpose
  9407. TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U)
  9408. T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
  9409. T2(Resp=N)
  9410. T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME)
  9411. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9412. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9413. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9414. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9415. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9416.  
  9417. # Linux 2.2.19 on a DEC Alpha 233mhz Multia
  9418. Fingerprint Linux 2.2.19 on a DEC Alpha
  9419. Class Linux | Linux | 2.2.X | general purpose
  9420. TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ)
  9421. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9422. T2(Resp=N)
  9423. T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  9424. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9425. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9426. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9427. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9428. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)
  9429.  
  9430. Fingerprint Linux 2.2.20 SMP
  9431. Class Linux | Linux | 2.2.X | general purpose
  9432. TSeq(Class=RI%gcd=<6%SI=<277C73C&>6371B%IPID=I%TS=100HZ)
  9433. T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
  9434. T2(Resp=N)
  9435. T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW)
  9436. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9437. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9438. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9439. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9440. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  9441.  
  9442. Fingerprint Linux 2.2.21 SMP (x86)
  9443. Class Linux | Linux | 2.2.X | general purpose
  9444. TSeq(Class=RI%gcd=<6%SI=<1921FE8&>404B1%IPID=I%TS=U)
  9445. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
  9446. T2(Resp=N)
  9447. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW)
  9448. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9449. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9450. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9451. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9452. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9453.  
  9454. Fingerprint Linux 2.2.22
  9455. Class Linux | Linux | 2.2.X | general purpose
  9456. TSeq(Class=RI%gcd=<6%SI=<22AB988&>58BFF%IPID=I%TS=U)
  9457. T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
  9458. T2(Resp=N)
  9459. T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW)
  9460. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9461. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9462. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9463. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9464. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9465.  
  9466. Fingerprint Linux 2.2.5 - 2.2.13 SMP
  9467. Class Linux | Linux | 2.2.X | general purpose
  9468. TSeq(Class=RI%gcd=<6%SI=<D49FAE&>2203C)
  9469. T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
  9470. T2(Resp=N)
  9471. T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME)
  9472. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9473. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9474. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9475. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9476. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E)
  9477.  
  9478. Fingerprint Linux 2.3.12
  9479. Class Linux | Linux | 2.3.X | general purpose
  9480. TSeq(Class=RI%gcd=<20%SI=>DDDD)
  9481. T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
  9482. T2(Resp=N)
  9483. T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW)
  9484. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9485. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9486. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9487. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9488. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9489.  
  9490. Fingerprint Linux 2.3.28-33
  9491. Class Linux | Linux | 2.3.X | general purpose
  9492. TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3)
  9493. T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  9494. T2(Resp=N)
  9495. T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  9496. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9497. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9498. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9499. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9500. PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9501.  
  9502. Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86
  9503. Class Linux | Linux | 2.3.X | general purpose
  9504. TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA)
  9505. T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  9506. T2(Resp=N)
  9507. T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  9508. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9509. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9510. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9511. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9512. PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9513.  
  9514. Fingerprint Linux 2.3.49 x86
  9515. Class Linux | Linux | 2.3.X | general purpose
  9516. TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E)
  9517. T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  9518. T2(Resp=N)
  9519. T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW)
  9520. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9521. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9522. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9523. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9524. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9525.  
  9526. Fingerprint Astaro Security Linux 4 (Kernel 2.4.19)
  9527. Class Linux | Linux | 2.4.X | general purpose
  9528. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  9529. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  9530. T2(Resp=N)
  9531. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW)
  9532. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9533. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9534. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9535. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9536. PU(Resp=N)
  9537.  
  9538. # I don't put "Gentoo" as the vendor for the classification because it
  9539. # makes output ugly when there are a bunch of Linux matches due to
  9540. # firewalling or similar problems.
  9541. Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5)
  9542. Class Linux | Linux | 2.4.X | general purpose
  9543. TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ)
  9544. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9545. T2(Resp=N)
  9546. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9547. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9548. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9549. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9550. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9551. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9552.  
  9553. # Cobalt Linux 6.0 Kernel 2.2.16c32_III on an i586
  9554. Fingerprint Linux 2.2.16
  9555. Class Linux | Linux | 2.4.X | general purpose
  9556. TSeq(Class=RI%gcd=<6%SI=<23D760E&>5BBDD%IPID=Z)
  9557. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9558. T2(Resp=N)
  9559. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9560. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9561. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9562. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9563. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9564. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9565.  
  9566. Fingerprint Linux 2.4.0 - 2.5.20
  9567. Class Linux | Linux | 2.4.X | general purpose
  9568. Class Linux | Linux | 2.5.X | general purpose
  9569. TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U)
  9570. T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
  9571. T2(Resp=N)
  9572. T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT)
  9573. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9574. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9575. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9576. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9577. PU(DF=Y|N%TOS=0|8|14|20|28|38|40|C0|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  9578.  
  9579. Fingerprint Linux 2.4.0 - 2.5.20 w/o tcp_timestamps
  9580. Class Linux | Linux | 2.4.X | general purpose
  9581. Class Linux | Linux | 2.5.X | general purpose
  9582. TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U)
  9583. T1(DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
  9584. T2(Resp=N)
  9585. T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW)
  9586. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9587. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9588. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9589. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9590. PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  9591.  
  9592. Fingerprint Linux 2.4.0-test5
  9593. Class Linux | Linux | 2.4.X | general purpose
  9594. TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8)
  9595. T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
  9596. T2(Resp=N)
  9597. T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW)
  9598. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9599. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9600. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9601. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9602. PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E)
  9603.  
  9604. # Linux 2.4.18
  9605. # SuSE Linux 7.3 linux-2.4.10-4GB, running on amd k6-2
  9606. Fingerprint Linux 2.4.10 - 2.4.18
  9607. Class Linux | Linux | 2.4.X | general purpose
  9608. TSeq(Class=RI%gcd=<6%SI=<21BFEA2&>46B9B%IPID=Z%TS=100HZ)
  9609. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  9610. T2(Resp=N)
  9611. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  9612. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9613. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9614. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9615. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9616. PU(DF=N%TOS=D0|D8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9617.  
  9618. # Strangely enough, I have received several prints like this that claim a T2:
  9619. Fingerprint Linux 2.4.16 - 2.4.18
  9620. Class Linux | Linux | 2.4.X | general purpose
  9621. TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ)
  9622. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9623. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  9624. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9625. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9626. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9627. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9628. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9629. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9630.  
  9631. Fingerprint Linux 2.4.17 on HP 9000 s700
  9632. Class Linux | Linux | 2.4.X | general purpose
  9633. TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ)
  9634. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9635. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  9636. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  9637. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  9638. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9639. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL)
  9640. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL)
  9641. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9642.  
  9643. Fingerprint Linux 2.4.18
  9644. Class Linux | Linux | 2.4.X | general purpose
  9645. TSeq(Class=RI%gcd=<8%SI=<1C15A06&>23F17%IPID=Z)
  9646. T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
  9647. T2(Resp=N)
  9648. T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW)
  9649. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9650. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9651. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9652. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9653. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9654.  
  9655. Fingerprint Linux 2.4.18 (PPC)
  9656. Class Linux | Linux | 2.4.X | general purpose
  9657. TSeq(Class=RI%gcd=<6%SI=<36CB986&>488A7%IPID=Z%TS=100HZ)
  9658. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  9659. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9660. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  9661. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9662. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9663. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9664. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9665. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9666.  
  9667. Fingerprint Linux 2.4.18 (x86)
  9668. Class Linux | Linux | 2.4.X | general purpose
  9669. TSeq(Class=RI%gcd=<6%SI=<5BA02C&>EA7B%IPID=Z%TS=100HZ)
  9670. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9671. T2(Resp=N)
  9672. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9673. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9674. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9675. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9676. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9677. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9678.  
  9679. Fingerprint Linux 2.4.18 (x86)
  9680. Class Linux | Linux | 2.4.X | general purpose
  9681. TSeq(Class=RI%gcd=<6%SI=<2774D66&>2F583%IPID=Z%TS=100HZ)
  9682. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9683. T2(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=)
  9684. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9685. T4(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=)
  9686. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9687. T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=)
  9688. T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
  9689. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9690.  
  9691. # Linux 2.4.18-custom
  9692. # Linux 2.4.19 w/o tcp_timestamps
  9693. Fingerprint Linux 2.4.18 - 2.4.19 w/o tcp_timestamps
  9694. Class Linux | Linux | 2.4.X | general purpose
  9695. TSeq(Class=RI%gcd=<6%SI=<1720870&>361B9%IPID=Z%TS=U)
  9696. T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
  9697. T2(Resp=N)
  9698. T3(Resp=Y%DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
  9699. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9700. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9701. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9702. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9703. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9704.  
  9705. Fingerprint Linux 2.4.18 - 2.4.20
  9706. Class Linux | Linux | 2.4.X | general purpose
  9707. TSeq(Class=RI%gcd=<6%SI=<14B7282&>11A94%IPID=Z%TS=100HZ)
  9708. T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9709. T2(Resp=N)
  9710. T3(Resp=Y%DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9711. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9712. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9713. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9714. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9715. PU(DF=N%TOS=30|60|D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9716.  
  9717. # linux 2.4.20 (i586) Preemptible
  9718. # Linux 2.4.18
  9719. Fingerprint Linux 2.4.18 - 2.4.20 (x86)
  9720. Class Linux | Linux | 2.4.X | general purpose
  9721. TSeq(Class=RI%gcd=<8%SI=<25C5808&>30578%IPID=Z%TS=100HZ)
  9722. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9723. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  9724. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9725. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9726. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9727. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9728. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9729. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9730.  
  9731. # Linux 2.4.20 (Gentoo 1.2; x86)
  9732. # Linux 2.4.18-14
  9733. Fingerprint Linux 2.4.18 - 2.4.20 (x86)
  9734. Class Linux | Linux | 2.4.X | general purpose
  9735. TSeq(Class=RI%gcd=<6%SI=<2B9C772&>6FA19%IPID=Z%TS=100HZ)
  9736. T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  9737. T2(Resp=N)
  9738. T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  9739. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9740. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9741. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9742. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9743. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9744.  
  9745. # Linux 2.4.18 on Alpha EV4
  9746. # Linux 2.5.70 (x86)
  9747. # Linux 2.6.4 i686
  9748. # Linux gentoo 2.6.7-gentoo-r11 i686
  9749. Fingerprint Linux 2.4.18 - 2.6.7
  9750. Class Linux | Linux | 2.4.X | general purpose
  9751. Class Linux | Linux | 2.5.X | general purpose
  9752. Class Linux | Linux | 2.6.X | general purpose
  9753. TSeq(Class=RI%gcd=<6%SI=<20DBA72&>5419C%IPID=Z%TS=1000HZ)
  9754. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9755. T2(Resp=N)
  9756. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9757. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9758. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9759. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9760. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9761. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9762.  
  9763. # Mandrake 9.1 SMP 2.4.19-16mdksmp #1 SMP Fri Sep 20 16:08:37 CEST 2002 i686 unknown unknown GNU/Linux
  9764. Fingerprint Linux 2.4.19 (Mandrake, X86)
  9765. Class Linux | Linux | 2.4.X | general purpose
  9766. TSeq(Class=RI%gcd=<6%SI=<263CFAC&>55266%IPID=Z%TS=U)
  9767. T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
  9768. T2(Resp=N)
  9769. T3(Resp=Y%DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M)
  9770. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9771. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9772. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9773. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9774. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  9775.  
  9776. Fingerprint Linux 2.4.19 (x86)
  9777. Class Linux | Linux | 2.4.X | general purpose
  9778. TSeq(Class=RI%gcd=<6%SI=<25CEE8A&>341B8%IPID=Z%TS=100HZ)
  9779. T1(DF=Y%W=1680%ACK=S++|O%Flags=AS%Ops=MNNTNW)
  9780. T2(Resp=N)
  9781. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  9782. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9783. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9784. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9785. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9786. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9787.  
  9788. # Linux 2.4.20-4GB-athlon i686
  9789. # SuSE Linux 8.2 2.4.20-64GB-SMP
  9790. # linux 2.4.19-4GB
  9791. Fingerprint Linux 2.4.19 - 2.4.20
  9792. Class Linux | Linux | 2.4.X | general purpose
  9793. TSeq(Class=RI%gcd=<6%SI=<22D7C86&>2AE00%IPID=I%TS=100HZ)
  9794. T1(DF=Y%W=16A0|1680|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9795. T2(Resp=N)
  9796. T3(Resp=N)
  9797. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9798. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9799. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9800. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9801. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  9802.  
  9803. Fingerprint Linux 2.4.19 w/grsecurity patch
  9804. Class Linux | Linux | 2.4.X | general purpose
  9805. TSeq(Class=RI%gcd=<6%SI=<2A492C6&>6C3F2%IPID=RD%TS=1000HZ)
  9806. T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
  9807. T2(Resp=N)
  9808. T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW)
  9809. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9810. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9811. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9812. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9813. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9814.  
  9815. Fingerprint Linux 2.4.20
  9816. Class Linux | Linux | 2.4.X | general purpose
  9817. TSeq(Class=RI%gcd=<6%SI=<18D4252&>3F8B9%IPID=Z%TS=100HZ)
  9818. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9819. T2(Resp=N)
  9820. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9821. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9822. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9823. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  9824. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  9825. PU(DF=N%TOS=8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9826.  
  9827. # Linux 2.4.20; Sysctl goodness below. Changed default TTL, syncookies, not sure what else. Scanned from localhost.
  9828. Fingerprint Linux 2.4.20
  9829. Class Linux | Linux | 2.4.X | general purpose
  9830. TSeq(Class=RI%gcd=<6%SI=<2C88A&>1E5%IPID=RD)
  9831. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9832. T2(Resp=N)
  9833. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9834. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9835. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9836. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9837. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9838. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9839.  
  9840. # Linux 2.4.20-xfs-rmap15d-ptrace #1 Debian GNU/Linux
  9841. Fingerprint Linux 2.4.20
  9842. Class Linux | Linux | 2.4.X | general purpose
  9843. TSeq(Class=RI%gcd=<6%SI=<15580A6&>30FB7%IPID=Z%TS=100HZ)
  9844. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9845. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9846. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9847. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9848. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9849. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9850. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  9851. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9852.  
  9853. Fingerprint Linux 2.4.20 (Itanium)
  9854. Class Linux | Linux | 2.4.X | general purpose
  9855. TSeq(Class=RI%gcd=<6%SI=<28E2CAC&>68A83%IPID=Z%TS=1000HZ)
  9856. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9857. T2(Resp=N)
  9858. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9859. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9860. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9861. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9862. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9863. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9864.  
  9865. # Red Hat Linux release 9 (Shrike) Kernel 2.4.20-8 on an i686
  9866. Fingerprint Linux 2.4.20 (Red Hat)
  9867. Class Linux | Linux | 2.4.X | general purpose
  9868. TSeq(Class=RI%gcd=<6%SI=<1B9DCC2&>469F7%IPID=Z%TS=100HZ)
  9869. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNTNW)
  9870. T2(Resp=N)
  9871. T3(Resp=N)
  9872. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9873. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9874. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9875. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9876. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9877.  
  9878. # Linux localhost 2.4.20-30.9 #1 Wed Feb 4 20:44:26 EST 2004 i686 i686 i386 GNU/Linux
  9879. Fingerprint Linux 2.4.20 (X86, Redhat 7.3)
  9880. Class Linux | Linux | 2.4.X | general purpose
  9881. TSeq(Class=RI%gcd=<6%SI=<3A23C96&>949CB%IPID=Z%TS=100HZ)
  9882. T1(DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW)
  9883. T2(Resp=N)
  9884. T3(Resp=Y%DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW)
  9885. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9886. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9887. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9888. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9889. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9890.  
  9891. # Linux 2.4.20-gentoo-r5 w/grsecurity
  9892. Fingerprint Linux 2.4.20 - 2.4.22 w/grsecurity.org patch
  9893. Class Linux | Linux | 2.4.X | general purpose
  9894. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  9895. T1(DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9896. T2(Resp=N)
  9897. T3(Resp=Y%DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9898. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9899. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9900. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9901. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9902. PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  9903.  
  9904. Fingerprint Linux 2.4.20 x86
  9905. Class Linux | Linux | 2.4.X | general purpose
  9906. TSeq(Class=RI%gcd=<8%SI=<1DB22CE&>1862A%IPID=Z%TS=100HZ)
  9907. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  9908. T2(Resp=N)
  9909. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  9910. T4(DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT)
  9911. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9912. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9913. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9914. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9915.  
  9916. # Linux 2.4.20-ac2
  9917. Fingerprint Linux 2.4.20-ac2
  9918. Class Linux | Linux | 2.4.X | general purpose
  9919. TSeq(Class=RI%gcd=<6%SI=<2A812D4&>2F29E%IPID=Z%TS=100HZ)
  9920. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9921. T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=)
  9922. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9923. T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=)
  9924. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9925. T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
  9926. T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=)
  9927. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9928.  
  9929. # SuSE Linux 8.1 (i386) 2.4.21 #4 SMP
  9930. Fingerprint Linux 2.4.21 (Suse, X86)
  9931. Class Linux | Linux | 2.4.X | general purpose
  9932. TSeq(Class=RI%gcd=<6%SI=<2634758&>55644%IPID=Z%TS=100HZ)
  9933. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9934. T2(Resp=N)
  9935. T3(Resp=N)
  9936. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9937. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9938. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9939. T7(Resp=N)
  9940. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  9941.  
  9942. # Linux 2.4.21-0.25mdk x86
  9943. Fingerprint Linux 2.4.21 (x86)
  9944. Class Linux | Linux | 2.4.X | general purpose
  9945. TSeq(Class=RI%gcd=<6%SI=<2A2786A&>6BE77%IPID=I%TS=100HZ)
  9946. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9947. T2(Resp=N)
  9948. T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9949. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9950. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9951. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9952. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9953. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9954.  
  9955. # Linux 2.4.21-121-athlon; SuSE, x86
  9956. Fingerprint Linux 2.4.21 (x86)
  9957. Class Linux | Linux | 2.4.X | general purpose
  9958. TSeq(Class=RI%gcd=<6%SI=<1C5FBC4&>48A1C%IPID=I%TS=1000HZ)
  9959. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  9960. T2(Resp=N)
  9961. T3(Resp=N)
  9962. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9963. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9964. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9965. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9966. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9967.  
  9968. # Linux mail2 2.4.21-4.ELsmp #1 SMP Fri Oct 3 17:52:56 EDT 2003 i686 i686 i386 GNU/Linux (Redhat Enterprise Linux AS 3)
  9969. Fingerprint Linux 2.4.21 (x86, RedHat)
  9970. Class Linux | Linux | 2.4.X | general purpose
  9971. TSeq(Class=RI%gcd=<6%SI=<26BFF42&>63303%IPID=Z%TS=100HZ)
  9972. T1(DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW)
  9973. T2(Resp=N)
  9974. T3(Resp=Y%DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW)
  9975. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9976. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9977. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9978. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9979. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9980.  
  9981. # Linux 2.4.21-166-default (Suse 9)
  9982. # Linux 2.4.23-pre6aa3 #2 Wed Mar 10 23:27:52 BRT 2004 i686 GNU/Linux
  9983. Fingerprint Linux 2.4.21 - 2.4.23
  9984. Class Linux | Linux | 2.4.X | general purpose
  9985. Class Linux | Linux | 2.6.X | general purpose
  9986. TSeq(Class=RI%gcd=<6%SI=<139B84E&>3230A%IPID=I%TS=1000HZ)
  9987. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  9988. T2(Resp=N)
  9989. T3(Resp=N)
  9990. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9991. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9992. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  9993. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  9994. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  9995.  
  9996. Fingerprint Linux 2.4.22 (SPARC)
  9997. Class Linux | Linux | 2.4.X | general purpose
  9998. TSeq(Class=RI%gcd=<6%SI=<256B646&>5FC9A%IPID=Z%TS=100HZ)
  9999. T1(DF=Y%W=1650%ACK=S++%Flags=AS%Ops=MNNTNW)
  10000. T2(Resp=N)
  10001. T3(Resp=Y%DF=Y%W=1650%ACK=S++%Flags=AS%Ops=MNNTNW)
  10002. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10003. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10004. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10005. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10006. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10007.  
  10008. # Linux 2.4.22 (x86) without timestamps, grsecurity 1.9 (rand_isns, rand_ip_ids)
  10009. Fingerprint Linux 2.4.22 (x86) w/grsecurity patch and with timestamps disabled
  10010. Class Linux | Linux | 2.4.X | general purpose
  10011. TSeq(Class=TR|RI%gcd=<6%IPID=RD|Z%TS=U)
  10012. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  10013. T2(Resp=N)
  10014. T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  10015. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10016. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10017. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10018. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10019. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10020.  
  10021. # Linux 2.4.22 (x86, Gentoo)
  10022. # Kernel 2.6.3 (X86); Gentoo Distro
  10023. Fingerprint Linux 2.4.22 - 2.6.3 (x86, Gentoo)
  10024. Class Linux | Linux | 2.4.X | general purpose
  10025. Class Linux | Linux | 2.6.X | general purpose
  10026. TSeq(Class=RI%gcd=<6%SI=<11A9004&>2D341%IPID=Z%TS=1000HZ)
  10027. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10028. T2(Resp=N)
  10029. T3(Resp=N)
  10030. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10031. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10032. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10033. T7(Resp=N)
  10034. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10035.  
  10036. # Linux 2.4.22 (x86, Gentoo)
  10037. # Linux server 2.6.7-ck5 (x86)
  10038. Fingerprint Linux 2.4.22 - 2.6.7
  10039. Class Linux | Linux | 2.4.X | general purpose
  10040. TSeq(Class=RI%gcd=<8%SI=<132F658&>188E0%IPID=Z%TS=1000HZ)
  10041. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10042. T2(Resp=N)
  10043. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10044. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10045. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10046. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10047. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10048. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10049.  
  10050. # Linux 2.4.22-gentoo-r7 (x86)
  10051. # Linux 2.6.4-gentoo-grsec (x86) - manual patch on gentoo's kernel (gentoo-dev-sources) with grsecurity-2.0-test2-2.6.4.patch
  10052. Fingerprint Linux 2.4.22 through 2.6.7 w/grsec (x86, Gentoo)
  10053. Class Linux | Linux | 2.4.X | general purpose
  10054. Class Linux | Linux | 2.6.X | general purpose
  10055. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  10056. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10057. T2(Resp=N)
  10058. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10059. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10060. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10061. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10062. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10063. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10064.  
  10065. Fingerprint Linux 2.4.22-ck2 (x86)   w/grsecurity.org and HZ=1000 patches
  10066. Class Linux | Linux | 2.4.X | general purpose
  10067. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  10068. T1(DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW)
  10069. T2(Resp=N)
  10070. T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW)
  10071. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10072. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10073. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10074. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10075. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10076.  
  10077. Fingerprint Linux 2.4.22-gentoo-r2 i686
  10078. Class Linux | Linux | 2.4.X | general purpose
  10079. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  10080. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10081. T2(Resp=N)
  10082. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10083. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10084. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10085. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10086. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10087. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  10088.  
  10089. # Linux gateway 2.4.22-gentoo-r5 #1 ven feb 6 05:25:25 CET 2004 i686 Celeron (Mendocino) GenuineIntel GNU/Linux - grsecurity patch + iptables
  10090. Fingerprint Linux 2.4.22-gentoo-r5 (x86) w/grsecurity
  10091. Class Linux | Linux | 2.4.X | general purpose
  10092. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  10093. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  10094. T2(Resp=N)
  10095. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  10096. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10097. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10098. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10099. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10100. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10101.  
  10102. Fingerprint Linux 2.4.22-gentoo-rc
  10103. Class Linux | Linux | 2.4.X | general purpose
  10104. TSeq(Class=RI%gcd=<8%SI=<22F8152&>2CC16%IPID=RD%TS=1000HZ)
  10105. T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  10106. T2(Resp=N)
  10107. T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  10108. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10109. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10110. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10111. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10112. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10113.  
  10114. Fingerprint Linux 2.4.23 (x86)
  10115. Class Linux | Linux | 2.4.X | general purpose
  10116. TSeq(Class=RI%gcd=<6%SI=<2B5505C&>6EEAA%IPID=I%TS=U)
  10117. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  10118. T2(Resp=N)
  10119. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  10120. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10121. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10122. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10123. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10124. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10125.  
  10126. Fingerprint Linux 2.4.23-grsec w/o timestamps
  10127. Class Linux | Linux | 2.4.X | general purpose
  10128. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  10129. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M)
  10130. T2(Resp=N)
  10131. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M)
  10132. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10133. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10134. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10135. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10136. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10137.  
  10138. # Adamantix GNU/Linux with Linux 2.4.25-grsec (X86)
  10139. Fingerprint Linux 2.4.25 w/grsec (x86)
  10140. Class Linux | Linux | 2.4.X | general purpose
  10141. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  10142. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10143. T2(Resp=N)
  10144. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10145. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10146. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10147. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10148. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10149. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10150.  
  10151. Fingerprint Linux 2.4.26-gentoo-r6 w/grsec
  10152. Class Linux | Linux | 2.4.X | general purpose
  10153. TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ)
  10154. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
  10155. T2(Resp=N)
  10156. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT)
  10157. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10158. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10159. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10160. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10161. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10162.  
  10163. Fingerprint Linux 2.4.27 with grsec
  10164. Class Linux | Linux | 2.4.X | general purpose
  10165. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  10166. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10167. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  10168. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10169. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10170. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10171. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10172. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10173. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10174.  
  10175. # Linux 2.4.3-2.10.1smp (RedHat 7.0.98 Wolverine)
  10176. Fingerprint Linux 2.4.3 SMP (RedHat)
  10177. Class Linux | Linux | 2.4.X | general purpose
  10178. TSeq(Class=RI%gcd=<6%SI=<2E7A750&>76F8A%IPID=Z%TS=1000HZ)
  10179. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10180. T2(Resp=N)
  10181. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10182. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10183. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10184. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10185. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10186. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10187.  
  10188. Fingerprint Linux 2.4.6 - 2.4.21
  10189. Class Linux | Linux | 2.4.X | general purpose
  10190. TSeq(Class=RI%gcd=<6%SI=<1E74A9A&>4DF5C%IPID=Z%TS=100HZ)
  10191. T1(DF=Y%W=16A0|4000|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10192. T2(Resp=N)
  10193. T3(Resp=N)
  10194. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10195. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10196. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10197. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10198. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10199.  
  10200. Fingerprint Linux 2.4.7 (x86)
  10201. Class Linux | Linux | 2.4.X | general purpose
  10202. TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U)
  10203. T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
  10204. T2(Resp=N)
  10205. T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M)
  10206. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10207. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10208. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10209. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10210. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10211.  
  10212. # Linux 2.4.7 (zLinux on OS/390)
  10213. Fingerprint Linux 2.4.7 (zLinux on OS/390)
  10214. Class Linux | Linux | 2.4.X | general purpose
  10215. TSeq(Class=RI%gcd=<6%SI=<152381A&>3616E%IPID=Z%TS=100HZ)
  10216. T1(DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
  10217. T2(Resp=N)
  10218. T3(Resp=Y%DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW)
  10219. T4(Resp=N)
  10220. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10221. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10222. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10223. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10224.  
  10225. # Linux Athena 2.6.3-1-686 #2 Tue Feb 24 20:24:38 EST 2004 i686 GNU/Linux
  10226. # Linux 2.4.7 (RedHat 7.3 on SPARC)  
  10227. Fingerprint Linux 2.4.7 through 2.6.3
  10228. Class Linux | Linux | 2.4.X | general purpose
  10229. Class Linux | Linux | 2.6.X | general purpose
  10230. TSeq(Class=RI%gcd=<6%SI=<1682210&>399B1%IPID=Z%TS=1000HZ)
  10231. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10232. T2(Resp=N)
  10233. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10234. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10235. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10236. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10237. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10238. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  10239.  
  10240. # Linux matrix 2.6.3-gentoo-r2 x86
  10241. Fingerprint Linux 2.5.25 - 2.6.3 or Gentoo 1.2 Linux 2.4.19 rc1-rc7)
  10242. Class Linux | Linux | 2.4.X | general purpose
  10243. Class Linux | Linux | 2.5.X | general purpose
  10244. Class Linux | Linux | 2.6.X | general purpose
  10245. TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ)
  10246. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10247. T2(Resp=N)
  10248. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10249. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10250. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10251. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10252. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10253. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10254.  
  10255. Fingerprint Microsoft Xbox running Debian Linux 2.4.20
  10256. Class Linux | Linux | 2.4.X | general purpose
  10257. TSeq(Class=RI%gcd=<6%SI=<FB5982&>2833E%IPID=Z%TS=100HZ)
  10258. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10259. T2(Resp=N)
  10260. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10261. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10262. T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
  10263. T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=)
  10264. T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=)
  10265. PU(Resp=N)
  10266.  
  10267. Fingerprint Linux 2.5.5 (Gentoo)
  10268. Class Linux | Linux | 2.6.X | general purpose
  10269. TSeq(Class=RI%gcd=<6%SI=<306B8C0&>6ABCE%IPID=Z%TS=1000HZ)
  10270. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10271. T2(Resp=N)
  10272. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10273. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10274. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10275. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10276. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10277. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  10278.  
  10279. Fingerprint Linux 2.6.0 (x86)
  10280. Class Linux | Linux | 2.6.X | general purpose
  10281. TSeq(Class=RI%gcd=<6%SI=<269E81A&>62D97%IPID=Z%TS=1000HZ)
  10282. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10283. T2(Resp=N)
  10284. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10285. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10286. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10287. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10288. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10289. PU(DF=N%TOS=D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10290.  
  10291. Fingerprint Linux 2.6.0 (x86)
  10292. Class Linux | Linux | 2.6.X | general purpose
  10293. TSeq(Class=RI%gcd=<6%SI=<34CD71A&>861AC%IPID=Z%TS=1000HZ)
  10294. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10295. T2(Resp=N)
  10296. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10297. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10298. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10299. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10300. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10301. PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10302.  
  10303. Fingerprint Linux 2.6.0-test10 (x86)
  10304. Class Linux | Linux | 2.6.X | general purpose
  10305. TSeq(Class=RI%gcd=<6%SI=<226FBCC&>58267%IPID=Z%TS=1000HZ)
  10306. T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  10307. T2(Resp=N)
  10308. T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW)
  10309. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10310. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10311. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10312. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10313. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10314.  
  10315. # Linux 2.6.0-test5 x86
  10316. Fingerprint Linux 2.6.0-test5 - 2.6.0 (x86)
  10317. Class Linux | Linux | 2.6.X | general purpose
  10318. TSeq(Class=RI%gcd=<6%SI=<29CB5CE&>6ADE5%IPID=Z%TS=1000HZ)
  10319. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10320. T2(Resp=N)
  10321. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10322. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10323. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10324. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10325. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10326. PU(DF=N%TOS=0|80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  10327.  
  10328. # Linux 2.6.0-test5 x86
  10329. Fingerprint Linux 2.6.0-test5 x86
  10330. Class Linux | Linux | 2.6.X | general purpose
  10331. TSeq(Class=RI%gcd=<6%SI=<2D3CFA0&>73C6B%IPID=Z%TS=1000HZ)
  10332. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10333. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  10334. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10335. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10336. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10337. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10338. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10339. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10340.  
  10341. Fingerprint Linux 2.6.0-test5-love3 (x86)
  10342. Class Linux | Linux | 2.6.X | general purpose
  10343. TSeq(Class=RI%gcd=<6%SI=<DDDFF6&>23458%IPID=Z%TS=U)
  10344. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
  10345. T2(Resp=N)
  10346. T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M)
  10347. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10348. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10349. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10350. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10351. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  10352.  
  10353. Fingerprint Linux 2.6.0-test7 (x86)
  10354. Class Linux | Linux | 2.6.X | general purpose
  10355. TSeq(Class=RI%gcd=<6%SI=<1488090&>34896%IPID=Z%TS=1000HZ)
  10356. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT)
  10357. T2(Resp=N)
  10358. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT)
  10359. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10360. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10361. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10362. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10363. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10364.  
  10365. Fingerprint Linux 2.6.0-test9 - 2.6.0 (x86)
  10366. Class Linux | Linux | 2.6.X | general purpose
  10367. TSeq(Class=RI%gcd=<6%SI=<263F536&>61B8F%IPID=Z%TS=1000HZ)
  10368. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10369. T2(Resp=N)
  10370. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10371. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10372. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10373. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10374. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10375. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10376.  
  10377. # Linux 2.6.3-gentoo-r1 #5 Wed Apr 7 13:48:31 EDT 2004 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux
  10378. # Gentoo 1.4.16; Kernel 2.6.7
  10379. Fingerprint Linux 2.6.3 - 2.6.7
  10380. Class Linux | Linux | 2.6.X | general purpose
  10381. TSeq(Class=RI%gcd=<6%SI=<1420E68&>337A0%IPID=Z%TS=1000HZ)
  10382. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10383. T2(Resp=N)
  10384. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10385. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10386. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10387. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10388. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10389. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  10390.  
  10391. Fingerprint Linux 2.6.3 - 2.6.8
  10392. Class Linux | Linux | 2.6.X | general purpose
  10393. TSeq(Class=RI%gcd=<6%SI=<3552DC&>8860%IPID=Z%TS=1000HZ)
  10394. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10395. T2(Resp=N)
  10396. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW)
  10397. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10398. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10399. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10400. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10401. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10402.  
  10403. # LINUX Suse 9.1 Professional Kernel 2.6.4 i686
  10404. Fingerprint Linux 2.6.4 (Suse)
  10405. Class Linux | Linux | 2.6.X | general purpose
  10406. TSeq(Class=RI%gcd=<6%SI=<1B18996&>45556%IPID=Z%TS=1000HZ)
  10407. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10408. T2(Resp=N)
  10409. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10410. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10411. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10412. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10413. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10414. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  10415.  
  10416. # Linux 2.6.6-rc2-bk3
  10417. Fingerprint Linux 2.6.6
  10418. Class Linux | Linux | 2.6.X | general purpose
  10419. TSeq(Class=RI%gcd=<6%SI=<2E04BFE&>4ADED%IPID=Z%TS=1000HZ)
  10420. T1(DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW)
  10421. T2(Resp=N)
  10422. T3(Resp=Y%DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW)
  10423. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10424. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10425. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10426. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10427. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10428.  
  10429. #  Linux 2.6.7-gentoo-r11 #2 Wed Jul 28 23:25:03 PDT 2004 i686 Pentium II (Deschutes)
  10430. # Linux  2.6.8-rc3 #1 Sat Aug 7 07:19:34 EDT 2004 i686 GNU/Linux
  10431. Fingerprint Linux 2.6.7 - 2.6.8
  10432. Class Linux | Linux | 2.6.X | general purpose
  10433. TSeq(Class=RI%gcd=<6%SI=<2BF6254&>70895%IPID=Z%TS=1000HZ)
  10434. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10435. T2(Resp=N)
  10436. T3(Resp=N)
  10437. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10438. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10439. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10440. T7(Resp=N)
  10441. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10442.  
  10443. Fingerprint Linux 2.6.7 w/grsecurity.org patch
  10444. Class Linux | Linux | 2.6.X | general purpose
  10445. TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ)
  10446. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10447. T2(Resp=N)
  10448. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10449. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10450. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10451. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10452. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10453. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10454.  
  10455. # Debian Sarge Kernel 2.6.8
  10456. Fingerprint Linux 2.6.8 (Debian)
  10457. Class Linux | Linux | 2.6.X | general purpose
  10458. TSeq(Class=RI%gcd=<6%SI=<2C96D4E&>34B7A%IPID=Z%TS=100HZ)
  10459. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10460. T2(Resp=N)
  10461. T3(Resp=N)
  10462. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10463. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10464. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10465. T7(Resp=N)
  10466. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10467.  
  10468. # Linux Kernel 2.6.3 (X86)
  10469. #  Linux 2.6.7 #3 Sat Jul 17 13:25:29 EEST 2004 i486
  10470. Fingerprint Linux Kernel 2.6.3 - 2.6.7 (X86)
  10471. Class Linux | Linux | 2.6.X | general purpose
  10472. TSeq(Class=RI%gcd=<6%SI=<205C682&>528B7%IPID=Z%TS=1000HZ)
  10473. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
  10474. T2(Resp=N)
  10475. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW)
  10476. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10477. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10478. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10479. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10480. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10481.  
  10482. Fingerprint Linux kernel 2.6.4 (x86)
  10483. Class Linux | Linux | 2.6.X | general purpose
  10484. TSeq(Class=RI%gcd=<6%SI=<16FCF2E&>297DE%IPID=Z%TS=1000HZ)
  10485. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10486. T2(Resp=N)
  10487. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10488. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10489. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10490. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10491. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10492. PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  10493.  
  10494. Fingerprint Linux kernel 2.6.4 (X86)
  10495. Class Linux | Linux | 2.6.X | general purpose
  10496. TSeq(Class=RI%gcd=<A%SI=<1E2EBD0&>198DF%IPID=Z%TS=1000HZ)
  10497. T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10498. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  10499. T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW)
  10500. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10501. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10502. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10503. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10504. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10505.  
  10506. # Linux 2.6.5 (Gentoo)
  10507. # Linux 2.6.8 (Fedora Core 2)
  10508. Fingerprint Linux kernel 2.6.5 - 2.6.8
  10509. Class Linux | Linux | 2.6.X | general purpose
  10510. TSeq(Class=RI%gcd=<6%SI=<17F9116&>3D580%IPID=Z%TS=1000HZ)
  10511. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10512. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  10513. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  10514. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10515. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10516. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10517. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10518. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10519.  
  10520. Fingerprint ComOS based terminal server - Livingston PortMaster or U.S. Robotics/3Com Total Control
  10521. Class Livingston | ComOS || terminal server
  10522. Class 3Com | ComOS || terminal server
  10523. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10524. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10525. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10526. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10527. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10528. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10529. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10530. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  10531.  
  10532. Fingerprint ATT UNIX SVR4.2 on a Lucent Definity voicemail system
  10533. Class Lucent | BSD-misc || general purpose
  10534. TSeq(Class=64K)
  10535. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  10536. T2(Resp=N)
  10537. T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
  10538. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10539. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10540. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10541. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10542. PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  10543.  
  10544. Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2
  10545. Class Lucent | ComOS || terminal server
  10546. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10547. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10548. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10549. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10550. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10551. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10552. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10553. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10554.  
  10555. # http://www.sics.se/~adam/lwip/
  10556. Fingerprint lwIP (Lightweight TCP/IP stack) version lwip-0.5.3-win32
  10557. Class lwIP | lwIP || general purpose
  10558. TSeq(Class=TD%gcd=<6%SI=<3C%IPID=I%TS=U)
  10559. T1(DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
  10560. T2(Resp=N)
  10561. T3(Resp=Y%DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME)
  10562. T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  10563. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10564. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  10565. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10566. PU(Resp=N)
  10567.  
  10568. Fingerprint Magna SG10 intranet router
  10569. Class Magna | embedded || router
  10570. TSeq(Class=RI%gcd=<6%SI=<31AD68E&>5F62F%TS=100HZ)
  10571. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW)
  10572. T2(Resp=N)
  10573. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10574. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10575. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10576. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10577. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10578. PU(Resp=N)
  10579.  
  10580. Fingerprint Maxim-IC TiniOS DS80c400
  10581. Class Maxim-IC | TiniOS || general purpose
  10582. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  10583. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  10584. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  10585. T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  10586. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10587. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10588. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10589. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10590. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10591.  
  10592. Fingerprint Maxim/Dallas TINI embedded Java v1.02b
  10593. Class Maxim-IC | TiniOS || general purpose
  10594. TSeq(Class=TD%gcd=<1F408%SI=<28%IPID=Z%TS=U)
  10595. T1(DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|)
  10596. T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10597. T3(Resp=Y%DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|)
  10598. T4(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10599. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10600. T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10601. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10602. PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  10603.  
  10604. # Maxim/Dallas TINI embedded Java v1.11
  10605. # Dallas Semiconductor TINI OS 1.02d
  10606. Fingerprint Maxim/Dallas TINI embedded Java v1.02d
  10607. Class Maxim-IC | TiniOS || general purpose
  10608. TSeq(Class=TR%gcd=<6%IPID=Z%TS=U)
  10609. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  10610. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  10611. T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  10612. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10613. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10614. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10615. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10616. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10617.  
  10618. Fingerprint MegaBit Gear TE4111C modem
  10619. Class Megabit | embedded || terminal server
  10620. TSeq(Class=64K%IPID=I%TS=U)
  10621. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  10622. T2(Resp=N)
  10623. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  10624. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  10625. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10626. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10627. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10628. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  10629.  
  10630. Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997)
  10631. Class Meridian | embedded || storage-misc
  10632. TSeq(Class=TD%gcd=40000%SI=<A)
  10633. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  10634. T2(Resp=N)
  10635. T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=)
  10636. T4(DF=N%W=200%ACK=O%Flags=R%Ops=)
  10637. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10638. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10639. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10640. PU(Resp=N)
  10641.  
  10642. Fingerprint Microbase VirtuOS v3.00b R.09
  10643. Class Microbase | VirtuOS || general purpose
  10644. TSeq(Class=TD%gcd=<2120004%SI=<14%IPID=I%TS=U)
  10645. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  10646. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  10647. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  10648. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  10649. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  10650. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  10651. T7(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  10652. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10653.  
  10654. Fingerprint Microplex Print Server
  10655. Class Microplex | embedded || print server
  10656. TSeq(Class=C)
  10657. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  10658. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10659. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME)
  10660. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10661. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10662. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10663. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10664. PU(Resp=N)
  10665.  
  10666. # Bart's Network Boot Disk 2.7 http://www.nu2.nu/bootdisk/network/ i386
  10667. Fingerprint Bart's Network Boot Disk 2.7 (X86) MS-DOS
  10668. Class Microsoft | DOS || general purpose
  10669. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  10670. T1(DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M)
  10671. T2(Resp=N)
  10672. T3(Resp=Y%DF=N%W=5AA%ACK=S++%Flags=AS%Ops=M)
  10673. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10674. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10675. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10676. T7(Resp=N)
  10677. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  10678.  
  10679. Fingerprint NCSA Telnet (dos)
  10680. Class Microsoft | DOS || general purpose
  10681. TSeq(Class=C)
  10682. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10683. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10684. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10685. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10686. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10687. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10688. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10689. PU(Resp=N)
  10690.  
  10691. # I'm not 100% sure this version is for DOS, just a guess
  10692. Fingerprint NCSA Telnet 2.3.08 for the PC (DOS)
  10693. Class Microsoft | DOS || general purpose
  10694. TSeq(Class=C)
  10695. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  10696. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  10697. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  10698. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  10699. T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  10700. T6(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  10701. T7(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  10702. PU(Resp=N)
  10703.  
  10704. Fingerprint Watt-32 DOS tcp/ip stack
  10705. Class Microsoft | DOS || general purpose
  10706. TSeq(Class=C%IPID=I%TS=1000HZ)
  10707. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MNNT)
  10708. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  10709. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10710. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10711. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10712. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10713. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10714. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10715.  
  10716. Fingerprint WNOS 5.0 on Microsoft DOS 6.22
  10717. Class Microsoft | DOS || general purpose
  10718. TSeq(Class=TD%gcd=1000|2000|3000%SI=<7F)
  10719. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  10720. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10721. T3(DF=N%W=400%ACK=O%Flags=AS%Ops=M)
  10722. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10723. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10724. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10725. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10726. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10727.  
  10728. # Microsoft xbox with hacked bios and xbmc running
  10729. #  Evolution-X 2.X (unsure which evolution-x version is running, one from the 2.X series though...) on mod-chipped XBOX
  10730. Fingerprint Microsoft Xbox (modified)
  10731. Class Microsoft | embedded || game console
  10732. TSeq(Class=RI%gcd=<6%SI=<5C26&>74%IPID=I%TS=U)
  10733. T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
  10734. T2(Resp=N)
  10735. T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
  10736. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10737. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10738. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10739. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10740. PU(Resp=N)
  10741.  
  10742. # v1.5 XBOX running Evolution build 3935, fresh default install.
  10743. # Microsoft XBOX with SmartXX modchip - running XBOX Media Center v1.0
  10744. Fingerprint Microsoft Xbox (modified)
  10745. Class Microsoft | embedded || game console
  10746. TSeq(Class=RI%gcd=<6%SI=<AD02&>20%TS=U)
  10747. T1(DF=N%W=4238%ACK=S++%Flags=AS%Ops=M)
  10748. T2(Resp=N)
  10749. T3(Resp=Y%DF=N%W=4238%ACK=S++%Flags=AS%Ops=M)
  10750. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10751. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10752. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10753. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10754. PU(Resp=N)
  10755.  
  10756. Fingerprint Microsoft Xbox (modified) running EvolutionX
  10757. Class Microsoft | embedded || game console
  10758. TSeq(Class=TD%gcd=<6%SI=<2E4%IPID=I%TS=U)
  10759. T1(DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M)
  10760. T2(Resp=N)
  10761. T3(Resp=Y%DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M)
  10762. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10763. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10764. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10765. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10766. PU(Resp=N)
  10767.  
  10768. # Xbox V1.1 Running Evolution-X Dashboard v1.8.3752
  10769. Fingerprint Microsoft Xbox (modified) running evolutionX
  10770. Class Microsoft | embedded || game console
  10771. TSeq(Class=RI%gcd=<6%SI=<5A14&>20%IPID=I%TS=U)
  10772. T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
  10773. T2(Resp=N)
  10774. T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M)
  10775. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10776. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10777. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10778. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10779. PU(Resp=N)
  10780.  
  10781. Fingerprint Microsoft Xbox (modified) running UnleashX 0.26
  10782. Class Microsoft | embedded || game console
  10783. TSeq(Class=RI%gcd=<6%SI=<A79E&>99%IPID=I%TS=U)
  10784. T1(DF=N%W=8470%ACK=S++%Flags=AS%Ops=M)
  10785. T2(Resp=N)
  10786. T3(Resp=Y%DF=N%W=8470%ACK=S++%Flags=AS%Ops=M)
  10787. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10788. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10789. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10790. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10791. PU(Resp=N)
  10792.  
  10793. # Microsoft Windows Longhorn Preview, Version 6.0 Build 4051.idx 02.031001-1340
  10794. Fingerprint Microsoft Windows Longhorn Preview
  10795. Class Microsoft | Windows Longhorn || general purpose
  10796. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  10797. T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10798. T2(Resp=N)
  10799. T3(Resp=N)
  10800. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10801. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  10802. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  10803. T7(Resp=N)
  10804. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10805.  
  10806. # Microsoft Windows Server 2003, Enterprise Edition, Build 3790
  10807. # Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947)
  10808. Fingerprint Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947)
  10809. Class Microsoft | Windows | 2003/.NET | general purpose
  10810. TSeq(Class=TR%gcd=<6%IPID=I)
  10811. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  10812. T2(Resp=N)
  10813. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  10814. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10815. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10816. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10817. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10818. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10819.  
  10820. # Microsoft Windows Server 2003 Standard Edition
  10821. Fingerprint Microsoft Windows 2003 Server
  10822. Class Microsoft | Windows | 2003/.NET | general purpose
  10823. TSeq(Class=TR%gcd=<6%IPID=I)
  10824. T1(DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  10825. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10826. T3(Resp=Y%DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  10827. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10828. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10829. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10830. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10831. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10832.  
  10833. # Microsoft Windows 2003 Server (Version 5.2 build 3790.srv03_rtm.030324-2048)
  10834. Fingerprint Microsoft Windows 2003 Server
  10835. Class Microsoft | Windows | 2003/.NET | general purpose
  10836. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  10837. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  10838. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10839. T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  10840. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10841. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10842. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10843. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10844. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10845.  
  10846. # Microsoft Windows.NET Enterprise Server (build 3615 beta)
  10847. # Windows .NET standard server build 3604
  10848. # Microsoft Windows 2003 Standard Build V5.2.3790 build 3790
  10849. # Microsoft Windows 2003 Server - Web edition - all available critical fixes as of 15th feb 2004
  10850. # Windows 2003 Standard Edition RTM
  10851. # Window Server 2003 Enterprise Edition Swedish
  10852. # Microsoft Windows XP Professional (English) w/ SP2 RC1 build 2600.xpsp_sp2_rc1.040311-2315 - WINDOWS FIREWALL DISABLED
  10853. Fingerprint Microsoft Windows 2003 Server or XP SP2
  10854. Class Microsoft | Windows | 2003/.NET | general purpose
  10855. Class Microsoft | Windows | NT/2K/XP | general purpose
  10856. TSeq(Class=TR%gcd=<6%IPID=I)
  10857. T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
  10858. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10859. T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
  10860. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10861. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10862. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10863. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10864. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  10865.  
  10866. Fingerprint Microsoft Windows Server 2003
  10867. Class Microsoft | Windows | 2003/.NET | general purpose
  10868. TSeq(Class=TR%gcd=<6)
  10869. T1(DF=Y%W=FB8B%ACK=S++%Flags=AS%Ops=MNWNNT)
  10870. T2(Resp=N)
  10871. T3(Resp=N)
  10872. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10873. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10874. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10875. T7(Resp=N)
  10876. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10877.  
  10878. # Microsoft Windows Server 2003 Enterprise Edition (Trial Version downloaded from Microsoft as at 06/03
  10879. # Microsoft Windows .NET Standard Server RC#2 (build 3718)
  10880. Fingerprint Microsoft Windows Server 2003
  10881. Class Microsoft | Windows | 2003/.NET | general purpose
  10882. TSeq(Class=TR%gcd=<6%IPID=I)
  10883. T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  10884. T2(Resp=N)
  10885. T3(Resp=N)
  10886. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10887. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10888. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10889. T7(Resp=N)
  10890. PU(DF=N%TOS=0|20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10891.  
  10892. Fingerprint Microsoft Windows Server 2003
  10893. Class Microsoft | Windows | 2003/.NET | general purpose
  10894. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  10895. T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW)
  10896. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10897. T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW)
  10898. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10899. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10900. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10901. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10902. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10903.  
  10904. # Microsoft Windows Server 2003 Enterprise Edition (English) with latest Windows Update patches as of September 2, 2004
  10905. Fingerprint Microsoft Windows Server 2003 Enterprise Edition
  10906. Class Microsoft | Windows | 2003/.NET | general purpose
  10907. T1(DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT)
  10908. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10909. T3(Resp=Y%DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT)
  10910. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10911. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10912. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10913. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10914. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10915.  
  10916. # Windows Server 2003, build 3790
  10917. Fingerprint Microsoft Windows Server 2003 or XP SP2
  10918. Class Microsoft | Windows | 2003/.NET | general purpose
  10919. Class Microsoft | Windows | NT/2K/XP | general purpose
  10920. TSeq(Class=TR%gcd=<6)
  10921. T1(DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  10922. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10923. T3(Resp=Y%DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  10924. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10925. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10926. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  10927. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10928. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10929.  
  10930. Fingerprint Microsoft Windows Server 2003 Standard Edition
  10931. Class Microsoft | Windows | 2003/.NET | general purpose
  10932. TSeq(Class=TR%gcd=<6%IPID=I)
  10933. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  10934. T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  10935. T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
  10936. T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  10937. T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
  10938. T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL)
  10939. T7(DF=N%W=400|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  10940. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10941.  
  10942. # Windows 2003 Standard build 3790
  10943. Fingerprint Microsoft Windows Server 2003 Standard Edition
  10944. Class Microsoft | Windows | 2003/.NET | general purpose
  10945. TSeq(Class=TR%gcd=<6%IPID=I)
  10946. T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNNT)
  10947. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  10948. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  10949. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  10950. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10951. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  10952. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  10953. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  10954.  
  10955. Fingerprint Microsoft Windows 3.1 with Trumpet Winsock 2.0 revision B
  10956. Class Microsoft | Windows | 3.X | general purpose
  10957. TSeq(Class=TD%gcd=10000%SI=<FF)
  10958. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  10959. T2(Resp=N)
  10960. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  10961. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10962. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10963. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  10964. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10965. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10966.  
  10967. Fingerprint Microsoft Windows for Workgroups 3.11 / TCP/IP-32 3.11b stack or Windows 98
  10968. Class Microsoft | Windows | 3.X | general purpose
  10969. Class Microsoft | Windows | 95/98/ME | general purpose
  10970. TSeq(Class=TD%gcd=<F%SI=<F)
  10971. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  10972. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10973. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  10974. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10975. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10976. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10977. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10978. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10979.  
  10980. # Win95 4.00.950B  -  IE 5 5.50.4807.2300
  10981. Fingerprint Microsoft Windows 95 4.00.950B
  10982. Class Microsoft | Windows | 95/98/ME | general purpose
  10983. TSeq(Class=TD%gcd=<6%SI=<3C%IPID=BI%TS=U)
  10984. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  10985. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10986. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  10987. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  10988. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10989. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  10990. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  10991. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  10992.  
  10993. Fingerprint Microsoft Windows 95 4.00.950B (IE 5 5.00 2314.1003)
  10994. Class Microsoft | Windows | 95/98/ME | general purpose
  10995. TSeq(Class=TD%gcd=<14%SI=<32%IPID=BI)
  10996. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  10997. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  10998. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  10999. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  11000. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11001. T6(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
  11002. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11003. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11004.  
  11005. Fingerprint Microsoft Windows 95/98/NT 4.0 or PocketPC
  11006. Class Microsoft | Windows | 95/98/ME | general purpose
  11007. Class Microsoft | Windows | PocketPC/CE | PDA
  11008. TSeq(Class=TD|RI%gcd=1|2|3|4|5|8|A|14|1E|28|5A|17C%SI=<1F4)
  11009. T1(DF=Y%W=2017|16D0|860|8000|869F%ACK=S++%Flags=AS%Ops=M|MNWNNT)
  11010. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11011. T3(Resp=Y%DF=Y|N%W=0%ACK=O%Flags=AR%Ops=)
  11012. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  11013. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11014. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  11015. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11016. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11017.  
  11018. Fingerprint Microsoft Windows 98
  11019. Class Microsoft | Windows | 95/98/ME | general purpose
  11020. TSeq(Class=RI%gcd=<6%SI=<FFF)
  11021. T1(DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
  11022. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11023. T3(Resp=Y%DF=Y%W=BB80%ACK=S++%Flags=AS%Ops=M)
  11024. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  11025. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11026. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  11027. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11028. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11029.  
  11030. Fingerprint Microsoft Windows 98 4.10.1998
  11031. Class Microsoft | Windows | 95/98/ME | general purpose
  11032. TSeq(Class=TD%gcd=<6%SI=<78%IPID=BI%TS=U)
  11033. T1(DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
  11034. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11035. T3(Resp=Y%DF=Y%W=10C0%ACK=S++%Flags=AS%Ops=M)
  11036. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  11037. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11038. T6(DF=N%W=0%ACK=S|O%Flags=R%Ops=)
  11039. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11040. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11041.  
  11042. # Windows 98SE 4.10.2222A
  11043. # Windows 98 4.10.1998
  11044. Fingerprint Microsoft Windows 98 or 98SE
  11045. Class Microsoft | Windows | 95/98/ME | general purpose
  11046. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=BI%TS=U)
  11047. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  11048. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11049. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  11050. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11051. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11052. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11053. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11054. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11055.  
  11056. Fingerprint Microsoft Windows 98 SP1
  11057. Class Microsoft | Windows | 95/98/ME | general purpose
  11058. TSeq(Class=TD%gcd=<5%SI=<20)
  11059. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  11060. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11061. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  11062. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  11063. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11064. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  11065. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11066. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11067.  
  11068. Fingerprint Microsoft Windows 98 SP2
  11069. Class Microsoft | Windows | 95/98/ME | general purpose
  11070. TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U)
  11071. T1(DF=Y%W=270F%ACK=S++%Flags=AS%Ops=M)
  11072. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11073. T3(Resp=Y%DF=Y%W=270F%ACK=S++%Flags=AS%Ops=M)
  11074. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11075. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11076. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11077. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11078. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11079.  
  11080. # Microsoft Windows 98 4.10.2222.A
  11081. # "Windows 98 Second Edition, patched up to date" (1/25/03)
  11082. Fingerprint Microsoft Windows 98SE
  11083. Class Microsoft | Windows | 95/98/ME | general purpose
  11084. TSeq(Class=TD%gcd=<A%SI=<46%IPID=RPI|RD|BI%TS=U)
  11085. T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
  11086. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11087. T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
  11088. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11089. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11090. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11091. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11092. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11093.  
  11094. # Windows 98 4.10.2222 A (1/27/04)
  11095. Fingerprint Microsoft Windows 98SE
  11096. Class Microsoft | Windows | 95/98/ME | general purpose
  11097. TSeq(Class=TD%gcd=<F4%SI=<14%IPID=RPI%TS=U)
  11098. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11099. T2(Resp=N)
  11100. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11101. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11102. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11103. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11104. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11105. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11106.  
  11107. # Windows 98 Second Edition (build 2222)
  11108. Fingerprint Microsoft Windows 98SE
  11109. Class Microsoft | Windows | 95/98/ME | general purpose
  11110. TSeq(Class=TD%gcd=<6%SI=<46%IPID=RPI|RD|BI%TS=U)
  11111. T1(DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
  11112. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11113. T3(Resp=Y%DF=Y%W=D780|EBC0%ACK=S++%Flags=AS%Ops=MNW)
  11114. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11115. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11116. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11117. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11118. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11119.  
  11120. # Microsoft Windows 98SE, no service packs
  11121. Fingerprint Microsoft Windows 98SE
  11122. Class Microsoft | Windows | 95/98/ME | general purpose
  11123. TSeq(Class=TD%gcd=<FF%SI=<32%IPID=BI%TS=U)
  11124. T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  11125. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11126. T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  11127. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11128. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11129. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11130. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11131. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11132.  
  11133. Fingerprint Microsoft Windows 98SE + IE5.5sp1
  11134. Class Microsoft | Windows | 95/98/ME | general purpose
  11135. T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M)
  11136. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11137. T3(Resp=N)
  11138. T4(DF=N%W=2DA0|0%ACK=S++|O%Flags=AS|R%Ops=M|)
  11139. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11140. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11141. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11142. PU(Resp=N|Y)
  11143.  
  11144. # Microsoft Windows 98SE, service pack 1 installed, litepc installed (www.litepc.com)
  11145. Fingerprint Microsoft Windows 98SE SP1
  11146. Class Microsoft | Windows | 95/98/ME | general purpose
  11147. TSeq(Class=TD%gcd=<6%SI=<32%IPID=BI%TS=U)
  11148. T1(DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=M)
  11149. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11150. T3(Resp=Y%DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=M)
  11151. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11152. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11153. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11154. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11155. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11156.  
  11157. Fingerprint Microsoft Windows 98SE with security patch A
  11158. Class Microsoft | Windows | 95/98/ME | general purpose
  11159. TSeq(Class=TD%gcd=<6%SI=<AA%IPID=BI%TS=U)
  11160. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  11161. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11162. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  11163. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11164. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11165. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11166. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11167. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11168.  
  11169. # Microsoft Windows Millenium Edition - no service packs
  11170. Fingerprint Microsoft Windows Millennium Edition
  11171. Class Microsoft | Windows | 95/98/ME | general purpose
  11172. TSeq(Class=RI%gcd=<6%SI=<2B05C&>2D1%IPID=I)
  11173. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
  11174. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11175. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT)
  11176. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11177. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11178. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11179. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11180. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11181.  
  11182. # Windows ME + all updates as of 1/1/03
  11183. Fingerprint Microsoft Windows Millennium Edition (Me)
  11184. Class Microsoft | Windows | 95/98/ME | general purpose
  11185. TSeq(Class=RI%gcd=<8%SI=<1DA74&>117%IPID=I)
  11186. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11187. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11188. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  11189. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11190. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11191. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11192. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11193. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11194.  
  11195. Fingerprint Microsoft Windows Millennium Edition (Me)
  11196. Class Microsoft | Windows | 95/98/ME | general purpose
  11197. TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I)
  11198. T1(DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT)
  11199. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11200. T3(Resp=Y%DF=Y%W=E920%ACK=S++%Flags=AS%Ops=MNWNNT)
  11201. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11202. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11203. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11204. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11205. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11206.  
  11207. # Windows Millenium Edition v4.90.300
  11208. # Windows Me or Windows 2000 RC1 through final release
  11209. # Microsoft Windows 2000 Advanced Server
  11210. # Windows 2000 with SP2 and long fat pipe (RFC 1323)
  11211. # Windows 2000 Pro Service Pack 3
  11212. # Windows 2000 5.00.2195 Service Pack 2 and latest hotfixes
  11213. # Windows 2000 Pro (x86)
  11214. # Compaq ProLiant DL-380G2 running Windows 2000 with SP3 and all the current patch sets (2/3/03)
  11215. # Windows XP Pro version 2002 on PC Intel processor
  11216. # Windows XP Build 2600
  11217. # XP Pro 5.1 (build 2600).. all patches up to June 20, 2002
  11218. # Fingerprint Microsoft Windows XP Pro with all current updates to May 2002
  11219. # Windows 2000 Version 5.0 Build (2195: Service Pack 3)
  11220. #  Windows 2000 Advanced Server SP3
  11221. Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000 Pro or Advanced Server, or Windows XP
  11222. Class Microsoft | Windows | 95/98/ME | general purpose
  11223. Class Microsoft | Windows | NT/2K/XP | general purpose
  11224. TSeq(Class=RI%gcd=<6%SI=<FFFFF&>49C%IPID=I%TS=0)
  11225. T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|4470|8052|B5C9|B580|C000|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT)
  11226. T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11227. T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|4470|8052|B5C9|B580|C000|402E|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11228. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11229. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11230. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11231. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11232. PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  11233.  
  11234. # Windows NT 3.51 SP5
  11235. Fingerprint Microsoft Windows NT 3.51 SP5, NT 4.0 or 95/98/98SE
  11236. Class Microsoft | Windows | 95/98/ME | general purpose
  11237. Class Microsoft | Windows | NT/2K/XP | general purpose
  11238. TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4%IPID=BI|RPI|RD%TS=U|0)
  11239. T1(DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=A|AS%Ops=|M|MNWNNT)
  11240. T2(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11241. T3(Resp=Y%DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=AS%Ops=M|MNWNNT)
  11242. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  11243. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11244. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  11245. T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=)
  11246. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11247.  
  11248. Fingerprint Microsoft Windows 2000 AD SP4
  11249. Class Microsoft | Windows | NT/2K/XP | general purpose
  11250. TSeq(Class=TR%gcd=<6)
  11251. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11252. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  11253. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  11254. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  11255. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11256. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL)
  11257. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  11258. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11259.  
  11260. Fingerprint Microsoft Windows 2000 Advanced Server SP3
  11261. Class Microsoft | Windows | NT/2K/XP | general purpose
  11262. TSeq(Class=RI%gcd=<6%SI=<206B6&>2E7%IPID=I)
  11263. T1(DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT)
  11264. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11265. T3(Resp=Y%DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT)
  11266. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11267. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11268. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11269. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11270. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11271.  
  11272. # Microsoft Windows 2000 Advanced Server SP3, all available updates as of 11/13/02
  11273. Fingerprint Microsoft Windows 2000 Advanced Server SP3
  11274. Class Microsoft | Windows | NT/2K/XP | general purpose
  11275. TSeq(Class=RI%gcd=<6%SI=<58066&>3E9%IPID=I)
  11276. T1(DF=Y%W=402E|FFF0%ACK=S++%Flags=AS%Ops=MNNT|MNWNNT)
  11277. T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  11278. T3(Resp=Y%DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  11279. T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  11280. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11281. T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL)
  11282. T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  11283. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11284.  
  11285. # Windows 2000 Advanced Server Service Pack 4 With ALL updates as of October 9th 2003 Winver: Version 5 build 2195 SP4
  11286. Fingerprint Microsoft Windows 2000 AS SP4
  11287. Class Microsoft | Windows | NT/2K/XP | general purpose
  11288. TSeq(Class=RI%gcd=<6%SI=<1FD06&>42A)
  11289. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11290. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11291. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11292. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11293. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11294. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11295. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11296. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11297.  
  11298. Fingerprint Microsoft Windows 2000 AS SP4
  11299. Class Microsoft | Windows | NT/2K/XP | general purpose
  11300. TSeq(Class=RI%gcd=<6%SI=<7CE98&>6B7)
  11301. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11302. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11303. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11304. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11305. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11306. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11307. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11308. PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11309.  
  11310. Fingerprint Microsoft Windows 2000 Pro
  11311. Class Microsoft | Windows | NT/2K/XP | general purpose
  11312. TSeq(Class=RI%gcd=<6%SI=<1C476&>472)
  11313. T1(DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
  11314. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11315. T3(Resp=Y%DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M)
  11316. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11317. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11318. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11319. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11320. PU(DF=N%TOS=0|20|80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11321.  
  11322. Fingerprint Microsoft Windows 2000 Pro RC1 or Windows 2000 Advanced Server Beta3
  11323. Class Microsoft | Windows | NT/2K/XP | general purpose
  11324. TSeq(Class=RI%gcd=<8%SI=<27D922&>65EE)
  11325. T1(DF=Y%W=402E|2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  11326. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11327. T3(Resp=Y%DF=Y%W=402E|2017%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  11328. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11329. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11330. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11331. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11332. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11333.  
  11334. # Microsoft Windows NT 5 Beta2 or Beta3
  11335. # Microsoft Windows 2000 Pro Edition (English) Build 2195 with SP2 - x86
  11336. Fingerprint Microsoft Windows 2000 Pro SP2
  11337. Class Microsoft | Windows | NT/2K/XP | general purpose
  11338. TSeq(Class=TD%gcd=<6%SI=<1000)
  11339. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11340. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11341. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11342. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  11343. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11344. T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  11345. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11346. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11347.  
  11348. # Microsoft Windows 2000 Pro SP2
  11349. # Microsoft  Windows XP Pro SP1
  11350. Fingerprint Microsoft Windows 2000 Pro SP2 or Windows XP SP1
  11351. Class Microsoft | Windows | NT/2K/XP | general purpose
  11352. TSeq(Class=RI%gcd=<6%SI=<270D8&>3E9%IPID=I)
  11353. T1(DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT)
  11354. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11355. T3(Resp=Y%DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT)
  11356. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11357. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11358. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11359. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11360. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11361.  
  11362. # Windows 2000 Pro Build 2195 Service Pack 3
  11363. Fingerprint Microsoft Windows 2000 Pro SP3
  11364. Class Microsoft | Windows | NT/2K/XP | general purpose
  11365. TSeq(Class=RI%gcd=<6%SI=<1BB0C&>2DC%IPID=I%TS=U)
  11366. T1(DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M)
  11367. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11368. T3(Resp=Y%DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M)
  11369. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11370. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11371. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11372. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11373. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11374.  
  11375. # Microsoft Windows 2000 Pro Version: 5.0.2195 Service Pack 4 Build 2195
  11376. # Microsoft 2000 Professional SP4  CPU AMD
  11377. Fingerprint Microsoft Windows 2000 Pro SP4
  11378. Class Microsoft | Windows | NT/2K/XP | general purpose
  11379. TSeq(Class=RI%gcd=<6%SI=<2B0D4&>22E%IPID=I)
  11380. T1(DF=Y%W=2238|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT)
  11381. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11382. T3(Resp=Y%DF=Y%W=2238|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT)
  11383. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11384. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11385. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11386. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11387. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11388.  
  11389. Fingerprint Microsoft Windows 2000 Server SP1
  11390. Class Microsoft | Windows | NT/2K/XP | general purpose
  11391. TSeq(Class=RI%gcd=<6%SI=<1B26A&>26A%IPID=I%TS=U)
  11392. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  11393. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11394. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  11395. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11396. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11397. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11398. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11399. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  11400.  
  11401. Fingerprint Microsoft Windows 2000 Server SP2
  11402. Class Microsoft | Windows | NT/2K/XP | general purpose
  11403. TSeq(Class=RI%gcd=<6%SI=<25224&>22C%IPID=I)
  11404. T1(DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
  11405. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11406. T3(Resp=Y%DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT)
  11407. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11408. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11409. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11410. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11411. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11412.  
  11413. # Microsoft Windows 2000 Server with Service Pack 3 and MS Exchange 2000 Server
  11414. Fingerprint Microsoft Windows 2000 Server SP3
  11415. Class Microsoft | Windows | NT/2K/XP | general purpose
  11416. TSeq(Class=RI%gcd=<6%SI=<DF0C&>186%IPID=I)
  11417. T1(DF=Y%W=FAF0%ACK=S++%Flags=A%Ops=NNT)
  11418. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11419. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  11420. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11421. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11422. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11423. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11424. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11425.  
  11426. Fingerprint Microsoft Windows 2000 Server SP3
  11427. Class Microsoft | Windows | NT/2K/XP | general purpose
  11428. TSeq(Class=RI%gcd=<8%SI=<255BC&>24F%IPID=I)
  11429. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11430. T2(Resp=N)
  11431. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11432. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11433. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11434. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11435. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11436. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11437.  
  11438. Fingerprint Microsoft Windows 2000 Server SP3
  11439. Class Microsoft | Windows | NT/2K/XP | general purpose
  11440. TSeq(Class=RI%gcd=<6%SI=<230DC&>388%IPID=I)
  11441. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  11442. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  11443. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  11444. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  11445. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11446. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  11447. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  11448. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  11449.  
  11450. # Windows (XP Pro) version 5.1 (numero 260.xpsp2.030422-1633:Service Pack 1)
  11451. Fingerprint Microsoft Windows 2000 Server SP3 or Windows XP Pro SP1
  11452. Class Microsoft | Windows | NT/2K/XP | general purpose
  11453. TSeq(Class=RI%gcd=<6%SI=<24F5E&>47E%IPID=I%TS=U)
  11454. T1(DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW)
  11455. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11456. T3(Resp=Y%DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW)
  11457. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11458. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11459. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11460. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11461. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11462.  
  11463. Fingerprint Microsoft Windows 2000 Server SP4
  11464. Class Microsoft | Windows | NT/2K/XP | general purpose
  11465. TSeq(Class=RI%gcd=<6%SI=<E76A8&>110C)
  11466. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11467. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11468. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11469. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11470. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11471. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11472. T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=)
  11473. PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11474.  
  11475. # Windows 2000 Server Edition Version 5.0 (Build 2195: Service Pack 4)
  11476. Fingerprint Microsoft Windows 2000 Server SP4
  11477. Class Microsoft | Windows | NT/2K/XP | general purpose
  11478. TSeq(Class=RI%gcd=<6%SI=<21E62&>256%IPID=I)
  11479. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11480. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11481. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11482. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11483. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11484. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11485. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11486. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  11487.  
  11488. # Windows 2000 Server SP 4 + ALL patches at 25 Sep. 2003
  11489. # Windows XP Pro SP1 and latest Windows Update patches as of Oct 04, 2004
  11490. Fingerprint Microsoft Windows 2000 Server SP4 or XP SP1
  11491. Class Microsoft | Windows | NT/2K/XP | general purpose
  11492. TSeq(Class=RI%gcd=<6%SI=<2B430&>5AD%IPID=I)
  11493. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11494. T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  11495. T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  11496. T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL)
  11497. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11498. T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL)
  11499. T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL)
  11500. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11501.  
  11502. Fingerprint Microsoft Windows 2000 SP1
  11503. Class Microsoft | Windows | NT/2K/XP | general purpose
  11504. TSeq(Class=RI%gcd=<6%SI=<1F216&>251%IPID=I)
  11505. T1(DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT)
  11506. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11507. T3(Resp=Y%DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT)
  11508. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11509. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11510. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11511. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11512. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11513.  
  11514. # Microsoft Windows 2000 Build 2195 Service Pack 1
  11515. Fingerprint Microsoft Windows 2000 SP1
  11516. Class Microsoft | Windows | NT/2K/XP | general purpose
  11517. TSeq(Class=RI%gcd=<6%SI=<220164&>80000%TS=U)
  11518. T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  11519. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11520. T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  11521. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11522. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11523. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11524. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11525. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11526.  
  11527. # Windows 2000 version 5 build 2195 Service Pack 2
  11528. Fingerprint Microsoft Windows 2000 SP2
  11529. Class Microsoft | Windows | NT/2K/XP | general purpose
  11530. TSeq(Class=RI%gcd=<6%SI=<270D8&>4BF%IPID=I)
  11531. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11532. T2(Resp=N)
  11533. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11534. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11535. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11536. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11537. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11538. PU(DF=N%TOS=28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11539.  
  11540. Fingerprint Microsoft Windows 2000 SP2
  11541. Class Microsoft | Windows | NT/2K/XP | general purpose
  11542. TSeq(Class=RI%gcd=<6%SI=<1D362&>237%IPID=I)
  11543. T1(DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT)
  11544. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11545. T3(Resp=Y%DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT)
  11546. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11547. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11548. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11549. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11550. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11551.  
  11552. Fingerprint Microsoft Windows 2000 SP2
  11553. Class Microsoft | Windows | NT/2K/XP | general purpose
  11554. TSeq(Class=RI%gcd=<6%SI=<2FE90&>6F9%IPID=I%TS=U)
  11555. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  11556. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11557. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  11558. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11559. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11560. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11561. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11562. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11563.  
  11564. Fingerprint Microsoft Windows 2000 SP2
  11565. Class Microsoft | Windows | NT/2K/XP | general purpose
  11566. TSeq(Class=RI%gcd=<6%SI=<2928E&>4B7%IPID=I%TS=U)
  11567. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  11568. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11569. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  11570. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11571. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11572. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11573. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11574. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11575.  
  11576. # Microsoft Windows 2000 Pro with SP3 and latest Windows Update
  11577. # patches as of August 22, 2003 - Laptop using G-Trans PCMCIA CDMA
  11578. # Wireless card.
  11579. Fingerprint Microsoft Windows 2000 SP3
  11580. Class Microsoft | Windows | NT/2K/XP | general purpose
  11581. TSeq(Class=RI%gcd=<6%SI=<39062&>5B5%IPID=I)
  11582. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11583. T2(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL)
  11584. T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL)
  11585. T4(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL)
  11586. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11587. T6(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  11588. T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  11589. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11590.  
  11591. Fingerprint Microsoft Windows 2000 SP3
  11592. Class Microsoft | Windows | NT/2K/XP | general purpose
  11593. TSeq(Class=RI%gcd=<6%SI=<2382B18&>5AE4C%IPID=Z%TS=U)
  11594. T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  11595. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11596. T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW)
  11597. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  11598. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11599. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11600. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11601. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11602.  
  11603. Fingerprint Microsoft Windows 2000 SP3
  11604. Class Microsoft | Windows | NT/2K/XP | general purpose
  11605. TSeq(Class=RI%gcd=<6%SI=<1A748&>D9%IPID=I%TS=U)
  11606. T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
  11607. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11608. T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M)
  11609. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11610. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11611. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11612. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11613. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11614.  
  11615. # Microsoft Windows 2000 SP3
  11616. Fingerprint Microsoft Windows 2000 SP3
  11617. Class Microsoft | Windows | NT/2K/XP | general purpose
  11618. TSeq(Class=RI%gcd=<6%SI=<2425C&>383%IPID=I)
  11619. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT)
  11620. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11621. T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT)
  11622. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11623. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11624. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11625. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11626. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11627.  
  11628. Fingerprint Microsoft Windows 2000 SP3
  11629. Class Microsoft | Windows | NT/2K/XP | general purpose
  11630. TSeq(Class=RI%gcd=<6%SI=<13EEB2&>2BD%IPID=I%TS=U)
  11631. T1(DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW)
  11632. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11633. T3(Resp=Y%DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW)
  11634. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11635. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11636. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11637. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11638. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11639.  
  11640. # Microsoft Windows 2000 [Version 5.00.2195]  SP3
  11641. Fingerprint Microsoft Windows 2000 SP3
  11642. Class Microsoft | Windows | NT/2K/XP | general purpose
  11643. TSeq(Class=RI%gcd=<6%SI=<269EE&>2EC%IPID=I)
  11644. T1(DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT)
  11645. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11646. T3(Resp=Y%DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT)
  11647. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11648. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11649. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11650. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11651. PU(DF=N%TOS=0|D0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11652.  
  11653. # Microsoft Windows 2000 SP3
  11654. Fingerprint Microsoft Windows 2000 SP3
  11655. Class Microsoft | Windows | NT/2K/XP | general purpose
  11656. TSeq(Class=RI%gcd=<6%SI=<28B54&>31B%IPID=I)
  11657. T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  11658. T2(Resp=N)
  11659. T3(Resp=N)
  11660. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11661. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11662. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11663. T7(Resp=N)
  11664. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11665.  
  11666. # Windows 2000 5.00.2195 with SP 3
  11667. Fingerprint Microsoft Windows 2000 SP3
  11668. Class Microsoft | Windows | NT/2K/XP | general purpose
  11669. TSeq(Class=TR%gcd=<6%IPID=I)
  11670. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  11671. T2(Resp=N)
  11672. T3(Resp=N)
  11673. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11674. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11675. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11676. T7(Resp=N)
  11677. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11678.  
  11679. Fingerprint Microsoft Windows 2000 SP3
  11680. Class Microsoft | Windows | NT/2K/XP | general purpose
  11681. TSeq(Class=RI%gcd=<6%SI=<876AE&>98E)
  11682. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  11683. T2(Resp=N)
  11684. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  11685. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11686. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11687. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11688. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11689. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11690.  
  11691. Fingerprint Microsoft Windows 2000 SP3
  11692. Class Microsoft | Windows | NT/2K/XP | general purpose
  11693. TSeq(Class=RI%gcd=<6%SI=<15374&>110%IPID=I)
  11694. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  11695. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11696. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  11697. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11698. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11699. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11700. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11701. PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11702.  
  11703. # Microsoft Windows 2000 build 2195 SP 4
  11704. Fingerprint Microsoft Windows 2000 SP4
  11705. Class Microsoft | Windows | NT/2K/XP | general purpose
  11706. TSeq(Class=RI%gcd=<6%SI=<139354&>972%IPID=I%TS=U)
  11707. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  11708. T2(Resp=N)
  11709. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  11710. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11711. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11712. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11713. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11714. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11715.  
  11716. # Microsoft Windows 2000 build 2195 sp4 with update patches through 4/22/2004
  11717. Fingerprint Microsoft Windows 2000 SP4
  11718. Class Microsoft | Windows | NT/2K/XP | general purpose
  11719. TSeq(Class=RI%gcd=<6%SI=<1BFDA&>357%IPID=I%TS=U)
  11720. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  11721. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11722. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M)
  11723. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11724. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11725. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11726. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11727. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11728.  
  11729. Fingerprint Microsoft Windows 2000 SP4
  11730. Class Microsoft | Windows | NT/2K/XP | general purpose
  11731. TSeq(Class=RI%gcd=<C%SI=<B994C&>A06%IPID=I%TS=U)
  11732. T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  11733. T2(Resp=N)
  11734. T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  11735. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11736. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11737. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11738. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11739. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11740.  
  11741. # Microsoft Windows 2000 SP4 and latest Windows Update patches as of Sept 26, 2003 running BlackICE
  11742. # Microsoft Windows XP Pro with SP1 and latest Windows Update patches as of September 01, 2003
  11743. Fingerprint Microsoft Windows 2000 SP4 or Windows XP SP1
  11744. Class Microsoft | Windows | NT/2K/XP | general purpose
  11745. TSeq(Class=RI%gcd=<6%SI=<1E58A2&>1517)
  11746. T1(DF=Y%W=2238|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11747. T2(Resp=N)
  11748. T3(Resp=N)
  11749. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11750. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11751. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11752. T7(Resp=N)
  11753. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11754.  
  11755. #  Microsoft Windows 2000 with Service Pack 3
  11756. # Microsoft Windows XP Pro with SP1 and latest Windows Update patches as of February 1st, 2003
  11757. Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000, or Windows XP
  11758. Class Microsoft | Windows | NT/2K/XP | general purpose
  11759. Class Microsoft | Windows | 95/98/ME | general purpose
  11760. TSeq(Class=RI%gcd=<20%SI=<E92A&>240)
  11761. T1(DF=Y%W=40E8|5B8E|7FFF|FAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
  11762. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11763. T3(Resp=Y%DF=Y%W=40E8|5B8E|7FFFFAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M)
  11764. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11765. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11766. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11767. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11768. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11769.  
  11770. Fingerprint Microsoft Windows NT 3.10 (Build 528)
  11771. Class Microsoft | Windows | NT/2K/XP | general purpose
  11772. TSeq(Class=RI|TD%gcd=<24%SI=<69A%IPID=I%TS=U)
  11773. T1(DF=N%W=1400%ACK=S++%Flags=AS%Ops=M)
  11774. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11775. T3(Resp=N)
  11776. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11777. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11778. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11779. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11780. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11781.  
  11782. Fingerprint Microsoft Windows NT 4.0 Server SP5-SP6
  11783. Class Microsoft | Windows | NT/2K/XP | general purpose
  11784. TSeq(Class=RI%gcd=<8%SI=<11784E&>2CA4)
  11785. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  11786. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11787. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  11788. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11789. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11790. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11791. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11792. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11793.  
  11794. Fingerprint Microsoft Windows NT 4.0 SP 6a + hotfixes
  11795. Class Microsoft | Windows | NT/2K/XP | general purpose
  11796. TSeq(Class=RI%gcd=<6%SI=<40132&>290%IPID=BI|RPI%TS=U)
  11797. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11798. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11799. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11800. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11801. T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  11802. T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  11803. T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  11804. PU(Resp=N|Y)
  11805.  
  11806. Fingerprint Microsoft Windows NT 4.0 SP3
  11807. Class Microsoft | Windows | NT/2K/XP | general purpose
  11808. TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73)
  11809. T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT)
  11810. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11811. T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT)
  11812. T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=)
  11813. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11814. T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
  11815. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11816. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11817.  
  11818. Fingerprint Microsoft Windows NT 4.0 SP3
  11819. Class Microsoft | Windows | NT/2K/XP | general purpose
  11820. TSeq(Class=TD%gcd=<F4%SI=<3C%IPID=BI%TS=U)
  11821. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11822. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11823. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11824. T4(DF=N%W=0%ACK=S|S++%Flags=R%Ops=)
  11825. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11826. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  11827. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11828. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11829.  
  11830. Fingerprint Microsoft Windows NT 4.0 SP5-SP6
  11831. Class Microsoft | Windows | NT/2K/XP | general purpose
  11832. TSeq(Class=RI%gcd=<6%SI=<DA16&>21A)
  11833. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11834. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11835. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11836. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11837. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11838. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11839. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11840. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11841.  
  11842. # Microsoft Windows NT4.0 Workstation SP6a
  11843. # Windows NT4.0 with Service Pack 6
  11844. # Microsoft Windows NT4.0 Terminal Server Edition with Service Pack 6 and Citrix MetaFrame 1.8 with Service Pack 4
  11845. Fingerprint Microsoft Windows NT 4.0 SP6a
  11846. Class Microsoft | Windows | NT/2K/XP | general purpose
  11847. TSeq(Class=RI%gcd=<A%SI=<1A66C&>112%IPID=RPI|BI%TS=U)
  11848. T1(DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M)
  11849. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11850. T3(Resp=Y%DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M)
  11851. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11852. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11853. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11854. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11855. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11856.  
  11857. Fingerprint Microsoft Windows NT 4.0 SP6a
  11858. Class Microsoft | Windows | NT/2K/XP | general purpose
  11859. TSeq(Class=RI%gcd=<6%SI=<8D3CE&>1017%IPID=RPI|RD%TS=U)
  11860. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  11861. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11862. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M)
  11863. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11864. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11865. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11866. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11867. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11868.  
  11869. Fingerprint Microsoft Windows NT 4.0 SP6a with Kerio WinRoute Pro 4.27 Firewall
  11870. Class Microsoft | Windows | NT/2K/XP | general purpose
  11871. TSeq(Class=TD%gcd=<8%SI=<8C%IPID=BI|RPI%TS=U)
  11872. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11873. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  11874. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11875. T4(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  11876. T5(DF=N%W=1000|400|800%ACK=S++%Flags=AR%Ops=WNMETL)
  11877. T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  11878. T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  11879. PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11880.  
  11881. Fingerprint Microsoft Windows NT 4.0 Terminal Server Edition
  11882. Class Microsoft | Windows | NT/2K/XP | general purpose
  11883. TSeq(Class=RI%gcd=<8%SI=<BEF0&>1D4%IPID=BI%TS=U)
  11884. T1(DF=N|Y%W=0|2017%ACK=S++%Flags=AR|AS%Ops=|M)
  11885. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11886. T3(Resp=Y%DF=N|Y%W=0|2017%ACK=O|S++%Flags=AR|AS%Ops=|M)
  11887. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11888. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11889. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11890. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11891. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11892.  
  11893. # Windows NT Version 4.0 (Build 1381 - Service Pack 6), Revised Service Pack 6a
  11894. Fingerprint Microsoft Windows NT 4.0 Workstation SP6a
  11895. Class Microsoft | Windows | NT/2K/XP | general purpose
  11896. TSeq(Class=TD%gcd=<8%SI=<46%IPID=RPI|RD|BI%TS=U)
  11897. T1(DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M)
  11898. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11899. T3(Resp=Y%DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M)
  11900. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11901. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11902. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11903. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11904. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11905.  
  11906. Fingerprint Microsoft Windows NT 4.0 Workstation SP6a
  11907. Class Microsoft | Windows | NT/2K/XP | general purpose
  11908. TSeq(Class=TD%gcd=<6%SI=<46%IPID=BI%TS=U)
  11909. T1(DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M)
  11910. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11911. T3(Resp=Y%DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M)
  11912. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11913. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11914. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11915. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11916. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11917.  
  11918. Fingerprint Microsoft Windows NT Version 4 (Build 1381) Service Pack 6a
  11919. Class Microsoft | Windows | NT/2K/XP | general purpose
  11920. TSeq(Class=RI%gcd=<6%SI=<377BC&>3BB%IPID=RPI|BI%TS=U)
  11921. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  11922. T2(Resp=Y%DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  11923. T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL)
  11924. T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  11925. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11926. T6(DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL)
  11927. T7(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL)
  11928. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11929.  
  11930. Fingerprint Microsoft Windows XP Home Edition
  11931. Class Microsoft | Windows | NT/2K/XP | general purpose
  11932. TSeq(Class=RI%gcd=<6%SI=<23C4E&>330%IPID=I%TS=U)
  11933. T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  11934. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11935. T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  11936. T4(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  11937. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11938. T6(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  11939. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11940. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11941.  
  11942. #  Microsoft Windows XP Home (German) w/SP1
  11943. # ver 5.1 build 2600.xpsp2.030422-1633 : SP 1; German version
  11944. # Microsoft Windows XP Home (German) w/SP1 
  11945. Fingerprint Microsoft Windows XP Home Edition (German) SP1
  11946. Class Microsoft | Windows | NT/2K/XP | general purpose
  11947. TSeq(Class=RI%gcd=<6%SI=<129062&>775%IPID=I)
  11948. T1(DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11949. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11950. T3(Resp=Y%DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  11951. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11952. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11953. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11954. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11955. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  11956.  
  11957. # Microsoft Windows XP Home (English) w/SP1 Version 5.1.2600.1106 build 2600 xpsp.1.020828-1-920
  11958. Fingerprint Microsoft Windows XP Home SP1
  11959. Class Microsoft | Windows | NT/2K/XP | general purpose
  11960. TSeq(Class=RI%gcd=<6%SI=<163E6&>31F%IPID=I)
  11961. T1(DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT)
  11962. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11963. T3(Resp=Y%DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT)
  11964. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11965. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11966. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11967. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11968. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11969.  
  11970. # Windows XP Pro WITHOUT ANY service packs
  11971. # Windows XP SP1
  11972. Fingerprint Microsoft Windows XP Pro
  11973. Class Microsoft | Windows | NT/2K/XP | general purpose
  11974. TSeq(Class=RI%gcd=<6%SI=<2EBEE&>45E%IPID=I%TS=U)
  11975. T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  11976. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11977. T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW)
  11978. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11979. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11980. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11981. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11982. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  11983.  
  11984. # No service packs
  11985. Fingerprint Microsoft Windows XP Pro (German)
  11986. Class Microsoft | Windows | NT/2K/XP | general purpose
  11987. TSeq(Class=RI%gcd=<6%SI=<1074EE&>E48%TS=U)
  11988. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  11989. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  11990. T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  11991. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11992. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11993. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  11994. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  11995. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  11996.  
  11997. # Microsoft Windows XP Prof Corporate (German) w/SP1 + all Security Updates as of Febr. 10, 2004
  11998. Fingerprint Microsoft Windows XP Pro (German) SP1
  11999. Class Microsoft | Windows | NT/2K/XP | general purpose
  12000. TSeq(Class=RI%gcd=<6%SI=<15BA8&>2DA%IPID=I%TS=U)
  12001. T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW)
  12002. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12003. T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW)
  12004. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12005. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12006. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12007. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12008. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12009.  
  12010. Fingerprint Microsoft Windows XP Pro (German) SP1
  12011. Class Microsoft | Windows | NT/2K/XP | general purpose
  12012. TSeq(Class=RI%gcd=<6%SI=<23E9C&>195%IPID=I)
  12013. T1(DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT)
  12014. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12015. T3(Resp=Y%DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT)
  12016. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12017. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12018. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12019. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12020. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12021.  
  12022. # No service packs
  12023. Fingerprint Microsoft Windows XP Pro (Italian)
  12024. Class Microsoft | Windows | NT/2K/XP | general purpose
  12025. TSeq(Class=RI%gcd=<6%SI=<3CF14&>33C)
  12026. T1(DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT)
  12027. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12028. T3(Resp=Y%DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT)
  12029. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12030. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12031. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12032. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12033. PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12034.  
  12035. Fingerprint Microsoft Windows XP Pro or Windows 2000 Pro SP2+
  12036. Class Microsoft | Windows | NT/2K/XP | general purpose
  12037. TSeq(Class=RI%gcd=<16%SI=<25AEE&>6B%IPID=I)
  12038. T1(DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  12039. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12040. T3(Resp=Y%DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT)
  12041. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12042. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12043. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12044. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12045. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12046.  
  12047. Fingerprint Microsoft Windows XP Pro RC1+ through final release
  12048. Class Microsoft | Windows | NT/2K/XP | general purpose
  12049. TSeq(Class=RI%gcd=<8%SI=<2959A&>356%IPID=I)
  12050. T1(DF=Y|N%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  12051. T2(Resp=N)
  12052. T3(Resp=N)
  12053. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12054. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12055. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12056. T7(Resp=N)
  12057. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12058.  
  12059. # Microsoft Windows XP Pro Edition Version 5.1 Build (2600.xpsp2.030422-1633: Service Pack 1)
  12060. # Microsoft Windows XP Pro w/SP1 and latest patches as of Jan 31,2004
  12061. # Microsoft Windows XP Professional (Italian) w/SP1 build 2600.xpsp2.030422-1633# Microsoft Windows XP Pro (Spanish) w/SP1 (Build 2600.xpsp2.030422-1633 : Service Pack 1) Intel
  12062. Fingerprint Microsoft Windows XP Pro SP1
  12063. Class Microsoft | Windows | NT/2K/XP | general purpose
  12064. TSeq(Class=RI%gcd=<6%SI=<29446&>49E%IPID=I)
  12065. T1(DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT)
  12066. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12067. T3(Resp=Y%DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT)
  12068. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12069. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12070. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12071. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12072. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12073.  
  12074. Fingerprint Microsoft Windows XP Pro SP1
  12075. Class Microsoft | Windows | NT/2K/XP | general purpose
  12076. TSeq(Class=RI%gcd=<8%SI=<10225A&>105E)
  12077. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  12078. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12079. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  12080. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12081. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12082. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12083. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12084. PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12085.  
  12086. Fingerprint Microsoft Windows XP Pro SP1
  12087. Class Microsoft | Windows | NT/2K/XP | general purpose
  12088. TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I)
  12089. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  12090. T2(Resp=N)
  12091. T3(Resp=N)
  12092. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12093. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12094. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12095. T7(Resp=N)
  12096. PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12097.  
  12098. # Windows XP Version 5.1 (Build 2600.xpsp2.030422-1633: Service pack 1)
  12099. # Windows XP Pro With serice pack 1... English..   2600.xpsp1.020828-1920
  12100. Fingerprint Microsoft Windows XP Pro SP1
  12101. Class Microsoft | Windows | NT/2K/XP | general purpose
  12102. TSeq(Class=RI%gcd=<6%SI=<9A6AA&>18A0%IPID=I%TS=U)
  12103. T1(DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS|A%Ops=M|)
  12104. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12105. T3(Resp=Y%DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS||A%Ops=M||)
  12106. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12107. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12108. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12109. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12110. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12111.  
  12112. # Windows XP Pro Version 5.1 (Build 2600.xpsp2.030422-1633: Service Pack1)
  12113. Fingerprint Microsoft Windows XP Pro SP1
  12114. Class Microsoft | Windows | NT/2K/XP | general purpose
  12115. TSeq(Class=RI%gcd=<6%SI=<63826&>D28%IPID=I%TS=U)
  12116. T1(DF=Y%W=6270|8000|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW)
  12117. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12118. T3(Resp=Y%DF=Y%W=6270|8000|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW)
  12119. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12120. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12121. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12122. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12123. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  12124.  
  12125. Fingerprint Microsoft Windows XP Pro SP1
  12126. Class Microsoft | Windows | NT/2K/XP | general purpose
  12127. TSeq(Class=RI%gcd=<6%SI=<2F7D8&>239%IPID=I)
  12128. T1(DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT)
  12129. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12130. T3(Resp=Y%DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT)
  12131. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12132. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12133. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12134. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12135. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12136.  
  12137. Fingerprint Microsoft Windows XP Pro SP1
  12138. Class Microsoft | Windows | NT/2K/XP | general purpose
  12139. TSeq(Class=RI%gcd=<6%SI=<14686&>1A0%IPID=I)
  12140. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  12141. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12142. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  12143. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12144. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12145. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12146. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12147. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12148.  
  12149. # Windows Xp Pro Service Pack 1 version 5.1 - Build  2600
  12150. # Microsoft Windows XP version 5.1 (build 2600.xpsp2.030422-1633 : Service Pack 1)
  12151. Fingerprint Microsoft Windows XP Pro SP1
  12152. Class Microsoft | Windows | NT/2K/XP | general purpose
  12153. TSeq(Class=RI%gcd=<6%SI=<3316C&>33B%IPID=I)
  12154. T1(DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT)
  12155. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12156. T3(Resp=Y%DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT)
  12157. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12158. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12159. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12160. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12161. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12162.  
  12163. Fingerprint Microsoft Windows XP Pro SP1
  12164. Class Microsoft | Windows | NT/2K/XP | general purpose
  12165. TSeq(Class=RI%gcd=<6%SI=<17D36&>18B%IPID=I)
  12166. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  12167. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12168. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12169. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  12170. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12171. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  12172. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12173. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12174.  
  12175. # Windows XP Profesional build 2600.xpsp2.030422-1633: Service Pack 1
  12176. Fingerprint Microsoft Windows XP Pro SP1
  12177. Class Microsoft | Windows | NT/2K/XP | general purpose
  12178. TSeq(Class=RI%gcd=<6%SI=<209B8&>33C%IPID=I)
  12179. T1(DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT)
  12180. T2(Resp=N)
  12181. T3(Resp=N)
  12182. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12183. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12184. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12185. T7(Resp=N)
  12186. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12187.  
  12188. # Microsoft Windows XP Pro SP1
  12189. # Microsoft Windows 2000 Advanced Server with Service Pack 3
  12190. Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 Advanced Server SP3
  12191. Class Microsoft | Windows | NT/2K/XP | general purpose
  12192. TSeq(Class=RI%gcd=<8%SI=<272A4&>31E%IPID=I%TS=U)
  12193. T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
  12194. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12195. T3(Resp=Y%DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M)
  12196. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12197. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12198. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12199. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12200. PU(DF=N%TOS=0|5C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12201.  
  12202. # Windows XP Pro Build 2600.xpsp1.020828-1920 with Windows Services for UNIX 3.0 installed
  12203. # Windows 2000 Advanced Server with SP3
  12204. # Microsoft Windows 2000 Server version 5.0 build 2195 Service Pack 3
  12205. # Windows 2000 SP3
  12206. Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 SP3
  12207. Class Microsoft | Windows | NT/2K/XP | general purpose
  12208. TSeq(Class=RI%gcd=<6%SI=<57472&>68D%IPID=I)
  12209. T1(DF=N|Y%W=0|FFF0%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  12210. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12211. T3(Resp=Y%DF=N|Y%W=0|FFF0%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT)
  12212. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12213. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12214. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12215. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12216. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12217.  
  12218. Fingerprint Microsoft Windows XP Pro Version 5.1 Build 2600
  12219. Class Microsoft | Windows | NT/2K/XP | general purpose
  12220. TSeq(Class=RI%gcd=<6%SI=<32578&>18D%IPID=I)
  12221. T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  12222. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12223. T3(Resp=Y%DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  12224. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12225. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12226. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12227. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12228. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12229.  
  12230. Fingerprint Microsoft Windows XP SP1
  12231. Class Microsoft | Windows | NT/2K/XP | general purpose
  12232. TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I)
  12233. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  12234. T2(Resp=N)
  12235. T3(Resp=N)
  12236. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12237. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12238. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12239. T7(Resp=N)
  12240. PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12241.  
  12242. # Microsoft Windows XP Prof (Build 2600.xpsp2.030422-1633: SP1
  12243. Fingerprint Microsoft Windows XP SP1
  12244. Class Microsoft | Windows | NT/2K/XP | general purpose
  12245. TSeq(Class=RI%gcd=<8%SI=<F2F30&>702%TS=U)
  12246. T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  12247. T2(Resp=N)
  12248. T3(Resp=N)
  12249. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12250. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12251. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12252. T7(Resp=N)
  12253. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12254.  
  12255. Fingerprint Microsoft Windows XP SP1
  12256. Class Microsoft | Windows | NT/2K/XP | general purpose
  12257. TSeq(Class=RI%gcd=<6%SI=<C99A0A&>291F)
  12258. T1(DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  12259. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12260. T3(Resp=Y%DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  12261. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12262. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12263. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12264. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12265. PU(DF=N%TOS=0|40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12266.  
  12267. # Microsoft Windows XP Version 5.1 (Build 2600.xpsp 1.020828-1920: Service Pack 1) > latest Windows Update patch too (1/31/03)
  12268. # Windows 2000 with Service Pack 3
  12269. Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP3
  12270. Class Microsoft | Windows | NT/2K/XP | general purpose
  12271. TSeq(Class=RI%gcd=<6%SI=<2461C&>3BA%IPID=I%TS=U)
  12272. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW)
  12273. T2(Resp=N)
  12274. T3(Resp=N)
  12275. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12276. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12277. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12278. T7(Resp=N)
  12279. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12280.  
  12281. # Microsoft Windows XP SP1 (Build 2600.XP SP2.030422-1633:Service Pack 1)
  12282. # Microsoft Windows XP Pro with SP1 and latest Windows Update patches as of Oct 12, 2003 except Q817778
  12283. # Windows 2000 Pro with SP4 and latest Windows Update patches as of november 25th, 2003
  12284. Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP4
  12285. Class Microsoft | Windows | NT/2K/XP | general purpose
  12286. TSeq(Class=RI%gcd=<6%SI=<18DEE&>24B%IPID=I)
  12287. T1(DF=Y%W=402E|FC00|FD20%ACK=S++%Flags=AS%Ops=MNWNNT)
  12288. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12289. T3(Resp=N)
  12290. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12291. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12292. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12293. T7(Resp=N)
  12294. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  12295.  
  12296. Fingerprint Microsoft Windows XP SP2
  12297. Class Microsoft | Windows | NT/2K/XP | general purpose
  12298. TSeq(Class=TR%gcd=<6%IPID=I)
  12299. T1(DF=Y%W=6360|805C|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT)
  12300. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12301. T3(Resp=Y%DF=Y%W=6360|805C|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT)
  12302. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12303. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12304. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12305. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12306. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12307.  
  12308. # Microsoft Windows XP Professional (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
  12309. Fingerprint Microsoft Windows XP SP2
  12310. Class Microsoft | Windows | NT/2K/XP | general purpose
  12311. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  12312. T1(DF=Y%W=5A0|FFFF%ACK=S++%Flags=AS%Ops=MNW)
  12313. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12314. T3(Resp=Y%DF=Y%W=5A0|FFFF%ACK=S++%Flags=AS%Ops=MNW)
  12315. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12316. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12317. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12318. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12319. PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12320.  
  12321. # Microsoft Windows XP Home (English) w/SP2 build 2600.xpsp_sp2_rtm.040803-2158
  12322. # Microsoft Windows XP Home (English) w/SP2 build 2600.xpsp_sp2_rtm.040803-2158
  12323. # Microsoft Windows XP Pro with SP2 (Version 5.1 Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2)
  12324. Fingerprint Microsoft Windows XP SP2 (firewall enabled)
  12325. Class Microsoft | Windows | NT/2K/XP | general purpose
  12326. TSeq(Class=TR%gcd=<6%IPID=I%TS=U|0)
  12327. T1(DF=Y%W=6360|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNW)
  12328. T2(Resp=N)
  12329. T3(Resp=N)
  12330. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12331. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12332. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12333. T7(Resp=N)
  12334. PU(Resp=N)
  12335.  
  12336. # HP Jornada running Windows CE 2.11 (Handheld/PC Pro 3.0) running on StrongARM 1100
  12337. Fingerprint HP Jornada running Microsoft Windows CE 2.11 (Handheld/PC Pro 3.0 PDA)
  12338. Class Microsoft | Windows | PocketPC/CE | PDA
  12339. TSeq(Class=TD%gcd=<36%SI=<28%IPID=BI%TS=U)
  12340. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  12341. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12342. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  12343. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12344. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12345. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  12346. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12347. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12348.  
  12349. Fingerprint Microsoft PocketPC 3.0.11171 running on Compaq iPAQ 3870 Pocket PC
  12350. Class Microsoft | Windows | PocketPC/CE | PDA
  12351. TSeq(Class=TD%gcd=<6%SI=<104%IPID=BI)
  12352. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  12353. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12354. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  12355. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  12356. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12357. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  12358. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12359. PU(DF=N%TOS=40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12360.  
  12361. # Windows Pocket PC 2003 second edition vanilla on a Dell Axim x30 via 802.11
  12362. # HP t5300 running `Microsoft Windows CE 4.2
  12363. # ADAM-6500 controller with Windows CE .NET 4.10 build 908
  12364. Fingerprint Microsoft Windows CE or Pocket PC (PDA or other embedded device)
  12365. Class Microsoft | Windows | PocketPC/CE | specialized
  12366. TSeq(Class=RI%gcd=<A%SI=<1BF76&>12A%IPID=I)
  12367. T1(DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT)
  12368. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12369. T3(Resp=Y%DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT)
  12370. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12371. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12372. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12373. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12374. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12375.  
  12376. # Windows 2000 Pro, Build 2195 SP4
  12377. Fingerprint Microsoft Windows 2000 Pro SP4
  12378. Class Microsoft | Windows || general purpose
  12379. TSeq(Class=RI%gcd=<6%SI=<457D6&>35E%IPID=I)
  12380. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  12381. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12382. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  12383. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12384. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12385. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12386. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12387. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  12388.  
  12389. Fingerprint Microsoft Windows 2000 Professional with SP4 and latest Windows Update patches as of August 11, 2004
  12390. Class Microsoft | Windows || general purpose
  12391. TSeq(Class=RI%gcd=<6%SI=<15E32&>1A1%IPID=I)
  12392. T1(DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT)
  12393. T2(Resp=N)
  12394. T3(Resp=N)
  12395. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12396. T5(DF=N%W=0%ACK=O%Flags=AR%Ops=)
  12397. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12398. T7(Resp=N)
  12399. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12400.  
  12401. Fingerprint Microsoft Windows Longhorn eval build 4051
  12402. Class Microsoft | Windows || general purpose
  12403. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  12404. T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12405. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  12406. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  12407. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12408. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12409. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12410. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12411. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12412.  
  12413. Fingerprint Minix 32-bit/Intel 2.0.0
  12414. Class Minix | Minix || general purpose
  12415. TSeq(Class=RI|TD%gcd=1|2|3|457%SI=<FFF)
  12416. T1(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=)
  12417. T2(Resp=N)
  12418. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=AR%Ops=)
  12419. T4(Resp=N)
  12420. T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  12421. T6(Resp=N)
  12422. T7(Resp=N)
  12423. PU(Resp=N)
  12424.  
  12425. Fingerprint Minix 32-bit/Intel 2.0.3
  12426. Class Minix | Minix || general purpose
  12427. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  12428. T2(Resp=N)
  12429. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  12430. T4(Resp=N)
  12431. T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  12432. T6(Resp=N)
  12433. T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  12434. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12435.  
  12436. Fingerprint Minix v2.0.2 32bits
  12437. Class Minix | Minix || general purpose
  12438. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  12439. T2(Resp=N)
  12440. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
  12441. T4(Resp=N)
  12442. T5(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  12443. T6(Resp=N)
  12444. T7(DF=N%W=2000%ACK=S++%Flags=AR%Ops=)
  12445. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12446.  
  12447. # Minolta Di183 printer/copy machine ROM Version 1.52
  12448. Fingerprint Minolta Di183 printer/copier
  12449. Class Minolta | embedded || printer
  12450. TSeq(Class=64K%IPID=I%TS=U)
  12451. T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=MNW)
  12452. T2(Resp=N)
  12453. T3(Resp=Y%DF=N%W=1%ACK=O%Flags=A%Ops=)
  12454. T4(DF=N%W=1%ACK=O%Flags=R%Ops=)
  12455. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12456. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12457. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12458. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12459.  
  12460. # VxWorks (for Destiny D8405 Pass 2 (Firmware build for Pass 1)) version 5.4.2.
  12461. Fingerprint Minolta QMS Printer running VxWorks 5.4.2
  12462. Class Minolta | VxWorks || printer
  12463. TSeq(Class=64K%IPID=I%TS=2HZ)
  12464. T1(DF=N%W=6000%ACK=S++%Flags=AS%Ops=MNWNNT)
  12465. T2(Resp=N)
  12466. T3(Resp=Y%DF=N%W=6000%ACK=O%Flags=A%Ops=NNT)
  12467. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  12468. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12469. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12470. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12471. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12472.  
  12473. Fingerprint Mirapoint messaging server M1000 (OS v 1.0.0)
  12474. Class MiraPoint | embedded || general purpose
  12475. TSeq(Class=RI%gcd=<6)
  12476. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  12477. T2(Resp=N)
  12478. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  12479. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  12480. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12481. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12482. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12483. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  12484.  
  12485. Fingerprint MiraPoint messaging server v3.1
  12486. Class MiraPoint | embedded || general purpose
  12487. TSeq(Class=RI%gcd=<6%SI=<DCCC6&>C2B%IPID=I%TS=100HZ)
  12488. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  12489. T2(Resp=N)
  12490. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  12491. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12492. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12493. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12494. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12495. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  12496.  
  12497. Fingerprint Motorola System V/68 version R3V7 on a 68030
  12498. Class Motorola | BSD-misc || general purpose
  12499. TSeq(Class=RI%gcd=<14%SI=<52F8&>C0)
  12500. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  12501. T2(Resp=N)
  12502. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  12503. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12504. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12505. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12506. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12507. PU(Resp=N)
  12508.  
  12509. # Motorola Surfboard SB5100e VxWorks Version: 5.4
  12510. # Motorola CG4500E Communication Gateway (cable modem)
  12511. # Thomson TCM390 cable modem; Software Version:  ST33.07.00; Software Model:   A801; Bootloader:  2.1.4c
  12512. Fingerprint Cable Modem: Motorola Surfboard/CG4500E or Thomson TCM390
  12513. Class Motorola | VxWorks || broadband router
  12514. TSeq(Class=64K%IPID=I%TS=U)
  12515. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  12516. T2(Resp=N)
  12517. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  12518. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  12519. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12520. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12521. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12522. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  12523.  
  12524. # Motorola SurfBoard 4401 provided by adelphia
  12525. Fingerprint Motorola SurfBoard 4401 cable modem
  12526. Class Motorola | VxWorks || broadband router
  12527. TSeq(Class=64K%IPID=I%TS=U)
  12528. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  12529. T2(Resp=N)
  12530. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  12531. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  12532. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12533. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12534. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12535. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F|0%ULEN=134%DAT=E)
  12536.  
  12537. # VxWorks Version: 5.3; Software Version: SB4100E-4.1.11-SCM05-NOSHELL; Hardware Version: 3
  12538. Fingerprint Motorola SurfBoard SB4100E Cable Modem
  12539. Class Motorola | VxWorks || broadband router
  12540. TSeq(Class=64K%IPID=I%TS=U)
  12541. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  12542. T2(Resp=N)
  12543. T3(Resp=N)
  12544. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  12545. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12546. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12547. T7(Resp=N)
  12548. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12549.  
  12550. # Motorola SURFboard SBG1000-0.1.3.0-SCM05-NOSH
  12551. Fingerprint Motorola SURFboard SBG1000 broadband router
  12552. Class Motorola | VxWorks || broadband router
  12553. TSeq(Class=64K%IPID=I%TS=U)
  12554. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
  12555. T2(Resp=N)
  12556. T3(Resp=N)
  12557. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  12558. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12559. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12560. T7(Resp=N)
  12561. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12562.  
  12563. Fingerprint MultiTech standalone firewall box, version 3
  12564. Class MultiTech | embedded || firewall
  12565. TSeq(Class=TD%gcd=<714%SI=<14)
  12566. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  12567. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12568. T3(Resp=Y%DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  12569. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12570. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12571. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12572. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12573.  
  12574. Fingerprint MultiTech MultiVOIP Version 2.01A Firmware
  12575. Class MultiTech | embedded || telecom-misc
  12576. TSeq(Class=TD%gcd=<714%SI=<14)
  12577. T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M)
  12578. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12579. T3(Resp=N)
  12580. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12581. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12582. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12583. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12584. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12585.  
  12586. Fingerprint MultiTech CommPlete (modem server) RAScard
  12587. Class MultiTech | embedded || terminal server
  12588. TSeq(Class=TD%gcd=388|710|A98%SI=<44)
  12589. T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M)
  12590. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12591. T3(Resp=N)
  12592. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12593. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12594. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12595. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12596. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12597.  
  12598. Fingerprint MultiTech CommPlete Controller (terminal server)
  12599. Class MultiTech | embedded || terminal server
  12600. TSeq(Class=TR|RI%gcd=<6%SI=>FFFF)
  12601. T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
  12602. T2(Resp=N)
  12603. T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME)
  12604. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12605. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12606. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12607. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12608. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12609.  
  12610. Fingerprint NAT LANB/290 router Console Program V4.00
  12611. Class NAT | embedded || router
  12612. TSeq(Class=TD%gcd=<80004%SI=<14)
  12613. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  12614. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12615. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
  12616. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12617. T5(Resp=N)
  12618. T6(Resp=N)
  12619. T7(Resp=N)
  12620. PU(Resp=N)
  12621.  
  12622. # NCD X server (SNMP says: NCD16 server 2.3.0 03/12/91 downloaded)
  12623. Fingerprint NCD X server (NCD16 server 2.3.0 03/12/91)
  12624. Class NCD | embedded || X terminal
  12625. TSeq(Class=64K)
  12626. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
  12627. T2(Resp=N)
  12628. T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
  12629. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  12630. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12631. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12632. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12633. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12634.  
  12635. Fingerprint NCR MP-RAS 3.0.x
  12636. Class NCR | BSD-misc || general purpose
  12637. TSeq(Class=64K)
  12638. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  12639. T2(Resp=N)
  12640. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
  12641. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12642. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12643. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12644. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  12645. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12646.  
  12647. Fingerprint NCR MP-RAS 3.01
  12648. Class NCR | BSD-misc || general purpose
  12649. TSeq(Class=i800)
  12650. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  12651. T2(Resp=N)
  12652. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
  12653. T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
  12654. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12655. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12656. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  12657. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12658.  
  12659. Fingerprint NCR S26 server (i386) running NCR MP-RAS SVR4 UNIX System
  12660. Class NCR | BSD-misc || general purpose
  12661. TSeq(Class=RI%gcd=<6%SI=<2BB718&>6FD5)
  12662. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  12663. T2(Resp=N)
  12664. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
  12665. T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=)
  12666. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  12667. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  12668. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  12669. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12670.  
  12671. Fingerprint NCR server running MP-RAS SVR4 UNIX System Version 3
  12672. Class NCR | BSD-misc || general purpose
  12673. TSeq(Class=RI%gcd=<6%SI=<31BA1E&>7F38)
  12674. T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  12675. T2(Resp=N)
  12676. T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
  12677. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  12678. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12679. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12680. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12681. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12682.  
  12683. Fingerprint NEC UX/4800
  12684. Class NEC | UX/4800 || general purpose
  12685. TSeq(Class=64K)
  12686. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  12687. T2(Resp=N)
  12688. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  12689. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12690. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12691. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12692. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12693. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  12694.  
  12695. # Necomm NB1300 ADSL Ethernet Modem/Router
  12696. Fingerprint Necomm NB1300 DSL router
  12697. Class Necomm | embedded || broadband router
  12698. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  12699. T2(Resp=N)
  12700. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  12701. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  12702. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12703. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12704. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12705. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  12706.  
  12707. # Host information:  @WorkStation (i960 based) X-terminal
  12708. # Neoware (was HDS) NetOS V. 2.0.1
  12709. # Hewlett-Packard Entria Model C3230A Server Version B.05.30
  12710. # Cisco 11151/Arrowpoint 150 Load Balancer
  12711. Fingerprint Cisco 11151/Arrowpoint 150 load balancer, Neoware (was HDS) NetOS V. 2.0.1 or HP Entria C3230A
  12712. Class Neoware | NetOS || X terminal
  12713. Class HP | embedded || X terminal
  12714. Class Cisco | embedded || load balancer
  12715. TSeq(Class=64K)
  12716. T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=|M)
  12717. T2(Resp=N)
  12718. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  12719. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  12720. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12721. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12722. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12723. PU(Resp=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12724.  
  12725. Fingerprint NetApp Data ONTAP 3.1.6 or BSDi 1.1
  12726. Class NetApp | Data ONTAP || fileserver
  12727. TSeq(Class=64K)
  12728. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  12729. T2(Resp=N)
  12730. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  12731. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  12732. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12733. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12734. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12735. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12736.  
  12737. Fingerprint NetApp Data ONTAP 5.1.2 - 5.3.5r2
  12738. Class NetApp | Data ONTAP || fileserver
  12739. TSeq(Class=RI%gcd=<6%SI=>BBB)
  12740. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12741. T2(Resp=N)
  12742. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  12743. T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=)
  12744. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12745. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12746. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12747. PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E)
  12748.  
  12749. Fingerprint NetApp Data ONTAP 6.1.2R3 on an F840 filer
  12750. Class NetApp | Data ONTAP || fileserver
  12751. TSeq(Class=RI%gcd=<6%SI=<83FEA&>B28%IPID=BI%TS=2HZ)
  12752. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12753. T2(Resp=N)
  12754. T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT)
  12755. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12756. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12757. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12758. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12759. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  12760.  
  12761. # NetApp Data ONTAP Release 6.3.1: Wed Nov 20 13:03:17 PST 2002
  12762. Fingerprint NetApp Data ONTAP Release 6.3.1
  12763. Class NetApp | Data ONTAP || fileserver
  12764. TSeq(Class=RI%gcd=<6%SI=<44A20&>AE7%IPID=BI%TS=100HZ)
  12765. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12766. T2(Resp=N)
  12767. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  12768. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12769. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12770. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12771. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12772. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  12773.  
  12774. Fingerprint NetApp F360 or F760 Filer
  12775. Class NetApp | Data ONTAP || fileserver
  12776. TSeq(Class=RI%gcd=<6%SI=<7CA10&>CA2%IPID=BI%TS=2HZ)
  12777. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12778. T2(Resp=N)
  12779. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  12780. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12781. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12782. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12783. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12784. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  12785.  
  12786. Fingerprint NetApp ONTAP Release 6.3.3
  12787. Class NetApp | Data ONTAP || fileserver
  12788. TSeq(Class=RI%gcd=<6%SI=<7128C&>B45%IPID=BI%TS=100HZ)
  12789. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12790. T2(Resp=N)
  12791. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  12792. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12793. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12794. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12795. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12796. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  12797.  
  12798. Fingerprint Network Appliance Filer running Data ONTAP Release 6.4.3
  12799. Class NetApp | Data ONTAP || fileserver
  12800. TSeq(Class=RI%gcd=<6%SI=<93792&>969%IPID=RPI|RD%TS=100HZ)
  12801. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12802. T2(Resp=N)
  12803. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12804. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12805. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12806. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12807. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12808. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12809.  
  12810. # NetCache 5.1D4 on a NetApp C1100 Box
  12811. Fingerprint NetApp NetCache C1100 (NetApp 5.1D4)
  12812. Class NetApp | embedded || web proxy
  12813. TSeq(Class=RI%gcd=<6%SI=<ABC02&>1371%IPID=BI%TS=2HZ)
  12814. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
  12815. T2(Resp=N)
  12816. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  12817. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12818. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12819. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12820. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12821. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  12822.  
  12823. # Network Appliance NetCache C1100 (NetApp 5.0)
  12824. Fingerprint NetApp NetCache C1100 with NetAppliance 5.0
  12825. Class NetApp | embedded || web proxy
  12826. TSeq(Class=RI%gcd=<6%SI=<93D5A&>95A%IPID=BI%TS=2HZ)
  12827. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12828. T2(Resp=N)
  12829. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  12830. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  12831. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12832. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12833. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12834. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  12835.  
  12836. Fingerprint NetApp NetCache C6100 (NetApp 5.5)
  12837. Class NetApp | embedded || web proxy
  12838. TSeq(Class=RI%gcd=<6%SI=<2642EC&>3974%IPID=BI%TS=100HZ)
  12839. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12840. T2(Resp=N)
  12841. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12842. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12843. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12844. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12845. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12846. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  12847.  
  12848. Fingerprint NetApp NetCache C760 os 4.x
  12849. Class NetApp | embedded || web proxy
  12850. TSeq(Class=RI%gcd=<6%SI=<4E51740&>FAA%IPID=I%TS=2HZ)
  12851. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12852. T2(Resp=N)
  12853. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  12854. T4(DF=N%W=5000%ACK=O%Flags=R%Ops=)
  12855. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12856. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12857. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12858. PU(Resp=N)
  12859.  
  12860. Fingerprint NetApp NetCache running OS 5.4R2
  12861. Class NetApp | embedded || web proxy
  12862. TSeq(Class=RI%gcd=<6%SI=<22AD62&>1619%IPID=BI%TS=100HZ)
  12863. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  12864. T2(Resp=N)
  12865. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12866. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12867. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12868. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12869. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12870. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  12871.  
  12872. Fingerprint NetBSD 1.0 big endian arch
  12873. Class NetBSD | NetBSD || general purpose
  12874. TSeq(Class=64K)
  12875. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  12876. T2(Resp=N)
  12877. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
  12878. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  12879. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12880. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12881. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12882. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12883.  
  12884. # Notes on NetBSD (written by Charles M. Hannum <root@ihack.net>):
  12885. # * The set of options in a SYN-ACK depends on the state of the
  12886. #   `net.inet.tcp.rfc1323' flag.
  12887. # * Releases prior to 1.3 did not randomize the ISS at all.
  12888. # * Releases prior to 1.3 incorrectly added the IP header length to the IP
  12889. #   packet length when returning an ICMP unreachable.
  12890. # * Releases prior to 1.3 calculated the window size slightly wrong.
  12891. # * Releases prior to 1.3 returned a non-zero window size when sending a RST
  12892. #   in response to an ACK on a listening socket (thereby making them
  12893. #   susceptible to stealth scanning).
  12894. # * Releases prior to 1.3H/1.3.4 did not return a response to the null flag
  12895. #   test (thereby making them susceptible to stealth scanning).
  12896. # * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in
  12897. #   the encapsulated IP header when sending an ICMP reply.  On little endian
  12898. #   machines the IP ID field was byte-swapped.  The checksums were always
  12899. #   zeroed.
  12900. # * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when
  12901. #   MTU discovery was enabled.
  12902. Fingerprint NetBSD 1.0 i386
  12903. Class NetBSD | NetBSD || general purpose
  12904. TSeq(Class=64K%IPID=I%TS=2HZ)
  12905. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  12906. T2(Resp=N)
  12907. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
  12908. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  12909. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12910. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12911. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12912. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  12913.  
  12914. Fingerprint NetBSD 1.0 little endian arch
  12915. Class NetBSD | NetBSD || general purpose
  12916. TSeq(Class=64K)
  12917. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  12918. T2(Resp=N)
  12919. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT)
  12920. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  12921. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12922. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  12923. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12924. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12925.  
  12926. Fingerprint NetBSD 1.1 - 1.2.1 litle endian arch
  12927. Class NetBSD | NetBSD || general purpose
  12928. TSeq(Class=64K)
  12929. T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12930. T2(Resp=N)
  12931. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12932. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  12933. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12934. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12935. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12936. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12937.  
  12938. Fingerprint NetBSD 1.2 - 1.2.1 big endian arch
  12939. Class NetBSD | NetBSD || general purpose
  12940. TSeq(Class=64K)
  12941. T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12942. T2(Resp=N)
  12943. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12944. T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=)
  12945. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12946. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12947. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12948. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12949.  
  12950. Fingerprint NetBSD 1.3 - 1.3.3 big endian arch
  12951. Class NetBSD | NetBSD || general purpose
  12952. TSeq(Class=RI%gcd=<6%SI=>18000)
  12953. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12954. T2(Resp=N)
  12955. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12956. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12957. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12958. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12959. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12960. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12961.  
  12962. Fingerprint NetBSD 1.3 - 1.3.3 little endian arch
  12963. Class NetBSD | NetBSD || general purpose
  12964. TSeq(Class=RI%gcd=<6%SI=>18000)
  12965. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12966. T2(Resp=N)
  12967. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12968. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12969. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12970. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12971. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12972. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12973.  
  12974. Fingerprint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch
  12975. Class NetBSD | NetBSD || general purpose
  12976. TSeq(Class=RI%gcd=<6%SI=>18000)
  12977. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12978. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12979. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12980. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12981. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12982. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12983. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12984. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12985.  
  12986. Fingerprint NetBSD 1.3H-1.5  big endian arch
  12987. Class NetBSD | NetBSD || general purpose
  12988. TSeq(Class=RI%gcd=<6%SI=>18000)
  12989. T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12990. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12991. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  12992. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12993. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  12994. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  12995. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  12996. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  12997.  
  12998. # NetBSD 1.3I (after 19990119)
  12999. # NetBSD 1.4 x86
  13000. # NetBSD 1.6L/Alpha
  13001. # NetBSD 1.6 NetBSD 1.6 (GENERIC) #0 Sun Sep 8 2002 i386
  13002. Fingerprint NetBSD 1.3I through 1.6
  13003. Class NetBSD | NetBSD || general purpose
  13004. TSeq(Class=RI%gcd=<6%SI=>18000)
  13005. T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  13006. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13007. T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M)
  13008. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13009. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13010. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13011. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13012. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13013.  
  13014. Fingerprint NetBSD 1.5.2 running on a Commodore Amiga (68040 processor)
  13015. Class NetBSD | NetBSD || general purpose
  13016. TSeq(Class=RI%gcd=<6%SI=<7AAB142&>874A7%IPID=I%TS=2HZ)
  13017. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13018. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13019. T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13020. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13021. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13022. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13023. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13024. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13025.  
  13026. Fingerprint NetBSD 1.5_ALPHA i386
  13027. Class NetBSD | NetBSD || general purpose
  13028. TSeq(Class=RI%gcd=<6%SI=<5CF5F1C&>EDF97)
  13029. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13030. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13031. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13032. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13033. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13034. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13035. T7(Resp=N)
  13036. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13037.  
  13038. Fingerprint NetBSD 1.6
  13039. Class NetBSD | NetBSD || general purpose
  13040. TSeq(Class=RI%gcd=<8%SI=<601F422&>60539%IPID=I)
  13041. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13042. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13043. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13044. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13045. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13046. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13047. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13048. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  13049.  
  13050. Fingerprint NetBSD 1.6 BETA 4 i386 (20020630 snapshot)
  13051. Class NetBSD | NetBSD || general purpose
  13052. TSeq(Class=RI%gcd=<6%SI=<76BC4C8&>A6C26%IPID=I)
  13053. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13054. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13055. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13056. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13057. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13058. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13059. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13060. PU(DF=N%TOS=0%IPLEN=38%RIPTL=4801%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  13061.  
  13062. Fingerprint NetBSD 1.6.1 (Alpha)
  13063. Class NetBSD | NetBSD || general purpose
  13064. TSeq(Class=RI|TR%gcd=<6%SI=<656F846%IPID=I)
  13065. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13066. T2(Resp=N)
  13067. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13068. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13069. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13070. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13071. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13072. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13073.  
  13074. Fingerprint NetBSD 1.6.2 (X86)
  13075. Class NetBSD | NetBSD || general purpose
  13076. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  13077. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13078. T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  13079. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13080. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13081. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13082. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13083. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13084.  
  13085. # NetBSD 1.6.2 on X86
  13086. # Avocent Switchview net KVM switch - this is a embedded device that makes a regular KVM accessible over IP.
  13087. # NetBSD 2.0_BETA i386
  13088. Fingerprint NetBSD 1.6.2 - 2.0_BETA or Avocent Switchview net KVM switch
  13089. Class NetBSD | NetBSD || general purpose
  13090. Class Avocent | embedded || specialized
  13091. TSeq(Class=RI%gcd=<6%SI=<7679164&>F13C6%IPID=I)
  13092. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  13093. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13094. T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  13095. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13096. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13097. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13098. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13099. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13100.  
  13101. Fingerprint NetBSD 1.6ZC (SPARC)
  13102. Class NetBSD | NetBSD || general purpose
  13103. TSeq(Class=RI%gcd=<6%SI=<67F4F30&>941F1%IPID=RD)
  13104. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13105. T2(Resp=N)
  13106. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13107. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13108. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13109. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13110. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13111. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13112.  
  13113. Fingerprint NetBSD 1.6ZD
  13114. Class NetBSD | NetBSD || general purpose
  13115. TSeq(Class=RI%gcd=<8%SI=<7C2EB86&>76383%IPID=RD)
  13116. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13117. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13118. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13119. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13120. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13121. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13122. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13123. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13124.  
  13125. # netbsd 1.6ZH GENERIC
  13126. # NetBSD 1.6ZK NetBSD 1.6ZK #1: Thu Feb 19 18:05:56 EST 2004
  13127. # NetBSD 2.0 
  13128. Fingerprint netbsd 1.6ZH - 2.0RC4
  13129. Class NetBSD | NetBSD || general purpose
  13130. TSeq(Class=RI%gcd=<6%SI=<714D5B4&>50BA4%IPID=I)
  13131. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13132. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13133. T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13134. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13135. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13136. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13137. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13138. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13139.  
  13140. Fingerprint NetBSD/Alpha 1.5.2 on a DEC 3000/300 LX
  13141. Class NetBSD | NetBSD || general purpose
  13142. TSeq(Class=RI%gcd=<6%SI=<736B300&>106DED%IPID=I%TS=2HZ)
  13143. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13144. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13145. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13146. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13147. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13148. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13149. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13150. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  13151.  
  13152. # Netgear DG824M Wireless (WAP) & 4-Port ADSL Router  - Version 1.4 Release 05
  13153. Fingerprint Netgear DG824M WAP
  13154. Class Netgear | embedded || broadband router
  13155. TSeq(Class=TD%gcd=<104%SI=<14%IPID=I%TS=U)
  13156. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  13157. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13158. T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  13159. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13160. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13161. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13162. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13163. PU(Resp=N)
  13164.  
  13165. # Netgear FM114P ProSafe Wireless Firewall with Print Server
  13166. # REPOTEC IP515H Cable Router / Print Server
  13167. Fingerprint Netgear FM114P/REPOTEC IP515H Router & Print Server
  13168. Class Netgear | embedded || broadband router
  13169. TSeq(Class=TD%gcd=<104%SI=<1E%IPID=I%TS=U)
  13170. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  13171. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13172. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  13173. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13174. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13175. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13176. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13177. PU(Resp=N)
  13178.  
  13179. Fingerprint Netgear FVL328 vpn/firewall/router
  13180. Class Netgear | embedded || broadband router
  13181. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  13182. T2(Resp=N)
  13183. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M)
  13184. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13185. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13186. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13187. T7(Resp=N)
  13188. PU(Resp=N)
  13189.  
  13190. # Netgear PS101 print server with firmware 6026
  13191. Fingerprint Netgear PS101 print server
  13192. Class Netgear | embedded || print server
  13193. T1(DF=N%W=5B4%ACK=S++%Flags=APS%Ops=M)
  13194. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13195. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  13196. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13197. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13198. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13199. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13200. PU(Resp=N)
  13201.  
  13202. # Netgear Printer Server PS110 firmware version: 6017
  13203. Fingerprint Netgear PS110 print server
  13204. Class Netgear | embedded || print server
  13205. TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U)
  13206. T1(DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M)
  13207. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13208. T3(Resp=Y%DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M)
  13209. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13210. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13211. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13212. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13213. PU(Resp=N)
  13214.  
  13215. Fingerprint NetJet Version 3.0 - 4.0 Printer
  13216. Class NetJet | embedded || printer
  13217. TSeq(Class=TD%gcd=<4%SI=<4)
  13218. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  13219. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13220. T3(Resp=Y%DF=N%W=0|800%ACK=S++%Flags=AR%Ops=|M)
  13221. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13222. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13223. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13224. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13225. PU(Resp=N)
  13226.  
  13227. # IPAD Model 5000 (see www.ipad-canada.com)
  13228. # eSoft IPAD, v.1.52 -- 64 line option on i86 hardware
  13229. Fingerprint IPAD (Internet Protocol Adapter) Model 5000 or V.1.52
  13230. Class NetMatrix | embedded || general purpose
  13231. TSeq(Class=TD|RI%gcd=1000|2000|3000%SI=<444)
  13232. T1(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  13233. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13234. T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M)
  13235. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13236. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13237. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13238. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13239. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13240.  
  13241. Fingerprint Broadband Router (Farralon Netopia or Compatible Systems 900i)
  13242. Class Netopia | embedded || broadband router
  13243. Class Compatible Systems | embedded || router
  13244. TSeq(Class=TD%gcd=388|710|A98%SI=<F)
  13245. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13246. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13247. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13248. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13249. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13250. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13251. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13252. PU(Resp=N)
  13253.  
  13254. # Netopia 4541 ADSL router v5.3.4
  13255. # Netopia R7100 SDSL router
  13256. Fingerprint Netopia 4541/R7100 DSL router
  13257. Class Netopia | embedded || broadband router
  13258. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  13259. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13260. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13261. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13262. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13263. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13264. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13265. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13266. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13267.  
  13268. Fingerprint Netopia DSL router
  13269. Class Netopia | embedded || broadband router
  13270. TSeq(Class=TR)
  13271. T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  13272. T2(Resp=N)
  13273. T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME)
  13274. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13275. T5(Resp=N)
  13276. T6(Resp=N)
  13277. T7(Resp=N)
  13278. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13279.  
  13280. # Netopia R3100-I DSL Router Firmware version v4.7.2
  13281. # Netopia 7100-C with firmware v4.6.3
  13282. Fingerprint Netopia DSL Router
  13283. Class Netopia | embedded || broadband router
  13284. TSeq(Class=TD%gcd=<EA64%SI=<10E%IPID=I%TS=U)
  13285. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13286. T2(Resp=N)
  13287. T3(Resp=N)
  13288. T4(Resp=N)
  13289. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13290. T6(Resp=N)
  13291. T7(Resp=N)
  13292. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13293.  
  13294. # Netopia R7100-C v4.11
  13295. # Netopia R5300 router; firmware v4.11
  13296. Fingerprint Netopia DSL router
  13297. Class Netopia | embedded || broadband router
  13298. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  13299. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13300. T2(Resp=N)
  13301. T3(Resp=N)
  13302. T4(Resp=N)
  13303. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13304. T6(Resp=N)
  13305. T7(Resp=N)
  13306. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13307.  
  13308. # Netopia R5300 Router; firmware v4.6
  13309. Fingerprint Netopia R5300 Router
  13310. Class Netopia | embedded || broadband router
  13311. TSeq(Class=TD%gcd=<D6DC%SI=<1E%IPID=I%TS=U)
  13312. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13313. T2(Resp=N)
  13314. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13315. T4(Resp=N)
  13316. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13317. T6(Resp=N)
  13318. T7(Resp=N)
  13319. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13320.  
  13321. # Netopia Cayman 3341 DSL router
  13322. # Radware Web Server Director NP with SynApps v8.10.02
  13323. # Cayman Model 3347W Wireless DSL Ethernet Switch
  13324. Fingerprint Netopia Cayman 3300-series router/WAP or Radware Web Server Director load balancer
  13325. Class Netopia | embedded || WAP
  13326. Class Radware | embedded || load balancer
  13327. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  13328. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  13329. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13330. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  13331. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13332. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13333. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13334. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13335. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13336.  
  13337. Fingerprint Netscreen 5GT Plus running ScreenOS 4.0.0r5.3
  13338. Class NetScreen | ScreenOS || firewall
  13339. TSeq(Class=TR%gcd=<6%TS=U)
  13340. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13341. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13342. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13343. T4(Resp=N)
  13344. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13345. T6(Resp=N)
  13346. T7(Resp=N)
  13347. PU(Resp=N)
  13348.  
  13349. Fingerprint Netscreen 5XP firewall+vpn (OS 3.0.1r2)
  13350. Class Netscreen | ScreenOS || firewall
  13351. TSeq(Class=TD%gcd=1000%SI=<FF)
  13352. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13353. T2(Resp=N)
  13354. T3(Resp=N)
  13355. T4(Resp=N)
  13356. T5(Resp=N)
  13357. T6(Resp=N)
  13358. T7(Resp=N)
  13359. PU(Resp=N)
  13360.  
  13361. Fingerprint Netscreen 5XP firewall+vpn (os 4.0.3r2.0)
  13362. Class Netscreen | ScreenOS || firewall
  13363. TSeq(Class=TR%gcd=<6)
  13364. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13365. T2(Resp=N)
  13366. T3(Resp=N)
  13367. T4(Resp=N)
  13368. T5(Resp=N)
  13369. T6(Resp=N)
  13370. T7(Resp=N)
  13371. PU(Resp=N)
  13372.  
  13373. Fingerprint NetScreen-100
  13374. Class NetScreen | ScreenOS || firewall
  13375. TSeq(Class=RI%gcd=<6%SI=<276A&>50)
  13376. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13377. T2(Resp=N)
  13378. T3(Resp=N)
  13379. T4(Resp=N)
  13380. T5(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  13381. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  13382. T7(Resp=N)
  13383. PU(Resp=N)
  13384.  
  13385. Fingerprint NetSilicon NetARM running ThreadX 2.0
  13386. Class NetSilicon | ThreadX || specialized
  13387. TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U)
  13388. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13389. T2(Resp=N)
  13390. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  13391. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  13392. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13393. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13394. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13395. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13396.  
  13397. Fingerprint Network Systems router NS6614 (NSC 6600 series)
  13398. Class Network Systems | embedded || router
  13399. TSeq(Class=64K)
  13400. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  13401. T2(Resp=N)
  13402. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  13403. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  13404. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13405. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13406. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13407. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  13408.  
  13409. # Nexland ISB Pro800 Turbo, Firmware version: V1 Rel 5U
  13410. Fingerprint Nexland ISB Pro800 Turbo Cable/DSL router
  13411. Class Nexland | embedded || broadband router
  13412. TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I)
  13413. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  13414. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13415. T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN)
  13416. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13417. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13418. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13419. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13420. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13421.  
  13422. # A NeXT Turbo, unknown version number
  13423. Fingerprint NeXT Mach
  13424. Class NeXT | Mach || general purpose
  13425. TSeq(Class=64K)
  13426. T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  13427. T2(Resp=N)
  13428. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  13429. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  13430. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13431. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13432. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13433. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13434.  
  13435. Fingerprint NeXTStep/OpenStep 4.2/Intel
  13436. Class NeXT | NeXTStep || general purpose
  13437. TSeq(Class=64K)
  13438. T1(Resp=Y%DF=N%W=F87%ACK=S++|O%Flags=AS%Ops=M)
  13439. T2(Resp=N)
  13440. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  13441. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  13442. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13443. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13444. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13445. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13446.  
  13447. Fingerprint OpenStep 4.0-4.2 or NeXTStep 1.0-3.3 (Intel)
  13448. Class NeXT | NeXTStep || general purpose
  13449. TSeq(Class=64K)
  13450. T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  13451. T2(Resp=N)
  13452. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  13453. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  13454. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13455. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  13456. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13457. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13458.  
  13459. Fingerprint OpenStep 4.1/NeXTStep 3.3
  13460. Class NeXT | NeXTStep || general purpose
  13461. TSeq(Class=64K)
  13462. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  13463. T2(Resp=N)
  13464. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  13465. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  13466. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13467. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13468. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13469. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13470.  
  13471. Fingerprint NIB 450-E printer network interface
  13472. Class NIB | embedded || printer
  13473. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  13474. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13475. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  13476. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13477. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13478. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13479. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13480. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13481.  
  13482. # Nokia M1122 DSL Router (Nokia Mrouter rel-Gx1x2220.R08)
  13483. Fingerprint Nokia M1122 DSL Router
  13484. Class Nokia | embedded || broadband router
  13485. TSeq(Class=RI%gcd=<6%SI=<1AF18&>43B%IPID=I)
  13486. T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  13487. T2(Resp=N)
  13488. T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT)
  13489. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13490. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13491. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13492. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13493. PU(Resp=N)
  13494.  
  13495. Fingerprint Nokia Rooftop Wireless Router model R240A
  13496. Class Nokia | embedded || router
  13497. T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME)
  13498. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13499. T3(Resp=Y%DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME)
  13500. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13501. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13502. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13503. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13504. PU(DF=N%TOS=0%IPLEN=40%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13505.  
  13506. Fingerprint Nokia IP530 Network Appliance (IPSO 3.4-3.4.2)
  13507. Class Nokia | IPSO || firewall
  13508. TSeq(Class=RI%gcd=<8%SI=<85DD6&>987%IPID=I%TS=2HZ)
  13509. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13510. T2(Resp=N)
  13511. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13512. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  13513. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13514. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13515. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13516. PU(DF=Y%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  13517.  
  13518. # Nokia IPSO 3.7-BUILD026 x86
  13519. Fingerprint Nokia IPSO 3.7 running CheckPoint FW-1
  13520. Class Nokia | IPSO || firewall
  13521. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  13522. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13523. T2(Resp=N)
  13524. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  13525. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  13526. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13527. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13528. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13529. PU(DF=N%TOS=0|E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  13530.  
  13531. # Symbian OS 6.1 on Nokia N-Gage v 4.03
  13532. Fingerprint Symbian OS 6.1 on Nokia N-Gage v 4.03 phone
  13533. Class Nokia | Symbian || phone
  13534. TSeq(Class=64K%IPID=I%TS=U)
  13535. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  13536. T2(Resp=N)
  13537. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  13538. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  13539. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13540. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13541. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13542. PU(Resp=N)
  13543.  
  13544. # Nortel Networks BayStack 450-24T Versions: HW:RevL  FW:V1.48 SW:v4.2.0.16 ISVN:2
  13545. Fingerprint Nortel Networks BayStack switch
  13546. Class Nortel | embedded || switch
  13547. TSeq(Class=RI%gcd=<6%SI=<762A&>C8%IPID=I%TS=U)
  13548. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13549. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13550. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  13551. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13552. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13553. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13554. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13555. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13556.  
  13557. # Nortel Networks Passport 1100 (version 2.0.7.2)
  13558. Fingerprint Nortel Networks Passport 1100 switch
  13559. Class Nortel | embedded || switch
  13560. TSeq(Class=64K%IPID=I%TS=U)
  13561. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  13562. T2(Resp=N)
  13563. T3(Resp=N)
  13564. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  13565. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13566. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13567. T7(Resp=N)
  13568. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13569.  
  13570. Fingerprint Nortel Networks Passport 8600 routing switch sw 3.3.0.0
  13571. Class Nortel | embedded || switch
  13572. TSeq(Class=RI%gcd=<6%SI=<E1C8A&>113A%IPID=I%TS=U)
  13573. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13574. T2(Resp=N)
  13575. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  13576. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  13577. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13578. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13579. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13580. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13581.  
  13582. # Nortel CallPilot 100 voicemail system
  13583. # 3Com superstack 3 4300 (3c17100) Hardware Version: V4.0 Software Version:  V1.12
  13584. # Cisco 1538M Micro Hub running latest firmware
  13585. # HP TopTools Remote Control Card
  13586. # Enterasys VH2402 Switch Firmware 2.05.02 
  13587. # NTT East VoIP gateway of some sort (  http://www.ntt-east.co.jp/ced/goods/voip/index.html )
  13588. Fingerprint Nortel CallPilot 100 voicemail system, 3Com Superstack 3 switch, Enterasys switch, HP TopTools remote control card, or Cisco 1538M hub
  13589. Class Nortel | embedded || telecom-misc
  13590. Class NTT | embedded || telecom-misc
  13591. Class 3Com | embedded || switch
  13592. Class Cisco | embedded || hub
  13593. Class Enterasys | embedded || switch
  13594. Class HP | embedded || remote management
  13595. TSeq(Class=64K%IPID=I%TS=U)
  13596. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13597. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13598. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  13599. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13600. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13601. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13602. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13603.  
  13604. # Nortel Passport 4400 Series - Release 4.0.3
  13605. Fingerprint Nortel Passport 4400 Series multiservice access switch
  13606. Class Nortel | embedded || telecom-misc
  13607. TSeq(Class=64K%IPID=I%TS=U)
  13608. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13609. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13610. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13611. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13612. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13613. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13614. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13615. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13616.  
  13617. Fingerprint Nortel Networks CVX1800 RAS. Software version 2.02
  13618. Class Nortel | embedded || terminal server
  13619. TSeq(Class=64K%gcd=<6%SI=<14)
  13620. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  13621. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13622. T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=)
  13623. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13624. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13625. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13626. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13627. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13628.  
  13629. Fingerprint Novell NetWare 3.12 - 5.00
  13630. Class Novell | NetWare | 3.X | general purpose
  13631. Class Novell | NetWare | 4.X | general purpose
  13632. Class Novell | NetWare | 5.X | general purpose
  13633. TSeq(Class=TD%gcd=10|20|30|40%SI=<64)
  13634. T1(DF=Y|N%W=7D0|8000|2000|1FFF|7FFF|8000|FFFF%ACK=S++%Flags=AS%Ops=M|ME)
  13635. T2(Resp=N)
  13636. T3(Resp=Y%DF=Y|N%W=7D0|8000|2000|1FFE|7FFF|8000|FFFF%ACK=O|S++%Flags=AS|ASF%Ops=M|ME)
  13637. T4(Resp=N)
  13638. T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  13639. T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
  13640. T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  13641. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13642.  
  13643. Fingerprint Novell NetWare 3.12 or 386 TCP/IP
  13644. Class Novell | NetWare | 3.X | general purpose
  13645. TSeq(Class=TD%gcd=<6B4A%SI=<1E)
  13646. T1(DF=N%W=73F|F87|3F25%ACK=S++%Flags=AS%Ops=ME)
  13647. T2(Resp=N)
  13648. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS|ASF%Ops=ME)
  13649. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13650. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13651. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13652. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13653. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13654.  
  13655. Fingerprint NetWare 4.11 SP7- 5 SP3A BorderManager 3.5
  13656. Class Novell | NetWare | 4.X | general purpose
  13657. TSeq(Class=RI%gcd=<6%SI=<1843D74&>3E1D0)
  13658. T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
  13659. T2(Resp=N)
  13660. T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
  13661. T4(Resp=N)
  13662. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13663. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13664. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13665. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13666.  
  13667. Fingerprint NetWare 4.11 SP8a - NetWare 5 SP4
  13668. Class Novell | NetWare | 4.X | general purpose
  13669. TSeq(Class=RI%gcd=<6%SI=<2DB195E&>74F88)
  13670. T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M)
  13671. T2(Resp=N)
  13672. T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M)
  13673. T4(Resp=N)
  13674. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13675. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13676. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13677. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13678.  
  13679. Fingerprint Novell NetWare 4.11-5.0SP5
  13680. Class Novell | NetWare | 4.X | general purpose
  13681. Class Novell | NetWare | 5.X | general purpose
  13682. TSeq(Class=RI%gcd=<6%SI=<2B302C0&>6E8E8)
  13683. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  13684. T2(Resp=N)
  13685. T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
  13686. T4(Resp=N)
  13687. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13688. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13689. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13690. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13691.  
  13692. Fingerprint NetWare 5.0 SP 3a
  13693. Class Novell | NetWare | 5.X | general purpose
  13694. TSeq(Class=RI%gcd=<8%SI=<5641338&>DCCE9)
  13695. T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  13696. T2(Resp=N)
  13697. T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
  13698. T4(Resp=N)
  13699. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13700. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13701. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13702. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13703.  
  13704. Fingerprint NetWare 5.1 SP3
  13705. Class Novell | NetWare | 5.X | general purpose
  13706. TSeq(Class=RI%gcd=<6%SI=<2385886&>53F65%IPID=RPI|BI|RD%TS=U)
  13707. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  13708. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13709. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13710. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13711. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13712. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13713. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13714. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13715.  
  13716. Fingerprint Novell NetWare 5.0 with Border Manager
  13717. Class Novell | NetWare | 5.X | general purpose
  13718. TSeq(Class=RI%gcd=<5%SI=>BBBBB)
  13719. T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M)
  13720. T2(Resp=N)
  13721. T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M)
  13722. T4(Resp=N)
  13723. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13724. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13725. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13726. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13727.  
  13728. # Novell NetWare 5 Support Pack Revision 06 Server Version 5.00.09
  13729. Fingerprint Novell NetWare 5.00.09 SP06
  13730. Class Novell | NetWare | 5.X | general purpose
  13731. TSeq(Class=RI%gcd=<6%SI=<1EDA0D4&>2F197%IPID=I%TS=U)
  13732. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  13733. T2(Resp=N)
  13734. T3(Resp=Y%DF=Y%W=FFF%ACK=O%Flags=AS%Ops=M)
  13735. T4(Resp=N)
  13736. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13737. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13738. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13739. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13740.  
  13741. # Novell NetWare 5.1 SP5 with Groupwise
  13742. Fingerprint Novell NetWare 5.1 SP5
  13743. Class Novell | NetWare | 5.X | general purpose
  13744. TSeq(Class=RI%gcd=<6%SI=<2378ABE&>57780%IPID=BI%TS=U)
  13745. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M|MEWN)
  13746. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13747. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  13748. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13749. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13750. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13751. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13752. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13753.  
  13754. Fingerprint Novell NetWare 5.1 SP5 with Groupwise
  13755. Class Novell | NetWare | 5.X | general purpose
  13756. TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U)
  13757. T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  13758. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13759. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  13760. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13761. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13762. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13763. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13764. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13765.  
  13766. Fingerprint Novell NetWare 5.1-6.0
  13767. Class Novell | NetWare | 5.X | general purpose
  13768. Class Novell | NetWare | 6.X | general purpose
  13769. TSeq(Class=RI%gcd=<6%SI=<2883446&>599C6%IPID=RD|RPI%TS=U)
  13770. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  13771. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13772. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13773. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13774. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13775. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13776. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13777. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13778.  
  13779. Fingerprint Novell NetWare 5.1SP4 - 6.0
  13780. Class Novell | NetWare | 5.X | general purpose
  13781. Class Novell | NetWare | 6.X | general purpose
  13782. TSeq(Class=RI%gcd=<6%SI=<253064A&>5F32F%IPID=BI%TS=U)
  13783. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  13784. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13785. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13786. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13787. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13788. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13789. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13790. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13791.  
  13792. Fingerprint Novell NetWare 5.1SP5 - 6.5
  13793. Class Novell | NetWare | 5.X | general purpose
  13794. Class Novell | NetWare | 6.X | general purpose
  13795. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  13796. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  13797. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13798. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13799. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13800. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13801. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13802. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13803. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13804.  
  13805. Fingerprint Novell NetWare 5.x
  13806. Class Novell | NetWare | 5.X | general purpose
  13807. TSeq(Class=RI%gcd=<8%SI=<286248A&>1B465%IPID=I%TS=U)
  13808. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M)
  13809. T2(Resp=N)
  13810. T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M)
  13811. T4(Resp=N)
  13812. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13813. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13814. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13815. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13816.  
  13817. # NetWare 6.5 SP2 (running on a Compaq Proliant ML370)
  13818. Fingerprint NetWare 6.5 SP2
  13819. Class Novell | NetWare | 6.X | general purpose
  13820. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  13821. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  13822. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13823. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13824. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13825. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13826. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13827. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13828. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  13829.  
  13830. Fingerprint Novell NetWare 6 SP1
  13831. Class Novell | NetWare | 6.X | general purpose
  13832. TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=U)
  13833. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  13834. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13835. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13836. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13837. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13838. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13839. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13840. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13841.  
  13842. # Novell NetWare 6 SP2 running BM3.7 (with no service packs)
  13843. Fingerprint Novell NetWare 6 SP2
  13844. Class Novell | NetWare | 6.X | general purpose
  13845. TSeq(Class=RI%gcd=<6%SI=<30102C2&>766BA%IPID=BI%TS=U)
  13846. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  13847. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13848. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13849. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13850. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13851. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13852. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13853. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13854.  
  13855. Fingerprint Novell NetWare 6.0 SP3
  13856. Class Novell | NetWare | 6.X | general purpose
  13857. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  13858. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  13859. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  13860. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13861. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13862. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13863. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13864. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13865. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  13866.  
  13867. Fingerprint Novell Netware 6.0 SP4
  13868. Class Novell | NetWare | 6.X | general purpose
  13869. TSeq(Class=TR%gcd=<6%IPID=BI%TS=U)
  13870. T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN)
  13871. T2(Resp=N)
  13872. T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=)
  13873. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13874. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13875. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  13876. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  13877. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13878.  
  13879. Fingerprint NSG 500 router. OS version 7.6.1 (http://www.nsg.ru)
  13880. Class NSG | embedded || router
  13881. TSeq(Class=TD%gcd=<14004%SI=<28%IPID=I%TS=U)
  13882. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13883. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13884. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  13885. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13886. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13887. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  13888. T7(Resp=N)
  13889. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  13890.  
  13891. # OkiData 20nx printer with OkiLAN 6100e TCP/IP Ethernet module
  13892. Fingerprint OkiData 20nx printer with OkiLAN ethernet module
  13893. Class Okidata | embedded || printer
  13894. TSeq(Class=C%IPID=I%TS=U)
  13895. T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M)
  13896. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13897. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13898. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13899. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13900. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13901. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13902. PU(Resp=N)
  13903.  
  13904. Fingerprint Okidata 7200 Printer
  13905. Class Okidata | embedded || printer
  13906. T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M)
  13907. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13908. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13909. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13910. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13911. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13912. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13913. PU(Resp=N)
  13914.  
  13915. Fingerprint Okidata OKI C5100 Laser Printer
  13916. Class Okidata | embedded || printer
  13917. T1(DF=N%W=C00%ACK=S++%Flags=AS|AR%Ops=M||MNW)
  13918. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  13919. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  13920. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  13921. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13922. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13923. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13924. PU(Resp=N)
  13925.  
  13926. Fingerprint Okidata OKI C7200 Printer
  13927. Class Okidata | embedded || printer
  13928. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13929. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13930. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13931. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13932. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13933. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13934. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13935. PU(Resp=N)
  13936.  
  13937. Fingerprint OpenBSD 2.7/SPARC or NFR IDS Appliance ( 12/10/00 )
  13938. Class OpenBSD | OpenBSD | 2.7 | general purpose
  13939. TSeq(Class=RI%gcd=<6%SI=<8FC28&>16EC)
  13940. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  13941. T2(Resp=N)
  13942. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  13943. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  13944. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13945. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13946. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13947. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  13948.  
  13949. Fingerprint OpenBSD 2.1 - 2.3/SPARC
  13950. Class OpenBSD | OpenBSD | 2.X | general purpose
  13951. TSeq(Class=RI%gcd=<6%SI=>FF)
  13952. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13953. T2(Resp=N)
  13954. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13955. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  13956. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13957. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13958. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13959. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13960.  
  13961. # This fingerprint had LAND patch installed
  13962. Fingerprint OpenBSD 2.1/x86
  13963. Class OpenBSD | OpenBSD | 2.X | general purpose
  13964. TSeq(Class=RI%gcd=<6%SI=>BBB)
  13965. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  13966. T2(Resp=N)
  13967. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  13968. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  13969. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13970. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13971. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13972. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13973.  
  13974. Fingerprint OpenBSD 2.2 - 2.3
  13975. Class OpenBSD | OpenBSD | 2.X | general purpose
  13976. TSeq(Class=RI%gcd=<6)
  13977. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13978. T2(Resp=N)
  13979. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  13980. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  13981. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13982. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13983. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13984. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  13985.  
  13986. Fingerprint OpenBSD 2.6 with all available patches as of roughly Feb01
  13987. Class OpenBSD | OpenBSD | 2.X | general purpose
  13988. TSeq(Class=RI%gcd=<6%SI=<4C22A&>C1A)
  13989. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  13990. T2(Resp=N)
  13991. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  13992. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  13993. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  13994. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  13995. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  13996. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F|E%UCK=F|E%ULEN=134%DAT=E)
  13997.  
  13998. # With more info provided by Theo De Raadt
  13999. # OpenBSD 2.6
  14000. Fingerprint OpenBSD 2.6-2.8
  14001. Class OpenBSD | OpenBSD | 2.X | general purpose
  14002. TSeq(Class=RI%gcd=<6%SI=<1869F6&>3E6B)
  14003. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14004. T2(Resp=N)
  14005. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14006. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  14007. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14008. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14009. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14010. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134|3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14011.  
  14012. Fingerprint OpenBSD 2.6-2.8
  14013. Class OpenBSD | OpenBSD | 2.X | general purpose
  14014. TSeq(Class=RI%gcd=<6%SI=<AD084&>1B9B)
  14015. T1(DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  14016. T2(Resp=N)
  14017. T3(Resp=Y%DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  14018. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  14019. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14020. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14021. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14022. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14023.  
  14024. Fingerprint OpenBSD 2.8 (x86)
  14025. Class OpenBSD | OpenBSD | 2.X | general purpose
  14026. TSeq(Class=TD|RI%gcd=<6%SI=<A8C&>1%IPID=RPI|BI%TS=U)
  14027. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14028. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14029. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14030. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14031. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14032. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14033. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14034. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14035.  
  14036. Fingerprint OpenBSD 2.9-beta through release (x86)
  14037. Class OpenBSD | OpenBSD | 2.X | general purpose
  14038. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14039. T1(DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14040. T2(Resp=N)
  14041. T3(Resp=Y%DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14042. T4(DF=Y|N%W=4000%ACK=O%Flags=R%Ops=)
  14043. T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  14044. T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=)
  14045. T7(DF=Y|N%W=0%ACK=S%Flags=AR%Ops=)
  14046. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  14047.  
  14048. Fingerprint OpenBSD 2.9-stable
  14049. Class OpenBSD | OpenBSD | 2.X | general purpose
  14050. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14051. T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
  14052. T2(Resp=N)
  14053. T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT)
  14054. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  14055. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14056. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14057. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14058. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14059.  
  14060. Fingerprint OpenBSD Post 2.4 (November 1998) - 2.5
  14061. Class OpenBSD | OpenBSD | 2.X | general purpose
  14062. TSeq(Class=RI%gcd=<6%SI=>FFF&<BBBBB)
  14063. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14064. T2(Resp=N)
  14065. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14066. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  14067. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14068. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14069. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14070. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14071.  
  14072. # OpenBSD 3.0 (x86 or SPARC)
  14073. # OpenBSD 3.3 (hppa)
  14074. # OpenBSD 3.3 (GENERIC) i386
  14075. Fingerprint OpenBSD 3.0 or 3.3
  14076. Class OpenBSD | OpenBSD | 3.X | general purpose
  14077. TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=2HZ)
  14078. T1(DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14079. T2(Resp=N)
  14080. T3(Resp=Y%DF=Y%W=403D|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14081. T4(DF=Y%W=4000|FFFF%ACK=O%Flags=R%Ops=)
  14082. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14083. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14084. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14085. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14086.  
  14087. Fingerprint OpenBSD 3.0 SPARC with pf "scrub in all"
  14088. Class OpenBSD | OpenBSD | 3.X | general purpose
  14089. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U|2HZ)
  14090. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14091. T2(Resp=N)
  14092. T3(Resp=N)
  14093. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  14094. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14095. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14096. T7(Resp=N)
  14097. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14098.  
  14099. Fingerprint OpenBSD 3.0-STABLE (x86)
  14100. Class OpenBSD | OpenBSD | 3.X | general purpose
  14101. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14102. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14103. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  14104. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14105. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  14106. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14107. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  14108. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  14109. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14110.  
  14111. Fingerprint OpenBSD 3.1 (x86)
  14112. Class OpenBSD | OpenBSD | 3.X | general purpose
  14113. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14114. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14115. T2(Resp=N)
  14116. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14117. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  14118. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14119. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14120. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14121. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14122.  
  14123. Fingerprint OpenBSD 3.1 (x86)
  14124. Class OpenBSD | OpenBSD | 3.X | general purpose
  14125. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14126. T2(Resp=N)
  14127. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14128. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  14129. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14130. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14131. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14132. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E)
  14133.  
  14134. Fingerprint OpenBSD 3.1 on an Alpha
  14135. Class OpenBSD | OpenBSD | 3.X | general purpose
  14136. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14137. T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14138. T2(Resp=N)
  14139. T3(Resp=N)
  14140. T4(DF=Y%W=FFFF%ACK=O%Flags=R%Ops=)
  14141. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14142. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14143. T7(Resp=N)
  14144. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14145.  
  14146. Fingerprint OpenBSD 3.2 (x86)
  14147. Class OpenBSD | OpenBSD | 3.X | general purpose
  14148. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  14149. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  14150. T2(Resp=N)
  14151. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  14152. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  14153. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14154. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14155. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14156. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14157.  
  14158. Fingerprint OpenBSD 3.2 with pf scrub and no-df
  14159. Class OpenBSD | OpenBSD | 3.X | general purpose
  14160. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14161. T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT)
  14162. T2(Resp=N)
  14163. T3(Resp=N)
  14164. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  14165. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14166. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14167. T7(Resp=N)
  14168. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14169.  
  14170. Fingerprint OpenBSD 3.3
  14171. Class OpenBSD | OpenBSD | 3.X | general purpose
  14172. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14173. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14174. T2(Resp=N)
  14175. T3(Resp=N)
  14176. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  14177. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14178. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14179. T7(Resp=N)
  14180. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14181.  
  14182. Fingerprint OpenBSD 3.3 x86 with pf "scrub in all"
  14183. Class OpenBSD | OpenBSD | 3.X | general purpose
  14184. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14185. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14186. T2(Resp=N)
  14187. T3(Resp=N)
  14188. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  14189. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14190. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14191. T7(Resp=N)
  14192. PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14193.  
  14194. Fingerprint OpenBSD 3.3 x86 with pf "scrub in all"
  14195. Class OpenBSD | OpenBSD | 3.X | general purpose
  14196. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14197. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14198. T2(Resp=N)
  14199. T3(Resp=N)
  14200. T4(DF=Y%W=0|4000%ACK=O%Flags=R%Ops=)
  14201. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14202. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14203. T7(Resp=N)
  14204. PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  14205.  
  14206. Fingerprint OpenBSD 3.4 (X86)
  14207. Class OpenBSD | OpenBSD | 3.X | general purpose
  14208. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14209. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14210. T2(Resp=N)
  14211. T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14212. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  14213. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14214. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14215. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14216. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  14217.  
  14218. Fingerprint OpenBSD 3.4 - 3.6
  14219. Class OpenBSD | OpenBSD | 3.X | general purpose
  14220. TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=2HZ)
  14221. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  14222. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14223. T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  14224. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14225. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14226. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14227. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14228. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14229.  
  14230. Fingerprint OpenBSD 3.4 x86
  14231. Class OpenBSD | OpenBSD | 3.X | general purpose
  14232. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14233. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14234. T2(Resp=N)
  14235. T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14236. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  14237. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14238. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14239. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14240. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  14241.  
  14242. Fingerprint OpenBSD 3.4 x86 with pf "scrub in all"
  14243. Class OpenBSD | OpenBSD | 3.X | general purpose
  14244. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14245. T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14246. T2(Resp=N)
  14247. T3(Resp=N)
  14248. T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=)
  14249. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14250. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14251. T7(Resp=N)
  14252. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14253.  
  14254. Fingerprint OpenBSD 3.4 x86 with pf "scrub in all"
  14255. Class OpenBSD | OpenBSD | 3.X | general purpose
  14256. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14257. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14258. T2(Resp=N)
  14259. T3(Resp=N)
  14260. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  14261. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14262. T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14263. T7(Resp=N)
  14264. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14265.  
  14266. Fingerprint OpenBSD 3.4-BETA
  14267. Class OpenBSD | OpenBSD | 3.X | general purpose
  14268. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14269. T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT)
  14270. T2(Resp=N)
  14271. T3(Resp=N)
  14272. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  14273. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14274. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14275. T7(Resp=N)
  14276. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14277.  
  14278. Fingerprint OpenBSD 3.5 (SPARC)
  14279. Class OpenBSD | OpenBSD | 3.X | general purpose
  14280. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14281. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  14282. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14283. T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  14284. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14285. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14286. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14287. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14288. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14289.  
  14290. Fingerprint OpenBSD 3.5 with pf "scrub in all"
  14291. Class OpenBSD | OpenBSD | 3.X | general purpose
  14292. TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ)
  14293. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT)
  14294. T2(Resp=N)
  14295. T3(Resp=N)
  14296. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14297. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14298. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14299. T7(Resp=N)
  14300. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14301.  
  14302. # OpenBSD fwall.xxx.xx 3.6 GENERIC#42 i386
  14303. Fingerprint OpenBSD 3.6 x86 with pf "scrub in all"
  14304. Class OpenBSD | OpenBSD | 3.X | general purpose
  14305. T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT)
  14306. T2(Resp=N)
  14307. T3(Resp=N)
  14308. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14309. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14310. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14311. T7(Resp=N)
  14312. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14313.  
  14314. Fingerprint Pace digital cable TV receiver
  14315. Class Pace | embedded || media device
  14316. TSeq(Class=RI%gcd=<6%SI=<2C3AB3E&>62A0A%IPID=Z%TS=100HZ)
  14317. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  14318. T2(Resp=N)
  14319. T3(Resp=N)
  14320. T4(Resp=N)
  14321. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14322. T6(Resp=N)
  14323. T7(Resp=N)
  14324. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14325.  
  14326. Fingerprint Packet Engines PowerRail 5200 router version 2.6.0r10 - 16 Sep, 1999
  14327. Class Packet Engines | embedded || router
  14328. TSeq(Class=64K)
  14329. T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M)
  14330. T2(Resp=N)
  14331. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=)
  14332. T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=)
  14333. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14334. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14335. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14336. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14337.  
  14338. Fingerprint Packet8 DTA310 VoIP/POTS gateway
  14339. Class Packet8 | embedded || VoIP adapter
  14340. TSeq(Class=TD%gcd=<200034%SI=<1E%TS=U)
  14341. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=)
  14342. T2(Resp=N)
  14343. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=)
  14344. T4(DF=N%W=578%ACK=O%Flags=R%Ops=)
  14345. T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  14346. T6(DF=N%W=578%ACK=O%Flags=R%Ops=)
  14347. T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=)
  14348. PU(DF=N%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  14349.  
  14350. Fingerprint Packet8 DTA310 VoIP/POTS gateway
  14351. Class Packet8 | embedded || VoIP adapter
  14352. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  14353. T1(DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  14354. T2(Resp=N)
  14355. T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=)
  14356. T4(DF=Y%W=578%ACK=O%Flags=R%Ops=)
  14357. T5(DF=Y%W=578%ACK=S++%Flags=AR%Ops=)
  14358. T6(DF=Y%W=578%ACK=O%Flags=R%Ops=)
  14359. T7(DF=Y%W=578%ACK=S++%Flags=AR%Ops=)
  14360. PU(DF=Y%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F)
  14361.  
  14362. Fingerprint Packeteer PacketShaper 4000 v4.1.3b2 2000-04-05
  14363. Class Packeteer | pSOS || load balancer
  14364. TSeq(Class=64K)
  14365. T1(DF=N%W=430%ACK=S++%Flags=AS%Ops=)
  14366. T2(Resp=N)
  14367. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  14368. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  14369. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14370. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14371. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14372. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  14373.  
  14374. # Packeteer IP-PacketShaper 2000 V3.1
  14375. Fingerprint pSOS embedded IP stack, such as Packeteer IP-PacketShaper 2000 V3.1
  14376. Class Packeteer | pSOS || load balancer
  14377. TSeq(Class=64K)
  14378. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  14379. T2(Resp=N)
  14380. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  14381. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  14382. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14383. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  14384. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14385. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  14386.  
  14387. Fingerprint PalmOS 3.5.1 on m100 PDA
  14388. Class Palm | PalmOS | 3.X | PDA
  14389. TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U)
  14390. T1(DF=N%W=A78%ACK=S++%Flags=AS%Ops=M)
  14391. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14392. T3(Resp=Y%DF=N%W=A78%ACK=S++%Flags=AS%Ops=M)
  14393. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14394. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14395. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14396. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14397. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14398.  
  14399. Fingerprint Panasonic IP Technology Broadband Networking Gateway, KX-HGW200
  14400. Class Panasonic | embedded || broadband router
  14401. TSeq(Class=RI%gcd=<6%SI=<27BE484&>16928%IPID=Z%TS=100HZ)
  14402. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  14403. T2(Resp=N)
  14404. T3(Resp=N)
  14405. T4(Resp=N)
  14406. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14407. T6(Resp=N)
  14408. T7(Resp=N)
  14409. PU(Resp=N)
  14410.  
  14411. # (printer, scanner, copier, fax machine)
  14412. Fingerprint Panasonic DP-3520 multi-function printer
  14413. Class Panasonic | embedded || printer
  14414. TSeq(Class=TD%gcd=<E0%SI=<1E%IPID=I%TS=U)
  14415. T1(Resp=N)
  14416. T2(Resp=N)
  14417. T3(Resp=N)
  14418. T4(Resp=N)
  14419. T5(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
  14420. T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=)
  14421. T7(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
  14422. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14423.  
  14424. Fingerprint Panasonic panafax DX2000 SuperG3 fax machine
  14425. Class Panasonic | embedded || printer
  14426. TSeq(Class=TD|RI%gcd=<18%SI=<177A&>27)
  14427. T1(Resp=N)
  14428. T2(Resp=N)
  14429. T3(Resp=N)
  14430. T4(Resp=N)
  14431. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  14432. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  14433. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  14434. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14435.  
  14436. # PCS Intus 3100 running TCL Version 5 with Firmware version 4.54
  14437. Fingerprint PCS Intus 3100 time management device
  14438. Class PCS | embedded || specialized
  14439. TSeq(Class=RI%gcd=<2004%SI=<1612&>21%IPID=I%TS=U)
  14440. T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AS%Ops=M)
  14441. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  14442. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  14443. T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  14444. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  14445. T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=)
  14446. T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  14447. PU(Resp=N)
  14448.  
  14449. Fingerprint Pelco Network Camera
  14450. Class Pelco | embedded || webcam
  14451. TSeq(Class=RI%gcd=<6%SI=<1000018&>28F48%IPID=I%TS=U)
  14452. T1(DF=N%W=B4%ACK=S++%Flags=AS%Ops=)
  14453. T2(Resp=Y%DF=N%W=B4%ACK=S%Flags=R%Ops=)
  14454. T3(Resp=Y%DF=N%W=B4%ACK=S++%Flags=AS%Ops=)
  14455. T4(DF=N%W=B4%ACK=S%Flags=R%Ops=)
  14456. T5(DF=N%W=B4%ACK=S++%Flags=R%Ops=)
  14457. T6(DF=N%W=B4%ACK=S%Flags=R%Ops=)
  14458. T7(DF=N%W=B4%ACK=S%Flags=R%Ops=)
  14459. PU(Resp=N)
  14460.  
  14461. Fingerprint Perle JetStream 8500 Serial/Access Server, v 2.6.0
  14462. Class Perle | embedded || terminal server
  14463. TSeq(Class=64K%IPID=I%TS=U)
  14464. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  14465. T2(Resp=N)
  14466. T3(Resp=Y%DF=N%W=7FC%ACK=O%Flags=A%Ops=)
  14467. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14468. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14469. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14470. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14471. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14472.  
  14473. Fingerprint Phillips ReplayTV 5000 DVR
  14474. Class Phillips | embedded || media device
  14475. TSeq(Class=64K%IPID=I%TS=2HZ)
  14476. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  14477. T2(Resp=N)
  14478. T3(Resp=N)
  14479. T4(Resp=N)
  14480. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14481. T6(Resp=N)
  14482. T7(Resp=N)
  14483. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14484.  
  14485. Fingerprint Pigtail Express VoIP phone (runs VxWorks)
  14486. Class Pigtail | VxWorks || VoIP phone
  14487. TSeq(Class=64K%IPID=I%TS=U)
  14488. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  14489. T2(Resp=N)
  14490. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  14491. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  14492. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14493. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14494. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14495. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  14496.  
  14497. Fingerprint Pirelli Microbusiness ADSL router
  14498. Class Pirelli | embedded || broadband router
  14499. TSeq(Class=64K%IPID=I%TS=2HZ)
  14500. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  14501. T2(Resp=N)
  14502. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  14503. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  14504. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14505. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14506. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14507. PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14508.  
  14509. # Pitney Bowes DL550 photocopier
  14510. #  Konica IP Controller Internal Print Server Module for Konica Multi-Purpose Printer/Fax/Scanner, Model KCA_018823
  14511. Fingerprint Pitney Bowes photocopier, Konica printer/fax/scanner, or Toshiba E-Studio16 printer
  14512. Class Pitney Bowes | embedded || printer
  14513. Class Konica | embedded || printer
  14514. Class Toshiba | embedded || printer
  14515. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  14516. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14517. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  14518. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14519. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14520. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14521. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14522. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14523.  
  14524. Fingerprint Planet WAP 1950 Wireless Access Point
  14525. Class Planet | embedded || WAP
  14526. TSeq(Class=TD%gcd=<1C%SI=<14%IPID=I%TS=U)
  14527. T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
  14528. T2(Resp=N)
  14529. T3(Resp=Y%DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME)
  14530. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14531. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14532. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14533. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14534. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14535.  
  14536. Fingerprint Polycom ViewStation
  14537. Class Polycom | embedded || webcam
  14538. TSeq(Class=C)
  14539. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  14540. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14541. T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  14542. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14543. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14544. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14545. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14546. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14547.  
  14548. Fingerprint Polycom ViewStation 512K videoconferencing system
  14549. Class Polycom | embedded || webcam
  14550. TSeq(Class=C)
  14551. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  14552. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14553. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  14554. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14555. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14556. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14557. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14558. PU(DF=N%TOS=0|80%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14559.  
  14560. Fingerprint PolyCom ViewStation video-conferencing system (firmware v7.2)
  14561. Class PolyCom | embedded || webcam
  14562. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  14563. T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M)
  14564. T2(Resp=N)
  14565. T3(Resp=N)
  14566. T4(Resp=N)
  14567. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14568. T6(Resp=N)
  14569. T7(Resp=N)
  14570. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14571.  
  14572. Fingerprint PowerShow NetworKam webcam
  14573. Class PowerShow | embedded || webcam
  14574. TSeq(Class=TD%gcd=<194%SI=<14%IPID=I%TS=U)
  14575. T1(Resp=N)
  14576. T2(Resp=N)
  14577. T3(Resp=N)
  14578. T4(Resp=N)
  14579. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  14580. T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=)
  14581. T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=)
  14582. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14583.  
  14584. Fingerprint Proteon OpenRoute 3.0 gt series router
  14585. Class Proteon | OpenRoute || router
  14586. TSeq(Class=TD%gcd=1%SI=0)
  14587. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML)
  14588. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14589. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14590. T4(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  14591. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14592. T6(DF=N%W=0%ACK=S++%Flags=R%Ops=)
  14593. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14594. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14595.  
  14596. # Proxim Stratum MP FW: 7_8_18;  managed via HTTP and only relevant data is (I guess) the firmware version: FW: 7_8_18
  14597. Fingerprint Proxim Stratum MP wireless bridge
  14598. Class Proxim | embedded || bridge
  14599. TSeq(Class=TD%gcd=<61AC%SI=<46%IPID=I%TS=1000HZ)
  14600. T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  14601. T2(Resp=N)
  14602. T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT)
  14603. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14604. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14605. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14606. T7(Resp=N)
  14607. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  14608.  
  14609. # Proxim 8571 802.11a Access Point Software Version:  2.0-B11 : Aug 12 2002 11:08:16
  14610. Fingerprint Proxim 8571 802.11a Access Point
  14611. Class Proxim | embedded || WAP
  14612. TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U)
  14613. T1(DF=N%W=1770%ACK=S++%Flags=AS%Ops=M)
  14614. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14615. T3(Resp=Y%DF=N%W=1770%ACK=S++%Flags=AS%Ops=M)
  14616. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  14617. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14618. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  14619. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14620. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14621.  
  14622. Fingerprint QMS Magicolor 2200 DeskLaser printer
  14623. Class QMS | embedded || printer
  14624. T1(DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M)
  14625. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  14626. T3(Resp=Y%DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M)
  14627. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14628. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14629. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14630. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14631. PU(Resp=N)
  14632.  
  14633. Fingerprint QNX 4.24 - 4.25 realtime embedded OS
  14634. Class QNX | QNX || general purpose
  14635. TSeq(Class=64K)
  14636. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M)
  14637. T2(Resp=N)
  14638. T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=)
  14639. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  14640. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14641. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14642. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14643. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14644.  
  14645. Fingerprint QNX 6.00 realtime embedded OS (x86)
  14646. Class QNX | QNX || general purpose
  14647. TSeq(Class=TD%gcd=<7D4%SI=<8C%IPID=I%TS=U)
  14648. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14649. T2(Resp=N)
  14650. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14651. T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14652. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14653. T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14654. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  14655. PU(Resp=N)
  14656.  
  14657. # Quanterra OS/9 V2.4 on 68K (Quanterra Q4124 - 68030)
  14658. Fingerprint Quanterra seismic data acquisition system running OS/9 V2.4 on 68K
  14659. Class Quanterra | OS/9 || specialized
  14660. TSeq(Class=i800)
  14661. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=)
  14662. T2(Resp=N)
  14663. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=)
  14664. T4(DF=N%W=C000%ACK=O%Flags=R%Ops=)
  14665. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14666. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14667. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14668. PU(Resp=N)
  14669.  
  14670. Fingerprint Quantum Snap server 4100
  14671. Class Quantum | embedded || storage-misc
  14672. TSeq(Class=i800%IPID=I%TS=U)
  14673. T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M)
  14674. T2(Resp=N)
  14675. T3(Resp=Y%DF=N%W=2238%ACK=O%Flags=A%Ops=)
  14676. T4(DF=N%W=2238%ACK=O%Flags=R%Ops=)
  14677. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14678. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14679. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14680. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14681.  
  14682. Fingerprint Quantum Snap Server Network Storage Box
  14683. Class Quantum | embedded || storage-misc
  14684. TSeq(Class=i800)
  14685. T1(Resp=Y%DF=N%W=4470%ACK=S++%Flags=AS%Ops=M)
  14686. T2(Resp=N)
  14687. T3(Resp=Y%DF=N%W=4470%ACK=O%Flags=A%Ops=)
  14688. T4(Resp=Y%DF=N%W=4470%ACK=O%Flags=R%Ops=)
  14689. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14690. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  14691. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14692. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14693.  
  14694. Fingerprint Racal 7100 Host Security Module 1.05 / 5.05
  14695. Class Racal | embedded || encryption accelerator
  14696. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  14697. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  14698. T2(Resp=N)
  14699. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME)
  14700. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14701. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14702. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14703. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14704. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14705.  
  14706. Fingerprint Radware Content Inspection Director v2.10.03
  14707. Class Radware | embedded || security-misc
  14708. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  14709. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  14710. T2(Resp=N)
  14711. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  14712. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14713. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14714. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14715. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14716. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  14717.  
  14718. Fingerprint Raptor firewall 5.03 on NT 4
  14719. Class Raptor | embedded || firewall
  14720. TSeq(Class=TR)
  14721. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14722. T2(Resp=N)
  14723. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  14724. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14725. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14726. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14727. T7(Resp=N)
  14728. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14729.  
  14730. Fingerprint Raptor Firewall 6 on Solaris 2.6
  14731. Class Raptor | Solaris | 2.X | firewall
  14732. TSeq(Class=RI%gcd=<6%SI=<E5CB8&>24B0)
  14733. T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
  14734. T2(Resp=N)
  14735. T3(Resp=N)
  14736. T4(Resp=N)
  14737. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14738. T6(Resp=N)
  14739. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14740. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14741.  
  14742. Fingerprint Cisco 1538M HUB running Cisco 1538M EES (1.00.00) or Assured Access Technology ISAS Switch Release-2.3.0 or Thomson Multimedia RCA DCM245 Cable Modem
  14743. Class RCA | embedded || broadband router
  14744. Class Cisco | embedded || hub
  14745. TSeq(Class=64K)
  14746. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  14747. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14748. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  14749. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  14750. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14751. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  14752. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14753. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14754.  
  14755. Fingerprint RCA/Thomson cable modem DCM-235/245
  14756. Class RCA | embedded || broadband router
  14757. TSeq(Class=64K%IPID=I%TS=U)
  14758. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  14759. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14760. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  14761. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14762. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14763. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14764. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14765. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  14766.  
  14767. Fingerprint Redback SMS 1800 router
  14768. Class Redback | AOS || router
  14769. TSeq(Class=RI%gcd=<6%SI=<4CA7C&>C2F)
  14770. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  14771. T2(Resp=N)
  14772. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  14773. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  14774. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14775. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14776. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14777. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14778.  
  14779. # Redback SMS 1800 router AOS Release 5.0.3.8
  14780. # Redback Networks SMS 10000 AOS 6.0.5.0
  14781. # Thomson TMC 390 cable modem
  14782. Fingerprint Redback SMS 1800/10000 router or Thomson TMC 390 cable modem
  14783. Class Redback | AOS || router
  14784. Class Thomson | embedded || broadband router
  14785. TSeq(Class=RI%gcd=<6%SI=<7B6BA&>BA7%IPID=I%TS=U)
  14786. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  14787. T2(Resp=N)
  14788. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  14789. T4(Resp=N)
  14790. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14791. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14792. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14793. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14794.  
  14795. # Redback SMS500 Redback Networks AOS Release 5.0.4.0 PRODUCTION RELEASE
  14796. Fingerprint Redback SMS500 Redback Networks router AOS Release 5.0.4.0
  14797. Class Redback | AOS || router
  14798. TSeq(Class=RI%gcd=<6%SI=<56DF6&>337%IPID=I%TS=U)
  14799. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  14800. T2(Resp=N)
  14801. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  14802. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  14803. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14804. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14805. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14806. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0|F%ULEN=134%DAT=E)
  14807.  
  14808. Fingerprint Redback SMS 1000-2000 DSL Router
  14809. Class Redback | embedded || broadband router
  14810. TSeq(Class=RI%gcd=<4%SI=>1000&<FFFF)
  14811. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  14812. T2(Resp=N)
  14813. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  14814. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  14815. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14816. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14817. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14818. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14819.  
  14820. Fingerprint Ricoh Aficio AP4500 Network Laser Printer
  14821. Class Ricoh | embedded || printer
  14822. TSeq(Class=C%Val=0)
  14823. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  14824. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14825. T3(Resp=N)
  14826. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14827. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14828. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14829. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14830. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14831.  
  14832. Fingerprint Ringdale RP21 Print server
  14833. Class Ringdale | embedded || print server
  14834. TSeq(Class=TR%gcd=<6)
  14835. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  14836. T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  14837. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=)
  14838. T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  14839. T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  14840. T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  14841. T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=)
  14842. PU(Resp=N)
  14843.  
  14844. Fingerprint Rio Karma mp3 player
  14845. Class Rio | embedded || media device
  14846. TSeq(Class=RI%gcd=<6%SI=<47130&>1BB%IPID=RD%TS=U)
  14847. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  14848. T2(Resp=N)
  14849. T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  14850. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  14851. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14852. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14853. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14854. PU(DF=N%TOS=0%IPLEN=38%RIPTL=3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14855.  
  14856. Fingerprint RoadLanner broadband router BRL-04FW 6.15.02r Build 0091 L:01
  14857. Class RoadLanner | embedded || broadband router
  14858. TSeq(Class=TD%gcd=<6E004%SI=<14%IPID=I%TS=1000HZ)
  14859. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL)
  14860. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14861. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL)
  14862. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14863. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14864. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14865. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14866. PU(Resp=N)
  14867.  
  14868. Fingerprint Rockwell Spectrum 100 POTS switcher release 7.2
  14869. Class Rockwell | embedded || telecom-misc
  14870. TSeq(Class=i800%IPID=I%TS=U)
  14871. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=)
  14872. T2(Resp=N)
  14873. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  14874. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  14875. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14876. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14877. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14878. PU(Resp=N)
  14879.  
  14880. Fingerprint Savin 9927 Copier
  14881. Class Savin | embedded || printer
  14882. TSeq(Class=i800%IPID=I%TS=U)
  14883. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  14884. T2(Resp=N)
  14885. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  14886. T4(DF=N%W=2000%ACK=O%Flags=UR%Ops=)
  14887. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14888. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14889. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14890. PU(DF=N%TOS=0%IPLEN=38%RIPTL=1C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  14891.  
  14892. Fingerprint SCO OpenServer 5.0.5
  14893. Class SCO | OpenServer || general purpose
  14894. TSeq(Class=RI%gcd=<5%SI=>FFFF)
  14895. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M)
  14896. T2(Resp=N)
  14897. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
  14898. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14899. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14900. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14901. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14902. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14903.  
  14904. Fingerprint SCO OpenServer 5.0.7
  14905. Class SCO | OpenServer || general purpose
  14906. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  14907. T1(DF=N%W=832C%ACK=S++%Flags=AS%Ops=M)
  14908. T2(Resp=N)
  14909. T3(Resp=Y%DF=N%W=8058%ACK=O%Flags=A%Ops=)
  14910. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14911. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14912. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14913. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14914. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14915.  
  14916. Fingerprint SCO OpenServer Release 5
  14917. Class SCO | OpenServer || general purpose
  14918. TSeq(Class=RI%gcd=<6%SI=>FFFF)
  14919. T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M)
  14920. T2(Resp=N)
  14921. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=)
  14922. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14923. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  14924. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  14925. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  14926. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14927.  
  14928. Fingerprint SCO OpenServer Release 5
  14929. Class SCO | OpenServer || general purpose
  14930. TSeq(Class=RI%gcd=<6%SI=<34A71A&>86B6)
  14931. T1(DF=N%W=1000|6000|111C%ACK=S++%Flags=AS%Ops=M)
  14932. T2(Resp=N)
  14933. T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=)
  14934. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14935. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14936. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14937. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14938. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  14939.  
  14940. # SCO Open Desktop ( Same as SCO UNIX?)
  14941. Fingerprint SCO Open Desktop 2.0
  14942. Class SCO | SCO UNIX || general purpose
  14943. TSeq(Class=64K)
  14944. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  14945. T2(Resp=N)
  14946. T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
  14947. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  14948. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14949. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  14950. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14951. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14952.  
  14953. Fingerprint SCO UNIX release 3.2
  14954. Class SCO | SCO UNIX || general purpose
  14955. TSeq(Class=64K%IPID=I%TS=U)
  14956. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  14957. T2(Resp=N)
  14958. T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=)
  14959. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14960. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14961. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14962. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14963. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  14964.  
  14965. Fingerprint SCO UnixWare 2.01
  14966. Class SCO | UnixWare || general purpose
  14967. TSeq(Class=64K)
  14968. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M)
  14969. T2(Resp=N)
  14970. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  14971. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14972. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14973. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14974. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14975. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  14976.  
  14977. Fingerprint SCO UnixWare 2.1
  14978. Class SCO | UnixWare || general purpose
  14979. TSeq(Class=RI%gcd=<6%SI=>FFF)
  14980. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  14981. T2(Resp=N)
  14982. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  14983. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14984. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14985. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14986. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14987. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  14988.  
  14989. Fingerprint SCO UnixWare 2.1.2
  14990. Class SCO | UnixWare || general purpose
  14991. TSeq(Class=RI%gcd=<6%SI=>FFFF)
  14992. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  14993. T2(Resp=N)
  14994. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  14995. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14996. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  14997. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  14998. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  14999. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  15000.  
  15001. Fingerprint SCO UnixWare 7.0.0 or OpenServer 5.0.4-5.0.6
  15002. Class SCO | UnixWare || general purpose
  15003. TSeq(Class=RI%gcd=<BB%SI=>FFFF)
  15004. T1(W=60F4%ACK=S++%Flags=AS%Ops=M)
  15005. T2(Resp=N)
  15006. T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=)
  15007. T4(W=0%ACK=O%Flags=R%Ops=)
  15008. T5(W=0%ACK=S++%Flags=AR%Ops=)
  15009. T6(W=0%ACK=O%Flags=R%Ops=)
  15010. T7(W=0%ACK=S%Flags=AR%Ops=)
  15011. PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15012.  
  15013. Fingerprint SCO UnixWare 7.1.0 - 7.1.1 (x86)
  15014. Class SCO | UnixWare || general purpose
  15015. TSeq(Class=RI%gcd=<6%SI=<403094&>8C71%IPID=I%TS=100HZ)
  15016. T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  15017. T2(Resp=N)
  15018. T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT)
  15019. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  15020. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15021. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15022. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15023. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15024.  
  15025. Fingerprint SCO UnixWare 7.1.0 x86
  15026. Class SCO | UnixWare || general purpose
  15027. TSeq(Class=RI%gcd=<6%SI=<442BB8&>AE70)
  15028. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT)
  15029. T2(Resp=N)
  15030. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT)
  15031. T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
  15032. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15033. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15034. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15035. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15036.  
  15037. #  UnixWare 7.1.1 i386 x86at SCO UNIX_SVR5
  15038. Fingerprint SCO UnixWare 7.1.1
  15039. Class SCO | UnixWare || general purpose
  15040. TSeq(Class=RI%gcd=<6%SI=<874330&>B9D5%IPID=I%TS=U)
  15041. T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=M)
  15042. T2(Resp=N)
  15043. T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=)
  15044. T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
  15045. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15046. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15047. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15048. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15049.  
  15050. Fingerprint Secure Computing SECUREZone Firewall Version 2.0
  15051. Class Secure Computing | embedded || firewall
  15052. TSeq(Class=TR%gcd=<6)
  15053. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  15054. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15055. T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT)
  15056. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15057. T5(Resp=N)
  15058. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15059. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15060. PU(Resp=N)
  15061.  
  15062. Fingerprint Secure Computing Sidewinder firewall 3.2 update 4
  15063. Class Secure Computing | embedded || firewall
  15064. TSeq(Class=RI%gcd=<5%SI=>FFF&<FFFFF)
  15065. T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT)
  15066. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15067. T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT)
  15068. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15069. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15070. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15071. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15072. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  15073.  
  15074. Fingerprint Secure Computing Sidewinder firewall 5.2.1.06
  15075. Class Secure Computing | embedded || firewall
  15076. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  15077. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15078. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15079. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15080. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15081. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15082. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15083. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15084. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15085.  
  15086. Fingerprint Sega Dreamcast game console
  15087. Class Sega | embedded || game console
  15088. TSeq(Class=TD%gcd=<780%SI=<14)
  15089. T1(DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
  15090. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15091. T3(Resp=Y%DF=N%W=1D4C%ACK=S++%Flags=AS%Ops=M)
  15092. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  15093. T5(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15094. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  15095. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15096. PU(Resp=N)
  15097.  
  15098. Fingerprint Sequent DYNIX/PTX 4.4.2
  15099. Class Sequent | DYNIX || general purpose
  15100. TSeq(Class=RI%gcd=<6%SI=<15E0&>23)
  15101. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M)
  15102. T2(Resp=N)
  15103. T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=)
  15104. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  15105. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15106. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15107. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15108. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  15109.  
  15110. Fingerprint Sequent DYNIX/ptx 4.4.6 x86
  15111. Class Sequent | DYNIX || general purpose
  15112. TSeq(Class=RI%gcd=<6%SI=<2E4AA&>752%IPID=I%TS=U)
  15113. T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNW)
  15114. T2(Resp=N)
  15115. T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=A%Ops=)
  15116. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  15117. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15118. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15119. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15120.  
  15121. Fingerprint Sequent DYNIX/ptx V4.2.1
  15122. Class Sequent | embedded || general purpose
  15123. TSeq(Class=RI%gcd=<F%SI=>FF&<FFFFF)
  15124. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  15125. T2(Resp=N)
  15126. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  15127. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  15128. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15129. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  15130. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15131. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  15132.  
  15133. Fingerprint Sequent DYNIX/ptx V4.4.6
  15134. Class Sequent | embedded || general purpose
  15135. TSeq(Class=RI|TD%gcd=<6%SI=<3FC)
  15136. T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MNW)
  15137. T2(Resp=N)
  15138. T3(Resp=Y%DF=Y%W=6000%ACK=O%Flags=A%Ops=)
  15139. T4(DF=N%W=6000%ACK=O%Flags=R%Ops=)
  15140. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15141. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15142. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15143. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  15144.  
  15145. Fingerprint SGI IRIX 5.2
  15146. Class SGI | IRIX | 5.X | general purpose
  15147. TSeq(Class=64K)
  15148. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
  15149. T2(Resp=N)
  15150. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  15151. T4(DF=N%W=F000%ACK=O%Flags=R%Ops=)
  15152. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15153. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15154. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15155. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  15156.  
  15157. Fingerprint SGI IRIX 5.3
  15158. Class SGI | IRIX | 5.X | general purpose
  15159. TSeq(Class=64K)
  15160. T1(DF=N%W=EF2A|F000%ACK=S++%Flags=AS%Ops=MNWNNT)
  15161. T2(Resp=N)
  15162. T3(Resp=Y%DF=N%W=EF2A|F000%ACK=O%Flags=A%Ops=NNT)
  15163. T4(DF=N%W=EF2A|F000%ACK=O%Flags=R%Ops=)
  15164. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15165. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15166. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15167. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15168.  
  15169. Fingerprint SGI IRIX 6.2
  15170. Class SGI | IRIX | 6.X | general purpose
  15171. TSeq(Class=64K%IPID=I%TS=2HZ)
  15172. T1(DF=N%W=1FA0%ACK=S++%Flags=AS%Ops=MNWNNT)
  15173. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15174. T3(Resp=Y%DF=N%W=1FA0%ACK=O%Flags=A%Ops=NNT)
  15175. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15176. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15177. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15178. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15179. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15180.  
  15181. Fingerprint SGI IRIX 6.2 - 6.5
  15182. Class SGI | IRIX | 6.X | general purpose
  15183. TSeq(Class=TD|64K|RI%gcd=<6|3E8|7D0|BB8|FA0)
  15184. T1(DF=N%W=EF2A|C000%ACK=S++%Flags=AS%Ops=MNWNNT)
  15185. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15186. T3(Resp=Y%DF=N%W=EF2A|C000%ACK=O%Flags=A%Ops=NNT)
  15187. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15188. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15189. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15190. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15191. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15192.  
  15193. Fingerprint SGI IRIX 6.2 - 6.5
  15194. Class SGI | IRIX | 6.X | general purpose
  15195. TSeq(Class=i800)
  15196. T1(DF=N%W=C000|EF2A%ACK=S++|O%Flags=AS%Ops=MNWNNT)
  15197. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15198. T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
  15199. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15200. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15201. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15202. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15203. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15204.  
  15205. Fingerprint SGI IRIX 6.4 - 6.5.3m  # Lamont Granquist (again :)
  15206. Class SGI | IRIX | 6.X | general purpose
  15207. TSeq(Class=RI|TD%gcd=28|50|78|A0|C8|F0|140%SI=<3E8)
  15208. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNT)
  15209. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15210. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
  15211. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15212. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15213. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15214. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15215. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15216.  
  15217. Fingerprint SGI IRIX 6.5
  15218. Class SGI | IRIX | 6.X | general purpose
  15219. TSeq(Class=RI%gcd=10%SI=<2222)
  15220. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
  15221. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15222. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  15223. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15224. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15225. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15226. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15227. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15228.  
  15229. # IRIX sgi 6.5 10100655 IP32 - Silicon Graphics O2 on MIPS R12000 
  15230. Fingerprint SGI IRIX 6.5 (MIPS)
  15231. Class SGI | IRIX | 6.X | general purpose
  15232. TSeq(Class=TD%gcd=<FA4%SI=<118%IPID=I%TS=2HZ)
  15233. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  15234. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15235. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  15236. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15237. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15238. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15239. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15240. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15241.  
  15242. Fingerprint SGI IRIX 6.5 Origin2
  15243. Class SGI | IRIX | 6.X | general purpose
  15244. TSeq(Class=64K)
  15245. T1(Resp=Y%DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
  15246. T2(Resp=N)
  15247. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  15248. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  15249. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15250. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  15251. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15252. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15253.  
  15254. # IP19/IP27/IP30/IP32
  15255. Fingerprint SGI IRIX 6.5-6.5.15m
  15256. Class SGI | IRIX | 6.X | general purpose
  15257. TSeq(Class=RI|64K|i800%gcd=<144%SI=<FFFF&>8%IPID=I%TS=2HZ)
  15258. T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  15259. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15260. T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
  15261. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15262. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15263. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15264. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15265. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15266.  
  15267. # SGI IRIX 6.5.14, SGI O2
  15268. # SGI IRIX 6.5 IP32
  15269. Fingerprint SGI IRIX 6.5.14
  15270. Class SGI | IRIX | 6.X | general purpose
  15271. TSeq(Class=RI%gcd=<C%SI=<13876&>257%IPID=I%TS=2HZ)
  15272. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  15273. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15274. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  15275. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15276. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15277. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15278. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15279. PU(Resp=N)
  15280.  
  15281. Fingerprint SGI IRIX 6.5.15m on SGI O2
  15282. Class SGI | IRIX | 6.X | general purpose
  15283. TSeq(Class=TD%gcd=<104%SI=<1AE%IPID=I%TS=2HZ)
  15284. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  15285. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15286. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  15287. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15288. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15289. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15290. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15291. PU(Resp=N)
  15292.  
  15293. # IRIX 6.5 6.5.20m IP32
  15294. Fingerprint SGI IRIX 6.5.20m
  15295. Class SGI | IRIX | 6.X | general purpose
  15296. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  15297. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  15298. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15299. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  15300. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15301. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15302. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15303. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15304. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15305.  
  15306. # SGI Indigo2 R10000 running IRIX64 6.5.20m
  15307. Fingerprint SGI IRIX 6.5.20m
  15308. Class SGI | IRIX | 6.X | general purpose
  15309. TSeq(Class=64K%IPID=I%TS=2HZ)
  15310. T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  15311. T2(Resp=N)
  15312. T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT)
  15313. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15314. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15315. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15316. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15317. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15318.  
  15319. Fingerprint SGI IRIX 6.5.7f-6.5.8f
  15320. Class SGI | IRIX | 6.X | general purpose
  15321. TSeq(Class=64K)
  15322. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  15323. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15324. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  15325. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15326. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15327. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15328. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15329. PU(Resp=N)
  15330.  
  15331. # SGI O2 running SGI IRIX 6.5.7f
  15332. Fingerprint SGI IRIX 6.5.7f-6.5.8f
  15333. Class SGI | IRIX | 6.X | general purpose
  15334. TSeq(Class=64K)
  15335. T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM)
  15336. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15337. T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
  15338. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15339. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15340. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15341. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15342. PU(Resp=N)
  15343.  
  15344. Fingerprint Sharp DIGITAL Imager (copier) AR-507
  15345. Class Sharp | embedded || printer
  15346. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  15347. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15348. T3(Resp=N)
  15349. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15350. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15351. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15352. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15353. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15354.  
  15355. Fingerprint Sharp Network Printer AR-337
  15356. Class Sharp | embedded || printer
  15357. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  15358. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15359. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  15360. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15361. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15362. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15363. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15364. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15365.  
  15366. #  Shiva AccessPort Bridge/Router Software V 2.1.0
  15367. #  3Com HiPer Access Router Card hardware 1.0.0 software 4.1.59
  15368. Fingerprint Shiva AccessPort Bridge/Router Software V 2.1.0 or 3Com HiPer Access Router Card hardware V1.0.0 software V4.1.59
  15369. Class Shiva | embedded || router
  15370. Class 3Com | embedded || router
  15371. TSeq(Class=TD%gcd=<6%SI=<F)
  15372. T1(DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  15373. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15374. T3(Resp=Y%DF=N%W=244%ACK=S++%Flags=AS%Ops=M)
  15375. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15376. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15377. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15378. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15379. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15380.  
  15381. Fingerprint Shiva LanRover/8E Version 3.5
  15382. Class Shiva | embedded || terminal server
  15383. TSeq(Class=64K)
  15384. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M)
  15385. T2(Resp=N)
  15386. T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=)
  15387. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  15388. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15389. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15390. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15391. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  15392.  
  15393. # Siemens Santis 50 wireless adsl router / Firmware version: 5.0.0.11 CPU: Helium 210-80
  15394. # A wireless router which functions as a gateway to the internet.
  15395. Fingerprint Siemens Santis 50 wireless adsl router
  15396. Class Siemens | embedded || broadband router
  15397. TSeq(Class=RI%gcd=<6%SI=<F776&>8E%IPID=I%TS=U)
  15398. T1(DF=N%W=1FFE%ACK=S++%Flags=AS%Ops=ME)
  15399. T2(Resp=Y%DF=N%W=1FFE%ACK=O%Flags=R%Ops=)
  15400. T3(Resp=N)
  15401. T4(DF=N%W=1FFE%ACK=O%Flags=R%Ops=)
  15402. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15403. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15404. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15405. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15406.  
  15407. Fingerprint Siemens Speedstream 2602 DSL/Cable router
  15408. Class Siemens | embedded || broadband router
  15409. TSeq(Class=RI%gcd=<6%SI=<22E601A&>31AA1%IPID=Z%TS=100HZ)
  15410. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  15411. T2(Resp=N)
  15412. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  15413. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15414. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15415. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15416. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15417. PU(Resp=N)
  15418.  
  15419. # Siemens HICOM 300 Phone switch (PBX) (WAML LAN card)
  15420. Fingerprint Siemens HICOM 300 Phone switch (PBX)
  15421. Class Siemens | embedded || PBX
  15422. TSeq(Class=64K)
  15423. T1(DF=N%W=808%ACK=S++%Flags=AS%Ops=M)
  15424. T2(Resp=N)
  15425. T3(Resp=Y%DF=N%W=808%ACK=O%Flags=A%Ops=)
  15426. T4(DF=N%W=808%ACK=O%Flags=R%Ops=)
  15427. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15428. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15429. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15430. PU(Resp=N)
  15431.  
  15432. Fingerprint Siemens HICOM Phone switch (PBX)
  15433. Class Siemens | embedded || PBX
  15434. TSeq(Class=RI%gcd=<A%SI=<4184D0&>4EB3%IPID=I%TS=100HZ)
  15435. T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNWNNT)
  15436. T2(Resp=N)
  15437. T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=NNT)
  15438. T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=)
  15439. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15440. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15441. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15442. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15443.  
  15444. # Siemens S7-400 PLC CPU-416-2
  15445. Fingerprint Siemens S7-400 programmable logic controller
  15446. Class Siemens | embedded || specialized
  15447. TSeq(Class=RI%gcd=<6%SI=<583DCAE&>977AD%IPID=I%TS=U)
  15448. T1(DF=N%W=230%ACK=S++%Flags=AS%Ops=ME)
  15449. T2(Resp=N)
  15450. T3(Resp=Y%DF=N%W=230%ACK=S++%Flags=AS%Ops=ME)
  15451. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15452. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15453. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15454. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15455. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  15456.  
  15457. Fingerprint Siemens HiCom 300E business phone system Release 6.5
  15458. Class Siemens | embedded || VoIP phone
  15459. TSeq(Class=RI%gcd=<6%SI=<5D131C&>4A3C%IPID=I%TS=U)
  15460. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME)
  15461. T2(Resp=N)
  15462. T3(Resp=N)
  15463. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15464. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15465. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15466. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15467. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  15468.  
  15469. Fingerprint ReliantUNIX-Y 5.44 B0033 RM600 1/256 R10000
  15470. Class Siemens | ReliantUNIX || general purpose
  15471. TSeq(Class=64K)
  15472. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  15473. T2(Resp=N)
  15474. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
  15475. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15476. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15477. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15478. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15479. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  15480.  
  15481. # Reliant UNIX 5.45B20 running on an RM400 (Siemens stuff)
  15482. Fingerprint Siemens Reliant UNIX 5.45B20
  15483. Class Siemens | ReliantUNIX || general purpose
  15484. TSeq(Class=RI%gcd=<6%SI=<A53AC&>100C%IPID=I%TS=2HZ)
  15485. T1(DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT)
  15486. T2(Resp=N)
  15487. T3(Resp=Y%DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT)
  15488. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  15489. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15490. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15491. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15492. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  15493.  
  15494. Fingerprint Siemens RM200-C40 running ReliantUNIX-N 5.45
  15495. Class Siemens | ReliantUNIX || general purpose
  15496. TSeq(Class=RI%gcd=<6%SI=<7DF64&>AAA%IPID=I%TS=2HZ)
  15497. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  15498. T2(Resp=N)
  15499. T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT)
  15500. T4(DF=N%W=8000%ACK=O%Flags=R%Ops=)
  15501. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15502. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15503. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15504. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  15505.  
  15506. Fingerprint Siemens SINIX-N 5.41C0005
  15507. Class Siemens | SINIX || general purpose
  15508. TSeq(Class=64K%gcd=<6%SI=<14)
  15509. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=)
  15510. T2(Resp=N)
  15511. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  15512. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15513. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15514. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15515. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15516. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=0%ULEN=134%DAT=E)
  15517.  
  15518. Fingerprint Siemens SINIX-N 5.43C3002
  15519. Class Siemens | SINIX || general purpose
  15520. TSeq(Class=64K%gcd=<6%SI=<14)
  15521. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=NW)
  15522. T2(Resp=N)
  15523. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=NW)
  15524. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15525. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15526. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15527. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15528. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=E%ULEN=134%DAT=E)
  15529.  
  15530. Fingerprint Siemens SINIX-Y 5.43B0045
  15531. Class Siemens | SINIX || general purpose
  15532. TSeq(Class=64K)
  15533. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M)
  15534. T2(Resp=N)
  15535. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=A%Ops=)
  15536. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15537. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15538. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15539. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15540. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  15541.  
  15542. Fingerprint Siemens SINIX-Y 5.43C4001
  15543. Class Siemens | SINIX || general purpose
  15544. TSeq(Class=RI%gcd=<6%SI=<26E76&>625)
  15545. T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW)
  15546. T2(Resp=N)
  15547. T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW)
  15548. T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=)
  15549. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15550. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15551. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15552. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  15553.  
  15554. # Sipura SPA SPA-1000 Software Version: 1.0.33 Hardware Version: 2.0.1
  15555. # Sipura SPA-2000  Software Version: 2.0.10(d)   IP Phone Adaptor
  15556. Fingerprint Sipura SPA-1000 or SPA-2000 POTS<->VOIP gateway
  15557. Class Sipura | embedded || VoIP adapter
  15558. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  15559. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  15560. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  15561. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  15562. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  15563. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  15564. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  15565. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  15566. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15567.  
  15568. # SMC Barricade SMC7004VR2.0EU DSL-Router Firmware R1.02-DDNS
  15569. Fingerprint SMC Barricade SMC7004VR2.0EU DSL router
  15570. Class SMC | embedded || broadband router
  15571. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
  15572. T1(DF=N%W=16D0%ACK=S++|O%Flags=AS%Ops=M)
  15573. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15574. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15575. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15576. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15577. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15578. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15579. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15580.  
  15581. # Panasonic KX-HCM10 network camera
  15582. # SMC EZConnect Wireless Access Point SMC2655W V.2
  15583. Fingerprint Panasonic network camera or SMC WAP
  15584. Class SMC | embedded || WAP
  15585. Class Panasonic | embedded || webcam
  15586. TSeq(Class=TD%gcd=<F4%SI=<1E%TS=U)
  15587. T1(Resp=N)
  15588. T2(Resp=N)
  15589. T3(Resp=N)
  15590. T4(Resp=N)
  15591. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15592. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  15593. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15594. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15595.  
  15596. # SMC Barricade7004VBR Boot Code v1.05
  15597. # SMC 7004VBR broadband router - firmware v1.2
  15598. # SMC Wireless AP 7004WFW
  15599. # SMC7004vwbr Barricade Wireless Cable/DSL Broadband Router
  15600. Fingerprint SMC Barricade DSL Router/Modem/Wireless AP
  15601. Class SMC | embedded || WAP
  15602. TSeq(Class=TD%gcd=<FF%SI=<1E%IPID=I%TS=U)
  15603. T1(DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME)
  15604. T2(Resp=N)
  15605. T3(Resp=Y%DF=Y%W=1770%ACK=S++%Flags=AS%Ops=ME)
  15606. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15607. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15608. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15609. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15610. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15611.  
  15612. Fingerprint SMC Barricade Router, firmware 1.94a
  15613. Class SMC | embedded || WAP
  15614. TSeq(Class=TD%gcd=<68%SI=<32%IPID=I%TS=U)
  15615. T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  15616. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  15617. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  15618. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  15619. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  15620. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  15621. T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  15622. PU(Resp=N)
  15623.  
  15624. Fingerprint SMC Barricade Wireless Broadband Router (firmware R1.93e)
  15625. Class SMC | embedded || WAP
  15626. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  15627. T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15628. T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=)
  15629. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15630. T4(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  15631. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15632. T6(DF=N%W=400%ACK=S%Flags=AR%Ops=)
  15633. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15634. PU(Resp=N)
  15635.  
  15636. Fingerprint Smoothwall Linux-based firewall 2.2.23
  15637. Class Smoothwall | Linux | 2.2.X | firewall
  15638. TSeq(Class=RI%gcd=<6%SI=<F1DA6&>474%IPID=I)
  15639. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  15640. T2(Resp=N)
  15641. T3(Resp=N)
  15642. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15643. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15644. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15645. T7(Resp=N)
  15646. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15647.  
  15648. # Softek Digi One RealPort serial device server
  15649. # Digi One SP Serial to Ethernet Converter Version 82000774_E 06/13/2003
  15650. Fingerprint Softek Digi One serial device server
  15651. Class Softek | embedded || specialized
  15652. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  15653. T2(Resp=N)
  15654. T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME)
  15655. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15656. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15657. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15658. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15659. PU(DF=Y%TOS=0%IPLEN=8E%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15660.  
  15661. # Sonicwall Pro 200 Firmware Version 6.4.2.0
  15662. Fingerprint Sonicwall Pro 200 firewall
  15663. Class SonicWall | embedded || firewall
  15664. TSeq(Class=TR%gcd=<6%IPID=I)
  15665. T1(DF=N|Y%W=0|402E%ACK=S++%Flags=AR|AS%Ops=|MNWNNT)
  15666. T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  15667. T3(Resp=Y%DF=N|Y%W=0|402E%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT)
  15668. T4(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=)
  15669. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=)
  15670. T6(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=)
  15671. T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=)
  15672.  
  15673. # SonicWALL 4060 firewall running SonicOS Enhaced 2.5
  15674. Fingerprint SonicWALL 4060 firewall
  15675. Class SonicWall | SonicOS || firewall
  15676. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  15677. T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW)
  15678. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  15679. T3(Resp=N)
  15680. T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  15681. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  15682. T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  15683. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  15684. PU(Resp=N)
  15685.  
  15686. # Cisco 350 Access Point, software rev 12.02T1
  15687. # Accelerated Networks VoDSL - But what sort of device?
  15688. Fingerprint SonicWall SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL, or Cisco 350 Access Point
  15689. Class SonicWall | SonicOS || firewall
  15690. Class Enterasys | embedded || switch
  15691. Class Cisco | embedded || WAP
  15692. TSeq(Class=64K)
  15693. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  15694. T2(Resp=N)
  15695. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=)
  15696. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  15697. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15698. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15699. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15700. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  15701.  
  15702. Fingerprint SonicWall SOHO-3 firewall
  15703. Class SonicWall | SonicOS || firewall
  15704. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15705. T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15706. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15707. T4(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15708. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15709. T6(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15710. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15711. PU(Resp=N)
  15712.  
  15713. Fingerprint SonicWall SOHO-3 firewall
  15714. Class SonicWall | SonicOS || firewall
  15715. TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ)
  15716. T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  15717. T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15718. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  15719. T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15720. T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15721. T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15722. T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15723. PU(Resp=N)
  15724.  
  15725. # SonicWALL SOHO3 (CPU: Toshiba 3927 H2 / 133 Mhz) Firmware version: 6.6.0.6 ROM version: 6.2.0.0
  15726. Fingerprint SonicWALL SOHO3 firewall
  15727. Class SonicWall | SonicOS || firewall
  15728. TSeq(Class=RI%gcd=<6%SI=<708FA&>904%IPID=I%TS=U)
  15729. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  15730. T2(Resp=N)
  15731. T3(Resp=N)
  15732. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  15733. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15734. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15735. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15736. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  15737.  
  15738. Fingerprint SonicWall/10 firewall
  15739. Class SonicWall | SonicOS || firewall
  15740. TSeq(Class=TR)
  15741. T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME)
  15742. T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15743. T3(Resp=Y%DF=Y|N%W=7FE0|7FDF%ACK=O|S++%Flags=A|ASF%Ops=ME)
  15744. T4(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15745. T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15746. T6(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15747. T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15748. PU(Resp=N)
  15749.  
  15750. Fingerprint SonicWall/10 firewall
  15751. Class SonicWall | SonicOS || firewall
  15752. TSeq(Class=TR)
  15753. T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  15754. T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15755. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  15756. T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15757. T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15758. T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15759. T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=)
  15760. PU(Resp=N)
  15761.  
  15762. Fingerprint PS2 Linux 1.0 on Sony PS2 game console
  15763. Class Sony | Linux || game console
  15764. TSeq(Class=RI%gcd=<6%SI=<20E2FE8&>5428C%IPID=I%TS=100HZ)
  15765. T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNT)
  15766. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  15767. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  15768. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  15769. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15770. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL)
  15771. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL)
  15772.  
  15773. # This appears to be used by game developers to test performance.
  15774. Fingerprint Sony PlayStation 2 Performance Analyser
  15775. Class Sony | Linux || specialized
  15776. TSeq(Class=RI%gcd=<6%SI=<18EC23A&>3FCBC%IPID=I%TS=100HZ)
  15777. T1(DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW)
  15778. T2(Resp=N)
  15779. T3(Resp=Y%DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW)
  15780. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15781. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15782. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15783. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15784. PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15785.  
  15786. Fingerprint SONY NewsOS 6.1.2
  15787. Class Sony | NewsOS || general purpose
  15788. TSeq(Class=64K%gcd=<6%SI=<14)
  15789. T1(DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
  15790. T2(Resp=N)
  15791. T3(Resp=Y%DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL)
  15792. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15793. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15794. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15795. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15796. PU(Resp=N)
  15797.  
  15798. Fingerprint Sony Ericsson P800 mobile phone, Symbian OS v7.0
  15799. Class Sony | Symbian || phone
  15800. TSeq(Class=RI%gcd=<8%SI=<31996C&>200D%IPID=I)
  15801. T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL)
  15802. T2(Resp=N)
  15803. T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL)
  15804. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15805. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15806. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15807. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15808. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15809.  
  15810. # speedstream router 5871 v4.0.1
  15811. Fingerprint Speedstream 5871 DSL router
  15812. Class SpeedStream | embedded || broadband router
  15813. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  15814. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  15815. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  15816. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  15817. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  15818. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15819. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  15820. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  15821. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  15822.  
  15823. Fingerprint Spirent AX4000 Network Testing Tool
  15824. Class Spirent | embedded || specialized
  15825. TSeq(Class=RI%gcd=<6%SI=<761F6&>E8E%IPID=I%TS=U)
  15826. T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  15827. T2(Resp=N)
  15828. T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M)
  15829. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  15830. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15831. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15832. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15833. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  15834.  
  15835. Fingerprint StackTools StackTos 1.0 embedded networking OS
  15836. Class StackTools | StackTos || general purpose
  15837. TSeq(Class=64K%IPID=I%TS=U)
  15838. T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
  15839. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  15840. T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M)
  15841. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15842. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15843. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15844. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15845. PU(DF=N%TOS=A8%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15846.  
  15847. Fingerprint Stratus VOS Release 14.3.1ae
  15848. Class Stratus | VOS || general purpose
  15849. T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL)
  15850. T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  15851. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  15852. T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  15853. T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL)
  15854. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL)
  15855. T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL)
  15856. PU(Resp=N)
  15857.  
  15858. # Sun StorEdge T3 / Sun StorEdge T3B, Workgroup Storage Array
  15859. Fingerprint Sun StorEdge T3 Storage Array
  15860. Class Sun | embedded || storage-misc
  15861. TSeq(Class=64K%IPID=I%TS=U)
  15862. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  15863. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15864. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  15865. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15866. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15867. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15868. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15869. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  15870.  
  15871. Fingerprint Sun Solaris 2.3 - 2.4
  15872. Class Sun | Solaris | 2.X | general purpose
  15873. TSeq(Class=64K)
  15874. T1(DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
  15875. T2(Resp=N)
  15876. T3(Resp=Y%DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME)
  15877. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15878. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15879. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15880. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15881. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15882.  
  15883. Fingerprint Sun Solaris 2.4 w/most Sun patches (jumbo cluster patch, security patches, etc)
  15884. Class Sun | Solaris | 2.X | general purpose
  15885. TSeq(Class=64K)
  15886. T1(DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
  15887. T2(Resp=N)
  15888. T3(Resp=Y%DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME)
  15889. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15890. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  15891. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  15892. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  15893. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15894.  
  15895. Fingerprint Sun Solaris 2.5, 2.5.1
  15896. Class Sun | Solaris | 2.X | general purpose
  15897. TSeq(Class=RI%gcd=<6)
  15898. T1(DF=Y|N%W=2229|2332|4452|FFAF|8377|8EDA|879B%ACK=S++%Flags=AS%Ops=ME)
  15899. T2(Resp=N)
  15900. T3(Resp=N)
  15901. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15902. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15903. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15904. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15905. PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15906.  
  15907. Fingerprint Sun Solaris 2.6
  15908. Class Sun | Solaris | 2.X | general purpose
  15909. TSeq(Class=RI%gcd=<6%SI=<512B6&>CE8)
  15910. T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=NNTME)
  15911. T2(Resp=N)
  15912. T3(Resp=N)
  15913. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15914. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15915. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15916. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15917. PU(Resp=N)
  15918.  
  15919. # SunOS dabox 5.6 Generic_105181-30 sun4u sparc SUNW,Ultra-Enterprise
  15920. Fingerprint Sun Solaris 2.6 (SPARC)
  15921. Class Sun | Solaris | 2.X | general purpose
  15922. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  15923. T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME)
  15924. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  15925. T3(Resp=N)
  15926. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  15927. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15928. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  15929. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  15930. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15931.  
  15932. Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=0
  15933. Class Sun | Solaris | 2.X | general purpose
  15934. Class Sun | Solaris | 7 | general purpose
  15935. TSeq(Class=64K)
  15936. T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
  15937. T2(Resp=N)
  15938. T3(Resp=N)
  15939. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15940. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15941. T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
  15942. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15943. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15944.  
  15945. Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=2
  15946. Class Sun | Solaris | 2.X | general purpose
  15947. Class Sun | Solaris | 7 | general purpose
  15948. TSeq(Class=TR%IPID=I%TS=100HZ)
  15949. T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME)
  15950. T2(Resp=N)
  15951. T3(Resp=N)
  15952. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15953. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15954. T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
  15955. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15956. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  15957.  
  15958. Fingerprint Sun Solaris 2.6 - 7 x86
  15959. Class Sun | Solaris | 2.X | general purpose
  15960. Class Sun | Solaris | 7 | general purpose
  15961. TSeq(Class=RI%gcd=<6)
  15962. T1(DF=Y%W=2491|462B%ACK=S++%Flags=AS%Ops=NNTNWME)
  15963. T2(Resp=N)
  15964. T3(Resp=N)
  15965. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15966. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15967. T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=)
  15968. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15969. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  15970.  
  15971. Fingerprint Sun Solaris 2.6 - 8 (SPARC)
  15972. Class Sun | Solaris | 2.X | general purpose
  15973. Class Sun | Solaris | 7 | general purpose
  15974. Class Sun | Solaris | 8 | general purpose
  15975. TSeq(Class=RI%gcd=<6%SI=<57A26&>DF1)
  15976. T1(DF=Y|N%W=109|212|2297|2788|4431|8371|8F4D|ABCD|FFF7|FFFF|2297%ACK=S++%Flags=AS%Ops=NNTNWME)
  15977. T2(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  15978. T3(Resp=N)
  15979. T4(DF=Y|N%W=0%ACK=O%Flags=R%Ops=|WNMETL)
  15980. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15981. T6(DF=Y|N%W=0%ACK=O|S%Flags=AR|R%Ops=|WNMETL)
  15982. T7(DF=Y|N%W=0%ACK=S|O%Flags=AR|R%Ops=|WNMETL)
  15983. PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=F|E%ULEN=134%DAT=E)
  15984.  
  15985. Fingerprint Sun Solaris 8
  15986. Class Sun | Solaris | 8 | general purpose
  15987. TSeq(Class=RI|TR%gcd=<8%SI=<FEC86&>E0F%IPID=I%TS=100HZ)
  15988. T1(DF=Y%W=5B4|60DA|807A|B68%ACK=S++%Flags=AS%Ops=NNTNWM|NNTM)
  15989. T2(Resp=N)
  15990. T3(Resp=N)
  15991. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15992. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  15993. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  15994. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  15995. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E)
  15996.  
  15997. Fingerprint Sun Solaris 8
  15998. Class Sun | Solaris | 8 | general purpose
  15999. TSeq(Class=RI%gcd=<8%SI=<7FA08&>620%IPID=I%TS=U)
  16000. T1(DF=Y%W=6050%ACK=S++%Flags=AS%Ops=NWM)
  16001. T2(Resp=N)
  16002. T3(Resp=N)
  16003. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16004. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16005. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16006. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  16007. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  16008.  
  16009. Fingerprint Sun Solaris 8
  16010. Class Sun | Solaris | 8 | general purpose
  16011. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  16012. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  16013. T2(Resp=N)
  16014. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16015. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16016. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16017. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16018. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16019. PU(DF=Y%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16020.  
  16021. # Trusted Solaris 8 - SunOS SunRayServer 5.8 TS8 sun4u sparc SUNW,Ultra-60
  16022. Fingerprint Sun Trusted Solaris 8
  16023. Class Sun | Solaris | 8 | general purpose
  16024. TSeq(Class=RI%gcd=<8%SI=<AD48A&>109A%IPID=I%TS=100HZ)
  16025. T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM)
  16026. T2(Resp=N)
  16027. T3(Resp=N)
  16028. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16029. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16030. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16031. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  16032. PU(DF=Y%TOS=0%IPLEN=138%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16033.  
  16034. # Sun Solaris 9 Beta through Release on SPARC
  16035. # solaris 9 i386
  16036. # Solaris 9 4/04 version (SPARC)
  16037. Fingerprint Sun Solaris 9
  16038. Class Sun | Solaris | 9 | general purpose
  16039. TSeq(Class=RI%gcd=<6%SI=<A927C&>116A%IPID=I%TS=100HZ)
  16040. T1(DF=Y%W=5B4|C0B7|807A%ACK=S++%Flags=AS%Ops=NNTMNW)
  16041. T2(Resp=N)
  16042. T3(Resp=N)
  16043. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16044. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16045. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16046. T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=)
  16047. PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  16048.  
  16049. Fingerprint Sun Solaris 9 with TCP_STRONG_ISS set to 2
  16050. Class Sun | Solaris | 9 | general purpose
  16051. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  16052. T1(DF=N|Y%W=C0B7|8000|807A%ACK=S++%Flags=AS%Ops=NNTMNW)
  16053. T2(Resp=N)
  16054. T3(Resp=N)
  16055. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16056. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16057. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16058. T7(Resp=N)
  16059. PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16060.  
  16061. Fingerprint Sun RSC (Remote System Control card) v1.14 (in Solaris 2.7)
  16062. Class Sun | SunOS || general purpose
  16063. T1(DF=N%W=2000%ACK=S++|O%Flags=ARS%Ops=MNW)
  16064. T2(Resp=N)
  16065. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=)
  16066. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16067. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16068. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16069. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16070. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16071.  
  16072. Fingerprint Sun SunOS 4.0.3
  16073. Class Sun | SunOS || general purpose
  16074. TSeq(Class=64K)
  16075. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  16076. T2(Resp=N)
  16077. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  16078. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  16079. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16080. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16081. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16082. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  16083.  
  16084. # Sun SunOS 4.1.1 - 4.1.4 (or derivative), or GatorBox CS LocalTalk/Ethernet bridge
  16085. # GatorBox CS LocalTalk/Ethernet bridge running GatorShare version 3.0.3 (build X4) software
  16086. Fingerprint Sun SunOS 4.1.1 - 4.1.4 (or derivative)
  16087. Class Sun | SunOS || general purpose
  16088. Class Gatorbox | GatorShare || bridge
  16089. TSeq(Class=64K)
  16090. T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M)
  16091. T2(Resp=N)
  16092. T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=)
  16093. T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=)
  16094. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16095. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16096. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16097. PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E)
  16098.  
  16099. Fingerprint Sun SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI
  16100. Class Sun | SunOS || general purpose
  16101. TSeq(Class=64K)
  16102. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL)
  16103. T2(Resp=N)
  16104. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  16105. T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=)
  16106. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16107. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16108. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16109. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  16110.  
  16111. Fingerprint Symantec Enterprise Firewall v7.0.4 (on Solaris 8)
  16112. Class Symantec | Solaris | 8 | firewall
  16113. TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ)
  16114. T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=NNTNWM)
  16115. T2(Resp=N)
  16116. T3(Resp=N)
  16117. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16118. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16119. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16120. T7(Resp=N)
  16121.  
  16122. Fingerprint Symantec Enterprise Firewall 7.0 running on Windows 2000 SP2
  16123. Class Symantec | Windows | NT/2K/XP | firewall
  16124. TSeq(Class=TR%gcd=<6%IPID=I)
  16125. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT)
  16126. T2(Resp=N)
  16127. T3(Resp=N)
  16128. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16129. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16130. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16131. T7(Resp=N)
  16132. PU(Resp=N)
  16133.  
  16134. Fingerprint Symbol/Spectrum24 wireless AP
  16135. Class Symbol | embedded || WAP
  16136. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  16137. T1(Resp=N)
  16138. T2(Resp=N)
  16139. T3(Resp=N)
  16140. T4(Resp=N)
  16141. T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=)
  16142. T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=)
  16143. T7(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=)
  16144. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16145.  
  16146. # http://www.systech.com/catalog/RCS3000Entry.html
  16147. # RCS/3182 - Firmware rev. 06D (Apr 26 2001 15:15:33) - OS ver. RCS_3000_BDNL Version 06F (May 18 2001 16:15:18)
  16148. Fingerprint Systech RCS/3182 Ethernet serial port server (firmware 06D)
  16149. Class Systech | embedded || specialized
  16150. TSeq(Class=64K%IPID=I%TS=U)
  16151. T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M)
  16152. T2(Resp=N)
  16153. T3(Resp=Y%DF=N%W=7FFC%ACK=O%Flags=A%Ops=)
  16154. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16155. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16156. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16157. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16158. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16159.  
  16160. Fingerprint Tahoe OS 1.2.1 running on Tahoe router
  16161. Class Tahoe | Tahoe OS || router
  16162. TSeq(Class=RI%gcd=<8%SI=<A5A1E0&>6430%IPID=I%TS=U)
  16163. T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=ME)
  16164. T2(Resp=N)
  16165. T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=ASF%Ops=ME)
  16166. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16167. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16168. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16169. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16170. PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16171.  
  16172. Fingerprint Tainet WANpro 2000i broadband router
  16173. Class Tainet | embedded || broadband router
  16174. TSeq(Class=64K%IPID=I%TS=U)
  16175. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  16176. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  16177. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  16178. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  16179. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16180. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16181. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16182. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  16183.  
  16184. # Talaris 1794 Printstation, firmware version 4.3.2, released 6/21/93
  16185. Fingerprint Talaris 1794 Printstation
  16186. Class Talaris | embedded || printer
  16187. TSeq(Class=RI%gcd=<6%SI=<4010&>8F%IPID=BI%TS=U)
  16188. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  16189. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16190. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16191. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16192. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16193. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16194. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16195. PU(Resp=N)
  16196.  
  16197. Fingerprint Tally 9112 Printer
  16198. Class Tally | embedded || printer
  16199. TSeq(Class=TD%gcd=<EAE8%SI=<14%IPID=I%TS=U)
  16200. T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  16201. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16202. T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  16203. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16204. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16205. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16206. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16207. PU(Resp=N)
  16208.  
  16209. Fingerprint Tandberg X-terminal
  16210. Class Tandberg | embedded || X terminal
  16211. TSeq(Class=64K)
  16212. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=)
  16213. T2(Resp=N)
  16214. T3(Resp=Y%DF=N%W=400%ACK=O%Flags=A%Ops=)
  16215. T4(DF=N%W=400%ACK=O%Flags=R%Ops=)
  16216. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16217. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16218. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16219. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E)
  16220.  
  16221. Fingerprint Tandem NSK D39
  16222. Class Tandem | Tandem NSK || general purpose
  16223. TSeq(Class=64K%gcd=<6%SI=<14)
  16224. T1(DF=N%W=0|2000%ACK=S++%Flags=AR|AS%Ops=|M)
  16225. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16226. T3(Resp=Y%DF=N%W=0|2000%ACK=S++|O%Flags=AR|A%Ops=)
  16227. T4(DF=N%W=0|2000%ACK=O%Flags=R%Ops=)
  16228. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16229. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16230. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16231. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16232.  
  16233. Fingerprint Tandem NSK D40
  16234. Class Tandem | Tandem NSK || general purpose
  16235. TSeq(Class=64K)
  16236. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16237. T2(Resp=N)
  16238. T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT)
  16239. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16240. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16241. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16242. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16243. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16244.  
  16245. # Tektronix Phaser 350 firmware 3.3 (printer)
  16246. Fingerprint Tektronix Phaser 350 printer
  16247. Class Tektronix | embedded || printer
  16248. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16249. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16250. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  16251. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16252. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16253. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16254. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16255. PU(Resp=N)
  16256.  
  16257. Fingerprint Tektronix Phaser 560 printer
  16258. Class Tektronix | embedded || printer
  16259. TSeq(Class=RI%gcd=<6%SI=<8C8C0&>B05%IPID=I%TS=U)
  16260. T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=M)
  16261. T2(Resp=N)
  16262. T3(Resp=Y%DF=N%W=1%ACK=S++%Flags=AS%Ops=M)
  16263. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16264. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16265. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16266. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16267. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16268.  
  16269. # From a Tektronix Phaser 350
  16270. #  Tektronix Phaser printer with shared Ethernet card, firmware version 3.01
  16271. Fingerprint Tektronix Phaser printer
  16272. Class Tektronix | embedded || printer
  16273. TSeq(Class=RI%gcd=<F%SI=>888&<4444)
  16274. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  16275. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16276. T3(Resp=Y%DF=N%W=0|1000%ACK=S++|O%Flags=AR|AS%Ops=|M)
  16277. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16278. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16279. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16280. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16281. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16282.  
  16283. # Tektronix Phaser 860 Printer
  16284. # Tektronix Phaser 840
  16285. Fingerprint Tektronix Phaser printer
  16286. Class Tektronix | embedded || printer
  16287. T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16288. T2(Resp=N)
  16289. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  16290. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16291. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16292. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16293. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16294. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16295.  
  16296. # Tektronix Phaser 360 Extended
  16297. # Tektronix Phaser 750
  16298. Fingerprint Tektronix/Xerox Phaser printer
  16299. Class Tektronix | embedded || printer
  16300. TSeq(Class=i800)
  16301. T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME)
  16302. T2(Resp=N)
  16303. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
  16304. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16305. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16306. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16307. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16308. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16309.  
  16310. Fingerprint Telebit NetBlazer router version 3.0
  16311. Class Telebit | embedded || router
  16312. TSeq(Class=TD%gcd=<100004%SI=<3C)
  16313. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  16314. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16315. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
  16316. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16317. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16318. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16319. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16320. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16321.  
  16322. Fingerprint Telebit NetBlazer router Version 3.05
  16323. Class Telebit | embedded || router
  16324. TSeq(Class=TD%gcd=40000|80000|C0000%SI=<BB)
  16325. T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  16326. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16327. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M)
  16328. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16329. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16330. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16331. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16332. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16333.  
  16334. # (Telebit router - 18 async/1 ether)
  16335. # Telebit NetBlazer router Version 3.1, patch level 13
  16336. Fingerprint Telebit NetBlazer router Version 3.1
  16337. Class Telebit | embedded || router
  16338. TSeq(Class=TD|TR%gcd=40000|80000|C0000|100000|200000%SI=<FF)
  16339. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  16340. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16341. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M)
  16342. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16343. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16344. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16345. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16346. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16347.  
  16348. Fingerprint Telindus 11xx ADSL Router
  16349. Class Telindus | embedded || broadband router
  16350. TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U)
  16351. T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  16352. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  16353. T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M)
  16354. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  16355. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  16356. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  16357. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  16358. PU(Resp=N)
  16359.  
  16360. Fingerprint Telocity (DirectTVDSL) Gateway x2 Model
  16361. Class Telocity | embedded || broadband router
  16362. TSeq(Class=64K%IPID=I%TS=U)
  16363. T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=MNW)
  16364. T2(Resp=N)
  16365. T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=)
  16366. T4(DF=N%W=3000%ACK=O%Flags=R%Ops=)
  16367. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16368. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16369. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16370. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  16371.  
  16372. Fingerprint Telos Zephyr Xstream v2.71p ISDN/POTS/Ethernet audio transceiver
  16373. Class Telos | embedded || media device
  16374. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  16375. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16376. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  16377. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16378. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16379. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16380. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16381. PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16382.  
  16383. Fingerprint CPV Telsey broadband + voip residential gateway
  16384. Class Telsey | embedded || broadband router
  16385. TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U)
  16386. T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  16387. T2(Resp=N)
  16388. T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=M)
  16389. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16390. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16391. T6(Resp=N)
  16392. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16393. PU(Resp=N)
  16394.  
  16395. Fingerprint Teltrend (aka Securicor 3net) Router
  16396. Class Teltrend | embedded || router
  16397. TSeq(Class=TD%gcd=388|710%SI=<F)
  16398. T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16399. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16400. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16401. T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  16402. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16403. T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  16404. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16405. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16406.  
  16407. Fingerprint Terayon Tj715x cable modem
  16408. Class Terayon | embedded || broadband router
  16409. TSeq(Class=TD%gcd=<1364%SI=<1E%IPID=I%TS=U)
  16410. T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=)
  16411. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16412. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=)
  16413. T4(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16414. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16415. T6(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16416. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16417. PU(Resp=N)
  16418.  
  16419. Fingerprint Thales WebSentry HSM Crypto Accelerator
  16420. Class Thales | embedded || encryption accelerator
  16421. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  16422. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  16423. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  16424. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  16425. T4(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  16426. T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=)
  16427. T6(DF=N%W=0%ACK=O%Flags=RF%Ops=)
  16428. T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=)
  16429. PU(Resp=N)
  16430.  
  16431. # Firmware 4.2.3.0.0 on Thomson (ex-Alcatel) SpeedTouch 510v4/530 DSL modem.
  16432. Fingerprint Thomson Speed Touch 510 or 610i *DSL modem
  16433. Class Thomson | embedded || broadband router
  16434. TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ)
  16435. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT)
  16436. T2(Resp=N)
  16437. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT)
  16438. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  16439. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16440. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16441. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16442. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E)
  16443.  
  16444. Fingerprint Toshiba TR650 ISDN Router
  16445. Class Toshiba | embedded || broadband router
  16446. TSeq(Class=TD%gcd=<9%SI=<14)
  16447. T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  16448. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16449. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  16450. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16451. T5(Resp=N)
  16452. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16453. T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16454. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E)
  16455.  
  16456. Fingerprint Toshiba estudio 4511 Multifunction Copier/Fax/Scanner/Printer
  16457. Class Toshiba | embedded || printer
  16458. TSeq(Class=RI%gcd=<6%SI=<4831A2C&>78B67%IPID=I%TS=U)
  16459. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  16460. T2(Resp=N)
  16461. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME)
  16462. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16463. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16464. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16465. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16466. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E)
  16467.  
  16468. # http://www.turtlebeach.com/site/products/audiotron/producthome.asp
  16469. Fingerprint Turtle Beach AudioTron 100 network MP3 player or Microsoft Windows 98SE
  16470. Class Turtle Beach | embedded || media device
  16471. Class Microsoft | Windows | 95/98/ME | general purpose
  16472. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U)
  16473. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  16474. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16475. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  16476. T4(DF=N%W=0%ACK=O|S++%Flags=R%Ops=)
  16477. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16478. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16479. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16480. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16481.  
  16482. # Turtle Beach AudioTron with firmware 3.0.0
  16483. Fingerprint Turtle Beach AudioTron network MP3 player
  16484. Class Turtle Beach | embedded || media device
  16485. TSeq(Class=TD%gcd=<68%SI=<14%IPID=BI%TS=U)
  16486. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  16487. T2(Resp=N)
  16488. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  16489. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16490. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16491. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16492. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16493. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16494.  
  16495. # AudioTron with 3.0.26 Firmware
  16496. Fingerprint Turtle Beach AudioTron network MP3 player
  16497. Class Turtle Beach | embedded || media device
  16498. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=RPI|RD%TS=U)
  16499. T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  16500. T2(Resp=N)
  16501. T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M)
  16502. T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=)
  16503. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16504. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16505. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16506. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16507.  
  16508. Fingerprint US Robotics Total Control NETServer Card
  16509. Class US Robotics | embedded || terminal server
  16510. TSeq(Class=C%Val=7F)
  16511. T1(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16512. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  16513. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16514. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  16515. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16516. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  16517. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL)
  16518. PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E)
  16519.  
  16520. # U.S. Robotics Broadband Router (Model # 8000-02, Version V2.5)
  16521. Fingerprint US Robotics broadband router (model #8000-02)
  16522. Class US Robotics | embedded || WAP
  16523. TSeq(Class=TD%gcd=<130%SI=<1E%IPID=BI%TS=U)
  16524. T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  16525. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  16526. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  16527. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  16528. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  16529. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  16530. T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  16531. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16532.  
  16533. Fingerprint US Robotics USR8022 broadband wireless router (WAP)
  16534. Class US Robotics | embedded || WAP
  16535. TSeq(Class=TD|RI%gcd=<68%SI=<636%IPID=I%TS=U)
  16536. T1(DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=)
  16537. T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=)
  16538. T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=)
  16539. T4(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=)
  16540. T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=)
  16541. T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=)
  16542. T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=)
  16543. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16544.  
  16545. Fingerprint MOTOROLA VANGUARD 320 IP router running OS version 5.4
  16546. Class Vanguard | embedded || router
  16547. TSeq(Class=TD%gcd=<6%SI=<1E)
  16548. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
  16549. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16550. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16551. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16552. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16553. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16554. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16555. PU(Resp=N)
  16556.  
  16557. Fingerprint Motorola Vanguard 320 multi-protocol network access device V5.5 - 5.6
  16558. Class Vanguard | embedded || router
  16559. TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U)
  16560. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL)
  16561. T2(Resp=N)
  16562. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16563. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16564. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16565. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16566. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16567. PU(Resp=N)
  16568.  
  16569. Fingerprint VersaNet ISP-Accelerator(TM) Remote Access Server
  16570. Class VersaNet | embedded || terminal server
  16571. TSeq(Class=TD%gcd=<2004%SI=<14)
  16572. T1(DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
  16573. T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
  16574. T3(Resp=Y%DF=Y%W=3E80%ACK=S++%Flags=AS%Ops=M)
  16575. T4(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
  16576. T5(DF=Y%W=0%ACK=S++%Flags=ARF%Ops=)
  16577. T6(DF=Y%W=0%ACK=O%Flags=RF%Ops=)
  16578. T7(DF=Y%W=0%ACK=S%Flags=ARF%Ops=)
  16579. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16580.  
  16581. Fingerprint Virtual Access LinXpeed Pro 120 router running Software 7.4.33CM
  16582. Class Virtual Access | embedded || router
  16583. TSeq(Class=C|TD%gcd=<10004%SI=<1E%IPID=I%TS=U)
  16584. T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M)
  16585. T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  16586. T3(Resp=Y|N%DF=Y%W=1000%ACK=O%Flags=AS%Ops=M)
  16587. T4(DF=Y%W=100%ACK=O%Flags=R%Ops=)
  16588. T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=)
  16589. T6(DF=Y%W=100%ACK=O%Flags=R%Ops=)
  16590. T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=)
  16591. PU(Resp=N)
  16592.  
  16593. # Firebox 700 Firewall - Firebox Release: andromeda;  Driver version: 7.2.B1501;  Daemon version: 7.2.B1501;  Sys_B Version: 4.61.B742;  Sys_B Version: 4.61.B742
  16594. Fingerprint WatchGuard Firebox 700 firewall
  16595. Class WatchGuard | embedded || firewall
  16596. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  16597. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16598. T2(Resp=N)
  16599. T3(Resp=N)
  16600. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16601. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16602. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16603. T7(Resp=N)
  16604. PU(Resp=N)
  16605.  
  16606. # Watchguard Firebox II version 7.00 build 2448
  16607. Fingerprint Watchguard Firebox II version 7.00
  16608. Class WatchGuard | embedded || firewall
  16609. TSeq(Class=TR%gcd=<6%IPID=I%TS=U)
  16610. T1(DF=N%W=3FE0%ACK=S++%Flags=BAS%Ops=ME)
  16611. T2(Resp=N)
  16612. T3(Resp=N)
  16613. T4(Resp=N)
  16614. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16615. T6(Resp=N)
  16616. T7(Resp=N)
  16617. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16618.  
  16619. # Watchguard SoHo 6 TC Firewall (inside)
  16620. Fingerprint WatchGuard Firebox SOHO V.5-V.6 firewall
  16621. Class WatchGuard | embedded || firewall
  16622. TSeq(Class=TR%gcd=<6%IPID=RD%TS=U)
  16623. T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M)
  16624. T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  16625. T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  16626. T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  16627. T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  16628. T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=)
  16629. T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=)
  16630. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16631.  
  16632. Fingerprint Watchguard Firebox X700
  16633. Class WatchGuard | embedded || firewall
  16634. TSeq(Class=RI|TR%gcd=<6%SI=<2FFF7A6%IPID=Z|I%TS=100HZ|U)
  16635. T1(DF=Y|N%W=16A0|3FE0%ACK=S++%Flags=AS|BAS%Ops=MNNTNW|ME)
  16636. T2(Resp=N)
  16637. T3(Resp=Y%DF=Y|N%W=16A0|3FE0%ACK=S++%Flags=AS|ASF%Ops=MNNTNW|ME)
  16638. T4(Resp=N)
  16639. T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=)
  16640. T6(Resp=N)
  16641. T7(Resp=N)
  16642. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16643.  
  16644. Fingerprint WuT Web Thermometer
  16645. Class Wiesemann & Theis | embedded || specialized
  16646. TSeq(Class=TD%gcd=<6%SI=<14%IPID=I%TS=U)
  16647. T1(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  16648. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=)
  16649. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  16650. T4(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  16651. T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  16652. T6(DF=N%W=0%ACK=S%Flags=APR%Ops=)
  16653. T7(DF=N%W=0%ACK=S++%Flags=APR%Ops=)
  16654. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16655.  
  16656. Fingerprint Wooksung TelePhoSee WVP-2100 teleconference system
  16657. Class Wooksung | embedded || telecom-misc
  16658. TSeq(Class=RI%gcd=<6%SI=<18A7BDA&>3F1C4%IPID=Z%TS=100HZ)
  16659. T1(DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW)
  16660. T2(Resp=N)
  16661. T3(Resp=Y%DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW)
  16662. T4(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16663. T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16664. T6(DF=Y%W=0%ACK=O%Flags=R%Ops=)
  16665. T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16666. PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16667.  
  16668. Fingerprint WTI Internet Power Switch 1.01
  16669. Class WTI | embedded || power-device
  16670. TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U)
  16671. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  16672. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=)
  16673. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16674. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16675. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16676. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16677. T7(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16678. PU(Resp=N)
  16679.  
  16680. Fingerprint WTI Network Power Switch v3.02
  16681. Class WTI | embedded || power-device
  16682. TSeq(Class=TD%gcd=<2A%SI=<1E%IPID=I%TS=U)
  16683. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
  16684. T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=)
  16685. T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  16686. T4(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  16687. T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=)
  16688. T6(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  16689. T7(DF=N%W=800%ACK=S%Flags=AR%Ops=)
  16690. PU(Resp=N)
  16691.  
  16692. # WYSE OS Firmware V4.2.137
  16693. Fingerprint WYSE Winterm terminal server
  16694. Class WYSE | WYSE OS || terminal server
  16695. TSeq(Class=64K%IPID=I%TS=U)
  16696. T1(DF=N%W=7800%ACK=S++%Flags=AS%Ops=M)
  16697. T2(Resp=N)
  16698. T3(Resp=Y%DF=N%W=7800%ACK=O%Flags=A%Ops=)
  16699. T4(DF=N%W=7800%ACK=O%Flags=R%Ops=)
  16700. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16701. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16702. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16703. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16704.  
  16705. Fingerprint XCD Xconnect print server, firmware version CC8S-3.58 (98.09.21)
  16706. Class XCD | embedded || print server
  16707. TSeq(Class=TD%gcd=<272A%SI=<1E)
  16708. T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  16709. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16710. T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME)
  16711. T4(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16712. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16713. T6(DF=N%W=0%ACK=S%Flags=R%Ops=)
  16714. T7(Resp=N)
  16715. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E)
  16716.  
  16717. Fingerprint Xerox 8830 Plotter
  16718. Class Xerox | embedded || printer
  16719. TSeq(Class=TD%gcd=1000%SI=1)
  16720. T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  16721. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16722. T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M)
  16723. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16724. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16725. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16726. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16727. PU(Resp=N)
  16728.  
  16729. Fingerprint Xerox Document Centre 440 w/ CentreWare Internet Services
  16730. Class Xerox | embedded || printer
  16731. TSeq(Class=64K%IPID=I%TS=U)
  16732. T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M)
  16733. T2(Resp=N)
  16734. T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=)
  16735. T4(DF=N%W=4000%ACK=O%Flags=R%Ops=)
  16736. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16737. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16738. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16739. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16740.  
  16741. Fingerprint Xerox Document Centre ColorSeries 50
  16742. Class Xerox | embedded || printer
  16743. TSeq(Class=i800%IPID=I%TS=U)
  16744. T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=ME)
  16745. T2(Resp=N)
  16746. T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME)
  16747. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16748. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16749. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16750. T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16751. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16752.  
  16753. Fingerprint Xerox DocuPrint C55
  16754. Class Xerox | embedded || printer
  16755. TSeq(Class=TD%gcd=1000|2000|3000|4000%SI=<A)
  16756. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  16757. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16758. T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  16759. T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16760. T5(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16761. T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16762. T7(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16763. PU(Resp=N)
  16764.  
  16765. Fingerprint Xerox Docuprint N2125 network printer
  16766. Class Xerox | embedded || printer
  16767. TSeq(Class=64K%IPID=I%TS=U)
  16768. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW)
  16769. T2(Resp=N)
  16770. T3(Resp=N)
  16771. T4(DF=N%W=2000%ACK=O%Flags=R%Ops=)
  16772. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16773. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16774. T7(Resp=N)
  16775. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16776.  
  16777. Fingerprint Xerox DocuPrint N24/N32/N40 Network Laser Printer
  16778. Class Xerox | embedded || printer
  16779. TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I%TS=U)
  16780. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16781. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16782. T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16783. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16784. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16785. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16786. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16787. PU(Resp=N)
  16788.  
  16789. Fingerprint Xerox DocuPrint N40
  16790. Class Xerox | embedded || printer
  16791. TSeq(Class=TD%gcd=<2004%SI=<8C)
  16792. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16793. T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16794. T3(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
  16795. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16796. T5(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16797. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16798. T7(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16799. PU(Resp=N)
  16800.  
  16801. Fingerprint xMach free distributed OS version 0.1 current
  16802. Class xMach | xMach || general purpose
  16803. TSeq(Class=64K%IPID=I%TS=2HZ)
  16804. T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16805. T2(Resp=N)
  16806. T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT)
  16807. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16808. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16809. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16810. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16811. PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16812.  
  16813. Fingerprint Xylan OmniSwitch 5x/9x Ethernet switch, Xylogics Annex-III Comm server R10.0, or Hitachi HI-UX/WE2
  16814. Class Xylan | embedded || switch
  16815. Class Xylogics | embedded || terminal server
  16816. Class Hitachi | HI-UX || general purpose
  16817. TSeq(Class=64K)
  16818. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  16819. T2(Resp=N)
  16820. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  16821. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  16822. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16823. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16824. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16825. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16826.  
  16827. Fingerprint Xylogics Micro Annex ELS terminal server x7.1.8
  16828. Class Xylogics | embedded || terminal server
  16829. TSeq(Class=64K)
  16830. T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=)
  16831. T2(Resp=N)
  16832. T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=)
  16833. T4(DF=N%W=800%ACK=O%Flags=R%Ops=)
  16834. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16835. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16836. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16837. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16838.  
  16839. Fingerprint Xylogics Remote Annex 4000 terminal server running LynxOS realtime OS
  16840. Class Xylogics | LynxOS || terminal server
  16841. TSeq(Class=64K)
  16842. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=)
  16843. T2(Resp=N)
  16844. T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=)
  16845. T4(DF=N%W=1000%ACK=O%Flags=R%Ops=)
  16846. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16847. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16848. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16849. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E)
  16850.  
  16851. Fingerprint Xyplex Network 9000 terminal server
  16852. Class Xyplex | embedded || terminal server
  16853. TSeq(Class=TD%gcd=<6%SI=<6)
  16854. T1(Resp=Y%DF=Y%W=100%ACK=S++%Flags=AS%Ops=M)
  16855. T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16856. T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16857. T4(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16858. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16859. T6(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  16860. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16861. PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16862.  
  16863. # Fingerprint Xyplex Terminal Server/Xyplex hardware CSERV-20 11.00.00 ROM 410000/Xyplex software Terminal Server v6.0.4 (info frm SNMP)
  16864. Fingerprint Xyplex Terminal Server CSERV-20 software v6.0.4
  16865. Class Xyplex | embedded || terminal server
  16866. TSeq(Class=TD%gcd=<2714%SI=<258%IPID=I%TS=U)
  16867. T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M)
  16868. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16869. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16870. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16871. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16872. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16873. T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16874. PU(Resp=N)
  16875.  
  16876. Fingerprint Xyplex Terminal Server v6.0.2S5
  16877. Class Xyplex | embedded || terminal server
  16878. TSeq(Class=TD%gcd=1388%SI=<F)
  16879. T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  16880. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16881. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16882. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16883. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16884. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16885. T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16886. PU(Resp=N)
  16887.  
  16888. Fingerprint Xyplex 1600 terminal server running MAXserver V6.0.2 firmware
  16889. Class Xyplex | MAXserver || terminal server
  16890. TSeq(Class=C|TD%gcd=<5%SI=<5)
  16891. T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M)
  16892. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16893. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16894. T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16895. T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16896. T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16897. T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16898. PU(Resp=N)
  16899.  
  16900. Fingerprint Xyplex Maxserver 1600 Terminal Server
  16901. Class Xyplex | MAXserver || terminal server
  16902. TSeq(Class=TD%gcd=<EA64%SI=<C8%IPID=I%TS=U)
  16903. T1(DF=N%W=0|100%ACK=S++%Flags=BAR|AS%Ops=|M)
  16904. T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16905. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16906. T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16907. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16908. T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16909. T7(DF=N%W=0%ACK=S++%Flags=UAPRF%Ops=)
  16910. PU(Resp=N)
  16911.  
  16912. Fingerprint Zcomax Wireless Access Point XI-1500
  16913. Class Zcomax | embedded || WAP
  16914. TSeq(Class=TD%gcd=<D24%SI=<14%IPID=I%TS=U)
  16915. T1(Resp=N)
  16916. T2(Resp=N)
  16917. T3(Resp=N)
  16918. T4(Resp=N)
  16919. T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=)
  16920. T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=)
  16921. T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=)
  16922. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16923.  
  16924. Fingerprint ZoomAir IG-4165 wireless gateway (WAP)
  16925. Class ZoomAir | embedded || WAP
  16926. TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U)
  16927. T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  16928. T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  16929. T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  16930. T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  16931. T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  16932. T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=)
  16933. T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=)
  16934. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16935.  
  16936. Fingerprint Hardware: Zyxel Prestige broadband router
  16937. Class Zyxel | ZyNOS || broadband router
  16938. T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
  16939. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16940. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16941. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16942. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16943. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16944. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16945. PU(Resp=N)
  16946.  
  16947. Fingerprint Zyxel 944S Prestige router
  16948. Class Zyxel | ZyNOS || broadband router
  16949. T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
  16950. T2(Resp=N)
  16951. T3(Resp=N)
  16952. T4(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=)
  16953. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16954. T6(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=)
  16955. T7(Resp=N)
  16956. PU(Resp=N)
  16957.  
  16958. Fingerprint ZyXEL P480 ISDN router running ZyNOS v2.42(O.00)
  16959. Class Zyxel | ZyNOS || broadband router
  16960. TSeq(Class=TD%gcd=<2004%SI=<1E)
  16961. T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M)
  16962. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16963. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16964. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16965. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16966. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16967. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16968. PU(Resp=N)
  16969.  
  16970. # Zyxel Prestige 642R-11 (analog ADSL router) ZyNOS F/W Version: V2.50(AJ.9)
  16971. Fingerprint Zyxel Prestige 642R-11 ASDL router running ZyNOS
  16972. Class Zyxel | ZyNOS || broadband router
  16973. TSeq(Class=TD%gcd=<F0004%SI=<14%IPID=I%TS=U)
  16974. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  16975. T2(Resp=N)
  16976. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16977. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16978. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16979. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  16980. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  16981. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  16982.  
  16983. Fingerprint ZyXEL Prestige 643 router
  16984. Class Zyxel | ZyNOS || broadband router
  16985. T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
  16986. T2(Resp=N)
  16987. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16988. T4(Resp=N)
  16989. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  16990. T6(Resp=N)
  16991. T7(Resp=N)
  16992. PU(Resp=N)
  16993.  
  16994. # ZyXEL Prestige 700 broadband router
  16995. # Netgear MR314 Cable/Wireless Router
  16996. Fingerprint ZyXEL Prestige 700/Netgear MR314 broadband router
  16997. Class Zyxel | ZyNOS || broadband router
  16998. T1(DF=N%W=0%ACK=S++%Flags=BAR%Ops=)
  16999. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17000. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17001. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17002. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17003. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17004. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17005. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17006.  
  17007. # Zyxel P128imh or P480 router (ZyNOS)
  17008. # ZyNOS F/W Version: V2.50(AJ.7) | 2/28/2002
  17009. # Zyxel Prestige 645-R11 adsl router
  17010. # Intel Express 8100 Router ISDN
  17011. Fingerprint Zyxel ZyNOS based broadband router (ZyNOS) or Intel Express ISDN router
  17012. Class Zyxel | ZyNOS || broadband router
  17013. Class Intel | embedded || broadband router
  17014. TSeq(Class=TD%gcd=1000|2000|5000|4000|6000|8000|A000|78000|1A4000%SI=<FF%IPID=I%TS=U)
  17015. T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M)
  17016. T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17017. T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17018. T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17019. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17020. T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
  17021. T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
  17022. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17023.  
  17024. # Zyxel ZyWALL 1 running ZyNOS Version V3.60(WD.3) | 05/24/2004
  17025. Fingerprint Zyxel ZyWALL 1 firewall
  17026. Class Zyxel | ZyNOS || firewall
  17027. TSeq(Class=TD%gcd=<2004%SI=<46%IPID=I%TS=U)
  17028. T1(DF=N%W=B680%ACK=S++%Flags=AS%Ops=M)
  17029. T2(Resp=N)
  17030. T3(Resp=N)
  17031. T4(Resp=N)
  17032. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17033. T6(Resp=N)
  17034. T7(Resp=N)
  17035. PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  17036.  
  17037. # ZyXEL ZyWALL 50 running ZyNOS V3.52(WC.2)C0 | 05/02/2003
  17038. Fingerprint Zyxel ZyWALL 50 (ZyNOS 3.52)
  17039. Class Zyxel | ZyNOS || firewall
  17040. TSeq(Class=TD%gcd=<F0004%SI=<1E%IPID=I%TS=U)
  17041. T1(DF=N%W=B680%ACK=S++%Flags=AS%Ops=M)
  17042. T2(Resp=N)
  17043. T3(Resp=N)
  17044. T4(Resp=N)
  17045. T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
  17046. T6(Resp=N)
  17047. T7(Resp=N)
  17048. PU(Resp=N)
  17049.