From 50c4981934c34074cf77646e14ed85eb6132ac3e Mon Sep 17 00:00:00 2001 From: david Date: Sat, 3 Nov 2007 01:31:02 +0000 Subject: [PATCH] Remove the first-generation OS detection and nmap-os-fingerprints. --- CHANGELOG | 2 + Makefile.in | 1 - NmapOps.cc | 1 - NmapOps.h | 1 - docs/nmap.usage.txt | 4 +- docs/refguide.xml | 54 +- global_structures.h | 4 +- idle_scan.cc | 6 +- mswin32/Makefile | 2 +- mswin32/nmap.vcproj | 24 - mswin32/nsis/Nmap.nsi | 2 - nmap-os-fingerprints | 21671 ---------------------------------------- nmap.cc | 28 +- nmap.h | 2 - osscan.cc | 1248 +-- osscan.h | 10 - osscan2.cc | 33 +- scripts/script.db | 1 + 18 files changed, 38 insertions(+), 23056 deletions(-) delete mode 100644 nmap-os-fingerprints diff --git a/CHANGELOG b/CHANGELOG index 651f8ae44..fbdca6731 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -13,6 +13,8 @@ o There is no longer any artificial limit on the number of ports or nmap -PAhttp,https target nmap -PU'[-]' target +o Removed the first-generation OS detection. + 4.22SOC8 o Removed the old massping() system, since the functionality has now diff --git a/Makefile.in b/Makefile.in index 435021b0a..badd5a08c 100644 --- a/Makefile.in +++ b/Makefile.in @@ -183,7 +183,6 @@ install-nmap: $(TARGET) $(INSTALL) -c -m 644 docs/nmap.dtd $(DESTDIR)$(nmapdatadir)/ $(INSTALL) -c -m 644 nmap-services $(DESTDIR)$(nmapdatadir)/ $(INSTALL) -c -m 644 nmap-rpc $(DESTDIR)$(nmapdatadir)/ - $(INSTALL) -c -m 644 nmap-os-fingerprints $(DESTDIR)$(nmapdatadir)/ $(INSTALL) -c -m 644 nmap-os-db $(DESTDIR)$(nmapdatadir)/ $(INSTALL) -c -m 644 nmap-service-probes $(DESTDIR)$(nmapdatadir)/ $(INSTALL) -c -m 644 nmap-protocols $(DESTDIR)$(nmapdatadir)/ diff --git a/NmapOps.cc b/NmapOps.cc index f4f3aec11..80905f919 100644 --- a/NmapOps.cc +++ b/NmapOps.cc @@ -203,7 +203,6 @@ void NmapOps::Initialize() { interactivemode = 0; ping_group_sz = PING_GROUP_SZ; generate_random_ips = 0; - reference_FPs1 = NULL; reference_FPs = NULL; magic_port = 33000 + (get_random_uint() % 31000); magic_port_set = 0; diff --git a/NmapOps.h b/NmapOps.h index 60a3dbb98..eaf38ca2f 100644 --- a/NmapOps.h +++ b/NmapOps.h @@ -185,7 +185,6 @@ class NmapOps { int interactivemode; int ping_group_sz; int generate_random_ips; /* -iR option */ - FingerPrintDB *reference_FPs1; /* Used in the old OS scan system. */ FingerPrintDB *reference_FPs; /* Used in the new OS scan system. */ u16 magic_port; unsigned short magic_port_set; /* Was this set by user? */ diff --git a/docs/nmap.usage.txt b/docs/nmap.usage.txt index a0f307f91..e371e24e4 100644 --- a/docs/nmap.usage.txt +++ b/docs/nmap.usage.txt @@ -48,9 +48,7 @@ SCRIPT SCAN: --script-trace: Show all data sent and received --script-updatedb: Update the script database. OS DETECTION: - -O: Enable OS detection (try 2nd generation w/fallback to 1st) - -O2: Only use the new OS detection system (no fallback) - -O1: Only use the old (1st generation) OS detection system + -O: Enable OS detection --osscan-limit: Limit OS detection to promising targets --osscan-guess: Guess OS more aggressively TIMING AND PERFORMANCE: diff --git a/docs/refguide.xml b/docs/refguide.xml index d356ec847..6435a2ef1 100644 --- a/docs/refguide.xml +++ b/docs/refguide.xml @@ -1726,7 +1726,7 @@ way. in the responses. After performing dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID sampling, and the initial window size check, Nmap compares the results to its - nmap-os-fingerprints database of more than 1500 known + nmap-os-db database of more than 800 known OS fingerprints and prints out the OS details if there is a match. Each fingerprint includes a freeform textual description of the OS, and a classification which provides the vendor name @@ -1782,51 +1782,7 @@ way. Enables OS detection, as discussed above. Alternatively, you can use to enable - OS detection along with other things. 2nd generation OS - detection is tried first. If that fails, Nmap will either - print out the host fingerprint and ask you to submit it (if - you are certain about what the target host is running), or - Nmap will fall back to the 1st generation OS detection - system in case its larger database has a match. - - - - - - - (2nd Generation OS Detection Only) - -O2 - - - - - Enables 2nd generation OS detection, but never falls - back to the old (1st generation) system, even if it fails to - find any match. This saves time and can reduce the number - of packets sent to each target. - - - - - - - (1st Generation OS Detection Only) - -O1 - - - - - Tells Nmap to only use the old OS detection system. - If just gives you a fingerprint to - submit, but you don't know what OS the target is running, - try . But in that case, don't submit the fingerprint as you - don't know for sure whether guessed - correctly. If it was perfect, we wouldn't have bothered to - create . - - This option, and all other vestiges of the old OS - detection system, will likely be removed in 2007. + OS detection along with other things. @@ -1884,9 +1840,7 @@ way. may be set to allow even more retries when conditions are favorable. This is rarely done, except to generate better fingerprints for submission and integration into the Nmap OS - database. This option only affects second generation OS - detection (, the default) and not the - old system (). + database. @@ -3381,7 +3335,7 @@ overwhelming requests. Specify to only see nmap-protocols, nmap-rpc, nmap-mac-prefixes, and - nmap-os-fingerprints. If the + nmap-os-db. If the location of any of these files has been specified (using the or options), that location is used for that file. After that, Nmap diff --git a/global_structures.h b/global_structures.h index 139bff9ab..d451f3014 100644 --- a/global_structures.h +++ b/global_structures.h @@ -191,14 +191,14 @@ typedef struct FingerTest { char *OS_name; struct OS_Classification OS_class[MAX_OS_CLASSIFICATIONS_PER_FP]; int num_OS_Classifications; - int line; /* For reference prints, the line # in nmap-os-fingerprints */ + int line; /* For reference prints, the line # in nmap-os-db */ const char *name; struct AVal *results; struct FingerTest *next; } FingerPrint; /* This structure contains the important data from the fingerprint - database (nmap-os-db or nmap-os-fingerprints) */ + database (nmap-os-db) */ typedef struct FingerPrintDB { FingerPrint **prints; FingerPrint *MatchPoints; diff --git a/idle_scan.cc b/idle_scan.cc index ba2c595a8..9def9fb8d 100644 --- a/idle_scan.cc +++ b/idle_scan.cc @@ -105,7 +105,7 @@ #include "idle_scan.h" #include "timing.h" -#include "osscan.h" +#include "osscan2.h" #include "nmap.h" #include "NmapOps.h" #include "services.h" @@ -305,7 +305,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName, struct ip *ip; struct tcp_hdr *tcp; int distance; - u16 ipids[NUM_IPID_PROBES]; + int ipids[NUM_IPID_PROBES]; u8 probe_returned[NUM_IPID_PROBES]; struct route_nfo rnfo; assert(proxy); @@ -504,7 +504,7 @@ static void initialize_idleproxy(struct idle_proxy_info *proxy, char *proxyName, proxy->host.HostName(), proxy->host.targetipstr(), proxy->probe_port); - proxy->seqclass = ipid_sequence(probes_returned, ipids, 0); + proxy->seqclass = get_ipid_sequence(probes_returned, ipids, 0); switch(proxy->seqclass) { case IPID_SEQ_INCR: case IPID_SEQ_BROKEN_INCR: diff --git a/mswin32/Makefile b/mswin32/Makefile index 9a9395665..3bfd02b8f 100644 --- a/mswin32/Makefile +++ b/mswin32/Makefile @@ -21,7 +21,7 @@ winbuild: $(MAKENSIS) winpcap/winpcap-nmap.nsi rm -rf nmap-$(NMAP_VERSION) mkdir nmap-$(NMAP_VERSION) - cd Release && cp -r ../../CHANGELOG ../../COPYING nmap-mac-prefixes nmap-os-fingerprints nmap-os-db nmap-protocols nmap-rpc nmap-service-probes nmap-services nmap.exe nmap.xsl ../nmap_performance.reg ../../README-WIN32 ../nmap-$(NMAP_VERSION)/ + cd Release && cp -r ../../CHANGELOG ../../COPYING nmap-mac-prefixes nmap-os-db nmap-protocols nmap-rpc nmap-service-probes nmap-services nmap.exe nmap.xsl ../nmap_performance.reg ../../README-WIN32 ../nmap-$(NMAP_VERSION)/ mkdir nmap-$(NMAP_VERSION)/scripts cd Release && cp -f $(NSE_FILES) ../nmap-$(NMAP_VERSION)/scripts/ mkdir nmap-$(NMAP_VERSION)/nselib diff --git a/mswin32/nmap.vcproj b/mswin32/nmap.vcproj index ee68e9e3e..548593ee9 100644 --- a/mswin32/nmap.vcproj +++ b/mswin32/nmap.vcproj @@ -719,30 +719,6 @@ /> - - - - - - - - diff --git a/mswin32/nsis/Nmap.nsi b/mswin32/nsis/Nmap.nsi index 6eb39f282..82b23ada3 100644 --- a/mswin32/nsis/Nmap.nsi +++ b/mswin32/nsis/Nmap.nsi @@ -114,7 +114,6 @@ Section "Nmap Core Files" SecCore File ..\..\CHANGELOG File ..\..\COPYING File ..\..\nmap-mac-prefixes - File ..\..\nmap-os-fingerprints File ..\..\nmap-os-db File ..\..\nmap-protocols File ..\..\nmap-rpc @@ -207,7 +206,6 @@ Section "Uninstall" Delete "$INSTDIR\CHANGELOG" Delete "$INSTDIR\COPYING" Delete "$INSTDIR\nmap-mac-prefixes" - Delete "$INSTDIR\nmap-os-fingerprints" Delete "$INSTDIR\nmap-os-db" Delete "$INSTDIR\nmap-protocols" Delete "$INSTDIR\nmap-rpc" diff --git a/nmap-os-fingerprints b/nmap-os-fingerprints deleted file mode 100644 index 9b97201b4..000000000 --- a/nmap-os-fingerprints +++ /dev/null @@ -1,21671 +0,0 @@ -# Nmap OS Fingerprint List. -*- mode: fundamental; -*- -# $Id$ -# -# Contributions to this database are welcome. If Nmap obtains a new -# fingerprint (and test conditions are favorable), it will print out a -# URL you can use to submit the fingerprint. If Nmap guesses wrong, -# please send the full Nmap output and the exact destination host OS -# name and version to fyodor@insecure.org . Thanks! -# -# By submitting fingerprints you are transfering any and all copyright -# interest in the data to Fyodor so that he can modify it, relicense it, -# incorporate it into programs, etc. -# -# This collection of fingerprint data is (C) 1998-2003 by -# Insecure.Com LLC. This data is available for -# free use by open source software under the terms of the GNU General -# Public License. We also license the data to selected -# commercial/proprietary vendors under less restrictive terms. -# Contact sales@insecure.com for more information. -# -# TEST DESCRIPTION: -# Tseq is the TCP sequenceability test -# T1 is a SYN packet with a bunch of TCP options to open port -# T2 is a NULL packet w/options to open port -# T3 is a SYN|FIN|URG|PSH packet w/options to open port -# T4 is an ACK to open port w/options -# T5 is a SYN to closed port w/options -# T6 is an ACK to closed port w/options -# T7 is a FIN|PSH|URG to a closed port w/options -# PU is a UDP packet to a closed port - -Fingerprint 2Wire Home Portal 100 residential gateway, v.3.1.0 -Class 2Wire | embedded || WAP -TSeq(Class=RI%gcd=<6%SI=<7A8FA&>50%IPID=I%TS=100HZ) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# 3Com Home Connect Cable Modem external with USB - Model 3CR29223 -Fingerprint 3Com Home Connect Cable Modem -Class 3Com | embedded || broadband router -TSeq(Class=TD%gcd=<9C8%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# 3Com 812 OfficeConnect ADSL Router Firmware version: 2.0.0 -Fingerprint 3Com OfficeConnect 812 ADSL router -Class 3Com | embedded || broadband router -TSeq(Class=TD%gcd=18000) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Tested ACC Amazon 9.2.29, ACC Congo 9.2.35 -Fingerprint ACC Amazon 9.2.29 or Congo 9.2.35 WAN concentrator -Class ACC | embedded || router -TSeq(Class=64K) -T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Acorn RISC OS 3.60 (Acorn TCP/IP Stack 4.07) -Class Acorn | RISC OS || general purpose -TSeq(Class=TR) -T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=3000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Acorn RISC OS 3.70 using AcornNet TCP/IP stack or RISC OS 4 (Pace, RISCOS Ltd) -Class Acorn | RISC OS || general purpose -TSeq(Class=RI%gcd=<6) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Actiontec Wireless ready DSL Gateway - Model R1520SU -# Actiontec 1520 DSL gateway with GlobespanVirata chipset hardware version RD6700 BSP v1.1 (ISOS 8.2) / He100/2xx CSP v2.3, firmware version 8.2.0.16 -Fingerprint Actiontec 1520 DSL gateway firmware 8.2.0.16 -Class Actiontec | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=8E%IPID=I%TS=U) -T1(DF=N%W=1194%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=1194%ACK=O%Flags=R%Ops=) -T3(Resp=N) -T4(DF=N%W=1194%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Adtran Atlas 890 digital cross-connect device -Class Adtran | embedded || telecom-misc -TSeq(Class=TD%gcd=<714%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -# Aethra Vega Star Gold (Videoconferencing appliance) -# Aethra Video Conference System Vega Pro S running pSOSystem -Fingerprint Aethra Vega Conference System -Class Aethra | embedded || webcam -TSeq(Class=RI%gcd=<6%SI=<2F97016&>79D33%IPID=I%TS=U) -T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Aironet 630-2400 V3.3P Wireless LAN bridge -Class Aironet | embedded || bridge -TSeq(Class=C%Val=0) -T1(DF=Y%W=400%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) -T5(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=1F4%ACK=S%Flags=AR%Ops=) -T7(DF=Y%W=1F4%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Aironet Wireless Bridge running firmware V5.0J -Class Aironet | embedded || bridge -TSeq(Class=C|TR) -T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400|1F4%ACK=O|S++%Flags=AS|AR%Ops=) -T4(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T5(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T7(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Aironet AP4800E v8.07 - Aironet (Cisco?) 11 Mbps Wireless access point -Class Aironet | embedded || WAP -TSeq(Class=TR%gcd=<6) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Alcatel 1000 ADSL (modem) -Class Alcatel | embedded || broadband router -TSeq(Class=64K) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=60%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Alcatel 1000 DSL Router -Class Alcatel | embedded || broadband router -TSeq(Class=RI%gcd=<5%SI=>AAA&AEE%IPID=I%TS=U) -T1(DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1090%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Advanced Reflexes IP Phone, Version: E/AT400/46.8 -# IBM x450 remote management console (lets you switch machine on/off, check temp, etc) -Fingerprint Alcatel Advanced Reflexes IP Phone or IBM x450 remote management console -Class Alcatel | embedded || VoIP phone -Class IBM | embedded || remote management -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) -T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) -T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) -PU(Resp=N) - -Fingerprint Allied Telesyn AT-S10 version 3.0 on an AT-TS24TR hub -Class Allied Telesyn | embedded || hub -TSeq(Class=C) -T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Allied Telesyn AT-3726 Ethernet Switch: 2.1cycleA -Class Allied Telesyn | embedded || switch -TSeq(Class=TD%gcd=FA|1F4%SI=85A%IPID=I%TS=U) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Nortel/Alteon ACE Director 3 Hardware Revision: B Software Version 6.0.42 -Fingerprint Nortel/Alteon ACE Director 3 Version 6.0.42-B -Class Alteon | embedded || load balancer -TSeq(Class=TR%gcd=<6%IPID=RD) -T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -# Alteon AceSwitch 110 (software 4.0.37) -# Centillion C100 ATM Switch OS Version 2.0.2. -Fingerprint Alteon AceSwitch 110 or Cantillion C100 ATM Switch -Class Alteon | embedded || switch -Class Cantillion | embedded || switch -TSeq(Class=TD%gcd=<9C8%SI=<1E) -T1(DF=N%W=200%ACK=S++|O%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Alteon ACEswitch 184 Software Version 8.0.49 -Fingerprint Alteon ACEswitch 184 V. 8.0.49 -Class Alteon | embedded || switch -TSeq(Class=RI%gcd=<34%SI=215%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Amiga OS 3.5 (Miami TCP/IP Stack v3.1) -Class Amiga | AmigaOS || general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint AmigaOS 2.1 running AmiTCP4.3 -Class Amiga | AmigaOS || general purpose -TSeq(Class=64K%TS=U) -T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint AmigaOS 3.1 running Miami Deluxe 0.9m -Class Amiga | AmigaOS || general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint AmigaOS 3.5/3.9 running Miami Deluxe 1.0c -Class Amiga | AmigaOS || general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint AmigaOS AmiTCP/IP 4.3 -Class Amiga | AmigaOS || general purpose -TSeq(Class=64K) -T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint AmigaOS AmiTCP/IP Genesis 4.6 -Class Amiga | AmigaOS || general purpose -TSeq(Class=64K) -T1(DF=N%W=7F53|2756%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7F53|2756%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint AmigaOS Miami 2.1-3.0 -Class Amiga | AmigaOS || general purpose -TSeq(Class=TR) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint AmigaOS Miami 3.0 -Class Amiga | AmigaOS || general purpose -TSeq(Class=TR) -T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint AmigaOS Miami 3.1-3.2 -Class Amiga | AmigaOS || general purpose -TSeq(Class=TR) -T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint AmigaOS Miami Deluxe 0.9 - Miami 3.2B -Class Amiga | AmigaOS || general purpose -TSeq(Class=TR) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint APC MasterSwitch Network Power Controller -Class APC | embedded || power-device -TSeq(Class=TR) -T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint APC Network management Card AP9616 -Class APC | embedded || power-device -TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ) -T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# APC AP9617 network management card inside Matrix 5000 UPS -Fingerprint APC network-enabled UPS -Class APC | embedded || power-device -TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ) -T1(DF=N%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# APC UPS Network Management Card, Model AP9617 -Fingerprint APC UPS Network Management Card -Class APC | embedded || power-device -TSeq(Class=TD%gcd=<61AC%SI=<3C%IPID=I%TS=1000HZ) -T1(DF=Y%W=10CD%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# SmartUPS 3000RM Firmware: 92.14.I -# APC PDU AOS v1.1.6 -Fingerprint APC UPS system -Class APC | embedded || power-device -TSeq(Class=TD%gcd=D46DF) -T1(DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=640%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Apollo Domain/OS SR10.3.5 -Class Apollo | Domain/OS || general purpose -TSeq(Class=RI|TD%gcd=15CB%IPID=I%TS=2HZ) -T1(DF=Y%W=2000|4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2000|4000%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=2000|4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Apple Airport Express (Wireless Router/Bridge) (Firmware v6.1) -# Apple AirPort Express (Apple Base Station V6.0) -# OKI Phaser B6300N laser printer -# Netgear 7000 Series Managed Switch (GSM7324) (strang ops) -# Westell Versalink 327W, Wireless DSL Modem/Router -Fingerprint Embedded device (Apple WAP, Dell bridge, OKI printer, Westell Broadband router) -Class Apple | embedded || WAP -Class Dell | embedded || storage-misc -Class Okidata | embedded || printer -Class Westell | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=1000%TS=2HZ) -T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2000%ACK=O%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Mac OS X 1.1-1.2 -Fingerprint Apple Mac OS X 1.1-1.2 (Rhapsody 5.5-5.6) on a G3 -Class Apple | Mac OS X | 10.0.X | general purpose -TSeq(Class=RI%gcd=<5) -T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Mac OS X Server 1.0 - 1.0-1 <-- should be 10.1.0? -Fingerprint Apple Mac OS X Server 1.0-1.0-1 (Rhapsody 5.3 - 5.4) -Class Apple | Mac OS X | 10.0.X | general purpose -TSeq(Class=RI%gcd=<5%SI=>BBB&4177) -T1(DF=N|Y%W=805C|2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N|Y%W=805C|2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS X 10.2.6 -Class Apple | Mac OS X | 10.2.X | general purpose -T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS X 10.2.6 (Jaguar) -Class Apple | Mac OS X | 10.2.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS X 10.2.8 (Jaguar) -Class Apple | Mac OS X | 10.2.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2788%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Mac OS X Server 10.2.8 Darwin Kernel 6.8 Macintosh powerpc -Fingerprint Apple Mac OS X Server 10.2.8 -Class Apple | Mac OS X | 10.2.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS X 10.3.3 (Panther) -Class Apple | Mac OS X | 10.3.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Apple Mac OS 10.3.5 (Darwin Kernel Version 7.5.0) -# Mac OS 10.3.7 Server, Darwain, PPC. Kernel version 7.70. All relevant updates as of 2/2/05 -Fingerprint Apple Mac OS X 10.3.5 or 10.3.7 -Class Apple | Mac OS X | 10.3.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Darwin 7.7.0 Power Macintosh powerpc, OS X, version 10.3.7 -# Apple Mac OS X 10.3.6 (7R28) - (Darwin 7.6.0) -Fingerprint Apple Mac OS X 10.3.6 or 10.3.7 -Class Apple | Mac OS X | 10.3.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS X 10.3.9 -Class Apple | Mac OS X | 10.3.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=E34E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS X 10.4.1 (Tiger) -Class Apple | Mac OS X | 10.3.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=A%Ops=NNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Apple Mac OS X 10.3.8 (Panther); Darwin Kernel Version 7.8.0 -# Apple Mac OS X 10.4 (Build: 8A428); Kernel: Darwin 8.0.0 -Fingerprint Apple Mac OS X 10.3.8 or 10.4 -Class Apple | Mac OS X | 10.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Apple Mac OS X 10.4.0 (Tiger) - Darwin Kernel Version 8.0.0 -# Apple Macintosh PowerBook G4 15" Titanium, Mac OS X 10.4.0 (Tiger) build 8A428 -# Mac OS X 10.4 Darwin 8.0.0 Darwin Kernel Version 8.0.0: Sat Mar 26 14:15:22 PST 2005; -# Fingerprint Apple Mac OS X 10.4.0 Build 8a428 Darwin Kernel Version 8.0.0. Power Macintosh powerpc Hardware is PB G4 -# Darwin 8.1.0 Kernel Version 8.1.0 (Apple Mac OS 10.4.1 Tiger) -Fingerprint Apple Mac OS X 10.4.0 - 10.4.4 (Tiger) -Class Apple | Mac OS X | 10.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 7.0-7.1 With MacTCP 1.1.1 - 2.0.6 -Class Apple | Mac OS | 7.X | general purpose -TSeq(Class=C|TD) -T1(DF=N%W=192F|2D25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) -T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Not really constant -- just slow incrementation -# This is an LCIII -Fingerprint Apple Mac OS 7.1 -Class Apple | Mac OS | 7.X | general purpose -TSeq(Class=C) -T1(DF=N%W=192F%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 7.5.5 - 9 -Class Apple | Mac OS | 7.X | general purpose -Class Apple | Mac OS | 8.X | general purpose -Class Apple | Mac OS | 9.X | general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 8 running on an LC 475 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=TR) -T1(DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=ASF%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 8.0 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<8294C&>14D0) -T1(DF=N|Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 8.1 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 8.1 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K) -T1(DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=4240%ACK=S++%Flags=AS%Ops=MEWL) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 8.1 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MEWL) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 8.1 running on a PowerPC G3 (iMac) -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=N%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 8.5 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K) -T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MWL) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) - -# on Macintosh GS server -Fingerprint Apple Mac OS 8.5.1 (Appleshare IP 6.0) -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K) -T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T4(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 8.6 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Mac OS 8.6 running WebStar http server -Fingerprint Apple Mac OS 8.6 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 8.6 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K) -T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Apple Mac OS 8.6 -Class Apple | Mac OS | 8.X | general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=455B%ACK=S++%Flags=AS%Ops=MEWL) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Mac OS 9 on a Power Macintosh 7200/75 -# iMac running Mac OS 9.1 -Fingerprint Apple Mac OS 9 - 9.1 -Class Apple | Mac OS | 9.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<9CE0&>17D) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# HP-UX B.11.00 -Fingerprint Apple Mac OS 9.04 or HP-UX B.11.00 -Class Apple | Mac OS | 9.X | general purpose -Class HP | HP-UX | 11.X | general purpose -TSeq(Class=RI%gcd=<9%SI=>3FFF) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0|A0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Mac OS 9.2.2 -Class Apple | Mac OS | 9.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<8AA66&>13BA%IPID=I%TS=1000HZ) -T1(DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=4B60%ACK=S++%Flags=AS%Ops=MWNNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple MacOS 9.2.2 -Class Apple | Mac OS | 9.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<32EA6&>111%IPID=I%TS=1000HZ) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0|40%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Apple Newton MessagePad 2100, Newton OS 2.1 -Class Apple | Newton OS || PDA -T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=1000%ACK=S%Flags=R%Ops=) -T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000%ACK=S%Flags=R%Ops=) -T7(DF=N%W=1000%ACK=S%Flags=R%Ops=) -PU(Resp=N) - -Fingerprint Arescom 800 series dsl router -Class Arescom | embedded || broadband router -T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) -T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) -PU(Resp=N) - -Fingerprint Arescom NetDSL 1000NDS series ADSL router -Class Arescom | embedded || broadband router -TSeq(Class=TD%gcd=<30004%SI=<14%IPID=I%TS=U) -T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) -T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) -PU(Resp=N) - -Fingerprint ARLAN BR2000E V5.0E Wireless Radio Bridge -Class Arlan | embedded || bridge -TSeq(Class=TR%gcd=<6) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Asante FriendlyNet FR3004 Series Internet Hub -Class Asante | embedded || hub -TSeq(Class=TD%gcd=<68%SI=<32%IPID=RD%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint AsanteHub 2072 Ethernet hub -Class Asante | embedded || hub -TSeq(Class=C) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Asante 6524-2G GigE switch -Class Asante | embedded || switch -TSeq(Class=TD%gcd=<1378%SI=<46%IPID=I%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Asante IntraStack Ethernet Switch (6014 DSB Versions: BP(2.06 ), FW(1.03 )) -Class Asante | embedded || switch -TSeq(Class=C%Val=4090000) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=APR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=APR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=APR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=APR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Asante IntraSwitch 5324 -Class Asante | embedded || switch -TSeq(Class=C%Val=80000) -T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=APR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=APR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Asante IntraSwitch 62xx (6216M in this case) Firmware v2.05A (16-port managed switch) -Fingerprint Asante IntraSwitch 6216M firmware v2.05A -Class Asante | embedded || switch -TSeq(Class=TD%gcd=114%IPID=I%TS=U) -T1(DF=Y%W=200%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=200%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Ascend Max 1800 50Ap8+ or 2024 router -Class Ascend | embedded || router -TSeq(Class=TD%gcd=388|710|A98%SI=BBB&500&600) -T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Ascend / Lucent MAX TNT Running IOS version 8.0.1 w/ VoIP Hash - I think meant TAOS -Fingerprint Ascend / Lucent MAX TNT terminal server -Class Ascend | TAOS || terminal server -TSeq(Class=RI%gcd=<6%SI=<14F46&>346) -T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Ascend Mac 6000 Terminal access server (dialup access server) Running TAOS 9.0.9 -# Lucent (Acend) DSLMAX 20 revision 8.0.7 -Fingerprint Ascend Mac 6000 Terminal access server -Class Ascend | TAOS || terminal server -TSeq(Class=RI%gcd=<6%SI=<919BA&>E5D%IPID=BI%TS=U) -T1(DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y|N%W=111C%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Ascend Max terminal server firmware 7.0.4 -Class Ascend | TAOS || terminal server -TSeq(Class=RI%gcd=<6%SI=<14&>1000) -T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Ascend TNT OS +5.0Ap48+ -Class Ascend | TAOS || terminal server -TSeq(Class=RI%gcd=<6%SI=>BBB&1000) -T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint MiNT with MiNTnet 1.03 running on Atari TT -Class Atari | Atari || game console -TSeq(Class=TD%gcd=3E7%SI=0) -T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(Resp=N) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Atari Mega STE running JIS-68k 3.0 -Class Atari | Atari || general purpose -TSeq(Class=RI%gcd=<8%SI=<1127450&>2BE86) -T1(DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7900%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint AtheOS ( www.atheos.cx ) -Class AtheOS | AtheOS || general purpose -TSeq(Class=RI%gcd=<8%SI=6) -T1(DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3FF0%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint AtheOS/Syllable 0.4.2 -Class AtheOS | AtheOS || general purpose -TSeq(Class=RI%gcd=89CC%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Avaya IP Office 403 PBX -Class Avaya | embedded || PBX -TSeq(Class=RI%gcd=<6%SI=<2B46872&>6EC4D%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=1111%ACK=S++%Flags=R%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=1111%ACK=S++%Flags=R%Ops=) -T6(DF=N%W=1111%ACK=S++%Flags=R%Ops=) -T7(DF=N%W=1111%ACK=S++%Flags=R%Ops=) -PU(Resp=N) - -# Avaya TN2302 Prowler/Medpro H.323 gateway HW03/FW022 -Fingerprint Avaya TN2302 Prowler/Medpro H.323 gateway -Class Avaya | embedded || telecom-misc -TSeq(Class=TD%gcd=<6%SI=<14%IPID=I) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Avocent net KVM switch -Class Avocent | embedded || specialized -TSeq(Class=TR|RI|i800%gcd=<2004%SI=<40D8%IPID=I%TS=1000HZ) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Avocent CPS 1610 serial port server -Class Avocent | embedded || terminal server -TSeq(Class=RI%gcd=<14004%SI=<10C2%IPID=I%TS=1000HZ) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Axent Raptor Firewall running on Windows NT -Class Axent | Windows | NT/2K/XP | firewall -TSeq(Class=TR) -T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(Resp=N) -PU(Resp=N) - -# Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) -Fingerprint AXIS or Meridian Data Network CD-ROM server -Class AXIS | embedded || fileserver -TSeq(Class=C) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=) -T4(DF=N%W=200%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# AXIS NetEye Camera Server V1.20 -# AXIS NPS 53X Printer Server V4.26 Jul 01 1995 -# AXIS StorPoint CD-ROM server V 4.20 -# AXIS Camera 200pV1.41 -Fingerprint AXIS Stack -- CD-ROM server or print server or camera server -Class AXIS | embedded || fileserver -Class AXIS | embedded || print server -Class AXIS | embedded || webcam -TSeq(Class=C|TD%gcd=20000|40000|60000|80000%SI=<5) -T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) -T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# AXIS StorPoint CD E100 CD-ROM Server V5.32 Jan 19 2001 -Fingerprint AXIS StorPoint CD E100 CD-ROM Server -Class AXIS | embedded || fileserver -TSeq(Class=TD%gcd=<80004%SI=<14%IPID=I%TS=U) -T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=) -T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# AXIS StorPoint CD E100 CD-ROM Server V5.20 Oct 27 1999 -Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.20 -Class AXIS | embedded || fileserver -TSeq(Class=C%Val=4B80000%IPID=I%TS=U) -T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=) -T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# AXIS StorPoint CD E100 CD-ROM Server V5.38 Jan 12 2004 -Fingerprint AXIS StorPoint CD E100 CD-ROM Server V5.38 -Class AXIS | embedded || fileserver -TSeq(Class=C%Val=30D40000%IPID=I%TS=U) -T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=5AC%ACK=O%Flags=A%Ops=) -T4(DF=N%W=5AC%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint AXIS 540 Ethernet Print Server ver 5.48 -Class AXIS | embedded || print server -TSeq(Class=TD%gcd=<80004%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint AXIS 540 Print Server -Class AXIS | embedded || print server -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# AXIS 540/542 print server v5.30 Jan 24 1997 -Fingerprint AXIS 540/542 Print Server v5.30 -Class AXIS | embedded || print server -TSeq(Class=C) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0|100%ACK=O|S++%Flags=AR|A%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint AXIS Print Server firmware 7.0.2 -Class AXIS | embedded || print server -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=) -T4(DF=N%W=100%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint AXIS 200+ Web Camera running OS v1.42 -Class AXIS | embedded || webcam -T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) - -Fingerprint AXIS 2120 network camera -Class AXIS | embedded || webcam -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=3FE0%ACK=S++%Flags=ASF%Ops=ME) -T4(DF=N%W=400%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# AXIS 200+ Webcam running software version is 1.42 -Fingerprint AXIS Neteye 200+ Webcam running software version 1.42 -Class AXIS | embedded || webcam -TSeq(Class=TD|C%gcd=<80004%SI=<1E%Val=DFB80000%IPID=RD|I%TS=U) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=200%ACK=O%Flags=A%Ops=) -T4(DF=N%W=200%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint AXIS NetEye Camera Server V1.20 -Class AXIS | embedded || webcam -TSeq(Class=C) -T1(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=100|0%ACK=O|S++%Flags=A|AR%Ops=) -T4(Resp=Y%DF=N%W=100|0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# AXIS 540+/542+ -# AXIS 5400 print server -Fingerprint AXIS Network Print Server -Class AXIS | Linux || print server -T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=100%ACK=O%Flags=A%Ops=) -T4(DF=N%W=100%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# The AXIS 2100 Network Camera Operating System, Linux/CRIS, is based on the Linux 2.0 kernel with non-MMU CPU patches from uClinux. The HTTP server used is based on Boa. The source code for the Linux/CRIS kernel, Boa and more is available at http://developer.axis.com/. -Fingerprint AXIS 2100 Network Camera running Linux/CRIS v2.32 -Class AXIS | Linux || webcam -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=APS%Ops=M) -T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) -T5(DF=N%W=FAF0%ACK=S++%Flags=R%Ops=) -T6(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Barix Exstreamer network MP3 player -Class Barix | embedded || media device -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1FF%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Bay Networks BLN-2 Network Router (latest Bay OS as of Feb16'99) -# Bay Networks ASN Processor revision 9, SE100NM and SFNM modules -Fingerprint Bay Networks BLN-2 Network Router or ASN Processor revision 9 -Class Bay Networks | embedded || router -T1(Resp=Y%DF=N%W=200|400%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(Resp=N) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Bay Networks Instant Internet router -Class Bay Networks | embedded || router -TSeq(Class=TD%gcd=1000|2000|3000%SI=C46) -T1(Resp=N) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S%Flags=R%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Bay Networks BayStack 310T switch -Class Bay Networks | embedded || switch -TSeq(Class=TD%gcd=36524|33E14|320C8|31704%SI=95%IPID=I|RD%TS=U) -T1(Resp=N) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=ARF%Ops=) -T3(Resp=N) -T4(DF=N%W=800|1000%ACK=S%Flags=ARF%Ops=) -T5(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint BBIagent v1.8.1 software router -Class BBIagent | Linux | 2.4.X | software router -TSeq(Class=RI%gcd=<6%SI=<18C54&>3B8%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Running on a BeBox 66Mhz -Fingerprint BeOS 4 - 4.5 -Class Be | BeOS | 4.X | general purpose -TSeq(Class=TD%gcd=1%SI=0) -T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint BeOS 5.0.4 (BeOS 5 Pro + BONE 7a) -Class Be | BeOS | 5.X | general purpose -TSeq(Class=TD%gcd=<6%SI=1F%IPID=I%TS=U) -T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint BeOS 5.1d0/DANO on x86 -Class Be | BeOS | 5.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<11D1DD8&>C92%IPID=I%TS=U) -T1(DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=7F53%ACK=S++|O%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint BeOS R5.03 Personal Edition -Class Be | BeOS | 5.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<8BF4F2&>16635%IPID=I%TS=U) -T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# IPC@CHIP (SC12) -@CHIP-RTOS version SC12 V1.10 Beta Test version MEDIUMBuild: Nov 26 2003 -Fingerprint IPC@CHIP CHIP-RTOS version SC12 -Class Beck-IPC | embedded || specialized -TSeq(Class=TD%gcd=306D3%IPID=Z) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) -T2(Resp=Y%DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Billion BIPAC-741GE V2 ADSL Router/Modem - Firmware 4.55 (HW: Helium 210-80 ADSL GE-A v1.00) -Fingerprint Billion BIPAC-741GE V2 aDSL Router -Class Billion | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=137%IPID=I%TS=U) -T1(DF=Y%W=1194%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=Y%W=1194%ACK=O%Flags=R%Ops=) -T3(Resp=N) -T4(DF=Y%W=1194%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# BIANCA/BRICK-XS version V.6.2 Rev. 5 from 2003/05/26 00:00:00 -Fingerprint BinTEC BIANCA/BRIK-XS Broadband router V. 6.X -Class BinTec | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<54E5C&>C09%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -# BINTEC-X4000 version V.7.1 Rev. 4 (Patch 3) IPSec -# BinTec BingoDSL Router Firmware version 7.1 Rev.1 Patch 11 -Fingerprint BinTec BingoDSL/X4000 Router Firmware V. 7.1 -Class BinTec | embedded || broadband router -TSeq(Class=RI%gcd=<8%SI=<240E&>1A%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -# XS SW Release 4.9.1 ISDN access router -# BinTec BIANCA XM OS version 4.93 -Fingerprint BinTec XS/XM ISDN access router V. 4.9.1-4.9.3 -Class BinTec | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=>FF&780%IPID=I%TS=2HZ) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Blue Coat SG6000 Series - SGOS 3.2.2.1 -Fingerprint Blue Coat ProxySG (SGOS 3.2.2.1) -Class Blue Coat | SGOS || web proxy -TSeq(Class=RI%gcd=<6%SI=<43F10C&>4CBD%TS=2HZ) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Blue Coat SGOS 2.0.09 (Release ID: 20047) -# Blue Coat SGOS 3.0.1.0 (Release ID: 20069) -Fingerprint Blue Coat Secure Gateway -Class Blue Coat | SGOS || web proxy -TSeq(Class=RI%gcd=<6%SI=<15654E&>1CC9%IPID=I%TS=2HZ) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MENWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint BlueCoat SG4 -Class Blue Coat | SGOS || web proxy -T1(DF=N%W=0|FFFF%ACK=S++%Flags=AR|AS%Ops=|MENWNNT) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Borderware 5.0 Firewall -Class Borderware | embedded || firewall -TSeq(Class=TR|RI%gcd=<204%SI=<14) -T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(Resp=N) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Borderware 5.2 firewall -Class Borderware | embedded || firewall -TSeq(Class=TR%gcd=<6) -T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL) -T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(Resp=N) -T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Borderware 6.0.2 firewall -Class Borderware | embedded || firewall -TSeq(Class=RI%gcd=<6%SI=<1016FC&>291C) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(Resp=N) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Bosch Security Systems's Divar Digital Video Recorder Version 2.00 -Class Bosch | embedded || webcam -TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ) -T1(DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint BreezeCOM BreezeACCESS Wireless bridge -Class BreezeCOM | embedded || bridge -TSeq(Class=RI%gcd=<6%SI=<988&>4%IPID=I%TS=U) -T1(DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5DC%ACK=S++%Flags=AS%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# http://www.brixnetworks.com/products/brix1000.html -Fingerprint Brix 1000 Verifier -Class Brix Networks | embedded || specialized -TSeq(Class=TD%gcd=<5C494%SI=<262%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Brother Laser Printer HL 1230 -Fingerprint Brother HL-1230 Printer -Class Brother | embedded || printer -TSeq(Class=TD%gcd=48B5D%IPID=I%TS=U) -T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint BSDI BSD/OS 2.0 - 2.1 -Class BSDI | BSD/OS | 2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=>FFF) -T1(DF=N%W=2017|805C%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2017|805C%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=2000|0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint BSDI BSD/OS 3.0-3.1 (or possibly Mac OS, NetBSD) -Class BSDI | BSD/OS | 3.X | general purpose -TSeq(Class=RI%gcd=<6) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint BSDI BSD/OS 4.0-4.0.1 -Class BSDI | BSD/OS | 4.X | general purpose -TSeq(Class=RI%gcd=16F) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint BSDI BSD/OS 4.0.1 -Class BSDI | BSD/OS | 4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=27A9) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint BSDI BSD/OS 4.2 -Class BSDI | BSD/OS | 4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=1A4F%IPID=I%TS=2HZ) -T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cabletron Smart Switch Router 8600 -Class Cabletron | embedded || router -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cabletron Systems SSR 8000 smart switch router System Software, Version 3.1.B.16 -Class Cabletron | embedded || router -TSeq(Class=RI%gcd=<6%SI=<90C5E&>1715) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Cabletron SmartSwitch, Hardware Revision: 00R, Firmware Revision: 05.00.48, BOOTPROM Revision: 02.02.00 -Fingerprint Cabletron SmartSwitch -Class Cabletron | embedded || switch -TSeq(Class=TD%gcd=<180004%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Cabletron Switch model 6H202-24 Module Hardware Revision: 00A Module Firmware Revision: 05.05.11 Module BootPROM Revision: +03.06.04 -Fingerprint Cabletron switch -Class Cabletron | embedded || switch -TSeq(Class=RI|TD%gcd=<404%SI=<263E%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint CacheFlow 6000 web proxy cache running CacheOS 4.1.05 -Class CacheFlow | CacheOS || web proxy -TSeq(Class=RI%gcd=<6%SI=<7062&>C6%IPID=I%TS=U) -T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) - -# (rel. ID: 17908) -Fingerprint CacheFlow 6000 web proxy running Security Gateway 2.1.0 -Class CacheFlow | CacheOS || web proxy -TSeq(Class=RI%gcd=<6%SI=15C0%IPID=I%TS=2HZ) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MENWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Cacheflow 6x5 web proxy cache running CacheOS 3.1.19-4.1.05 -Class CacheFlow | CacheOS || web proxy -TSeq(Class=RI%gcd=<6%SI=16F5%IPID=I%TS=2HZ) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# CacheFlow CacheOS (CacheFlow 500-5000 web cache) CFOS 2.1.08 - 2.2.1 -Fingerprint CacheFlow CacheOS (web proxy cache) CFOS 2.1.08 - 2.2.1 -Class CacheFlow | CacheOS || web proxy -TSeq(Class=RI%gcd=<5%SI=>BBBB&1C6E5%IPID=RPI%TS=2HZ) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint CacheOS (CacheFlow 2000 proxy cache) -Class CacheFlow | CacheOS || web proxy -TSeq(Class=RI%gcd=<5%SI=>1111) -T1(Resp=Y%DF=N%W=212%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint Canon GP 160 PF printer -Class Canon | embedded || printer -TSeq(Class=TD%gcd=5EC%IPID=I%TS=2HZ) -T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Canon iR6000 printer -Class Canon | embedded || printer -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Canon iR7200 Printer -Class Canon | embedded || printer -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Canon photocopier/fax/scanner/printer GP30F -Class Canon | embedded || printer -TSeq(Class=TD%gcd=600%SI=0) -T1(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C00%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=C00%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Canon inkjet printer iP4000R with Wireless interface -Fingerprint Canon Pixmar IP4000R printer -Class Canon | embedded || printer -TSeq(Class=TD%gcd=<20004%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++|O%Flags=AS|A%Ops=M|) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Capellix 3000 Modular SAN Switch -Class Capellix | embedded || storage-misc -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint CastleNet AR502/GlobespanVirata GS8100 (same thing) DSL router -Class CastleNet | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# http://www.cayman.com/ -Fingerprint Cayman 2E DSL/CABLE router -Class Cayman | embedded || broadband router -TSeq(Class=TR%gcd=<6) -T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cayman 3000 DSL Router -Class Cayman | embedded || broadband router -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=R%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Netopia Cayman 3346 DSL router -Class Cayman | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Chase/Perle IOLAN terminal server -Class Chase | embedded || terminal server -T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S|O%Flags=AR%Ops=) -PU(Resp=N) - -# Chase/Perle IOLAN Terminal Server v3.5.02 CDi -Fingerprint Chase/Perle IOLAN terminal server -Class Chase | embedded || terminal server -TSeq(Class=TD%gcd=<84%SI=<1E) -T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# These boxes give goofy PU RIPTL results (like 3549 and 4801) so I removed -# that test -Fingerprint Chase/Perle IOLAN terminal server -Class Chase | embedded || terminal server -TSeq(Class=TD%gcd=<84%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=|M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=600%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Nokia IPSO 3.2 Running Check Point Firewall-1 -# IPSO 3.5-FCS8 releng 1020 Running Check Point FW-1 NG FP2 -Fingerprint Nokia IPSO 3.2-3.5 Running Check Point Firewall-1 or NG FP2 -Class Check Point | IPSO || firewall -TSeq(Class=RI%gcd=<6%SI=2476) -T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y|N%TOS=E0|0%IPLEN=164|38%RIPTL=134|148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E) - -# Nokia IPSO 3.2-3.2.1 releng 783-849 -# IPSO 3.4-FCS4A releng 767 Running CheckPoint 4.1 SP6 -# Nokia IPSO 3.2-fcs4 releng 783 (FreeBSD Based) -# Nokia IPSO 4.3.1-FCS5 -Fingerprint Nokia IPSO 3.2-4.3.1-FCS5 Running checkpoint FW1 -Class Check Point | IPSO || firewall -TSeq(Class=RI%gcd=<6%SI=<77DC6&>1319) -T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Nokia IPSO 3.6 FCS 6 releng 1061 01.21.2003-230310 i386 w/ CheckPoint FW-1 NG FP 2, SSL & DNS hotfix and SmartDefense Supplemental -Fingerprint Nokia IPSO 3.6 running Check Point FW-1 NG FP2 -Class Check Point | IPSO || firewall -TSeq(Class=RI%gcd=<6%SI=<7A148&>A01%IPID=I%TS=2HZ) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Check Point Firewall-1 NG on Sun Solaris 8 -Class Check Point | Solaris | 8 | firewall -TSeq(Class=RI%gcd=<6%SI=<6C82C&>E51%IPID=I%TS=100HZ) -T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Check Point FireWall-1 4.0 SP-5 (IPSO build) -Class Check Point | Windows | NT/2K/XP | firewall -TSeq(Class=RI%gcd=<6%SI=<18358&>3CB) -T1(DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Check Point Firewall-1 on Windows NT 4.0 Server SP4-SP5 -Class Check Point | Windows | NT/2K/XP | firewall -TSeq(Class=TD%gcd=<8%SI=<154) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Check Point Firewall-1/VPN-1 SecurePlatform NG, running FeaturePack 3 -Fingerprint Check Point SecurePlatform NG FP3 -Class Check Point | Windows | NT/2K/XP | firewall -TSeq(Class=RI%gcd=<6%SI=<1C6F042&>48C8B%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco CacheOS (1.1.0) -Class Cisco | CacheOS || web proxy -TSeq(Class=64K) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Cisco 675 DSL router -- cbos 2.1 -Class Cisco | CBOS || broadband router -T1(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS|ASF|APSF%Ops=M) -T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) -T3(DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) -T4(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(Resp=Y%DF=Y%W=100%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cisco ACNS 5.1 Content Engine -Class Cisco | Content Networking System || web proxy -TSeq(Class=RI%gcd=<6%SI=1EAE1%IPID=I%TS=U) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco Content Engine 505 Software V. 4.2.1 -Class Cisco | Content Networking System || web proxy -TSeq(Class=RI%gcd=<6%SI=<2D75904&>5AE06%IPID=I%TS=U) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0|CC%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# running Application and Content Networking System Software 4.2.3 -# Fingerprint Cisco Content Engine 560 Software V. 4.2.3 -Fingerprint Cisco Content Engine 560 running Content Networking System V. 4.2.3 -Class Cisco | Content Networking System || web proxy -TSeq(Class=RI%gcd=<6%SI=<19440B6&>40ACE%IPID=I%TS=U) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Application and Content Networking System Software Release 5.3.1 (build b5 Mar 17 2005) -Fingerprint Cisco Content Engine ACNSS V5.2.1 or V5.3.1 -Class Cisco | Content Networking System || web proxy -TSeq(Class=RI%gcd=<6%SI=<1A91BDA&>44018%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=ME) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco Accesspoint 1200 -Class Cisco | embedded || bridge -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco AIR-WGB340 V8.38 Workgroup Bridge 340 -Fingerprint Cisco AIR-WGB340 V8.38 Wireless workgroup bridge 340 -Class Cisco | embedded || bridge -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1F4|1000%ACK=S++%Flags=AR|AS%Ops=) -T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco WGB350 Wireless WorkGroup Bridge -Class Cisco | embedded || bridge -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1F4%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=1F4%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=5C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 760 Series ISDN router (non IOS) or IBM Stackable Hub -Class Cisco | embedded || broadband router -Class IBM | embedded || hub -TSeq(Class=TD|i800%gcd=<14004%SI=<14) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=800%ACK=O|S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 761 running c760-in.r.NET3 4.3(1) -Class Cisco | embedded || broadband router -TSeq(Class=TD%gcd=<348004%SI=<14%IPID=I%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 762 Non-IOS Software release 4.1(2) or 766 ISDN router -Class Cisco | embedded || broadband router -TSeq(Class=TD%gcd=A000|3C000|14000|14A000|348000|26C000%SI=29F4D%IPID=I%TS=2HZ) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# 3Com 4924 gigabit switch ver 2.04 -# Cisco VPN 3000 3.5 -Fingerprint Cisco VPN 3000 or 3Com 4924 GigE Switch -Class Cisco | embedded || encryption accelerator -Class 3Com | embedded || switch -TSeq(Class=RI%gcd=<6%SI=<59088&>B4F%IPID=I%TS=2HZ) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco CSS 11501 Content Services Switch -Class Cisco | embedded || load balancer -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco CSS 11501 Content Services Switch -Class Cisco | embedded || load balancer -TSeq(Class=RI%gcd=<6%SI=<159FA&>235%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Cisco Local Director 420 version 2.1.1 -Class Cisco | embedded || load balancer -TSeq(Class=C) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=1000%ACK=S%Flags=RS%Ops=WNMETL) -T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000%ACK=S%Flags=UPRF%Ops=WNMETL) -PU(Resp=N) - -# The "True Random" is bogus, it is because of sequences -# from servers behind the LB like: 4B028A43 E016F844 4B05F5D2 4DB8B4C E402869 -# Cisco Localdirector 430, running OS 2.1 -Fingerprint Cisco LocalDirector load balancer -Class Cisco | embedded || load balancer -TSeq(Class=TR|C) -T1(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|400|1000%ACK=O%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL) -T5(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=C00|400|1000%ACK=O%Flags=R%Ops=WNMETL) -T7(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# LocalDirector 430 Version 4.2.4 -Fingerprint Cisco LocalDirector load balancer -Class Cisco | embedded || load balancer -TSeq(Class=RI%gcd=<6%SI=<2F240C&>789A%IPID=BI%TS=U) -T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=O%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cisco Router C2600 running IOS 12.2(2)T -Class Cisco | embedded || router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|800|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco X.25/TCP/LAT Protocol Translator ver 8.2(4) -Class Cisco | embedded || router -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 1548M 10/100 Managed Switch (Firmware Version: v1.03.02) -Fingerprint Cisco 1548M managed switch -Class Cisco | embedded || switch -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco Catalyst 1900 switch, Bay networks 350-450 switch, or Netopia DSL/ISDN router -Class Cisco | embedded || switch -Class Bay Networks | embedded || switch -Class Netopia | embedded || broadband router -TSeq(Class=TD%gcd=<6000%SI=<1E) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y|N%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco Catalyst 2820 switch Management Console -Class Cisco | embedded || switch -TSeq(Class=TD%gcd=<6%SI=<1B8%IPID=I%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N|Y) - -# Cisco Catalyst 6500: WS-C6509 Software, Version NmpSW: 6.3(5) -# Cisco Catalyst 5500 with OS Version 6.3(5) -# Alcatel OmniSwitch/Router! Version 4.3.1 GA -Fingerprint Cisco Catalyst 5500/6500 or Alcatel OmniSwitch/Router -Class Cisco | embedded || switch -Class Alcatel | embedded || switch -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Cisco 6509 Cisco Internetwork Operating System Software IOS Version 12.1(23)E -Fingerprint Cisco Catalyst 6509 switch running IOS Version 12.1(23)E -Class Cisco | embedded || switch -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL|MENN) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MNW|MW|ML) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cisco Catalyst switch -Class Cisco | embedded || switch -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# LanPlex 2500 (rev 8.6) Version 8.11 or Cisco Catalyst 5505 or -# Trancell WebRamp router or Xylan OmniSwitch 3.2.X.X - 3.4.X.X -# Epson Stylus Color 1520C with 100BTX-NIC from Epson -# Cisco 6509 WS-C6509 Software, Version NmpSW: 5.3(3)CSX -# SonicWALL firewall appliance 10meg firmware 3.3.1 -Fingerprint Router/Switch/Printer/Firewall (LanPlex 2500/Cisco Catalyst 5505/Cisco 6509/Trancell Webramp/Xylan OmniSwitch)/Epson Stylus (100BTX-NIC HP Secure Web Console, SonicWALL firewall appliance 3.3.1) -Class Cisco | embedded || switch -Class Xylan | embedded || switch -Class Epson | embedded || printer -Class SonicWALL | SonicOS || firewall -Class Trancell | embedded || router -TSeq(Class=64K) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Cisco AS5200 terminal server -Class Cisco | embedded || terminal server -TSeq(Class=RI%gcd=<6%SI=>FFF) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# A Cisco ATA 186 is a little box that allows a standard POTS -# telephone to be used as a voice-over-IP phone. There is a -# variation, the ATA 188 that has a pass-through port, much like the -# Cisco 7960 phone. -Fingerprint Cisco ATA 186 POTS<->VoIP phone gateway device -Class Cisco | embedded || VoIP adapter -TSeq(Class=TD%gcd=VoIP phone gateway device -Class Cisco | embedded || VoIP adapter -T1(Resp=N) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 7960 SIP Phone running OS 4.2 -Class Cisco | embedded || VoIP phone -TSeq(Class=TD%gcd=<2A004%SI=<28%IPID=I%TS=U) -T1(DF=N%W=3E8%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cisco IP phone (POS3-04-3-00, PC030301) -Class Cisco | embedded || VoIP phone -TSeq(Class=TD%gcd=FF&666) -T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 7206 running IOS 11.1(24) -Class Cisco | IOS | 11.X | router -TSeq(Class=RI%gcd=<5%SI=CC) -T1(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco IOS 11.3 - 12.0(11) -Class Cisco | IOS | 11.X | router -Class Cisco | IOS | 12.X | router -TSeq(Class=TD|RI%gcd=<6) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco IOS v11.14(CA)/12.0.2aT1/v12.0.3T -Class Cisco | IOS | 11.X | router -TSeq(Class=RI%gcd=<4%SI=<999&>CC) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# 25XX/45XX router, 29XX switch, RSP2 processor -Fingerprint Cisco Router/Switch with IOS 11.2 -Class Cisco | IOS | 11.X | router -Class Cisco | IOS | 11.X | switch -TSeq(Class=RI%gcd=<6%SI=<18000) -T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O|S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 3640 router IOS 11.1(7)AX [KUONG(7)AX] -# Cisco Catalyst 2900 Series switch with IOS Version 11.2(8.10)SA6 -Fingerprint Cisco switch/router with IOS 11.1(7)-11.2(8.10) -Class Cisco | IOS | 11.X | router -Class Cisco | IOS | 11.X | switch -TSeq(Class=RI%gcd=<6%SI=>BBB&BBB) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 827 ADSL router running IOS 112.2(11) -Class Cisco | IOS | 12.X | broadband router -TSeq(Class=RI%gcd=<6%SI=<1B1F2&>24E%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Cisco 827 ADSL router running IOS 12.1(1)XB1 -Class Cisco | IOS | 12.X | broadband router -TSeq(Class=RI%gcd=<6%SI=<9B28&>3E%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cisco 1601 router running IOS 12.0(8) -Class Cisco | IOS | 12.X | router -TSeq(Class=RI%gcd=<6%SI=8A%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 1601R router running IOS 12.1(5) -Class Cisco | IOS | 12.X | router -TSeq(Class=TD%gcd=<6%SI=<32%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 1721 Router running IOS 12.3(10) -Fingerprint Cisco 1721 router running IOS 12.3(10) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=O|S++%Flags=A|AS%Ops=|ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cisco 2514 router running IOS 12.0(21) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# CISCO 2600 router running IOS 12.2(3) -Fingerprint Cisco 2600 router running IOS 12.2(3) -Class Cisco | IOS | 12.X | router -TSeq(Class=TD|RI%gcd=<8%SI=249%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# CISCO 2610 router running IOS 12.2(21a) -Fingerprint Cisco 2610 router running IOS 12.2(21a) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Cisco 2611 router running IOS 12.0(7)T -Fingerprint Cisco 2611 router running IOS 12.0(7)T -Class Cisco | IOS | 12.X | router -TSeq(Class=RI%gcd=<6%SI=49%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00|1000|800%ACK=S%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -# Cisco 2611 router running IOS 12.2(7a) -Fingerprint Cisco 2611 router running IOS 12.2(7a) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# IOS (tm) 1600 Software (C1600-K8OSY-M), Version 12.2(15)T9 -# Cisco 2620 Router /w IOS 12.2(15)T14 -Fingerprint Cisco 2620 router running IOS 12.2(15) -Class Cisco | IOS | 12.X | router -TSeq(Class=RI%gcd=<6%SI=<1938568&>4088D%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 2620 router running IK903S3-M ios ver 12.3(5) -Fingerprint Cisco 2620 router running IOS 12.3(5) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 2620 running IOS 12.2(19a) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 3660, IOS 12.0(6r)T -Fingerprint Cisco 3660 running IOS 12.0(6r)T -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# cisco 3725 IOS (tm) 3700 Software (C3725-IS-M), Version 12.3(6c), RELEASE SOFTWARE (fc1) -Fingerprint Cisco 3725 router running IOS 12.3(6c) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=109%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 3745 Router running IOS version 12.2(15)T13 -Fingerprint Cisco 3745 Router running IOS 12.2(15)T13 -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Cisco 4000 series, IOS 4500 Software (C4500-P-m), Version 12.0(10.3)S -Fingerprint Cisco 4000 Series running IOS 12.0(10.3) -Class Cisco | IOS | 12.X | router -TSeq(Class=RI|TD%gcd=<6%SI=3219%IPID=Z%TS=U) -T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MM) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Cisco 837 router running IOS 12.3(11)T -# Cisco 2811 router running IOS 12.3(8r)T7 -Fingerprint Cisco 837 router running IOS 12.3(11)T or Cisco 2811 router running IOS 12.3(8r)T7 -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R|BR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 837 Router IOS version 12.3T(8) -Fingerprint Cisco 837 router running IOS 12.3(8)T -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco AS5350, IOS 12.2(2)XB6 -Fingerprint Cisco AS5350 running IOS 12.2(2)XB6 -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) -T1(DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MEML|MEMWL) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1020%ACK=S++%Flags=AS%Ops=MML|MMWL) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cisco IOS 12.0(3.3)S (perhaps a 7200 router) -Class Cisco | IOS | 12.X | router -TSeq(Class=RI%gcd=<6%SI=>FF&D%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco IOS 12.1(4) on a 2600 router -Class Cisco | IOS | 12.X | router -TSeq(Class=RI%gcd=3A%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Cisco 7507 running 12.2(8)T5 -Fingerprint Cisco IOS 12.2(8)T5 on a 7507 router -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Cisco 1720 router running 12.2.8T4 with IP/FW/PLUS/3DES feature set -# Cisco 801 router running IOS 12.2(8)T1 (image: c800-k8nosy6-mw.122-8.T1) -# Cisco Aironet 1100/1200/1400 access point running IOS 12.2.15 -Fingerprint Cisco router or WAP running IOS 12.2 -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 12008 running IOS 12.0(18.6)S1 -# Cisco 7206VXR running IOS 12.0(18)S -Fingerprint Cisco router running IOS 12.0(18)S or 12.0(18)S1 -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=10C0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=10C0%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Cisco 800 running 12.1(5) -# Cisco 2620 router running IOS 12.1(6) -Fingerprint Cisco router running IOS 12.1 -Class Cisco | IOS | 12.X | router -TSeq(Class=RI%gcd=<6%SI=78%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Cisco 3620 running IOS 12.2.1 -# IOS (tm) C2600 Software (C2600-I-M), Version 12.2(1) -Fingerprint Cisco router running IOS 12.1(5)-12.2(7a) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Cisco 2620, IOS 12.2(6r) -# Found on Cisco 1720/1750/2611/3640/AS5300 routers -Fingerprint Cisco router running IOS 12.1.5-12.2.13a -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N|Y%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=20|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco WS-C4006 -# Cisco 7120-4T1 ISO 12.2 -# CISCO 2950C -# Cisco 3600 -Fingerprint Cisco router running IOS 12.2 -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 2621 running IOS 12.2.8T -# Cisco SOHO 77 running IOS 12.2(8)T -Fingerprint Cisco router running IOS 12.2(8)T -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Cisco IOS Software, C1700 Software (C1700-ADVSECURITYK9-M), Version 12.3(11)T3, RELEASE SOFTWARE (fc4) -Fingerprint Cisco router running IOS 12.3(11) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Cisco Router (1760) - IOS (tm) C1700 Software, Version 12.3(6) -# IOS (tm) 3700 Software (C3745-IS-M), Version 12.3(6), RELEASE SOFTWARE (fc3) -# Cisco 837 router running IOS 12.3.8T3 -# CISCO C827 (MPC855T) processor (revision 0x501) with 23552K/1024K bytes of memory. -# Cisco 2611XM router running IOS 12.3(10) -# Cisco 2921XM router running IOS 12.3(6a) -# Cisco 7206VXR running IOS 12.3(6b) -# Cisco 831 running IOS Version 12.3(8)T3 -# Cisco 3825 Router, IOS 12.3(11)T3 (C3825-ADVSECURITYK9-M, Version 12.3(11)T3, RELEASE SOFTWARE+(fc4)) -Fingerprint Cisco router running IOS 12.3(6) - 12.3(11) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR|BAR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R|BR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0|C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco 5200 router IOS v12.0(15) -# Cisco 2924C -Fingerprint Cisco router running IOS v12.0(15) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# IOS (tm) SOHO91 Software (SOHO91-K9OY6-M), Version 12.3(2)XC, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) (Cisco SOHO 91 Secure router) -Fingerprint Cisco SOHO 91 secure router running IOS 12.3 -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=F53C%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco Lightstream 1010 ATM Switch running IOS (tm) LS1010 WA4-5 Software (LS1010-WP-M), Version 12.1(23)E, RELEASE SOFTWARE (fc2) -# Cisco 6500 switch running IOS 12.1(23)E -Fingerprint Cisco switch running IOS 12.1(23)E -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MEL) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ML) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# router Cisco 3640, IOS 12.2(23a) -Fingerprint router Cisco 3640 running IOS 12.2(23a) -Class Cisco | IOS | 12.X | router -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco catalyst 2924 running IOS 12.0(5)WC5 -Class Cisco | IOS | 12.X | switch -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -# Cisco Catalyst 2924XL-EN running IOS 12.0(5)WC8 -Fingerprint Cisco Catalyst 2924XL switch running IOS 12.0(5) -Class Cisco | IOS | 12.X | switch -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MM) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco Catalyst 2950 switch running IOS 12.0(5.3)WC(1) -Class Cisco | IOS | 12.X | switch -TSeq(Class=TR%gcd=<6%IPID=C%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Cisco Catalyst 2950 switch, IOS 12.1(9)EA1 -Fingerprint Cisco Catalyst 2950 switch running IOS 12.1(9)EA1 or IOS 12.1(22)EA2 -Class Cisco | IOS | 12.X | switch -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MEM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y|N%W=1020%ACK=S++%Flags=AS%Ops=MM) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco IOS 12.0(5)WC5a on a catalyst 2900XL switch -Class Cisco | IOS | 12.X | switch -TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=MML) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 1200 access point (WAP) running IOS 12.2(8) -Class Cisco | IOS | 12.X | WAP -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cisco AP1220 IOS 12.2(11)JA1 -Fingerprint Cisco AP1220 WAP running IOS 12.2(11) -Class Cisco | IOS | 12.X | WAP -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco CPA2500 (68030) or 2511 router -Class Cisco | IOS || router -TSeq(Class=RI%gcd=<6%SI=>FFF) -T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=O|S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cisco uBR 7223 router -Class Cisco | IOS || router -TSeq(Class=TR%gcd=<6%IPID=C%TS=U) -T1(DF=N%W=1020%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1020%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cisco Catalyst 4006 Switch running NmpSW 7.4(2) -Class Cisco | NmpSW || switch -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Cisco PIX 4.2(2) Internal Interface -Class Cisco | PIX | 4.X | firewall -TSeq(Class=C) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRSF%Ops=WNMETL) -T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) -T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco PIX 515 firewall running software 4.4(5) -Class Cisco | PIX | 4.X | firewall -TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) -T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco PIX Firewall running PIX 4.1(5) -Class Cisco | PIX | 4.X | firewall -TSeq(Class=C%Val=211E005F) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T5(Resp=Y%DF=N%W=800%ACK=S%Flags=RS%Ops=WNMETL) -T6(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T7(Resp=Y%DF=N%W=800%ACK=S%Flags=UPRF%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco Pix Firewall running PIX 4.1.6 -Class Cisco | PIX | 4.X | firewall -TSeq(Class=C%Val=71F60191%IPID=BI%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=800|1000%ACK=S%Flags=RS%Ops=WNMETL) -T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00|400%ACK=S%Flags=UPRF%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco PIX v4.2 Firewall -Class Cisco | PIX | 4.X | firewall -TSeq(Class=RI%gcd=<8%SI=<1E1D60&>4D03) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=C00|400|800%ACK=S%Flags=RS%Ops=WNMETL) -T6(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00|400|800%ACK=S%Flags=UPRF%Ops=WNMETL) -PU(Resp=N) - -# Cisco PIX running IOS 6.1(1) - Internal interface -# Cisco PIX 520 firewall running PixOS 6.1(3) -# Secure PIX Firewall Version 5.2(2) -Fingerprint Cisco PIX Firewall (PixOS 5.2 - 6.1) -Class Cisco | PIX | 5.X | firewall -Class Cisco | PIX | 6.X | firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR|AS%Ops=WNMETL|M) -T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco Secure PIX Firewall Version 5.0(2) -Class Cisco | PIX | 5.X | firewall -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) -T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -# Cisco 535 IOS 6.2 PIX running in failover mode... ie.. idle -# PIX 506 running PIX IOS 6.2 -Fingerprint Cisco Firewall (PIX 6.1.4 - 6.2.2) -Class Cisco | PIX | 6.X | firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco PIX 501 firewall running PIX 6.1(1) -Class Cisco | PIX | 6.X | firewall -TSeq(Class=TR%IPID=I%TS=U) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) -T4(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) -T6(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco PIX 515 or 525 Firewall running 6.1(4) - 6.2(1) -Class Cisco | PIX | 6.X | firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|C00%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -# Cisco PIX 501 Firewall running IOS 6.3(1) -# Cisco PIX Firewall IOS version 6.22 -# Cisco PIX 515 version 6.3(1) -# Cisco PIX 501 Firewall running PIXOS 6.3.3 -Fingerprint Cisco PIX Firewall running PIX 6.2 - 6.3.3 -Class Cisco | PIX | 6.X | firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=N%W=400||800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco PIX Firewall Version 6.1(2) -Class Cisco | PIX | 6.X | firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco PIX Firewall Version 6.2(1) -Class Cisco | PIX | 6.X | firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(Resp=N) -T6(Resp=N) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Cisco PIX Firewall Version 6.2(2) - 6.3 -Class Cisco | PIX | 6.X | firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Cisco PIX 506 Firewall -Class Cisco | PIX || firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -# Sun Remote System Console version 1.12 -# Brocade Fibre Switch, Firmware 2.6.0 -# Cisco Aironet 340 WAP running v 12.03T of the firmware (and VxWorks OS) -Fingerprint Cisco Aironet WAP, Brocade Fibre Switch, or Sun Remote System Console -Class Cisco | VxWorks || WAP -Class Brocade | embedded || switch -Class Sun | embedded || remote management -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Clipcomm CP-100 v1.1.39 (040820) -Fingerprint Clipcomm CP-100 VoIP phone -Class Clipcomm | embedded || VoIP phone -TSeq(Class=TD%gcd=<9B4%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM) -T2(Resp=N) -T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=MNNM) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cnet CNIG904B Internet Broadband Gateway firmware version 1.11 -Class Cnet | embedded || broadband router -TSeq(Class=TD%gcd=DAF%IPID=I%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# OSF1 V4.0 1530 alpha -# Tru64 4.0F (Alpha), Patch Kit 8, Kernel Build 1229 -Fingerprint Tru64 UNIX 4.0f - 4.0g -Class Compaq | Tru64 UNIX | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Compaq Tru64 UNIX 5.0 on AlphaServer -# DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A on a DEC 4000 Model 610 running OpenVMS V7.2 -Fingerprint Compaq Tru64 UNIX 5.0 or DEC OpenVMS 7.2 -Class Compaq | Tru64 UNIX | 5.X | general purpose -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=RI%gcd=<10%SI=<1C90D0&>490C) -T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732) -Class Compaq | Tru64 UNIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Compaq Tru64 UNIX V5.1 (Rev. 732) -Class Compaq | Tru64 UNIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885) -Class Compaq | Tru64 UNIX | 5.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<72826&>D2D%IPID=I%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Compaq Tru64 UNIX V5.1A (Rev. 1885) -Class Compaq | Tru64 UNIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Compaq Tru64 UNIX V5.1B (Rev. 2650) -Fingerprint Compaq Tru64 UNIX V5.1B -Class Compaq | Tru64 UNIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP Tru64 UNIX v5.1B: OSF1 V5.1 2650 alpha -Fingerprint HP Tru64 UNIX v5.1B -Class Compaq | Tru64 UNIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint OSF1 5.0 Rev. 910 (AKA Compaq/DIGITAL Tru64 UNIX) -Class Compaq | Tru64 UNIX | 5.X | general purpose -TSeq(Class=RI%gcd=<6%SI=11) -T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=805C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Compaq T1010 Thin Client Windows CE 2.12 -Class Compaq | Windows | PocketPC/CE | terminal -TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI%TS=U) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Compatible Systems ISDN/leased-line/dialup Microrouter 2220R w/ firmware v4.5 -Class Compatible Systems | embedded || broadband router -TSeq(Class=TD%gcd=388|710|A98%SI=<14) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint Compatible Systems ISDN/leased-line/dialup MicroRouter 900i v3.0.9 -Class Compatible Systems | embedded || broadband router -TSeq(Class=TD%gcd=388|710|A98%SI=45EAE%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B) with Conexant-Hasbani CX82xxx_4.1.0.9 firmware running on VxWorks 5.4.2 OS -Fingerprint Sphairon Turbolink ADSL Modem/Router (AR800C2-B01B) -Class Conexant | embedded || broadband router -TSeq(Class=64K%IPID=I%TS=2HZ) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Contiki 1.2-devel0 on Ethernut (Atmel AVR ATmega128 with RTL8019as Ethernet chip) -# uIP 0.9 running on a Atmel ATmega16 using a Packet Whacker for ethernet connectivity -Fingerprint Contiki 1.2-devel0 embedded OS on Ethernut card or uIP 0.9 TCP/IP stack -Class Contiki | Contiki || specialized -Class uIP | uIP || specialized -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Convex OS Release 10.1 -Class Convex | ConvexOS || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=7C00%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7C00%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=7C00%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Convex SPP-UX 5.2.1 -Class Convex | SPP-UX || general purpose -TSeq(Class=64K) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) -T2(Resp=N) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=<1001%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=<1001%ACK=S%Flags=R%Ops=) -T7(DF=N%W=<1001%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint SPP-UX 5.x on a Convex SPP-1600 -Class Convex | SPP-UX || general purpose -TSeq(Class=C) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) -T2(Resp=N) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=WN) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00%ACK=S%Flags=R%Ops=) -T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP j4813A ProCurve Switch 2524 -# Copper Mountain Networks DSL Concentrator -# Compaq Remote Insight Lights-Out remote console card -# 3Com Home Wireless Gateway 3CRWE50194-E1, firmware 1.14 -# TrueTime NTS-200 GPS Network Time Server -# Compaq Lights Out Edition firmware v2.41 -# 3Com NBX 25 (Phone System) Version: R1_0_3 -Fingerprint Embedded device: HP Switch, Copper Mountain DSL Concentrator, Compaq Remote Insight Lights-Out remote console card, 3Com NBX 25 phone system or Home Wireless Gateway, or TrueTime NTP clock -Class Copper Mountain | embedded || terminal server -Class 3Com | embedded || WAP -Class 3Com | embedded || telecom-misc -Class TrueTime | embedded || specialized -Class Compaq | embedded || remote management -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Corega BAR SW-4P [Part number:CG-BARSW4P] -Fingerprint Corega BAR SW-4P Broadband Access Router -Class Corega | embedded || broadband router -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint UNICOS 10.0.0 on Cray 90 -Class Cray | UNICOS | 10.X | general purpose -TSeq(Class=RI%gcd=2222) -T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MWNTL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=20%ACK=O%Flags=A%Ops=NNT) -T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Cray UNICOS/mk 8.6 -Class Cray | UNICOS | 8.X | general purpose -TSeq(Class=TR|RI%gcd=<6%SI=<390630E&>91FA1) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cray UNICOS 9.0 - 10.0 or UNICOS/mk 1.5.1 -Class Cray | UNICOS || general purpose -TSeq(Class=RI%gcd=<6) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MWNTL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=100%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Cray UNICOS 9.0.1ai - 10.0.0.2 -Class Cray | UNICOS || general purpose -TSeq(Class=RI%gcd=<6%SI=>F) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=WNTL) -T2(Resp=N) -T3(Resp=Y%DF=N%W=20%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Unisys LX/NX MCP 46.1/HMP 5.0 on an Unisys LX5120 -Fingerprint Cray Unisys LX/NX MCP 46.1/HMP 5.0 on LX5120 -Class Cray | Unisys || general purpose -TSeq(Class=RI%gcd=<6%SI=<7868FCE&>CF0B8%IPID=I%TS=U) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cyberguard 4.0 firewall -Class Cyberguard | embedded || firewall -TSeq(Class=RI%gcd=<6%SI=>FFFF) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# Cyberguard Firewall 5.2 on Firestar 500 (proprietary Unixware version) -Fingerprint Cyberguard Firewall 5.2 -Class Cyberguard | embedded || firewall -TSeq(Class=RI%gcd=<6%SI=<5FE3BC&>A86A%IPID=RD%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O|S++%Flags=R|AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Cyclades PathRouter -Class Cyclades | Cyras || router -TSeq(Class=TD|RI%gcd=<618708%SI=BBBBB) -T1(DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=6C2%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cyclades PathRouter V 1.2.4 -Class Cyclades | Cyros || router -TSeq(Class=RI%gcd=<6%SI=>BBBBB) -T1(DF=N%W=96%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=96%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Cyclades PathRAS Remote Access Server v1.1.8 - 1.3.12 -Class Cyclades | Cyros || terminal server -TSeq(Class=TD%gcd=30C382%SI=16%IPID=BI%TS=U) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# D-Link DI-604 Ethernet Broadband Router with firmware V3.01 -# D-link 4 port Ethernet Broadband Router DI-604 H/W Ver.:D1 F/W Ver.:3.01 -Fingerprint D-Link DI-604 Ethernet Broadband Router -Class D-Link | embedded || broadband router -TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint D-Link DI-604 Ethernet router -Class D-Link | embedded || broadband router -TSeq(Class=TD%gcd=<2C0%SI=<14%IPID=BI%TS=U) -T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint D-Link DI-701, Version 2.22 -Class D-Link | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<12E1C&>2F1) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(Resp=N) -T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint D-Link DI-704 cable/DSL residential gateway, firmware 2.50 build 9 -Class D-Link | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<3A2%IPID=I%TS=U) -T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# D-Link DI-704P Cable/DSL Residential Gateway firmware version 2.57 build 3 -Fingerprint D-Link DI-704P Cable/DSL Residential Gateway -Class D-Link | embedded || broadband router -TSeq(Class=RI%gcd=<68%SI=<1338&>13%IPID=I%TS=U) -T1(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# D-Link DI-804 Cable/DSL Residential Gateway (with firmware v2.00B7) -# DI-804 Broadband Router with Firmware 2.01 -Fingerprint D-Link DI-804 Cable/DSL Residential Gateway -Class D-Link | embedded || broadband router -TSeq(Class=TD|TR%gcd=<10%SI=<3C%IPID=I%TS=U) -T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# D-Link DI-804HV 4-Port Broadband VPN Router -# US-Robotics Wireless Router : Revision Number : Model#8022, Version V4.2, CheckSum# B719 -Fingerprint D-Link DI-804HV VPN Router or US-Robotics 8022 WAP or DI-714P+ Wireless router -Class D-Link | embedded || broadband router -Class US Robotics | embedded || WAP -TSeq(Class=TD%gcd=<3EC%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# D-Link DSL-300G+ version 7.1.0.30 AnnexA (Oct 18 2002) R2.05.b4t9uk -Fingerprint D-Link DSL-300G+ DSL modem -Class D-Link | embedded || broadband router -TSeq(Class=TD%gcd=<1731C%SI=<14%IPID=I%TS=U) -T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint D-Link DSL-500 DSL modem -Class D-Link | embedded || broadband router -TSeq(Class=TD%gcd=<1FBD4%SI=<14%IPID=I%TS=U) -T1(DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=5DC%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint D-Link DSL-500 DSL modem -Class D-Link | embedded || broadband router -TSeq(Class=TD%gcd=2%IPID=BI%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=400|1000|C00%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# D-Link DI-714P+, Firmware V1.33 -# D-Link 4-port Broadband VPN Router DI-804HV -Fingerprint D-Link VPN Router DI-714P+/DI-804HV -Class D-Link | embedded || broadband router -TSeq(Class=TD%gcd=<3EC%SI=<6E%IPID=I%TS=U) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# DI-701 Residential Gateway ( http://www.dlink.com/products/broadband/di701/ ) or KA9Q NOS - KO4KS-TNOS v. 2.30 -Fingerprint DI-701 Residential Gateway or KA9Q NOS - KO4KS-TNOS v. 2.30 -Class D-Link | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<17DC20&>3D00) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(Resp=N) -T5(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -# D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Compiled -# Date: Oct 14 1997, Time: 09:35:04 (claims software version 2.04B3, -# boot PROM version 2.21) -Fingerprint D-Link Corp. DE-1800 Stackable Hub SNMP/Telnet Agent Software version 2.04B3 boot PROM 2.21 -Class D-Link | embedded || hub -TSeq(Class=TD%gcd=1388%SI=0) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# D-Link Print Server Model DP-101P+ -Fingerprint D-Link Print Server -Class D-Link | embedded || print server -TSeq(Class=TD%gcd=<374%SI=<1E) -T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=ASF%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint D-Link VoIP Gateway GS-104SH -Class D-Link | embedded || telecom-misc -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) -T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) -PU(Resp=N) - -# D-Link DI-604 Ethernet router using firmware 1.62 build 2 -# DI-707P router -# Sitecom - Broadband Home Station - Firmware R1.96c -# SMC Barricade Broadband Router with firmware R1.96h2 - internal interface -Fingerprint Broadband router or WAP: D-Link DI-series, Sitecom BHS WAP, or SMC Barricade -Class D-Link | embedded || WAP -TSeq(Class=TD%gcd=281) -T1(DF=N%W=2229%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2225%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Data General DG/UX Release R4.20MU06 -Class Data General | DG/UX || general purpose -TSeq(Class=RI%gcd=<6%SI=779%IPID=I%TS=U) -T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFAB%ACK=O%Flags=A%Ops=) -T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint 4.3BSD-tahoe on a MicroVax III -Class DEC | BSD-misc || general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000|218%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=1C|0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint DEC OSF/1 V1.3A - 2.0 -Class DEC | Digital UNIX | 1.X | general purpose -Class DEC | Digital UNIX | 2.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Digital UNIX OSF1 V 3.0,3.2,3.2C -Class DEC | Digital UNIX | 3.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=8000|805C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=8000|805C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint DEC Digital UNIX OSF1 V 4.0-4.0F -Class DEC | Digital UNIX | 4.X | general purpose -TSeq(Class=C|RI%gcd=<6) -T1(DF=Y%W=805C|8000|70D5%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=8000|70D5|805C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000|7000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) - -Fingerprint Digital UNIX OSF1 V 4.0,4.0B,4.0D,4.0E,4.0F -Class DEC | Digital UNIX | 4.X | general purpose -TSeq(Class=RI|TD|64K%gcd=<6) # Boy, OSF1 comes in all colors! -T1(DF=Y%W=805C|8000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=805C|8000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint DEC OSF1 (AKA Compaq/DIGITAL Tru64 UNIX) Version 5.0.0 -Class DEC | Digital UNIX | 5.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<186794&>13E0%TS=U) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint OSF/1 (AKA Compaq/DIGITAL Tru64 UNIX) 5.60 -Class DEC | Digital UNIX | 5.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint DECNIS 600 V4.1.3B multiprotocol bridge/router -Class DEC | embedded || router -TSeq(Class=TD%gcd=30D4|C35%SI=1009%IPID=I%TS=U) -T1(DF=N%W=7E4A%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7E4A%ACK=O%Flags=A%Ops=) -T4(DF=N%W=7E00%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS 7.1 Alpha running DIGITAL's UCX v4.1ECO2 TCP/IP package -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=BB8%ACK=S++%Flags=AS%Ops=MWN) -T2(Resp=N) -T3(Resp=Y%DF=N%W=BB8%ACK=O%Flags=A%Ops=) -T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS 7.1 using Process Software's TCPWare 5.3 TCP/IP package -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=RI|TD%gcd=<6%SI=543%IPID=I%TS=U) -T1(DF=N%W=C3A5%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C3A5%ACK=O%Flags=A%Ops=) -T4(DF=N%W=C350%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS 7.2 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=RI%gcd=<44%SI=<2670&>3B%IPID=I%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Digital OpenVMS Alpha 7.2 -Fingerprint DEC OpenVMS 7.2 Alpha -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=BB8%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# The OS was running on a GS1280 Alpha server -Fingerprint DEC OpenVMS 7.3 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=TR%gcd=<6%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# OpenVMS 7.3 with TCP/IP 5.3 -Fingerprint DEC OpenVMS 7.3 (Alpha) TCP/IP 5.3 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=TR%gcd=<6%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS 7.3 (Compaq TCP/IP 5.3) -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS 7.3-1 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<56E82&>B37%IPID=I%TS=U) -T1(DF=N%W=C6C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS Alpha 7.2-3 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=C6C%ACK=S++|O%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C6C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS Alpha V7.1-1H2 running DIGITAL TCP/IP Services (UCX) V4.2 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=MWN) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS V7.1 on VAX 6000-530 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=64K%gcd=<6%SI=<14) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS v7.1 VAX running Process Software's TCPWare 5.1-5 TCP/IP package -Class DEC | OpenVMS | 7.X | general purpose -T1(DF=Y%W=6000%ACK=S++%Flags=AS%Ops=MWL) -T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) -T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# DEC VAXVMS TCPIP V5.1-15 Full LP Installed -Fingerprint DEC OpenVMS v7.3 on VAXStation 4000/60 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=RI%gcd=<104%SI=<404C&>14%IPID=I%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS VAX V7.3, Process Software MultiNet V5.0 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint DEC OpenVMS/Alpha 7.1 using Process Software's TCPWare V5.3-4 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=RI%gcd=<16%SI=<867D6&>3%IPID=BI|RD%TS=U) -T1(DF=Y%W=6000|1000%ACK=S++%Flags=AS%Ops=MWL) -T2(Resp=Y%DF=N%W=6000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=6000|1000%ACK=O%Flags=AS%Ops=MWL) -T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=6000%ACK=O%Flags=R%Ops=) -T7(DF=N%W=6000%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint DEC VMS MultiNet V4.2(16)/ OpenVMS V7.1-2 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint DEC VMS MultiNet V4.4 / OpenVMS V7.1 -Class DEC | OpenVMS | 7.X | general purpose -TSeq(Class=TR%gcd=<6%TS=2HZ) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1800%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=1800%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint DEC TOPS-20 Monitor 7(102540)-1,TD-1 -Class DEC | TOPS-20 || general purpose -TSeq(Class=TD%gcd=30000|60000|90000%SI=BBBBB) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=64%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=64%ACK=O%Flags=AR%Ops=) -T5(DF=N%W=64%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=64%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=64%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint DEC VMS MultiNet V4.1(16) -Class DEC | VMS || general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=2200%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=2200%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=A0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# dell 5100 printer -# Dell 3100cn printer, OEM of Xerox DocuPrint C525A -Fingerprint Dell 3100cn/5100cn printer -Class Dell | embedded || printer -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3000%ACK=S++|O%Flags=AR|A%Ops=) -T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=4E4%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# Dell Remote Access Card III/XT -# Dell Remote Access Card 4/I (DRAC4) -# Drac III/XT Administation Card for Dell PowerEdge -# Dell Remote Access Controller 4/I (DRAC 4/I) Version 1.20 (Build 03.15) -Fingerprint Dell Remote Access Controller III/XT or 4/I -Class Dell | embedded || remote management -TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Dell Powervault 132T Automated Tape Library -Class Dell | embedded || storage-misc -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Dell PowerVault 132T Library (Firmware 103D.GY001) -Fingerprint Dell Powervault 132T Automated Tape Library -Class Dell | embedded || storage-misc -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=578%ACK=O%Flags=A%Ops=) -T4(DF=N%W=578%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Dell Tape Library MSL6030 -Class Dell | embedded || storage-misc -TSeq(Class=TD%gcd=<2004%SI=<1D6%IPID=I%TS=1000HZ) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Dell PowerConnect 3324 Switch -# Dell PowerConnect 3348 Switch, Software Version 1.2.0.6 Boot Version 1.0.0.13 -# Dell 3324 PowerConnect Switch with firmware version 1.1.0.42 -Fingerprint Dell PowerConnect Switch 3324 or 3348 -Class Dell | embedded || switch -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=200|800%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=200|800%ACK=S++%Flags=AS%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Dell PowerConnect 5324 24 Port Gigabit Switch -Fingerprint Dell PowerConnect Switch 5324 -Class Dell | embedded || switch -TSeq(Class=TD%gcd=<2C%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Dell PowerConnect Switch running SW V.1.0.0.52 -Fingerprint Dell PowerConnect Switch running SW V.1.0.0.52 -Class Dell | embedded || switch -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=100%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=100%ACK=S++%Flags=AS%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Digital Link DL2001 CSU/DSU Management Access Processor -Class Digital Link | embedded || CSUDSU -TSeq(Class=TD%gcd=<2780%SI=<14) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Digital Networks VNswitch 900 -Class Digital Networks | embedded || switch -TSeq(Class=TD%gcd=<4%SI=<4) -T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MEL) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Digitel NetRouter NR3000 -Class Digitel | embedded || router -TSeq(Class=RI%gcd=<2004%SI=<10CC&>16) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Digitel NetRouter NR3100 -Class Digitel | embedded || router -TSeq(Class=TD%gcd=<2004%SI=<78%IPID=I%TS=U) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Draytek Vigor 2000 ISDN router -Class Draytek | embedded || broadband router -T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Draytek Vigor 2200e DSL router v2.1a -Class Draytek | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=834%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=834%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Draytek Vigor 2200e DSL router v2.1b -Class Draytek | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<2D38FC2&>72E8A%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Software version VIK-1.35.020320j -- www.easytel.fi -Fingerprint Easytel TeleWell EA-701B ADSL Modem/Router -Class Easytel | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Edimax BR-6004 Broadband router -Class Edimax | embedded || broadband router -TSeq(Class=i800%IPID=I%TS=2HZ) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) - -Fingerprint Edimax PS-1001 Print Server model -Class Edimax | embedded || print server -TSeq(Class=TD%gcd=<1C004%SI=<244%IPID=I%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=N%W=0%ACK=O%Flags=R%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(Resp=N) - -Fingerprint Edimax PS-901 Print Server model 1P/13E-9.5.12 -Class Edimax | embedded || print server -TSeq(Class=RI%gcd=<2004%SI=<12D4&>1C%IPID=I%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=N%W=0%ACK=O%Flags=R%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(Resp=N) - -Fingerprint Efficient Networks/SpeedStream DSL router -Class Efficient Networks | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Eicon Diva1830 ISDN router running 1.5 firmware -Class Eicon | embedded || broadband router -TSeq(Class=TD%gcd=<20004%SI=<14%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M) -T2(Resp=Y%DF=N%W=1%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=ASF%Ops=M) -T4(DF=N%W=1%ACK=O%Flags=R%Ops=) -T5(DF=N%W=1%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1%ACK=O%Flags=R%Ops=) -T7(DF=N%W=1%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# ELSA LANCOM 1100 Office, Firmware 2.50.0005 / 15.11.2001 -Fingerprint ELSA LANCOM 1100 office router -Class Elsa | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint ELSA LANCOM DSL I-10 Office router -Class Elsa | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=WNMETL) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# ELSA LANCOM Wireless L-11 3.42.0021 / 24.06.2004 -# Lancom (Elsa) DSL I-10 Office Firmware 3.2 -Fingerprint ELSA LANCOM DSL I-10 Office router or Wireless L-11 -Class Elsa | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# LANCOM DSL/10 Office DSL router with firmware v3.22 -Fingerprint ELSA LANCOM DSL/10 Office DSL router -Class Elsa | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# ELSA LANCOM DSL/10 Office router 2.62.0002 -Fingerprint ELSA LANCOM DSL/10 office router -Class Elsa | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint ELSA LANCOM DSL/10 office router -Class Elsa | embedded || broadband router -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# ELSA LANCOM DSL/I-1611 Office 2.70.0025 / 06.08.2002 http://www.lancom-systems.de/ -# ELSA LANCOM DSL/I-1611 Office 2.50.0005 / 15.11.2001 -Fingerprint ELSA LANCOM DSL/I-1611 Office router -Class Elsa | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=578%ACK=S++%Flags=BAS%Ops=) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(Resp=N) - -Fingerprint EMC DART running on a Data Mover fileserver. Version T4.1.8.1 -Class EMC | DART || fileserver -TSeq(Class=64K%IPID=I%TS=2HZ) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint EMC IP4700 Filer -Class EMC | DART || fileserver -TSeq(Class=RI%gcd=<6%SI=<506F4&>961%IPID=I%TS=2HZ) -T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Enterasys XSR-1805 Software Version 6.0.0.0, Built Sep 14 2003, 11:09:28 -Fingerprint Enterasys XSR-1805 Security Route -Class Enterasys | embedded || firewall -TSeq(Class=RI%gcd=<6%SI=<55280&>B75%IPID=I%TS=2HZ) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Enterasys XP-2400 switch running Enterasys E9.0.0.0 -# Cabletron Smartswitch 6000 running Enterasys E8.2.0.0 -Fingerprint Enterasys/Cabletron switch running Enterasys E8.2.0.0 - E9.0.0.0 -Class Enterasys | embedded || switch -TSeq(Class=RI%gcd=<6%SI=<7A31E&>10AD%IPID=I%TS=2HZ) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint EPSON Ethernet Ver. 4.20 6.04, 13395E-98 -Class Epson | embedded || printer -TSeq(Class=TR) -T1(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR|AF%Ops=) -T4(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) -T5(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) -T7(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Epson Stylus 800n/EPSON Ethernet Ver. 4.20 -Class Epson | embedded || printer -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=200%ACK=S++%Flags=AR%Ops=) -T3(DF=N%W=200%ACK=S++%Flags=AF|AR%Ops=) -T4(DF=N%W=200%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=200%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=200%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=200%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Ericsson Congo router running software version 9.9.34 -Fingerprint Ericsson Congo router -Class Ericsson | embedded || broadband router -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Ericsson HM220dp ADSL modem/router -Class Ericsson | embedded || broadband router -TSeq(Class=TD%gcd=<50000%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1FB0%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=S%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=S%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Ericsson Tigris Access Server V. 12.1.15 with 10.2 ISDN code -# Integrated Access Platform, Software Version = 12.1.1.22 (ISDN Software Version 10.1) -Fingerprint Ericsson Tigris Access Server Software V. 12.1.* -Class Ericsson | embedded || terminal server -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Exabyte X80 tape backup robot -Class Exabyte | embedded || storage-misc -TSeq(Class=TD%gcd=<6004%SI=<14%IPID=I%TS=U) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=16D0|0%ACK=S++|O%Flags=AS|AR%Ops=M|) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Extreme Gigabit switch (unknown version) -Class Extreme Networks | embedded || switch -TSeq(Class=64K) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint Extreme Networks Black Diamond switch -Class Extreme Networks | embedded || switch -TSeq(Class=64K%gcd=<6%SI=<14) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint Extreme Networks Alpine 3804 Switch running Extremeware 6.2.1 -Class Extreme Networks | Extremeware || switch -TSeq(Class=RI%gcd=<6%SI=<1598C&>223) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Extremeware Version 6.2.2 (Build 68) by Release_Master 01/15/03 16:58:48 -Fingerprint Extremeware 6.2.2 -Class Extreme Networks | Extremeware || switch -TSeq(Class=RI%gcd=<6%SI=<2F062&>36C%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=C0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint F5 Labs Big/IP HA TCP/IP Load Balancer (BSDI kernel/x86) -Class F5 Labs | BSDI || load balancer -TSeq(Class=RI%gcd=<8%SI=<75C74&>12C4) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# F5 labs BIG-IP Load balancer. BIG-IP 4.1.1PTF-03 BIG-IP Kernel 4.1.1PTF-03 Build3 i386 -# F5 BIG-IP 540 loadbalancer. -Fingerprint F5 Labs BIG-IP Load balancer Kernel 4.1.1PTF-03 (x86) -Class F5 Labs | embedded || load balancer -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint F5 Labs BIG-IP load balancer kernel 4.2PTF-05a (x86) -Class F5 Labs | embedded || load balancer -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint FastComm FRAD (Frame Relay Access Device) F9200-DS-DNI -- Ver. 4.2.3A -Class FastComm | embedded || specialized -TSeq(Class=TD|RI%gcd=<8%SI=<1E) -T1(DF=N%W=648%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=648%ACK=S++|O%Flags=AS%Ops=) -T4(DF=N%W=0%ACK=S|O%Flags=AR|A%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0|B01%ACK=S|O%Flags=AR|A%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Fiber Line Wireless Broadband DSL Router, type: 802.11g, hardware release: R1.03SRM firmware version: V1.96.1g -Fingerprint FiberLine Wireless DSL router -Class FiberLine | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<23C9F22&>5B99B%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint FiberLine WL-1200R1 (also known as InterEpoch IWE-1200A-1) Wireless Broadband Router (WAP) -Class FiberLine | embedded || WAP -TSeq(Class=TD%gcd=<8%SI=<14%IPID=I%TS=U) -T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# FlowPoint 144 or 22XX DSL Router v3.0.8 -# SpeedStream 5851 SDSL [ATM] Router (120-5851-012) v4.0.5.1 Ready -Fingerprint DSL Router: FlowPoint 144/22XX v3.0.8 or SpeedStream 5851 v4.0.5.1 -Class FlowPoint | embedded || broadband router -Class SpeedStream | embedded || broadband router -TSeq(Class=TR%gcd=<6) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F|E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FlowPoint/2000 - 2200 SDSL Router (v1.2.3 - 3.0.4) or ASCOM Timeplex Access Router -Class FlowPoint | embedded || broadband router -Class ASCOM | embedded || broadband router -TSeq(Class=TD%gcd=<6%SI=5BD%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Fortigate-50A running FortiOS V2.80,build393,050405 -Fingerprint Fortinet firewall Fortigate 50A (FortiOS V2.80) -Class Fortinet | embedded || firewall -TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ) -T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(DF=Y%W=16D0%ACK=O%Flags=AS%Ops=M) -PU(Resp=N) - -# Fortinet Fortigate-60 firewall version 2.80,build430,050609 -Fingerprint Fortinet firewall Fortigate 60 -Class Fortinet | embedded || firewall -TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ) -T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Foundry FastIron Edge Switch (load balancer) 2402 -Class Foundry | embedded || load balancer -TSeq(Class=RI%gcd=<6%SI=<3E418&>988%IPID=RD%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Foundry 1500 OS Ver 7.2.06T51 -# Foundry ServerIron XL 16 Port 7.3.06T12 -Fingerprint Foundry Load Balancer OS Ver 7.2.X - 7.3.X -Class Foundry | embedded || load balancer -TSeq(Class=RI%gcd=<6%SI=<1366E&>AE%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) - -Fingerprint Foundry Networks Biglron 8000 load balancer -Class Foundry | embedded || load balancer -TSeq(Class=RI%gcd=<6%SI=<4C464&>294%IPID=I%TS=U) -T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Foundry FastIronII 4000 load balancer running 06.6.34T43 -Class Foundry | IronWare || load balancer -TSeq(Class=RI%gcd=<6%SI=<1370E&>1D3%IPID=I%TS=U) -T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Foundry NetIron load balancer OS Ver. 7.1.23T13 -Class Foundry | IronWare || load balancer -TSeq(Class=RI%gcd=<6%SI=<14C1C&>2B1%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Foundry Networks, Inc. Router/Load balancer, IronWare Version 06.5.12T43 -Class Foundry | IronWare || load balancer -TSeq(Class=C) -T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Foundry ServerIron XL load balancing IP Switch Version 06.0.00T12 -Class Foundry | IronWare || load balancer -TSeq(Class=C) -T1(DF=Y%W=4000%ACK=S++|O%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=44%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) - -Fingerprint FreeBSD 2.1.0 - 2.1.5 -Class FreeBSD | FreeBSD | 2.X | general purpose -TSeq(Class=64K) -T1(DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N|Y%W=402E|403D%ACK=S++|O%Flags=AS|A%Ops=M|NNT|MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 2.2.1 - 4.1 -Class FreeBSD | FreeBSD | 2.X | general purpose -Class FreeBSD | FreeBSD | 3.X | general purpose -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<38E50&>906) -T1(DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D|C0B7|402E|C08A|FFFF%ACK=S++%Flags=AS|A%Ops=MNWNNT|NNT|M) -T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0|F%ULEN=134%DAT=E) - -Fingerprint FreeBSD 2.2.1-STABLE -Class FreeBSD | FreeBSD | 2.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<74A54&>1295) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 3.2-4.0 -Class FreeBSD | FreeBSD | 3.X | general purpose -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<92D42&>1769) -T1(DF=Y%W=403D|402E%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT|M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=403D|402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T4(DF=N%W=4000|0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint FreeBSD 3.4-RELEASE -Class FreeBSD | FreeBSD | 3.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<58AD4&>3BB) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# DragonFly 1.1-Stable #0: Sun Nov 14 17:22:45 CET 2004 -# DragonFly 1.1-CURRENT (i386) build on 2004/12/03 -Fingerprint DragonFly 1.1-Stable (FreeBSD-4 fork) -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.0-20000208-CURRENT -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<63074&>FC4) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.1.1 - 4.3 (x86) -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<6A4D2&>10D%IPID=I%TS=U) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y|N%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.10-STABLE i386 -Fingerprint FreeBSD 4.10-STABLE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.3-RC -# FreeBSD 4.2-RELEASE i386 -Fingerprint FreeBSD 4.2 - 4.3-RC (x86) -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=CD3%IPID=I%TS=100HZ) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.3 - 4.4-RELEASE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.3 - 4.4PRERELEASE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF|403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.4 for i386 (IA-32) -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5B4|403D|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.4-5 or Apple Mac OS X 10.0.4 (Darwin V. 1.3-1.3.7 or 4P13) -Class FreeBSD | FreeBSD | 4.X | general purpose -Class Apple | Mac OS X | 10.0.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<6E99C&>2A1%IPID=I%TS=2HZ) -T1(DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=807A|C0B7%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.4-STABLE Thu Jan 31 19:43:54 GMT 2002 -Fingerprint FreeBSD 4.4-STABLE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.5-RELEASE (or -STABLE) (x86) -# FreeBSD 4.6-RC -Fingerprint FreeBSD 4.5-RELEASE (or -STABLE) through 4.6-RC (x86) -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.6 -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.6-RELEASE FreeBSD 4.6-RELEASE #0 i386 -Fingerprint FreeBSD 4.6 -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.6 -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<8AAA2&>96A%IPID=I%TS=U) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# 4.6-RELEASE -# 4.6-STABLE -# 4.6.2-RELEASE-p6 -Fingerprint FreeBSD 4.6 through 4.6.2 (July 2002) (x86) -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%IPID=I%TS=100HZ) -T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.6-RC on Alpha -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.6.2-RELEASE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) -T1(DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.8-RELEASE -# 4.7-STABLE FreeBSD 4.7-STABLE #0: Tue Nov 19 16:13:55 2002 -Fingerprint FreeBSD 4.6.2-RELEASE - 4.8-RELEASE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.7-RELEASE -# FreeBSD 4.8-RELEASE-p13 -Fingerprint FreeBSD 4.7 - 4.8-RELEASE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.7-RELEASE-p3 FreeBSD 4.7-RELEASE-p3 #0: Wed Jan 8 21:31:21 CET 2003 i386 -Fingerprint FreeBSD 4.7-RELEASE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.7-RELEASE through 4.8-RELEASE (x86) -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.7-RELEASE-p3 on i386 -Fingerprint FreeBSD 4.7-RELEASE-p3 -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.7-STABLE (Jan 2003) -Fingerprint FreeBSD 4.7-STABLE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.9-PRERELEASE alpha -# FreeBSD 4.8-RELEASE on DEC Alpha -# FreeBSD 4.9-STABLE (platform unspecified) -Fingerprint FreeBSD 4.8-RELEASE through 4.9-STABLE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.8-STABLE (June 2003) -Fingerprint FreeBSD 4.8-STABLE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|1000HZ) -T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.8-STABLE (June 2003) -Fingerprint FreeBSD 4.8-STABLE -Class FreeBSD | FreeBSD | 4.X | general purpose -T1(DF=Y%W=E000%ACK=S++|O%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.8-STABLE - 4.9-PRERELEASE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.0-RELEASE x86 -# sparc64 running FreeBSD 5.1-RELEASE -# FreeBSD 4.9-STABLE FreeBSD 4.9-STABLE i386 -Fingerprint FreeBSD 4.9 - 5.1 -Class FreeBSD | FreeBSD | 4.X | general purpose -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I|RD%TS=100HZ) -T1(DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 4.9-RELEASE-p1 #0 i386 -Fingerprint FreeBSD 4.9-RELEASE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# 4.9-RELEASE FreeBSD 4.9-RELEASE #0 -Fingerprint FreeBSD 4.9-RELEASE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 4.9-STABLE -Class FreeBSD | FreeBSD | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RPI%TS=100HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.0-CURRENT Sun Apr 14 12:41:40 EDT 2002 -Fingerprint FreeBSD 5.0-CURRENT (Apr 2002) -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 5.0-RELEASE -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 5.0-RELEASE -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD somehost.someplace 5.0-CURRENT FreeBSD 5.0-CURRENT #0: Wed Jan 29 12:31:51 CST 2003 i386 -# FreeBSD 5.0-RELEASE Alpha -Fingerprint FreeBSD 5.0-RELEASE or -CURRENT (Jan 2003) -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 5.1-CURRENT (June 2003) on Sparc64 -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 5.1-RELEASE (x86) -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeBSD 5.2 -Class FreeBSD | FreeBSD | 5.X | general purpose -T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5B4|84%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.2-CURRENT (Jan 2004) on x86 -# FreeBSD 5.2.1-RELEASE i386 -# FreeBSD 5.3-RELEASE #0 -Fingerprint FreeBSD 5.2 - 5.3 -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.3-RELEASE -# FreeBSD 5.2-CURRENT i386 -# FreeBSD 5.4-RELEASE #4 -# FreeBSD 5.4-Stable -# FreeBSD 5.4-STABLE #0 -# BummiOS 5.4-CURRENT i386 (based on FreeBSD 5.4-STABLE) -Fingerprint FreeBSD 5.2 - 5.4 -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ|U) -T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.2-CURRENT (Jun 25, 2004) on x86 running pf as firewall with "scrub in all" -# FreeBSD 5.3-Beta2 (x86) -# FreeBSD 5.3-RELEASE (x86) Generic kernel -Fingerprint FreeBSD 5.2-CURRENT - 5.3 (x86) with pf scrub all -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.2.1 running on Ultra5 spac64 -Fingerprint FreeBSD 5.2.1 (SPARC) -Class FreeBSD | FreeBSD | 5.X | general purpose -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.3-STABLE (x86) as of 2004.11.14 -# FreeBSD 5.3-RELEASE -Fingerprint FreeBSD 5.3 -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%TS=1000HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.3rc3 with pf scrub all -Fingerprint FreeBSD 5.3 -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# FreeBSD 5.3-RELEASE i386 -Fingerprint FreeBSD 5.3-RELEASE -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -Fingerprint FreeBSD 5.3-RELEASE -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.3-STABLE #7 Tue Feb 8 17:55:23 WET 2005 i386 -Fingerprint FreeBSD 5.3-STABLE -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.3-STABLE as of 2004-11-14, pf scrib in all random-id -Fingerprint FreeBSD 5.3-STABLE -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# FreeBSD 5.4-RC2 FreeBSD 5.4-RC2 #2 i386 -# FreeBSD 5.4-STABLE FreeBSD 5.4-STABLE #7 i386 -Fingerprint FreeBSD 5.4 -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=FFFF%ACK=O|S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 5.4-RELEASE-p2 i386 -Fingerprint FreeBSD 5.4-RELEASE -Class FreeBSD | FreeBSD | 5.X | general purpose -TSeq(Class=TR%gcd=<6%TS=100HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# FreeBSD 6.0-CURRENT #1 i386 -# FreeBSD 5.2.1-RELEASE -Fingerprint FreeBSD 5.2.1-RELEASE or 6.0-CURRENT -Class FreeBSD | FreeBSD | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint FreeSCO 0.27 (Linux 2.0.38) -Class FreeSCO | Linux | 2.0.X | router -TSeq(Class=RI%gcd=<6%SI=<1F22A6E&>4E0A2%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint FreeSCO 0.27 (Linux 2.0.38) -Class FreeSCO | Linux | 2.0.X | router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=3FE0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Galacticomm WorldGroup BBS (MajorBBS) w/TCP/IP -Class Galacticomm | WorldGroup || BBS -TSeq(Class=RI|TR%gcd=<6%SI=>FFFF&89C%IPID=I%TS=U) -T1(DF=Y%W=2120%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(Resp=N) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Genius Print Server -Class Genius | embedded || print server -T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Gnat Box Light firewall v3.0.3 (from the inside interface) -Class Global Technology Associates | embedded || firewall -TSeq(Class=RI%gcd=<6%SI=264) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(Resp=N) -T5(Resp=N) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -# GNet BB0040 DSL router -# SAR-703 Combined ADSL Modem/Router -Fingerprint GNet BB0040 or SAR 703 DSL modem + router -Class GNet | embedded || broadband router -Class SAR | embedded || broadband router -TSeq(Class=TD%gcd=VoIP phone gateway device -Class Grandstream | embedded || VoIP adapter -TSeq(Class=C%Val=66559055%IPID=I%TS=U) -T1(Resp=N) -T2(Resp=Y%DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=400%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Grandstream BT-100 IP Phone -Class Grandstream | embedded || VoIP phone -TSeq(Class=C%Val=FBD5528A%IPID=I%TS=U) -T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=400|1000|800%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=400%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Grandstream BT-100 IP Phone -Class Grandstream | embedded || VoIP phone -T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=1000|C00%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=800|C00|400%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Grandstream BudgeTone101 VoIP phone, firmware 1.0.4.50 -Fingerprint Grandstream BT-101 IP phone -Class Grandstream | embedded || VoIP phone -TSeq(Class=C%Val=75DFD55D%IPID=I%TS=U) -T1(Resp=N) -T2(Resp=Y%DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=C00|800|400%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=1000|C00|800%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=800|400|C00%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# GrandStream BT-101 with firmware 1.0.5.22 -Fingerprint Grandstream BT-101 IP phone -Class Grandstream | embedded || VoIP phone -TSeq(Class=C%Val=5CE04AC5%IPID=I%TS=U) -T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=C00|800%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=1000|800|400%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Grandstream BudgeTone 101 IP Phone -Class Grandstream | embedded || VoIP phone -TSeq(Class=C%IPID=I%TS=U) -T1(Resp=N) -T2(Resp=Y%DF=Y%W=800|1000|C00%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=800|400%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=400|C00|800%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=C00|800|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Grandstream IP Phone -Class Grandstream | embedded || VoIP phone -TSeq(Class=C%IPID=I%TS=U) -T1(Resp=N) -T2(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=1000|400|C00%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=C00%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# GrandStream BudgeTone-100 VoIP phone -# GrandStream BudgeTone-100 1.0.5.16 -Fingerprint Grandstream VoIP Phone (BudgeTone-100) -Class Grandstream | embedded || VoIP phone -TSeq(Class=C%Val=4D86DFEA|F66461C1%IPID=I%TS=U) -T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=1000|400%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=800|1000%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=400|800|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=800|C00|1000%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=400|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Grandstream Budge Tone 101 VoIP phone, firmware 1.0.5.16 -Fingerprint Grandstream VoIP Phone (BudgeTone-101) -Class Grandstream | embedded || VoIP phone -TSeq(Class=C%Val=4F4264AA%IPID=I%TS=U) -T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=400|800%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=800|C00%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=400|C00%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=C00|400|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint PalmOS 5.2.1 on Handspring Treo -Class Handspring | PalmOS | 5.X | PDA -TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Hawking PS12U Embedded Print Server (Firmware Version : 6.09.17H (2003/04/18 16:55:07) -Fingerprint Hawking PS12U Embedded Print Server -Class Hawking | embedded || print server -TSeq(Class=TD%gcd=78000|F0000%SI=<14%IPID=I%TS=U) -T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Zero One Tech. Print Server 3000 -# Hawking Print Server PN7117 -# Zero One Tech Printserver ZOT-PS-11 (firmware 5.4.2049) -# EUSSO Technologies UPS1211-B print server -Fingerprint Print server: Zero One Tech 3000, Hawking PN7117, or EUSSO UPS1211-B -Class Hawking | embedded || print server -Class Zero One | embedded || print server -Class EUSSO | embedded || print server -TSeq(Class=TD%gcd=1295%IPID=I%TS=2HZ) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# HP Buisiness InkJet 1200 internal print server -# HP Deskjet 6127, firmware FD4R019A -Fingerprint HP Deskjet 6127 printer or InkJet 1200 printer server -Class HP | embedded || printer -Class HP | embedded || print server -TSeq(Class=TD%gcd=<3D094%SI=<14%IPID=I%TS=1000HZ) -T1(DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y|N%W=8E5%ACK=S++%Flags=AS%Ops=MENWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP JetDirect Card (J4169A) in an HP LaserJet 8150/8550 -# HP LaserJet 2200 with JetDirect (J6057A) -# HP Wireless JetDirect EIO card - 680n -Fingerprint HP JetDirect Card in a LaserJet printer -Class HP | embedded || printer -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=5B4%ACK=O%Flags=A%Ops=) -T4(DF=N%W=5B4%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0|F%UCK=0%ULEN=134%DAT=E) - -# HP Laserjet 4250, HP JetDirect J7949E -# hp LaserJet 2420 -# hp LaserJet 4250 w/ embedded HP JetDirect J7949E; firmware V.28.43.FF w/ datecode 20040902 08.007.0 -# HP LaserJet 2420dn printer, JetDirect J7949E, firmware V.28.43 -# hp LaserJet 4250 with embedded HP JetDirect J7949E -# HP LaserJet 2420 printer -Fingerprint HP LaserJet 2420 or 4250 printer -Class HP | embedded || printer -TSeq(Class=64K%IPID=I%TS=2HZ) -T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint HP LaserJet 4000N Printer -Class HP | embedded || printer -TSeq(Class=TD%gcd=<6%SI=<1E) -T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP LaserJet 4100N printer -Class HP | embedded || printer -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2DA0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint HP LaserJet 5 -Class HP | embedded || printer -TSeq(Class=TD%gcd=<6%SI=9E9%IPID=I%TS=2HZ) -T1(DF=N%W=5B4|16D0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=5B4|16D0%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=5B4|16D0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# HP JetDirect J6057A Firmware Version R.22.09 in 4100mpf printer -Fingerprint HP printer w/JetDirect card -Class HP | embedded || printer -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=16D0%ACK=O%Flags=A%Ops=) -T4(DF=N%W=16D0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# This is a HP 5si printer with a JetDirect Ethernet card model# J2556b Firmware A.05.32 -Fingerprint HP printer w/JetDirect J2556b card (firmware A.05.32) -Class HP | embedded || printer -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP printer w/JetDirect J2556b card firmware A.05.32 -Class HP | embedded || printer -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# HP iLO (Integrated Lights Out) Firmware Version 1.20 (12/04/2002) -# HP Integrated Lights Out (iLO) with firmware 1.41 08/19/2003 -Fingerprint HP Integrated Lights Out remote configuration Board -Class HP | embedded || remote management -TSeq(Class=TD%gcd=<194%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) -T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP Router 210 with OS 9.72 -# Netgear RP114 DSL-Router with 4-Port Switch -Fingerprint HP Advancestack Etherswitch 224T or 210 or Netgear RP114 DSL-Router w/Switch -Class HP | embedded || switch -Class Netgear | embedded || broadband router -TSeq(Class=TD%SI=<20) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=400%ACK=O%Flags=R%Ops=) -T5(DF=N%W=400%ACK=O%Flags=R%Ops=) -T6(DF=N%W=400%ACK=O%Flags=R%Ops=) -T7(DF=N%W=400%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP Entria II with Kernel B.09.11 and Boot Block B.08.02 -Fingerprint HP Entria II X station -Class HP | embedded || X terminal -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint HP-UX 10.20 # 9000/777 or A 712/60 with tcp_random_seq = 1 or 2 -Class HP | HP-UX | 10.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<18000) -T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX 10.20 A 9000/715 or 9000/899 -Class HP | HP-UX | 10.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=|M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX 10.20 E 9000/777 or A 712/60 with tcp_random_seq = 0 -Class HP | HP-UX | 10.X | general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# XXX: It crashed the machine again, but I got a full -# scan this time. -Fingerprint HP-UX B.10.01 A 9000/715 -Class HP | HP-UX | 10.X | general purpose -TSeq(Class=64K|TR) -T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=8014%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX B.10.20 9000/897 -Class HP | HP-UX | 10.X | general purpose -TSeq(Class=64K) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 with tcp_random_seq = 1 -Class HP | HP-UX | 10.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<18000) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX B.10.20 A 9000/750 -Class HP | HP-UX | 10.X | general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# HP-UX B.10.20 A 9000/715 or 9000/712 or 9000/871 or 9000/861 with tcp_random_seq = 0 -Fingerprint HP-UX B.10.20 A with tcp_random_seq = 0 -Class HP | HP-UX | 10.X | general purpose -TSeq(Class=64K) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=8000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX release B.10.20 version A -Class HP | HP-UX | 10.X | general purpose -TSeq(Class=TD%gcd=<56%SI=<14%IPID=I%TS=U) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP9000 Model 804 K450 running HP-UX 11.00 -# Mac OS9 -Fingerprint Apple Mac OS 9, or HP-UX 11.00 -Class HP | HP-UX | 11.X | general purpose -Class Apple | Mac OS | 9.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<4F254&>C95) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP-UX B.11.00 -# HP-UX B.11.11 -Fingerprint HP-UX 11 -Class HP | HP-UX | 11.X | general purpose -TSeq(Class=RI%gcd=<6%SI=C6E%IPID=I%TS=100HZ) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX 11 w/tcp_isn_passphrase -Class HP | HP-UX | 11.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# This is a weird one -Fingerprint HP-UX 11.00 -Class HP | HP-UX | 11.X | general purpose -TSeq(Class=TD%gcd=>20000%SI=<3) -T1(Resp=N) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP-UX test01 B.11.11 U 9000/800 1277844053 unlimited-user license -Fingerprint HP-UX 11.11 -Class HP | HP-UX | 11.X | general purpose -TSeq(Class=RI%gcd=<6%SI=ABA%IPID=I%TS=100HZ) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX 11.11 -Class HP | HP-UX | 11.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=R%Ops=WNMETL) -T4(DF=N%W=800|1000|C00%ACK=S%Flags=R%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) -T7(DF=N%W=1000|800|C00%ACK=S%Flags=R%Ops=WNMETL) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX B.11.00 A 9000/785 -Class HP | HP-UX | 11.X | general purpose -TSeq(Class=RI%gcd=<6%SI=630%IPID=I%TS=100HZ) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX B.11.00 A 9000/800 -Class HP | HP-UX | 11.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<8E148&>846%IPID=I%TS=100HZ) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MEWNNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint HP-UX B11.00 U 9000/839 -Class HP | HP-UX | 11.X | general purpose -TSeq(Class=RI%gcd=<10%SI=<2114C&>536) -T1(Resp=N) -T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP-UX 7.0 B 9000/375 -Fingerprint HP-UX 7.0 -Class HP | HP-UX | 7.X | general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX 9.01 - 9.07 -Class HP | HP-UX | 9.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP-UX A.09.00 E 9000/817 - A.09.07 A 9000/777 -Class HP | HP-UX | 9.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint HP MPE/iX 5.5 -Class HP | MPE/iX || general purpose -TSeq(Class=TD%gcd=<6%SI=<14) -T1(DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=3CA%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint HP MPE/iX 5.5 on HP 3000 -Class HP | MPE/iX || general purpose -TSeq(Class=TD%gcd=<6%SI=<1E%TS=U) -T1(DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C00|6000%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint HP Entria X station (running Netstation 7.x) -Class HP | Netstation || X terminal -TSeq(Class=64K) -T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# HPJ2600A Ethernet hub or HP ProCurve Switch 4000M -# Bay Networks MicroAnnex XL running firmware 10.0B -Fingerprint VxWorks 5.3.x bases system (usually an Ethernet hub or switch such as HP ProCurve) or Bay Networks MicroAnnex XL terminal server -Class HP | VxWorks || switch -Class Bay Networks | embedded || terminal server -TSeq(Class=64K) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Huawei Quidway R2621 router running VRP 1.5.6(1) -Class Huawei | VRP || router -TSeq(Class=TD%gcd=<1E804%SI=<1E%IPID=I%TS=2HZ) -T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint Huawei Quidway Router R2621E VRP 1.5.6 -Class Huawei | VRP || router -TSeq(Class=TD%gcd=<1E806%SI=<14%IPID=I%TS=2HZ) -T1(DF=N%W=1090%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1090%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint Hydra HydraWEB 5000 -Class Hydra | embedded || load balancer -TSeq(Class=RI%gcd=1|2|3|4%SI=1111) -T1(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 3.2 -Class IBM | AIX | 3.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 3.2 -Class IBM | AIX | 3.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7F53%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 3.2 running on RS/6000 -Class IBM | AIX | 3.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 3.2.3 running on RS6000 model 560 -Class IBM | AIX | 3.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3F25%ACK=O%Flags=A%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 3.2.5 (Bull HardWare) -Class IBM | AIX | 3.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=FFAF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N|Y%DF=N%W=FFAF%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# IBM AIX v3.2.5 running on 8xPower-2 wide nodes -# Fingerprint IBM AIX Version 4 -Fingerprint IBM AIX v3.2.5 - 4 -Class IBM | AIX | 3.X | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=N%W=FEFA%ACK=S++|O%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 4.0 - 4.2 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=7F53|3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=8000|4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM AIX 4.02.0001.0000 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR) -T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM AIX 4.1 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=64K%gcd=<6%SI=<14) -T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 4.1-4.1.5 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 4.2 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR) -T1(DF=N%W=FFAF|FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 4.2-4.3.3 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR) -T1(DF=N%W=3E43%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 4.2.X-4.3.3.0 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR%IPID=I%TS=U) -T1(DF=N|Y%W=3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 4.3 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=5B4|F87%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=1000|4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E|F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 4.3.1 on a IBM RS/6000 R40 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR%gcd=<6%TS=U) -T1(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Fingerprint IBM AIX 4.3.3 on an RS/6000 H50 -# Fingerprint IBM AIX 4.3.3 on a p660-6M1 -# IBM AIX 4.3.3 ML10 -Fingerprint IBM AIX 4.3.2.0-4.3.3.0 on an IBM RS/* -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=N|Y%W=3E43|FEFA|7E80|FFAF|FFFF|3F25%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0|4000|8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0|F%UCK=0%ULEN=134%DAT=E) - -# Fingerprint IBM-RS/6000 7017-S80, AIX Version 4.3.3.0 -Fingerprint IBM AIX 4.3.3.0 on an IBM RS/* -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR%gcd=<6%TS=U) -T1(DF=N%W=AEF1%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX v4.1 running on a C10 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM AIX v4.2 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=N%W=FEFA%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|0%UCK=F|E%ULEN=134%DAT=E) - -Fingerprint IBM AIX Version 4.3 -Class IBM | AIX | 4.X | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=N%W=3F25%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 5.1 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Fingerprint IBM AIX 5.1.0.0 maintenance level 3 -Fingerprint IBM AIX 5.1 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0|4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 5.1 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# IBM AIX 5L 5.1 -# IBM AIX 5.1 ML00 -# AIX 5.1.4 -# IBM AIX 5L Version 5.2 -Fingerprint IBM AIX 5.1 - 5.2 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(DF=Y|N%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 5.1 - 5.2 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5B4|402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# IBM AIX 5.1 on pSeries LPAR -# AIX 2 5 000B8CDC4C00 IBM AIX 5.2L Update 2 -Fingerprint IBM AIX 5.1 - 5.2 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N|Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# aix 5.1 Maintenance Level 6 -Fingerprint IBM AIX 5.1 on a p610-6C1 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3F40%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 5.1-5.2 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# IBM AIX 5.103 on -Fingerprint IBM AIX 5.103 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# IBM AIX 5.2 on pSeries (Power4) -Fingerprint IBM AIX 5.2 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# IBM AIX 5.2 (Maintenance Level 1) on RS/6000 -Fingerprint IBM AIX 5.2 (on RS/6000) -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%TS=2HZ) -T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# AIX 5.2-003 -Fingerprint IBM AIX 5.2.3 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%TS=2HZ) -T1(DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFF7%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Fingerprint IBM AIX 5L V5.3 5765-G03 (2005/02) on IBM p5 (Power5 processor) -# Fingerprint IBM AIX 5.3 ML 01 on RS/6000 43P150 -Fingerprint IBM AIX 5.3 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM AIX 5.3 ML01 -Class IBM | AIX | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U) -T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM 8222 hub -Class IBM | embedded || hub -TSeq(Class=TD%gcd=<6%SI=<1A4%IPID=I%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM 8239 Token-Ring Stackable Hub -Class IBM | embedded || hub -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Microplex M205 Pocket Print Server v5.7 -# IBM 6400 Printer - Network Printer Server Version 7.0.9.6 [ network card ] -Fingerprint IBM 6400 printer or Microplex Pocket Print Server -Class IBM | embedded || printer -Class Microplex | embedded || print server -TSeq(Class=TD%gcd=<6%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint IBM Infoprint 12 Net-Printer -Class IBM | embedded || printer -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint IBM BladeCenter Remote Management Module -Class IBM | embedded || remote management -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM Remote Supervisor Adapter II -Class IBM | embedded || remote management -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) -T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) -PU(Resp=N) - -Fingerprint IBM 2210 router -Class IBM | embedded || router -TSeq(Class=TD%gcd=<6%SI=1A6E%IPID=I%TS=U) -T1(DF=Y%W=805C%ACK=O|S++%Flags=A|AS%Ops=|MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM LAN RouteSwitch/Xylan OmniSwitch Version 3.2.5/NeXT -Class IBM | embedded || switch -Class Xylan | embedded || switch -TSeq(Class=64K) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# AGE Logic, Inc. IBM X-Station -Fingerprint AGE Logic, Inc. IBM XStation -Class IBM | embedded || X terminal -TSeq(Class=64K) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM MVS -Class IBM | MVS || general purpose -TSeq(Class=RI%gcd=64|C8|12C|190) -T1(DF=N%W=4000|3FFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000|3FFF%ACK=S++%Flags=AS|APF%Ops=M|) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM MVS TCP/IP stack V. 3.2 or AIX 4.3.2 -Class IBM | MVS || general purpose -TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<200) -T1(DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FFFF|800%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) - -Fingerprint IBM MVS TCP/IP TCPMVS 3.2 -Class IBM | MVS || general purpose -TSeq(Class=TD%gcd=64|C8|12C|190|1F4%SI=<1E) -T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM MVS TCP/IP TCPOE 3.3 -Class IBM | MVS || general purpose -TSeq(Class=RI%gcd=<6%SI=FF) -T1(DF=Y%W=805C%ACK=O%Flags=A%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM OS/2 Warp Server for E-business (Aurora) Beta -Class IBM | OS/2 || general purpose -TSeq(Class=RI%gcd=<6%SI=FF) -T1(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint OS/2 Warp Server for eBusiness 4.52 -Class IBM | OS/2 || general purpose -TSeq(Class=RI%gcd=<8%SI=<5A9A6&>633%IPID=I%TS=U) -T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=805C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint IBM OS/390 V2R10 -Class IBM | OS/390 | V2 | general purpose -TSeq(Class=RI%gcd=<6%SI=<17C1E&>128%IPID=I%TS=1000HZ) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint IBM OS/390 V5R0M0 -Class IBM | OS/390 | V5 | general purpose -TSeq(Class=RI%gcd=<5%SI=>F& -Fingerprint IBM AS/400 V3 and V4 -Class IBM | OS/400 | V3 | general purpose -Class IBM | OS/400 | V4 | general purpose -TSeq(Class=RI%gcd=<6) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM OS/400 V3 -Class IBM | OS/400 | V3 | general purpose -TSeq(Class=RI%gcd=<8%SI=<3411C4&>5977%TS=1000HZ) -T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM AS/400 running OS/400 R4.4 -Class IBM | OS/400 | V4 | general purpose -TSeq(Class=TD%gcd=<6%SI=<1E) -T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM OS/400 V4 r4-5 -Class IBM | OS/400 | V4 | general purpose -TSeq(Class=RI%gcd=3%IPID=I%TS=1000HZ) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM OS/400 V4R2M0 -Class IBM | OS/400 | V4 | general purpose -TSeq(Class=TD|RI%gcd=<6%SI=<285DC&>206%IPID=I%TS=U) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM OS/400 V4R5 -Class IBM | OS/400 | V4 | general purpose -TSeq(Class=C%IPID=I%TS=1000HZ) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM OS/400 V4R5M0 -Class IBM | OS/400 | V4 | general purpose -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM AS/400 running OS/400 5.1 -Class IBM | OS/400 | V5 | general purpose -TSeq(Class=TD%gcd=<6000%SI=<14%IPID=I) -T1(DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# IBM proprietary operating system for AS/400 systems (now known as "iSeries") -# Fingerprint OS/400 V5R2 -# IBM OS/400 V5R1M0 -Fingerprint IBM OS/400 V5R1 - V5R2 -Class IBM | OS/400 | V5 | general purpose -TSeq(Class=RI%gcd=<24%SI=<19DCD2&>6D3%IPID=I) -T1(DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N|Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# OS/400 V5R1M0 w/ C2134 + Autumn '02 Hiper, DB & Java -Fingerprint IBM OS/400 V5R1M0 -Class IBM | OS/400 | V5 | general purpose -TSeq(Class=TD%gcd=<22222%SI=<14%IPID=I%TS=1000HZ) -T1(DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2000|4000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# IBM OS/400 V5.2 -Fingerprint IBM OS/400 V5R2M0 -Class IBM | OS/400 | V5 | general purpose -TSeq(Class=RI%gcd=<24%SI=<41D304&>7BC%IPID=I) -T1(DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y|N%W=FB80%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM OS/400 V5R2M0 -Class IBM | OS/400 | V5 | general purpose -TSeq(Class=RI%gcd=<8%SI=<2871A2&>276C%IPID=I%TS=1000HZ) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# IBM iSeries OS/400 V5R2M0 L000 -# IBM AS/400 - Operating System: OS/400 V5R2M0 (Version 5, Revision 2) -# IBM OS/400 V5R3M0 on iSeries -# OS/400 V5R3 -Fingerprint OS/400 V5R2M0 or V5R3 or V5R3M0 -Class IBM | OS/400 | V5 | general purpose -TSeq(Class=RI%gcd=<14%SI=<2EB440&>EF0%IPID=I%TS=1000HZ) -T1(DF=Y%W=2000|8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint IBM VM/CMS (mainframe) -Class IBM | VM/CMS || general purpose -TSeq(Class=RI%gcd=64|C8%SI=>CC&116E%IPID=I%TS=100HZ) -T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Linux kernel 2.4.27 (x86) ipcop 1.40 -# Linux ipcop 2.4.27 #1 Thu Sep 30 02:57:11 GMT 2004 i586 AuthenticAMD unknown GNU/Linux -# IPcop v1.4.2 Linux 2.4.27 -# Linux fw.ioes.org 2.4.27 #1 Wed Sep 29 12:48:42 GMT 2004 i686 GenuineIntel unknown GNU/Linux (IPCOP+1.4) -# Linux 2.4.27-29 (IPCop 1.4.2) -# IPCop 1.4.2 (Kernel: 2.4.27) i486 -# Linux 2.4.27 i686 GNU/Linux IPCop 1.4.2 (Green Interface) -# Linux 2.4.29 #1 i686 GenuineIntel+unknown GNU/Linux / IPCop 1.4.5 -# IPCop Linux 1.4.5 (Linux xxx 2.4.29 #1) Pentuim II -# IPCOP 1.4.6 based on Debian/Linux 2.4.29 -Fingerprint IPCop 1.4 - 1.4.6 Linux 2.4.2x-based firewall -Class IPCop | Linux | 2.4.X | firewall -TSeq(Class=RI%gcd=<6%SI=<24E74F4&>49DD3%IPID=Z%TS=U) -T1(DF=Y%W=16D0|400C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# IPRoute V1.18, compiled at 08:26:02 on Jun 23 1998 -Fingerprint IPRoute (DOS based software router) -Class IPRoute | DOS || software router -TSeq(Class=TD%gcd=<6%SI=<82%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=E0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# IQinVison IQeye3 Version V2.1/1(030123) -Fingerprint IQinVison IQeye3 webcam -Class IQinVision | embedded || webcam -TSeq(Class=RI%gcd=<6%SI=<5168&>B3%IPID=I%TS=U) -T1(DF=N%W=5B4%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# IronPort AsyncOS 3.7.1-001 running on C60 platform -Fingerprint IronPort C60 email security appliance -Class IronPort | AsyncOS || specialized -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=4000%ACK=O%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Isolation Systems Infocrypt Enterprise -Class Isolation | embedded || encryption accelerator -TSeq(Class=C) -T1(Resp=N) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) -T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Ixia 1600 -- Ixia Socket/Serial TCL traffic generation and analysis server -Class Ixia | embedded || specialized -TSeq(Class=TD%gcd=<34C%SI=<14%IPID=BI) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Juniper Networks JUNOS 5.3 on an Olive router -Class Juniper | JUNOS || router -TSeq(Class=RI%gcd=<6%SI=661%IPID=I%TS=100HZ) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# JUNOS 5.6R1.3 JUNOS 5.6R1.3 #0: 2003-01-02 20:38:33 UTC -- This one was no Juniper Hardware Router but a JunOS installed on a simple i386 box. -Fingerprint Juniper Networks JUNOS 5.6R1.3 routing software on x86 box -Class Juniper | JUNOS || router -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Juniper Networks JUNOS 5.5R1.2 built 2002-09-28 -Fingerprint Juniper Networks router JUNOS 5.5R1.2 -Class Juniper | JUNOS || router -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Juniper router M10i JUNOS ROUTER 7.2R1.7 #0 i386 -Fingerprint Juniper Networks router M10i running JUNOS 7.2R1.7 -Class Juniper | JUNOS || router -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Juniper Router running JUNOS -Class Juniper | JUNOS || router -TSeq(Class=RI%gcd=<5%SI=>FFF) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# KA9Q is a networking OS used mostly by amateur radio operators for radio to -# internet gateways. -Fingerprint KA9Q amateur radio OS -Class KA9Q | KA9Q || specialized -TSeq(Class=TD%gcd=37000%SI=<1E) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=MTWL) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# 3Com OfficeConnect 812 ADSL router firmware 2.0.0 -# Kentrox DataSMART 656 CSU/DSU or USR NETServer/16 -Fingerprint Kentrox DataSMART 656 CSU/DSU, USR NETserver/16, or 3Com OfficeConnect ADSL router -Class Kentrox | embedded || CSUDSU -Class US Robotics | embedded || switch -Class 3Com | embedded || broadband router -TSeq(Class=TD%gcd=61A8|C350|124F8|186A0%SI=CCC&91%IPID=BI%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Lantronix ETS16P terminal server Version V3.5/2(970721) -Class Lantronix | embedded || terminal server -TSeq(Class=RI%gcd=<6%SI=<404C&>90) -T1(DF=N%W=700|2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620) -Class Lantronix | embedded || terminal server -TSeq(Class=RI%gcd=<6%SI=<9318E&>1688%IPID=BI%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Lantronix SCS1600 secure console server version V1.0/2(010620) -Class Lantronix | embedded || terminal server -TSeq(Class=RI%gcd=<8%SI=<404C&>8C%IPID=BI%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Lantronix EPS1 Print Server version V3.5/1(970325) -Class Lantronix | Punix || print server -TSeq(Class=RI%gcd=<6%SI=>FF&8F%IPID=BI%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Lantronix EPS2 Print Server Version V3.5/2(970721) -Class Lantronix | Punix || print server -TSeq(Class=RI|TD%gcd=<6) -T1(Resp=Y%DF=N%W=E00%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Lantronix ETS16 Version V3.1/2(940207) / [Punix version 2.9/379(940207)] -Fingerprint Lantronix ETS16 terminal server -Class Lantronix | Punix || terminal server -TSeq(Class=RI%gcd=<6%SI=<41E9C&>AD%IPID=RPI|BI%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++|O%Flags=AR|AF%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=D%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Leunig ePower Switch b723 v5.2 -Class Leunig | embedded || power-device -TSeq(Class=TR) -T1(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) -T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) -T4(Resp=Y%DF=Y%W=578%ACK=S++%Flags=R%Ops=) -T5(Resp=N) -T6(Resp=N) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Fingerprint LevelOne WBR-3406TX Wireless Broadband router -Class Level One | embedded || broadband router -TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) -T1(DF=N%W=1540|1638%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# LevelOne Wireless router WBR-3403TX -Fingerprint LevelOne WBR-3403TX Wireless Broadband router -Class Level One | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<102C870&>295B1%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Lexmark M412n network printer -Class Lexmark | embedded || printer -TSeq(Class=RI%gcd=<6%SI=<4ADB2&>9B2%IPID=I%TS=2HZ) -T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=800%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Lexmark Marknet X2031e printer -Class Lexmark | embedded || printer -TSeq(Class=RI%gcd=<6%SI=16E0%IPID=I%TS=2HZ) -T1(DF=Y%W=8E5%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=800%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Lexmark Optra N Laser Printer -Fingerprint Lexmark Optra N Laser Printer -Class Lexmark | embedded || printer -TSeq(Class=TD%gcd=<272A%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=1C%RIPTL=0%RID=0%RIPCK=0%UCK=F%ULEN=134%DAT=E) - -# Lexmark Optra R+ (4049-RA0) w. MarkNet XL card (firmware rev. 79.133.1 -# Lexmark Optra Lx+ Network Printer, firmware -Fingerprint Lexmark Optra network printer -Class Lexmark | embedded || printer -TSeq(Class=TD%gcd=388|1393|3AB9|4E4C|61DF|7572|8905|C3BE%SI=<20) -T1(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) -T4(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Lexmark Optra T612 (printer) running firmware 3.11.17 -# Lexmark Optra S 2420 -Fingerprint Lexmark Optra printer -Class Lexmark | embedded || printer -TSeq(Class=TD%gcd=1000%SI=<30) -T1(DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=3F2|3F6%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N|Y) - -# Lexmark T520 printer, firmware 54.30.39 -Fingerprint Lexmark T520 printer -Class Lexmark | embedded || printer -TSeq(Class=RI%gcd=<6%SI=<3651E88&>8AEFD%IPID=Z%TS=100HZ) -T1(DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=624%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Lexmark T522 printer -Class Lexmark | embedded || printer -TSeq(Class=RI%gcd=<6%SI=<24E3426&>5E5DB%IPID=Z%TS=100HZ) -T1(DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5A8%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Lexmark T522/T622 printer -Class Lexmark | embedded || printer -TSeq(Class=RI%gcd=<8%SI=<2C2D254&>387BA%IPID=Z%TS=100HZ) -T1(DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5A8|B50%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint LG Goldstream LR3001f router, software version 4.0 -Class LG GoldStream | embedded || router -TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U) -T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) -T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) - -Fingerprint LG Goldstream LR3100p router, software version 1.0-1.5 -Class LG GoldStream | embedded || router -TSeq(Class=TD%gcd=<8004%SI=<1E%IPID=I%TS=U) -T1(DF=Y%W=EA60%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=1%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=EA60%ACK=O%Flags=AS%Ops=M) -T4(DF=Y%W=1%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=1%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=1%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=1%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Liebert Intellislot SNMP/Web Card (power devices, air conditioning, etc.) -Class Liebert | embedded || specialized -TSeq(Class=TD%gcd=<32DC4%SI=<14%IPID=I%TS=U) -T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# "This device listens on all TCP and all UDP ports, so OS -# fingerprints are not that excellent. Actually there's not even an OS -# running on it, it simply translates monitoring data into SNMP OIDs. It -# can also be used to control the unit by setting specific OIDs." -Fingerprint Liebert-Hiross HiSNMP A/C controlling unit -Class Liebert-Hiross | embedded || specialized -T1(DF=Y%W=2000%ACK=S++%Flags=BAS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2000%ACK=S++%Flags=UAPSF%Ops=M) -T4(Resp=N) -T5(DF=Y%W=2000%ACK=S%Flags=R%Ops=) -T6(DF=Y%W=2000%ACK=S%Flags=R%Ops=) -T7(DF=Y%W=2000%ACK=S%Flags=R%Ops=) -PU(Resp=N) - -# Linksys WET-11 Wireless Ethernet bridge running firmware rev. 1.43 -Fingerprint Linksys WET-11 Wireless Ethernet bridge -Class Linksys | embedded || bridge -TSeq(Class=RI%gcd=<6%SI=<2C30D0&>52F7%IPID=I%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linksys WGA54G Wireless Game Adapter (bridge) -Class Linksys | embedded || bridge -TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MM) -T2(Resp=N) -T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Linksys EtherFast Cable/DSL Router with 4-port switch BEFSR41 ver. 3; firmware: 1.44.3, FEB 13 2003 -Fingerprint Linksys BEFSR41 Broadband router -Class Linksys | embedded || broadband router -TSeq(Class=TD%gcd=<18%SI=<1E%IPID=Z%TS=U) -T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linksys BEFSR41 Broadband router and 4-port hub -Fingerprint Linksys BEFSR41 Broadband router -Class Linksys | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<2FF88AC&>7ACA0%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Linksys/Cisco BEFSR41 V3 Etherfast Cable/DSL Router (Firmware 1.04.17) -Fingerprint Linksys BEFSR41 V3 Etherfast cable/DSL router -Class Linksys | embedded || broadband router -T1(Resp=N) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=) -T4(Resp=N) -T5(DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linksys BEFVP41 VPN Router - Firmware Version 1.41.1, Sep 04 2003 -Fingerprint Linksys BEFVP41 VPN Router -Class Linksys | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linksys BEFW11S4 DSL/Cable Router with Firmware 1.45z -Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router -Class Linksys | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=4009%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Linksys BEFW11S4 firmware revision 1.45.10 -Fingerprint Linksys BEFW11S4 Wireless DSL/Cable Router -Class Linksys | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# LinkSys WRT-54G running the SVEASOFT code -# Linksys BEFW11S4 802.11B WAP -# Linksys BEFSR41 firmware ver. 1.40.2 -# Linksys Router: BEFW11S4 v2/v3 -Fingerprint Linksys BEFW11S4/WRT-54G Wireless Broadband router or BEFSR41 Cable/DSL router -Class Linksys | embedded || broadband router -TSeq(Class=TD|RI%gcd=<400%SI=<62C%IPID=Z|RD%TS=U) -T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linksys WAG54G Wireless Broadband Router -Fingerprint Linksys WAG54G Wireless Broadband Router -Class Linksys | embedded || broadband router -TSeq(Class=TD%gcd=24FCE%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Linux kernel 2.4.20 (mips) on Linksys WRT54G Wireless Broadband Router with firmware Sveasoft +Alchemy-pre7a beta build version v3.37.6.8sv -Fingerprint Linksys WRT54G Wireless Broadband Router (Linux kernel 2.4.20) -Class Linksys | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<17B7D1A&>3BAFF%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linksys EtherFast Print Server -Class Linksys | embedded || print server -T1(DF=N%W=0|C80%ACK=S++%Flags=AR|APS%Ops=|M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Linksys EtherFast Print Server -Class Linksys | embedded || print server -TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=APS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=APS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Linksys PSUS4 USB Print Server and switch -Class Linksys | embedded || print server -TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U) -T1(DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=111C%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Linksys WPS54GU2 Wireless Print Server -Class Linksys | embedded || print server -TSeq(Class=TD%gcd=<1A866%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=111C%ACK=S++%Flags=APS|A%Ops=M|) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=111C|0%ACK=S++|O%Flags=APS|AR%Ops=M|) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Linksys WRK54G Firmware Version: 1.56.01 -# Linksys Wireless-B router/switch/802.11b access point (device model BEFW11S4 V4) -# Linksys BEFW11S4 firmware 1.50.14 -# Linksys BEFSR41 v2 Firmware Version: 1.46.02, Aug 03 2004 -# Linksys BEFSR81v2 Router with firmware 2.45.10 -# Linksys EtherFast Cable/DSL Router (Model: BEFSR41 Ver 2)(Updated Firmware ver. 1.46.02, Aug 03+2004) -# Linksys Wireless-B Broadband Router BEFW11S4 Firmware v.1.50.14 -# Linksys RT31P2 VoIP router (Vonage; firmware version 1.28.00; internal interface) -Fingerprint Linksys BEFW11S4/BEFSR41/BEFSR81/WRK54G Broadband router or RT31P2 VoIP router -Class Linksys | embedded || WAP -TSeq(Class=TD%gcd=10000%IPID=I%TS=100HZ) -T1(DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y|N%DF=Y|N%W=3C0A|37E6|3F25|7B2F|7F53|7C38|B63%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=28|C0|A0|0|70|14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Linux 2.1.24 PowerPC -Class Linux | Linux | 2.1.X | general purpose -TSeq(Class=TR) -T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.1.76 -Class Linux | Linux | 2.1.X | general purpose -TSeq(Class=TR) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.1.88 -Class Linux | Linux | 2.1.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1535966&>364A7) -T1(DF=Y%W=7F53%ACK=S++|O%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=Y|N%W=7F53|0%ACK=S++%Flags=AS|AR%Ops=ME|) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.1.91 - 2.1.103 -Class Linux | Linux | 2.1.X | general purpose -TSeq(Class=RI%gcd=<6%SI=>7A000) -T1(Resp=Y%DF=Y%W=7F7D%ACK=S++|O%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0|7F7D%ACK=S++%Flags=AR|AS%Ops=|MENNTNW) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.2.12 - 2.2.25 -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1FF51DA&>51CC9%IPID=I%TS=U) -T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0|60|A0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.2.13 -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=24CA0) -T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# SuSE Linux 6.3 (i386) - Kernel 2.2.13 -Fingerprint Linux 2.2.13 (SuSE; x86) -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<21DE76C&>2B4E4%IPID=I%TS=100HZ) -T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.2.14 -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2DD9C88&>755F7) -T1(DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7C38|7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0|C8%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E) - -Fingerprint Linux 2.2.16C37_III on Sun Cobalt -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2021DA2&>3CBCC%IPID=I%TS=100HZ) -T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.2.19-6.2.1ensim-3.1.5-2 (RedHat 7.2) -Fingerprint Linux 2.2.19 -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<242483C&>5C202%IPID=I%TS=100HZ) -T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.2.19 (Alpha) -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1409420&>3348D%IPID=I%TS=1000HZ) -T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.2.19 - 2.2.20 -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2665AC4&>62494%IPID=I%TS=U) -T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.2.19 on a DEC Alpha 233mhz Multia -Fingerprint Linux 2.2.19 on a DEC Alpha -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2E962E8&>4DF93%IPID=I%TS=1000HZ) -T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E) - -Fingerprint Linux 2.2.20 SMP -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<277C73C&>6371B%IPID=I%TS=100HZ) -T1(DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=109%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Linux 2.2.21 SMP (x86) -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1921FE8&>404B1%IPID=I%TS=U) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MENW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.2.22 -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<22AB988&>58BFF%IPID=I%TS=U) -T1(DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.2.5 - 2.2.13 SMP -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=2203C) -T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=212%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F|E%ULEN=134%DAT=E) - -# Linux kernel 2.4.4-4GB (x86) from Red hat -Fingerprint Linux 2.4.4 -Class Linux | Linux | 2.2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=19E%IPID=Z%TS=U) -T1(DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=860%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S|O%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Linux 2.3.12 -Class Linux | Linux | 2.3.X | general purpose -TSeq(Class=RI%gcd=<20%SI=>DDDD) -T1(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.3.28-33 -Class Linux | Linux | 2.3.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<177B202&>3C1B3) -T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0|A0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.3.47 - 2.3.99-pre2 x86 -Class Linux | Linux | 2.3.X | general purpose -TSeq(Class=RI%gcd=<10%SI=<1335F26&>312CA) -T1(DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7900|7C70%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.3.49 x86 -Class Linux | Linux | 2.3.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1363570&>31A0E) -T1(DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7C70%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Astaro Security Linux 4 (Kernel 2.4.19) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# I don't put "Gentoo" as the vendor for the classification because it -# makes output ugly when there are a bunch of Linux matches due to -# firewalling or similar problems. -Fingerprint Gentoo 1.2 linux (Kernel 2.4.19-gentoo-rc5) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1BF1FC0&>4788F%IPID=RD%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Cobalt Linux 6.0 Kernel 2.2.16c32_III on an i586 -Fingerprint Linux 2.2.16 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<23D760E&>5BBDD%IPID=Z) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.0 - 2.5.20 -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.5.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I|RD%TS=100HZ|U) -T1(DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5B4|F98|1140|11AC|12CC|16A0|1680|2D24|4000|474C|7E18|7EA0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW|MNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y|N%TOS=0|8|14|20|28|38|40|C0|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.0 - 2.5.20 w/o tcp_timestamps -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.5.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<2D870AA&>10000%IPID=Z|C|I%TS=U) -T1(DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5B4|1140|2D24|16A0|16B0|16D0|1680|4000|400C|7FFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y|N%TOS=14|C0|0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.0-test5 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<34AE3EC&>86DB8) -T1(DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7C70|7E18%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=C0%IPLEN=178%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F|E) - -# Linux 2.4.18 -# SuSE Linux 7.3 linux-2.4.10-4GB, running on amd k6-2 -Fingerprint Linux 2.4.10 - 2.4.18 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<21BFEA2&>46B9B%IPID=Z%TS=100HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=D0|D8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Strangely enough, I have received several prints like this that claim a T2: -Fingerprint Linux 2.4.16 - 2.4.18 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<165F990&>39170%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.17 on HP 9000 s700 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<3305D06&>414E0%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.18 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<1C15A06&>23F17%IPID=Z) -T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Debian/Gnu Linux 3.0 (Woody) Kernel 2.4.18-bf2.4 -Fingerprint Linux 2.4.18 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<293EE44&>69651%IPID=Z%TS=100HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.18 (PPC) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<36CB986&>488A7%IPID=Z%TS=100HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.18 (x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<5BA02C&>EA7B%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.18 (x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2774D66&>2F583%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.18-custom -# Linux 2.4.19 w/o tcp_timestamps -Fingerprint Linux 2.4.18 - 2.4.19 w/o tcp_timestamps -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1720870&>361B9%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.18 - 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<14B7282&>11A94%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=30|60|D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.20 (Gentoo 1.2; x86) -# Linux 2.4.18-14 -Fingerprint Linux 2.4.18 - 2.4.20 (x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2B9C772&>6FA19%IPID=Z%TS=100HZ) -T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# linux 2.4.20 (i586) Preemptible -# Linux 2.4.18 -# 2.4.21-20.ELsmp SMP RedHat AS3, REL3 -Fingerprint Linux 2.4.18 - 2.4.21 (x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<25C5808&>30578%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.4.21-4.0.1.ELsmp x86 Dual Xeon RedHat EL3 AS3 (Red Hat Linux 3.2.3-20) -# Linux Kernel 2.4.21-4.0.1 Red Hat Enterprise Linux ES release 3 (Taroon) -# Linux sun 2.4.27 #3 SMP Mon Nov 1 21:24:45 GMT 2004 sparc unknown unknown GNU/Linux -# Linux AthenA-server 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i586 unknown -Fingerprint Linux 2.4.18 - 2.4.27 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR|RI%gcd=<6%SI=<2CA3968&>49B3D%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux live cd knoppix 2.4.27 (knoppix 2.6) -Fingerprint Linux 2.4.18 - 2.4.27 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<3859E24&>47DBA%IPID=Z%TS=100HZ) -T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Linux 4.19-4GB #1 Tue Sep 30 19:01:07 UTC 2003 i686 unknown / SuSe Linux OpenExchange Server -Fingerprint Linux 2.4.19 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<13A36B6&>3244E%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) -T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Linux kernel 2.4.19C13_V (x86) Sun Cobalt RaQ550 -Fingerprint Linux 2.4.19 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<20DD6C4&>54211%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Mandrake 9.1 SMP 2.4.19-16mdksmp #1 SMP Fri Sep 20 16:08:37 CEST 2002 i686 unknown unknown GNU/Linux -Fingerprint Linux 2.4.19 (Mandrake, x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<263CFAC&>55266%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++|O%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.19 (x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<25CEE8A&>341B8%IPID=Z%TS=100HZ) -T1(DF=Y%W=1680%ACK=S++|O%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.20-4GB-athlon i686 -# SuSE Linux 8.2 2.4.20-64GB-SMP -# linux 2.4.19-4GB -Fingerprint Linux 2.4.19 - 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<22D7C86&>2AE00%IPID=I%TS=100HZ) -T1(DF=Y%W=16A0|1680|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.19 w/grsecurity patch -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2A492C6&>6C3F2%IPID=RD%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.4.20-4GB (x86) -Fingerprint Linux 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<1540758&>1B32B%IPID=I%TS=100HZ) -T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.20-wolk4.16s -Fingerprint Linux 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) -T1(DF=Y%W=7D74%ACK=S++%Flags=AS%Ops=MNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<18D4252&>3F8B9%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.20; Sysctl goodness below. Changed default TTL, syncookies, not sure what else. Scanned from localhost. -Fingerprint Linux 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2C88A&>1E5%IPID=RD) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.20-xfs-rmap15d-ptrace #1 Debian GNU/Linux -Fingerprint Linux 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<15580A6&>30FB7%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.4.20 from ALT Linux Master 2.2 (uname -r = 2.4.20-alt16-smp) -Fingerprint Linux 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<25A8F50&>60659%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.20-8 #1 i686 i686 i386 GNU/Linux -Fingerprint Linux 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1A82ACC&>43DBE%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Red Hat Linux release 9 (Shrike) Kernel 2.4.20-8 on an i686 -Fingerprint Linux 2.4.20 (Red Hat) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1B9DCC2&>469F7%IPID=Z%TS=100HZ) -T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux localhost 2.4.20-30.9 #1 Wed Feb 4 20:44:26 EST 2004 i686 i686 i386 GNU/Linux -Fingerprint Linux 2.4.20 (x86, Redhat 7.3) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<3A23C96&>949CB%IPID=Z%TS=100HZ) -T1(DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1630|16D4%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Red Hat Linux release 9 (Shrike), Kernel Version 2.4.20-31.9.progeny.5 -# Linux 2.4.21-27.0.2.EL i686 i386 (Red Hat Enterprise Linux ES release 3 (Taroon Update 4)) + APF 0.9.3 -# Linux 2.4.21-15.0.4.ELsmp #1 SMP i686 i686 i386 GNU/Linux -# Linux 2.4.22-1.2115.nptlsmp -# Linux 2.4.22-1.2199.nptlsmp #1 SMP i686 i686 +i386 GNU/Linux -Fingerprint Linux 2.4.20 - 2.4.22 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<3089154&>7C37E%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(Resp=N) - -# Linux 2.4.20-gentoo-r5 w/grsecurity -Fingerprint Linux 2.4.20 - 2.4.22 w/grsecurity.org patch -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) -T1(DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5B4|16A0|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Linux kernel 2.4.20-wolk4.17s (x86) -# Linux demeter 2.4.20-wolk4.17s #1 i686 unknown -# "Devil Linux 1.2.2" 2.4.27-grsec #1 SMP i686 AuthenticAMD unknown+GNU/Linux -# Gentoo 2.4.28-hardened-r5 (Up to date with Gentoo Hardened Patches) on a Proliant 1600R -Fingerprint Linux 2.4.20 - 2.4.28 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) -T1(DF=Y%W=1690|16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.20 or 2.6.0-test5-love3 (x86) -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=23458%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.20 x86 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<1DB22CE&>1862A%IPID=Z%TS=100HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=2200%ACK=O%Flags=A%Ops=NNT) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.20-ac2 -Fingerprint Linux 2.4.20-ac2 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2A812D4&>2F29E%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=800|400%ACK=S%Flags=AR%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.21-32.0.1.ELsmp #1 i686 i686 i386 GNU/Linux -Fingerprint Linux 2.4.21 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<31EB9A2&>7FCA1%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# RedHat Linux Enterprise 3 2.4.21-27.0.2.EL #1 -Fingerprint Linux 2.4.21 (RedHat) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Linux Boobie 2.4.21-9.EL #1 RedHat -Fingerprint Linux 2.4.21 (RedHat) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2E5DABA&>58D55%IPID=Z%TS=100HZ) -T1(DF=Y%W=564%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=C00|800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -# base on msg 1058, 1776 -# Linux kernel 2.4.21-243(athlon) from SuSE 9.0 -# SuSE 9.0 with updates, kernel 2.4.21-280-default -Fingerprint Linux 2.4.21 (Suse) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<243DCC4&>17466%IPID=I%TS=U) -T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SuSE Linux 8.1 (i386) 2.4.21 #4 SMP -Fingerprint Linux 2.4.21 (Suse, x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2634758&>55644%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# SuSE Linux 9.0 2.4.21-215-athlon -# Linux 2.4.21-121-athlon; SuSE, x86 -# Linux 2.4.21-231-athlon from SuSE 9.0 -Fingerprint Linux 2.4.21 (x86 SuSE) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1C5FBC4&>48A1C%IPID=I%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Linux 2.4.21-0.25mdk x86 -Fingerprint Linux 2.4.21 (x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2A2786A&>6BE77%IPID=I%TS=100HZ) -T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux mail2 2.4.21-4.ELsmp #1 SMP Fri Oct 3 17:52:56 EDT 2003 i686 i686 i386 GNU/Linux (Redhat Enterprise Linux AS 3) -Fingerprint Linux 2.4.21 (x86, RedHat) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<26BFF42&>63303%IPID=Z%TS=100HZ) -T1(DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1590%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.21-166-default (Suse 9) -# Linux 2.4.23-pre6aa3 #2 Wed Mar 10 23:27:52 BRT 2004 i686 GNU/Linux -Fingerprint Linux 2.4.21 - 2.4.23 -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<139B84E&>3230A%IPID=I%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Debian Linux feeshus 2.4.22-1-ipvs-686 #1 -Fingerprint Linux 2.4.22 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<180F182&>3D924%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.22 (SPARC) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<256B646&>5FC9A%IPID=Z%TS=100HZ) -T1(DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=830|1650%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.22 (x86) without timestamps, grsecurity 1.9 (rand_isns, rand_ip_ids) -Fingerprint Linux 2.4.22 (x86) w/grsecurity patch and with timestamps disabled -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR|RI%gcd=<6%IPID=RD|Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.22 (x86, Gentoo) -# Linux server 2.6.7-ck5 (x86) -# Linux lamaquina 2.6.8.1-10mdk #1 Wed Sep 8 17:00:52 CEST 2004 i686 AMD Athlon(tm) 64 Processor 3200+ -Fingerprint Linux 2.4.22 - 2.6.8 -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<132F658&>188E0%IPID=Z%TS=1000HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux Kernel 2.6.10-ck (x86) Gentoo system -Fingerprint Linux 2.4.22 or 2.6.10 -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<29CB48E&>6AF95%IPID=Z%TS=U) -T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.22 (x86, Gentoo) -# Linux 2.6.7-hardened-r16 #1 x86_64 AMD Athlon(tm) 64 Processor 3000+ AuthenticAMD GNU/Linux -# Slackware 10 kernel 2.6.7 -# Fedora Core 2 With Kernel 2.6.8-1 -# Kernel 2.6.3 (x86); Gentoo Distro -# Gentoo Base System version 1.4.16 Linux linuxbox 2.6.9 #2 SMP+Pentium III (Coppermine) GenuineIntel GNU/Linux -# Linux kernel 2.6.10-1.760_FC3 from Fedora Core 3 -Fingerprint Linux 2.4.22 or 2.6.3 - 2.6.10 -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<11A9004&>2D341%IPID=Z%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.22-gentoo-r7 (x86) -# Linux 2.6.4-gentoo-grsec (x86) - manual patch on gentoo's kernel (gentoo-dev-sources) with grsecurity-2.0-test2-2.6.4.patch -# Linux 2.6.10 with grsecurity 2.6.10 i686 -Fingerprint Linux 2.4.22 or 2.6.4 - 2.6.10 -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.22-ck2 (x86) w/grsecurity.org and HZ=1000 patches -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=A|AS%Ops=NNT|MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.22-gentoo-r2 i686 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Linux gateway 2.4.22-gentoo-r5 #1 ven feb 6 05:25:25 CET 2004 i686 Celeron (Mendocino) GenuineIntel GNU/Linux - grsecurity patch + iptables -Fingerprint Linux 2.4.22-gentoo-r5 (x86) w/grsecurity -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.22-gentoo-rc -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<22F8152&>2CC16%IPID=RD%TS=1000HZ) -T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.23 (x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2B5505C&>6EEAA%IPID=I%TS=U) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.23-grsec w/o timestamps -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Adamantix GNU/Linux with Linux 2.4.25-grsec (x86) -Fingerprint Linux 2.4.25 w/grsec (x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.26-gentoo-r6 #1 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux -Fingerprint Linux 2.4.26 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<298F858&>6A637%IPID=I%TS=U) -T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.26 from slackware linux 10 -Fingerprint Linux 2.4.26 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2961188&>6375E%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Linux kernel 2.4.26 from Slackware 10.0 -Fingerprint Linux 2.4.26 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<3230066&>338AC%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.26 i686 GNU/Linux -Fingerprint Linux 2.4.26 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2049F82&>52A3D%IPID=Z%TS=100HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.26-gentoo-r12 #5 i686 Pentium II -# Linux 2.4.26-gentoo-r9 #14 i686 Celeron (Mendocino) GenuineIntel GNU/Linux -Fingerprint Linux 2.4.26 (gentoo) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<2E22EC4&>27AD8%IPID=I|RD%TS=100HZ) -T1(DF=N|Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.26-gentoo-r6 w/grsec -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.27-1-586tsc #1 Wed Dec 1 19:25:25 JST 2004 i586 GNU/Linux (Debian Sid) -Fingerprint Linux 2.4.27 or D-Link DSL-500T (running linux 2.4) -Class Linux | Linux | 2.4.X | general purpose -Class D-Link | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<2031130&>5267C%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.27-grsec #1 SMP i686 -# Linux 2.4.27-grsec (x86) (grsecurity 2.0.1) w/ net.ipv4.tcp_timestamps = 0 -Fingerprint Linux 2.4.27 with grsec -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) -T1(DF=Y%W=16D0|7FFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.27 with grsec -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.4.29 from Slackware 10.1.0 -Fingerprint Linux 2.4.29 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2209F48&>571E7%IPID=Z%TS=100HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=1000|C00|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Linux kernel 2.4.30 (vanilla) -Fingerprint Linux 2.4.30 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<293A11E&>6963B%IPID=Z%TS=100HZ) -T1(DF=Y%W=1578%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1578%ACK=S++|O%Flags=AS|A%Ops=MNNTNW|NNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.4-4GB #1 Wed May 16 00:37:55 GMT 2001 i586 unknown -Fingerprint Linux 2.4.4 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<10F070C&>15ACF%IPID=Z%TS=100HZ) -T1(DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1678%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.26 #6 i686 unknown unknown GNU/Linux -# Linux kernel 2.6.9-1.681_FC3 from Fedora Core 3 -Fingerprint Linux 2.4.6 - 2.4.26 or 2.6.9 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1E74A9A&>4DF5C%IPID=Z%TS=100HZ) -T1(DF=Y%W=1680|16A0|4000|7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.4.7 (x86) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2AEC8D6&>2FF0F%IPID=Z%TS=U) -T1(DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF|12CC|16D0%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.7 (zLinux on OS/390) -Fingerprint Linux 2.4.7 (zLinux on OS/390) -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<152381A&>3616E%IPID=Z%TS=100HZ) -T1(DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=3F98%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.4.18 on Alpha EV4 -# Linux 2.5.70 (x86) -# Linux 2.6.4 i686 -# Linux gentoo 2.6.7-gentoo-r11 i686 -# Linux gentoo 2.6.11-gentoo-r9 -Fingerprint Linux 2.4.7 - 2.6.11 -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.5.X | general purpose -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<20DBA72&>5419C%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux Athena 2.6.3-1-686 #2 Tue Feb 24 20:24:38 EST 2004 i686 GNU/Linux -# Linux 2.4.7 (RedHat 7.3 on SPARC) -Fingerprint Linux 2.4.7 - 2.6.11 -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1682210&>399B1%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Linux RedHat 2.4.18-5 #1 Mon Jun 10 15:31:48 EDT 2002 i686 unknown -Fingerprint Linux 2.4.9 - 2.4.18 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1C3AE82&>46383%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|800|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Mandrake Communiry 10.1 (2.6.8.1-10mdk-i586-up-1GB) -# Linux matrix 2.6.3-gentoo-r2 x86 -Fingerprint Linux 2.5.25 - 2.6.8 or Gentoo 1.2 Linux 2.4.19 rc1-rc7 -Class Linux | Linux | 2.4.X | general purpose -Class Linux | Linux | 2.5.X | general purpose -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<244F6FE&>5CF30%IPID=Z%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Xbox running Debian Linux 2.4.20 -Class Linux | Linux | 2.4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=2833E%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|C00|800%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Linux 2.5.5 (Gentoo) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<306B8C0&>6ABCE%IPID=Z%TS=1000HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Linux 2.6.0 (x86) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<269E81A&>62D97%IPID=Z%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=D0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.6.0 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<34CD71A&>861AC%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=20%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.10 #1 Wed Jan 5 12:36:35 CET 2005 i686 unknown Debian 3.0r2 -# linux gentoo kernel 2.6.10 -# Linux kernel 2.6.10-custom (x86) from Debian GNU/Linux 3.1 -Fingerprint Linux 2.6.0 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1A5ABDA&>43761%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=38|A0|B8|C8%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.3-gentoo-r1 #5 Wed Apr 7 13:48:31 EDT 2004 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux -# Gentoo 1.4.16; Kernel 2.6.7 -# Linux sarge 2.6.8-2-386 #1 Thu May 19 17:40:50 JST 2005 i686 GNU/Linux -Fingerprint Linux 2.6.0 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<16883CC&>1CD61%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Linux 2.6.8.1-12mdk #1 i686 Intel(R) Xeon(TM) CPU 2.80GHz unknown GNU/Linux -# Linux 2.6.8-1-k7 #1 i686 GNU/Linux -Fingerprint Linux 2.6.0 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<18C0F36&>3F49D%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=14|30%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.6.8-1-k7-smp (x86) Debian GNU/Linux 3.1 (Sarge - testing) -# Linux 2.6.11-gentoo-r2-ck1 -# Linux 2.6.11-gentoo-r4 #1 i686 P4CPU+2.40GHz GenuineIntel GNU/Linux Gentoo Base System version 1.4.16 -# Linux 2.6.11-gentoo-r9-nymph #1i686 Pentium III (Coppermine) GenuineIntel GNU/Linux -Fingerprint Linux 2.6.0 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=O|S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=80%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.9 #1 i686 -# Linux kernel 2.6.9 (PIII-80Mhz) -Fingerprint Linux 2.6.0 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2AB93AA&>6D5A3%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=28|40%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.6.0-test10 (x86) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<226FBCC&>58267%IPID=Z%TS=1000HZ) -T1(DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=3000%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.0-test5 x86 -Fingerprint Linux 2.6.0-test5 x86 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2D3CFA0&>73C6B%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.6.0-test7 (x86) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1488090&>34896%IPID=Z%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.6.0-test9 - 2.6.0 (x86) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<263F536&>61B8F%IPID=Z%TS=1000HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Gentoo Linux running on a UML client, Linux 2.6.10-linode12 #1 i686 UML User Mode -Fingerprint Linux 2.6.10 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2CE05FC&>72AE6%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Linux 2.6.10 i686 on IBM Thinkpad T30 -# Linux barton 2.6.10-gentoo-r6 Gentoo -# Linux 2.6.10-grsec #1 Fri Jan 28 00:37:15 CET 2005 i686 GNU/Linux -Fingerprint Linux 2.6.10 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=TR|RI%gcd=<6%SI=<321C62E&>8044F%IPID=I|RD%TS=1000HZ) -T1(DF=Y|N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.6.10 x86 Slackware 10.0 -Fingerprint Linux 2.6.10 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1FB5BDE&>51299%IPID=Z%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Ubuntu Hoary Hedgehog - Linux ubuntu 2.6.10-5-386 #1 Tue Apr 5 12:12:40 UTC 2005 i686 GNU/Linux -Fingerprint Linux 2.6.10 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<15962A2&>3740B%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Linux runerm 2.6.10-kanotix-8 #1 Wed Feb 2 16:49:31 GMT 2005 i686 GNU/Linux -# Linux Kernel 2.6.11 With some Fixes from debian/kanotix -# debian 3.1 kernel : 2.6.11-rc7 -Fingerprint Linux 2.6.10 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<249F172&>5DBEE%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=O|S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux linux 2.6.11.9 #1 Sat May 14 00:49:06 CEST 2005 i686 unknown unknown GNU/Linux -Fingerprint Linux 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=Z%TS=1000HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|400|C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.11 (gentoo-dev-sources) -Fingerprint Linux 2.6.11 (gentoo) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1F96C34&>50AA5%IPID=Z%TS=1000HZ) -T1(DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7D0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Linux 2.6.10-1.741_FC3 i686 athlon i386 GNU/Linux -Fingerprint Linux 2.6.3 - 2.6.10 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<3552DC&>8860%IPID=Z%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux Kernel 2.6.3 (x86) -# Linux 2.6.7 #3 Sat Jul 17 13:25:29 EEST 2004 i486 -Fingerprint Linux 2.6.3 - 2.6.7 (x86) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<205C682&>528B7%IPID=Z%TS=1000HZ) -T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.3-6mdksecure #1 SMP x86_64 from Mandrake 10 -# Linux 2.6.8-p4 #1 SMP i686 GNU/Linux -Fingerprint Linux 2.6.3 or 2.6.8 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<24F1576&>1E7BD%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# LINUX Suse 9.1 Professional Kernel 2.6.4 i686 -Fingerprint Linux 2.6.4 (Suse) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1B18996&>45556%IPID=Z%TS=1000HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Slackware current kernel 2.6.9 -# Fedora Core 3 Linux Kernel 2.6.9 x86 (i386) -# Linux kernel 2.6.4-52 from (x86) SuSE Linux 9.1 -# Debian Sarge Linux 2.6.6-1, i686 (x86) -Fingerprint Linux 2.6.4 - 2.6.9 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<28A04EC&>2F60A%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=1000|800|C00|400%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|1000|400|800%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Linux 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux -Fingerprint Linux 2.6.5 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<265B754&>6225F%IPID=Z%TS=1000HZ) -T1(DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1680%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Linux 2.6.7-gentoo-r11 #2 Wed Jul 28 23:25:03 PDT 2004 i686 Pentium II (Deschutes) -# Linux 2.6.8-rc3 #1 Sat Aug 7 07:19:34 EDT 2004 i686 GNU/Linux -# Debian Sarge GNU/Linux kernel 2.6.8-1 (i386) -# Linux 2.6.7-hardened-r17 Gentoo -# Linux 2.6.9-1.681_FC3smp #1 SMP i586 i586 i386 GNU/Linux (Fedora Core 3+kernel as supplied) -# Linux 2.6.8-1-686 from Debian sid -# SuSE Linux Prefessional 9.1, with kernel 2.6.10 -# Linux 2.6.8, PLD distribution, SMP -# Linux 2.6.11.4-20a-default #1 i686 i686 i386 GNU/Linux from+Suse 9.3 -# Linux 2.6.8-24.11-default #1 Fri Jan 14 13:01:26 UTC 2005 i686 i686 i386 GNU/Linux -# Linux 2.6.5-7.155.29-default #1 Thu Jun 2 12:07:05 UTC 2005 i686 i686 i386 GNU/Linux (SuSE+9.2 ) -# Linux Debian Sarge 2.6.11.7 -# Linux kernel 2.6.10-4GB (x86) with Debian GNU/Linux 3.1 -# Linux Kernel 2.6.7-1-686-smp from backports.org Debian Woody -Fingerprint Linux 2.6.5 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2BF6254&>70895%IPID=Z%TS=1000HZ) -T1(DF=Y%W=15E0|16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Linux 2.6.9 #1 i686 Intel(R) Pentium(R) 4 CPU 3.06GHz+GenuineIntel GNU/Linux -# Linux kernel 2.6.10-rc3 from Gentoo on an Ultra 1 (sparc) -# Linux 2.6.5 i686 P42.00GHz, Gentoo Base System version 1.6.6, Portage+2.0.51-r3 -# Gentoo Linux 2004.1 PPC (old blue and white G3) Kernel 2.6.11.7 -Fingerprint Linux 2.6.5 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<360764E&>48D40%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0|C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Linux 2.6.6-rc2-bk3 -Fingerprint Linux 2.6.6 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2E04BFE&>4ADED%IPID=Z%TS=1000HZ) -T1(DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1164%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.6.6-1-k7 (x86) from Debian Testing -Fingerprint Linux 2.6.6-1-k7 (x86) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<235C288&>5A817%IPID=Z%TS=1000HZ) -T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.7-tp #5 i686 GNU/Linux -Fingerprint Linux 2.6.7 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<13C059A&>1B365%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=14%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.6.7 with grsecurity patches -Fingerprint Linux 2.6.7 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.7-hardened-r16 (Gentoo hardened-dev-sources) x86 -# Linux 2.6.7-hardened-r16 #3 SMP i686 GNU/Linux (grsec+pax, gentoo hardened-dev-sources)) -Fingerprint Linux 2.6.7 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.6.7 (x86) from Mepis -Fingerprint Linux 2.6.7 (x86) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<14E7284&>35813%IPID=Z%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux kernel 2.6.8 on PLD Linux -# Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 Community -# Linux kernel 2.6.8.1-10mdk (x86) from Mandrake 10.1 community -# Linux kernel 2.6.7-SMP from Knoppix 3.6 -# Linux 2.6.8.1-4-k7 i686 GNU/Linux -Fingerprint Linux 2.6.7 - 2.6.8 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1D19DA8&>4A672%IPID=Z%TS=1000HZ) -T1(DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=830|159C|474C%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Linux 2.6.7 w/grsecurity.org patch -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.8-24.14-smp GNU/Linux Suse Linux 9.2 Professional -Fingerprint Linux 2.6.8 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=1ED0B%IPID=Z%TS=1000HZ) -T1(DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux Mandrake 10.1, i586, kernel 2.6.8.1-12mdk -# Linux 2.6.8.1-12mdk #1 Fri Oct 1 12:53:41 CEST 2004 i686 AMD Athlon(tm) XP 3000+ unknown GNU/Linux -Fingerprint Linux 2.6.8 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1E91DE8&>4E3D1%IPID=Z%TS=1000HZ) -T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.8-1.521 #1 i686 athlon i386 GNU/Linux -Fingerprint Linux 2.6.8 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=20154%IPID=I%TS=1000HZ) -T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.8-2-k7 #1 Thu May 19 18:03:29 JST 2005 i686 GNU/Linux -# Linux 2.6.8-2-386 #1 Mon Jan 24 03:01:58 EST 2005 i686 GNU/Linux, from Debian testing -Fingerprint Linux 2.6.8 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<32035F2&>2A223%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000|400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00|800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|800|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Debian Sarge Kernel 2.6.8 -Fingerprint Linux 2.6.8 (Debian) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2C96D4E&>34B7A%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux ubuntu 2.6.8.1-5-386 #1 Sat Feb 12 00:19:31 UTC 2005 i686 GNU/Linux -Fingerprint Linux 2.6.8 (Ubuntu) -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<10F66C0&>2B6A6%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Linux kernel 2.6.8.1 from Debian sarge netinst -# Linux kernel 2.6.11-1.27 from Fedora Core 3 -Fingerprint Linux 2.6.8 - 2.6.11 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<23C986A&>4BB91%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNT) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.9-gentoo-r13Hipcia #3 i686 Pentium III (Coppermine) GenuineIntel GNU/Linux -# Linux 2.6.8-1-686-smp #1 SMP i686 GNU/Linux from Debian 3.1 -Fingerprint Linux 2.6.8 - 2.6.9 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<11DFD8E&>15CCF%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Linux 2.6.9-1.649 FC Rawhide -# Linux kernel 2.6.9 (x86_64) from kernel.org -Fingerprint Linux 2.6.9 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<13935EA&>32119%IPID=Z%TS=1000HZ) -T1(DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5AC|1540%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.9-1.681_FC3 #1 i686 i686 i386 GNU/Linux Fedora Core 3 -Fingerprint Linux 2.6.9 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1BA9D60&>26DF4%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Linux 2.6.5 (Gentoo) -# Linux 2.6.8 (Fedora Core 2) -# Fingerprint Linux kernel 2.6.8-1.521 Fedora 2 -Fingerprint Linux kernel 2.6.5 - 2.6.8 -Class Linux | Linux | 2.6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<17F9116&>3D580%IPID=Z%TS=1000HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint ComOS based terminal server - Livingston PortMaster or U.S. Robotics/3Com Total Control -Class Livingston | ComOS || terminal server -Class 3Com | ComOS || terminal server -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint ATT UNIX SVR4.2 on a Lucent Definity voicemail system -Class Lucent | BSD-misc || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Lucent Portmaster 4 running ComOS v4.0.3c2 -Class Lucent | ComOS || terminal server -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# http://www.sics.se/~adam/lwip/ -Fingerprint lwIP (Lightweight TCP/IP stack) version lwip-0.5.3-win32 -Class lwIP | lwIP || general purpose -TSeq(Class=TD%gcd=<6%SI=<3C%IPID=I%TS=U) -T1(DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5000%ACK=S++%Flags=AS%Ops=ME) -T4(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# M0n0wall 1.2b2 - Firewall based on FreeBSD 4.1 -# M0n0wall 1.2b2 FreeBSD-based firewall running on PC Engines WRAP board (Geode x86 architecture) -# m0n0wall FreeBSD based firewall (http://m0n0.ch/wall/) version 1.2b3 (version 1.2 beta 3) generic PC -# m0n0wall Router/Captive portal version 1.2b8 running on stripped down version of FreeBSD -Fingerprint M0n0wall 1.2b2 - 1.2b8 FreeBSD 4.1 based firewall -Class m0n0wall | FreeBSD | 4.X | firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=1000HZ) -T1(DF=Y%W=E000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# m0n0wall or pfsense firewall distro based on FreeBSD 5.3 -# M0n0wall (FreeBSD 5.3 based) with firmware beta version 1.2b7 -Fingerprint M0n0wall 1.2b7 FreeBSD 5.3 based firewall -Class m0n0wall | FreeBSD | 5.X | firewall -TSeq(Class=TR%gcd=<6%TS=1000HZ) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Madge Smart Ringswitch -Class Madge | embedded || switch -T1(DF=N%W=1F4%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1F4%ACK=S++%Flags=AS%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Magna SG10 intranet router -Class Magna | embedded || router -TSeq(Class=RI%gcd=<6%SI=<31AD68E&>5F62F%TS=100HZ) -T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Maxim-IC TiniOS DS80c400 -Class Maxim-IC | TiniOS || general purpose -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Maxim/Dallas TINI embedded Java v1.02b -Class Maxim-IC | TiniOS || general purpose -TSeq(Class=TD%gcd=<1F408%SI=<28%IPID=Z%TS=U) -T1(DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|) -T2(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1000|0%ACK=S++%Flags=AS|AR%Ops=M|) -T4(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=4C%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) - -# Maxim/Dallas TINI embedded Java v1.11 -# Dallas Semiconductor TINI OS 1.02d -Fingerprint Maxim/Dallas TINI embedded Java v1.02d -Class Maxim-IC | TiniOS || general purpose -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint MegaBit Gear TE4111C modem -Class Megabit | embedded || terminal server -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Meridian Data Network CD-ROM Server (V4.20 Nov 26 1997) -Class Meridian | embedded || storage-misc -TSeq(Class=TD%gcd=40000%SI=20%TS=U) -T1(DF=N%W=4238%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4238%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Microsoft Xbox Console running Xbox Media Centre version 1.1.01 -# Microsoft Xbox (modified) running EvolutionX -Fingerprint Microsoft Xbox (modified) -Class Microsoft | embedded || game console -TSeq(Class=TD%gcd=<6%SI=<2E4%IPID=I%TS=U) -T1(DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=41A0|4238|FC00%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Xbox V1.1 Running Evolution-X Dashboard v1.8.3752 -Fingerprint Microsoft Xbox (modified) running evolutionX -Class Microsoft | embedded || game console -TSeq(Class=RI%gcd=<6%SI=<5A14&>20%IPID=I%TS=U) -T1(DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=41A0%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Microsoft Xbox (modified) running UnleashX 0.26 -Class Microsoft | embedded || game console -TSeq(Class=RI%gcd=<6%SI=99%IPID=I%TS=U) -T1(DF=N%W=8470%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=8470%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Microsoft Windows Longhorn Preview, Version 6.0 Build 4051.idx 02.031001-1340 -Fingerprint Microsoft Windows Longhorn Preview -Class Microsoft | Windows Longhorn || general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows Server 2003, Enterprise Edition, Build 3790 -# Microsoft .NET Enterprise Server RC2 (Version 5.2 build 3718.dnsrv.021114-1947) -# Microsoft Windows .NET Enterprise Server RC2 (Version 5.2, build 3718.dnsrv.021114-1947) -# Windows Server 2003 Standard Edition. no SP, all current hotfixes -Fingerprint Microsoft Windows 2003 Server -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Microsoft Windows 2003 Server Edition, no service packs -Fingerprint Microsoft Windows 2003 Server -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL) -T4(DF=N%W=C00|400%ACK=S%Flags=R%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|800|1000%ACK=S%Flags=R%Ops=WNMETL) -T7(DF=N%W=C00|1000|400%ACK=S%Flags=R%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Microsoft Windows 2003 Server -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=80%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Microsoft Windows 2003 Server (Version 5.2 build 3790.srv03_rtm.030324-2048) -Fingerprint Microsoft Windows 2003 Server -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2003 Server -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=FB8B%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2003 Server -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows Server 2003 Enterprise Edition (English) with latest Windows Update patches as of September 2, 2004 -Fingerprint Microsoft Windows 2003 Server Enterprise Edition -Class Microsoft | Windows | 2003/.NET | general purpose -T1(DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=B630%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2003 Server Enterprise Edition -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Microsoft Windows Server 2003, Enterprise Edition, no service packs, (build 3790.srv03_rtm.030324-2048) -# Microsoft Windows XP Professional (English) SP2 with latest updates through Nov. 24, 2004 -Fingerprint Microsoft Windows 2003 Server Enterprise Edition or XP Pro SP2 -Class Microsoft | Windows | 2003/.NET | general purpose -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=6360%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows.NET Enterprise Server (build 3615 beta) -# Windows .NET Standard Server build 3604 -# Microsoft Windows 2003 Standard Build V5.2.3790 build 3790 -# Microsoft Windows 2003 Server - Web edition - all available critical fixes as of 15th feb 2004 -# Windows 2003 Standard Edition RTM -# Window Server 2003 Enterprise Edition Swedish -# Microsoft Windows XP Professional (English) w/ SP2 RC1 build 2600.xpsp_sp2_rc1.040311-2315 - WINDOWS FIREWALL DISABLED -# Microsoft Windows 5.2 Build 3790.srv03_rtm.030324-2048 -# Microsoft Windows Version 5.1 (Build 2600.spdp_sp2_rtm.040803-2158 : Services Pack 2) -Fingerprint Microsoft Windows 2003 Server or XP SP2 -Class Microsoft | Windows | 2003/.NET | general purpose -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E|FB8B%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -# Microsoft Windows XP Pro (French) version:2002 SP2 -# Microsoft Windows Server 2003 version 5.2 (Build 3790.srv03_gdr.040410-1234) -# Microsoft Windows Server 2003 Enterprise Edition (Trial Version downloaded from Microsoft as at 06/03 -# Microsoft Windows 2003 Server Enterprise Edition (German) build 3790.srv03_rtm.030324-2048 -# Microsoft Windows .NET Standard Server RC#2 (build 3718) -# Microsoft Windows XP Professional version 2002 service pack 2 -# Microsoft Windows XP Home Edition (English) SP2 Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) -# Microsoft Windows XP Home /SP2 Polish Edition -Fingerprint Microsoft Windows 2003 Server or XP SP2 -Class Microsoft | Windows | 2003/.NET | general purpose -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y|N%W=2017|402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0|20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -# Windows Server 2003, build 3790 -# Microsoft Windows XP Media Center Edition -Fingerprint Microsoft Windows 2003 Server or XP SP2 -Class Microsoft | Windows | 2003/.NET | general purpose -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Microsoft Windows 2003 Server with SP1 and latest Windows Update patches as of May, 2005 -# Windows Server 2003 w/ SP1, build 3790.srv03_sp1 -# Microsoft Windows 2003 Server, version SBS 2003 Premium, just after Windows Server SP1 installed -# Windows Server 2003 Version 5.2 (Build 3790.srv03_sp1_rtm.050324-1447: Service Pack 1 -# Windows Server 2003 w/ SP1, build 3790.srv03_sp1 -Fingerprint Microsoft Windows 2003 Server SP1 -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows Server 2003 SP1 [Version 5.2.3790] -# Windows 2003 Service Pack 1 32 Bit Running on Abit Mobo AMD64 -Fingerprint Microsoft Windows 2003 Server SP1 -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows 5.2 (Build 3790.srv03_sp1_rtm.050324-1447 : Service Pack 1) -# Windows Server 2003 SP1 all patches as of June-23-05 -Fingerprint Microsoft Windows 2003 Server SP1 -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2003 Server Standard Edition -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=20%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2003 Server Standard Edition -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=800|400%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2003 Server Standard Edition (Build 3790.srv03_gdr.040410-1234) -Fingerprint Microsoft Windows 2003 Server Standard Edition -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Microsoft Windows 2003 Server Standart Edition SP1 -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=5C%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows 2003 standard edition version 5.2 build 3790.srv03_rtm.030324-2048 and lastest windows updates patches as november 9, 2004 -Fingerprint Microsoft Windows 2003 standard edition -Class Microsoft | Windows | 2003/.NET | general purpose -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows Server 2003, No Service Packs build 3790.srv03_gdr.040410-1234 -Fingerprint Microsoft Windows Server 2003 -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Microsoft Windows Server 2003 Enterprise Edition Version 5.2.3790 -Fingerprint Microsoft Windows Server 2003 Enterprise Edition -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=10%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 3.1 with Trumpet Winsock 2.0 revision B -Class Microsoft | Windows | 3.X | general purpose -TSeq(Class=TD%gcd=10000%SI=D%IPID=RPI%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 98 4.10.2222.A -# "Windows 98SE, patched up to date" (1/25/03) -Fingerprint Microsoft Windows 98SE -Class Microsoft | Windows | 95/98/ME | general purpose -TSeq(Class=TD%gcd=2D1%IPID=I) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows ME + all updates as of 1/1/03 -Fingerprint Microsoft Windows Millennium Edition (Me) -Class Microsoft | Windows | 95/98/ME | general purpose -TSeq(Class=RI%gcd=<8%SI=<1DA74&>117%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows Millennium (German) 4.90.3000 -Fingerprint Microsoft Windows Millennium Edition (Me) -Class Microsoft | Windows | 95/98/ME | general purpose -TSeq(Class=RI%gcd=<6%SI=<249A0&>3B6%IPID=I) -T1(DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2180|E920%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows Millenium Edition v4.90.300 -# Windows Me or Windows 2000 RC1 through final release -# Microsoft Windows 2000 Advanced Server -# Windows 2000 with SP2 and long fat pipe (RFC 1323) -# Windows 2000 Professional Service Pack 3 -# Windows 2000 5.00.2195 Service Pack 2 and latest hotfixes -# Windows 2000 Professional (x86) -# Compaq ProLiant DL-380G2 running Windows 2000 with SP3 and all the current patch sets (2/3/03) -# Windows XP Professional version 2002 on PC Intel processor -# Windows XP Build 2600 -# XP Professional 5.1 (build 2600).. all patches up to June 20, 2002 -# Fingerprint Microsoft Windows XP Professional with all current updates to May 2002 -# Windows 2000 Version 5.0 Build (2195: Service Pack 3) -# Windows 2000 Advanced Server SP3 -Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000 Professional or Advanced Server, or Windows XP -Class Microsoft | Windows | 95/98/ME | general purpose -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=49C%IPID=I%TS=0) -T1(DF=Y%W=5B4|14F0|16D0|2EE0|402E|4470|8052|B5C9|B580|C000|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=NNT|MNWNNT) -T2(Resp=Y|N%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=5B4|14F0|16D0|2EE0|4470|8052|B5C9|B580|C000|402E|D304|FAF0|FC00|FD20|FD68|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -# Windows NT 3.51 SP5 -Fingerprint Microsoft Windows NT 3.51 SP5, NT 4.0 or 95/98/98SE -Class Microsoft | Windows | 95/98/ME | general purpose -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TD|RI%gcd=1|2|3|4|5|A|14|1E|28|5A%SI=<1F4%IPID=BI|RPI|RD%TS=U|0) -T1(DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=A|AS%Ops=|M|MNWNNT) -T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y|N%W=2017|3908|16D0|860|4470|61A8|7FFF|8000|869F|9C40|FAF0%ACK=S++%Flags=AS%Ops=M|MNWNNT) -T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++|S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Microsoft Windows XP Professional (English) w/ SP2 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) -# Widows XP Professional (English UK) SP2 - latest patches as of 20 Dec 2004 - build 2600.xpsp_sp2_rtm.040803-2158 -# Microsoft Windows XP Home Edition (French) SP2 build 2600.xpsp_sp2_rtm.040803-2158 -# Microsoft Windows XP Profesional (English) SP2 Ver 5.1 build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2 -Fingerprint Microsoft Widows XP SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=805C|88A4|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=805C|88A4|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Advanced Server SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<22FBA&>28B%IPID=I) -T1(DF=Y%W=7530%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7530%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Advanced Server SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<206B6&>2E7%IPID=I) -T1(DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000|FEE2%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Advanced Server SP3, all available updates as of 11/13/02 -Fingerprint Microsoft Windows 2000 Advanced Server SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<58066&>3E9%IPID=I) -T1(DF=Y%W=402E|FFF0%ACK=S++%Flags=AS%Ops=MNNT|MNWNNT) -T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Windows 2000 Advanced Server Service Pack 4 With ALL updates as of October 9th 2003 Winver: Version 5 build 2195 SP4 -Fingerprint Microsoft Windows 2000 Advanced Server SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1FD06&>42A) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Advanced Server SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<7CE98&>6B7) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Windows 2000 Advanced Server Version 5.0 (Build 2195: Service Pack 4) -Fingerprint Microsoft Windows 2000 Advanced Server SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Professional -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1C476&>472) -T1(DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y|N%W=2238%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|20|80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Professional (Russian) SP2 with some antiworm patches (MS04-011 etc.), firewalled with wipfw (http://wipfw.sourceforge.net) dropping TCP_SYNFIN -# Microsoft Windows 2000 Professional Rus with SP2 with only Sasser etc. patches -Fingerprint Microsoft Windows 2000 Professional (Russian) SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<3073C&>393) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Professional RC1 or Windows 2000 Advanced Server Beta3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=<27D922&>65EE) -T1(DF=Y%W=402E|2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E|2017%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows NT 5 Beta2 or Beta3 -# Microsoft Windows 2000 Professional Edition (English) Build 2195 with SP2 - x86 -Fingerprint Microsoft Windows 2000 Professional SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TD%gcd=<6%SI=<1000) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++|O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows 2000 Professional Build 2195 Service Pack 3 -Fingerprint Microsoft Windows 2000 Professional SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1BB0C&>2DC%IPID=I%TS=U) -T1(DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=1F8C|9448%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# base one msg 170, 666 -# Windows 2000 Professional SP4 fully patched as of 10/20/04 -# Microsoft Windows 2000 Professional SP4 and latest Windows Update as of December 8th, 2004 -# Microsoft Windows 2000 Professional Version: 5.0.2195 Service Pack 4 Build 2195 -# Microsoft 2000 Professional SP4 CPU AMD -Fingerprint Microsoft Windows 2000 Professional SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR|RI%gcd=<6%SI=<2B0D4&>22E%IPID=I) -T1(DF=Y%W=2238|7D78|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2238|7D78|8753|9FFF|FC94%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Professional SP4 build 2195 -Fingerprint Microsoft Windows 2000 Professional SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<29B6C&>2EF%IPID=I%TS=U) -T1(DF=Y%W=FB06|FF70%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FB06|FF70%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Server SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1B26A&>26A%IPID=I%TS=U) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Server SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<25224&>22C%IPID=I) -T1(DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=5B4|B68%ACK=S++%Flags=AS%Ops=MNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Server with Service Pack 3 and MS Exchange 2000 Server -Fingerprint Microsoft Windows 2000 Server SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=186%IPID=I) -T1(DF=Y%W=FAF0%ACK=S++%Flags=A%Ops=NNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Server SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=<255BC&>24F%IPID=I) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Server SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<230DC&>388%IPID=I) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E|F%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# Windows (XP Pro) version 5.1 (numero 260.xpsp2.030422-1633:Service Pack 1) -Fingerprint Microsoft Windows 2000 Server SP3 or Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<24F5E&>47E%IPID=I%TS=U) -T1(DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16D0|B680|FAF0|FF3C%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Server (Spanish) with SP4 build 2195 -Fingerprint Microsoft Windows 2000 Server SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<67DF4&>2FB%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=A%Ops=NNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Server with SP4 and Windows Update patches as of January 14, 2005. -# Microsoft Windows 2000 Server with SP4 and latest Update Patches as of January 10 2005 -Fingerprint Microsoft Windows 2000 Server SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=110C) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S|S++%Flags=AR%Ops=) -PU(DF=N%TOS=C0|68%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Windows 2000 Server Edition Version 5.0 (Build 2195: Service Pack 4) -Fingerprint Microsoft Windows 2000 Server SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<21E62&>256%IPID=I) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Server SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=6AA%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows 2000 Server SP4 with all current patches april 9th 2005 -Fingerprint Microsoft Windows 2000 Server SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1C3B8&>157%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows 2003 Standard build 3790 -# Microsoft Windows 2003/.NET Standard Edition -# Windows 2000 Server with SP4 fully patched as of 10/8/04 -Fingerprint Microsoft Windows 2000 Server SP4 or 2003 Server Standard Edition -Class Microsoft | Windows | NT/2K/XP | general purpose -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNNT) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Server with SP4 and no other updates -# Windows 2000 Server SP 4 + ALL patches at 25 Sep. 2003 -# Windows XP Professional SP1 and latest Windows Update patches as of Oct 04, 2004 -Fingerprint Microsoft Windows 2000 Server SP4 or XP SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2B430&>5AD%IPID=I) -T1(DF=Y%W=FA00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1F216&>251%IPID=I) -T1(DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FF3C%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Build 2195 Service Pack 1 -Fingerprint Microsoft Windows 2000 SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<220164&>80000%TS=U) -T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows 2000 version 5 build 2195 Service Pack 2 -Fingerprint Microsoft Windows 2000 SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<270D8&>4BF%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=28%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1D362&>237%IPID=I) -T1(DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=4000|C350%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2FE90&>6F9%IPID=I%TS=U) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2928E&>4B7%IPID=I%TS=U) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Professional SP2 -# Microsoft Windows XP Professional SP1 -# Microsoft Windows XP Professional, ver. 5.1 Build 2600.xpclnt_qfe.010827-1803 -Fingerprint Microsoft Windows 2000 SP2 or XP or XP SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<327F6C&>3E9%IPID=I) -T1(DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FD80%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# base on msg 1039 -# Microsoft Windows 2000 SP2 with Hotfix Q300972, Q301625 -Fingerprint Microsoft Windows 2000 SP2 with Hotfix (Pre-SP3) -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=<1E08C&>15A%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|1000|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|C00|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|1000|800%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 Professional with SP3 and latest Windows Update -# patches as of August 22, 2003 - Laptop using G-Trans PCMCIA CDMA -# Wireless card. -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<39062&>5B5%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2382B18&>5AE4C%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1A748&>D9%IPID=I%TS=U) -T1(DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FC00%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 SP3 -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2425C&>383%IPID=I) -T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<13EEB2&>2BD%IPID=I%TS=U) -T1(DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N|Y%W=7FFF|F990%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 [Version 5.00.2195] SP3 -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<269EE&>2EC%IPID=I) -T1(DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=111C|FC00|E01F|FF00|FF70%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|D0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 SP3 -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<28B54&>31B%IPID=I) -T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows 2000 5.00.2195 with SP 3 -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<876AE&>98E) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<15374&>110%IPID=I) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=80%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Microsoft Windows 2000: v5.00.2195: SP4 -Fingerprint Microsoft Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=400|1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|C00|800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 with SP4 ( version 5.0 (build 2195: sp 4) ) -Fingerprint Microsoft Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<17D54&>2B4%IPID=I%TS=U) -T1(DF=Y%W=FFFF%ACK=S++|O%Flags=AS|A%Ops=MNW|) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Windows 2000 Professional 5.00.2195 SP4 incl. latest Hotfixes till 30.12.2004 -# Microsoft Windows 2000 build 2195 SP 4 -Fingerprint Microsoft Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<139354&>972%IPID=I%TS=U) -T1(DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 build 2195 SP4 with update patches through 4/22/2004 -Fingerprint Microsoft Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1BFDA&>357%IPID=I%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=A06%IPID=I%TS=U) -T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<51CB6&>2DF%IPID=I) -T1(DF=Y%W=B547%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=B547%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Fingerprint Windows 2000 build 5.00.2195 SP4 -Fingerprint Microsoft Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=<78816&>95%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows 2000 Version 5.0 Build 2195 SP 4 x86 -Fingerprint Microsoft Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=4204|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=4204|FFAF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows Version 5.0 build 2195 SP 4 -Fingerprint Microsoft Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=7FFF|832C|FA00%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7FFF|832C|FA00%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 SP4 and latest Windows Update patches as of Sept 26, 2003 running BlackICE -# Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of September 01, 2003 -Fingerprint Microsoft Windows 2000 SP4 or Windows XP SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1E58A2&>1517) -T1(DF=Y%W=2238|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# base on msg 2213(-2210), 2378, 2473, 2476, 2174, 2153, 1942, 1955 -# Microsoft Windows 2000 Professional (German) with SP4 build 2195 and latest Windows Update patches (2005.5.19) -# Windows 2000 terminal version 5.0 build 2195 service pack 4 -# Microsoft Windows 2000 Professional SP4 and latest Windows Update patches (2005.6.11) -# Microsoft Windows 2000 Server with SP4 and latest Windows Update patches as of May 17, 2005 -# Windows XP Professional Version 2002 Service Pack 1 -# Microsoft Windows 2000 Advanced Server SP4 -Fingerprint Microsoft Windows 2000 SP4 or XP SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=B547|FC00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=B547|FC00|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows Server 2003 Standard Edition -# Microsoft Windows 2003 standard edition Version 5.2 (Build 3790.srv03_gdr.040410-1234) -# Microsoft Windows 2003 Server with SP1 -# Windows Server 2003 Enterprise SP1 + hotfixes (build 3790.srv30_sp1_rtm.050324-1447 : Service Pack 1) -# Windows 2003 Enterprise SP1 Version 5.2 (Build 3790.srv03_sp1_rc1.041202-1618 : +Service Pack 1, v.1) -# Microsoft Windows XP Professional /w SP2 build 2600.xpsp_sp2_rtm.040803-2158 -# Microsoft Windows 2003 Standard Edition SP1 Updated through June 19th 2005 -# Windows Server 2003 Enterprise Edition (Version 5.2 Build 3790.srv03_sp1_rtm.050324-1447 : +Service Pack 1) -Fingerprint Microsoft Windows 2003 Server, 2003 Server SP1 or XP Pro SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000|402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2000 with Service Pack 3 -# Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of February 1st, 2003 -Fingerprint Microsoft Windows Millennium Edition (Me), Windows 2000, or Windows XP -Class Microsoft | Windows | NT/2K/XP | general purpose -Class Microsoft | Windows | 95/98/ME | general purpose -TSeq(Class=RI%gcd=<20%SI=240) -T1(DF=Y%W=40E8|5B8E|7FFF|FAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=40E8|5B8E|7FFFFAF0|FEF4%ACK=S++%Flags=AS%Ops=MNWNNT|MNW|M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows NT 3.10 (Build 528) -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI|TD%gcd=<24%SI=<69A%IPID=I%TS=U) -T1(DF=N%W=1400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows NT 4.0 Server SP5-SP6 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=<11784E&>2CA4) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows NT 4.0 SP 6a + hotfixes -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<40132&>290%IPID=BI|RPI%TS=U) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) -PU(Resp=N|Y) - -Fingerprint Microsoft Windows NT 4.0 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TD|RI%gcd=<18%SI=<2A00DA&>6B73) -T1(DF=Y%W=7FFF|2017%ACK=S++%Flags=AS%Ops=M|MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7FFF|2017%ACK=S++|O%Flags=AS|A%Ops=M|NNT) -T4(DF=N%W=0%ACK=O|S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O|S++%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows NT 4.0 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TD%gcd=21A) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows NT 4.0 Service pack 6 w/exchange 5.5 -# Microsoft Windows NT 4.0 service pack 6 (English) -Fingerprint Microsoft Windows NT 4.0 SP6 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=<1F9C8&>FA%IPID=BI|RPI|RD%TS=U) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows NT4.0 Workstation SP6a -# Windows NT4.0 with Service Pack 6 -# Microsoft Windows NT4.0 Terminal Server Edition with Service Pack 6 and Citrix MetaFrame 1.8 with Service Pack 4 -Fingerprint Microsoft Windows NT 4.0 SP6a -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=112%IPID=RPI|BI%TS=U) -T1(DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=4470|7210|8000|AC00|FC00%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows NT 4.0 SP6a -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<8D3CE&>1017%IPID=RPI|RD%TS=U) -T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows NT 4.0 SP6a with Kerio WinRoute Pro 4.27 Firewall -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TD%gcd=<8%SI=<8C%IPID=BI|RPI%TS=U) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) -T5(DF=N%W=1000|400|800%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) -PU(DF=N%TOS=60%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows NT 4.0 Terminal Server Edition -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=1D4%IPID=BI%TS=U) -T1(DF=N|Y%W=0|2017%ACK=S++%Flags=AR|AS%Ops=|M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N|Y%W=0|2017%ACK=O|S++%Flags=AR|AS%Ops=|M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Windows NT Version 4.0 (Build 1381 - Service Pack 6), Revised Service Pack 6a -Fingerprint Microsoft Windows NT 4.0 Workstation SP6a -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TD%gcd=<8%SI=<46%IPID=RPI|RD|BI%TS=U) -T1(DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7210%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows NT 4.0 Workstation SP6a -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TD%gcd=<6%SI=<46%IPID=BI%TS=U) -T1(DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FC00%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows NT Version 4 (Build 1381) Service Pack 6a -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<377BC&>3BB%IPID=RPI|BI%TS=U) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|800%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP [Version 5.1.2600] -Fingerprint Microsoft Windows XP -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2C09C&>2CB%IPID=I%TS=U) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Microsoft Windows XP Home Edition -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<23C4E&>330%IPID=I%TS=U) -T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Home Edition (English) SP2 build 2600.xps_p2_gdr.050301:1519 -Fingerprint Microsoft Windows XP Home Edition (English) SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=F%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Microsoft Windows XP Home Edition (German) SP1 -# ver 5.1 build 2600.xpsp2.030422-1633 : SP 1; German version -# Microsoft Windows XP Home Edition (German) SP1 -Fingerprint Microsoft Windows XP Home Edition (German) SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<129062&>775%IPID=I) -T1(DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FF3C|7FFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Microsoft Windows XP Version 5.1 Home German SP2 (Build 2600.xpsp_sp2_rtm.040803-2158 : SP2), latest Updates as of Oct 27, 2004 -Fingerprint Microsoft Windows XP Home Edition (German) SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Home Edition (English) SP1 Version 5.1.2600.1106 build 2600 xpsp.1.020828-1-920 -Fingerprint Microsoft Windows XP Home Edition SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<163E6&>31F%IPID=I) -T1(DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FD5C%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Home Edition (Italian) SP1 build 2600.xpclnt_qfe.021108-2107 -# Windows XP Home Edition SP2 -Fingerprint Microsoft Windows XP Home Edition SP1 or SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2522E&>381%IPID=I%TS=U) -T1(DF=Y%W=1FE0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows XP Professional WITHOUT ANY service packs -# Windows XP SP1 -Fingerprint Microsoft Windows XP Pro -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2EBEE&>45E%IPID=I%TS=U) -T1(DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=F424%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# No service packs -Fingerprint Microsoft Windows XP Pro (German) -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1074EE&>E48%TS=U) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Microsoft Windows XP Prof Corporate (German) SP1 + all Security Updates as of Febr. 10, 2004 -Fingerprint Microsoft Windows XP Pro (German) SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<15BA8&>2DA%IPID=I%TS=U) -T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP Pro (German) SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<23E9C&>195%IPID=I) -T1(DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=3240%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# No service packs -Fingerprint Microsoft Windows XP Pro (Italian) -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<3CF14&>33C) -T1(DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7D00%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Fingerprint Microsoft Windows XP Pro (Spanish) SP2 -Fingerprint Microsoft Windows XP Pro (Spanish) SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Microsoft Windows XP Pro or Windows 2000 Professional SP2+ -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<16%SI=<25AEE&>6B%IPID=I) -T1(DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=402E|7D78|FAF0%ACK=S++|O%Flags=AS|A%Ops=MNWNNT|NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP Pro RC1+ through final release -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=<2959A&>356%IPID=I) -T1(DF=Y|N%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microaodr Windows XP Pro with SP! and latest Windows Update patches as of June 1, 2005 -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# bsed on msg 2236, 1304 -# Microsoft R Windows Version 5.1 (Build 2600.xpsp2.040919-1003 : Service Pack 1) -# Microsoft Windows XP version 5.1 (no. 2600 xpsp2.040919-1003: Service Pack 1) -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2553A&>42E%IPID=I) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNT) -T2(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<31812&>7D7%IPID=I) -T1(DF=Y%W=7D00%ACK=O|S++%Flags=A|AS%Ops=NNT|MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Professional Edition Version 5.1 Build (2600.xpsp2.030422-1633: Service Pack 1) -# Microsoft Windows XP Professional SP1 and latest patches as of Jan 31,2004 -# Microsoft Windows XP Professional (Italian) SP1 build 2600.xpsp2.030422-1633# Microsoft Windows XP Pro (Spanish) SP1 (Build 2600.xpsp2.030422-1633 : Service Pack 1) Intel -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<29446&>49E%IPID=I) -T1(DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=733C|96F0|DA58|FCA4%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=<10225A&>105E) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=30%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Windows XP Version 5.1 (Build 2600.xpsp2.030422-1633: Service pack 1) -# Windows XP Professional With serice pack 1... English.. 2600.xpsp1.020828-1920 -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<9A6AA&>18A0%IPID=I%TS=U) -T1(DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS|A%Ops=M|) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=4470|771C|8820|FAF0|F990%ACK=S++|O%Flags=AS||A%Ops=M||) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows XP Professional Version 5.1 (Build 2600.xpsp2.030422-1633: Service Pack1) -# Windows XP SP1 running ZoneAlarm -# Microsoft Windows XP Professional Version 5.1 (Build 2600.xpsp2_gdr.040517-1325: Service Pack 1) -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<63826&>D28%IPID=I%TS=U) -T1(DF=Y%W=3BB8|6270|8000|9448|A1D3|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=3BB8|6270|8000|9448|A1D3|AE4C|E7B0|F990%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2F7D8&>239%IPID=I) -T1(DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FEF4%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<14686&>1A0%IPID=I) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows Xp Professional Service Pack 1 version 5.1 - Build 2600 -# Microsoft Windows XP version 5.1 (build 2600.xpsp2.030422-1633 : Service Pack 1) -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<3316C&>33B%IPID=I) -T1(DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=6270|B680%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<17D36&>18B%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP [Version 5.1.2600] (XP Professional SP1) -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=C00|800%ACK=S%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|1000|C00%ACK=S%Flags=R%Ops=WNMETL) -T4(DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|400|800%ACK=S%Flags=R%Ops=WNMETL) -T7(DF=N%W=1000|800%ACK=S%Flags=R%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows Version 5.1 Build 2600.xpsp2.030825-2117: Service Pack 1 -# Microsoft Windows XP Professional SP1 build 2600, latest windows updates (march 27, 2005) -Fingerprint Microsoft Windows XP Pro SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<1B1AC&>29E%IPID=I%TS=U) -T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows XP Professional 2002 - Service Pack 1 - Hotfixes -# Windows XP Profesional build 2600.xpsp2.030422-1633: Service Pack 1 -# Windows XP Professional SP1 build 2600.xpsp1.030422-166: Service Pack 1 -# Windows XP Professional (Italian) build 2600 with SP1 and latest Windows Update patches as of middle Sept. 2004 circa -# Microsoft Windows 2000 SP4 all updates as of Apr 17 2004 -Fingerprint Microsoft Windows XP Pro SP1 or 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<209B8&>33C%IPID=I) -T1(DF=Y%W=6270|FC00%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Professional SP1 -# Microsoft Windows 2000 Advanced Server with Service Pack 3 -Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 Advanced Server SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=<272A4&>31E%IPID=I%TS=U) -T1(DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2000|4000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|5C%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows XP Professional Build 2600.xpsp1.020828-1920 with Windows Services for UNIX 3.0 installed -# Windows 2000 Advanced Server with SP3 -# Microsoft Windows 2000 Server version 5.0 build 2195 Service Pack 3 -# Windows 2000 SP3 -Fingerprint Microsoft Windows XP Pro SP1 or Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<57472&>68D%IPID=I) -T1(DF=N|Y%W=0|FFF0%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N|Y%W=0|FFF0%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Professional w/ SP1 V5.1.2600 and most WU patches as of 4/20/05 -# Microsoft Windows XP Professional 5.1.2600 Service Pack 1 Build 2600 -# Microsoft Windows XP Home Edition (English) with Service Pack 2 -# Windows XP Professional (Version 5.1 - Build 2600.xpsp2.050301-1526: Service Pack 1) -# version 5.1 build 2600 xpsp2 040919-1003 service pack 1 -# Windows 2000 SP4 Version 5.0 (Build 2195: Service Pack 4) on a 2 GHz Pentium 4 -# Microsoft Windows 2000 s/SP4 build 5.00.2195 -# Microsoft Windows 2000 Professional 5.00.2195 SP4 - all patches as of 02 Jun 2005 (OEM) -# Windows 2000 Advanced Server SP4 and patches as of June 17 2004 -# Microsoft Windows 2000 Professional (v5.0, Build 2195, SP4), all current hotfixes applied 7th June -# Microsoft Windows 2000 Professional with SP4 and latest Windows Update patches as of June 21, 2005 -# Microsoft Windows 2000 Advanced SP4 running Sphinx a-Wall -# Microsoft Windows XP Professional SP1a build 2600.xpsp2.050301-1526 -# Microsoft Windows XP Professional (German) SP1 build 2600.xpsp1.050301-1526 -Fingerprint Microsoft Windows XP Pro SP1/SP2 or 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows XP Professionnel (5.1) Service Pack 2 -Fingerprint Microsoft Windows XP Pro SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=C00|800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|800|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -# Microsoft Windows XP Professional Service Pack 2 Build 5 1 2600 -Fingerprint Microsoft Windows XP Pro SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=20%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Microsoft Windows Version 5.1 (Build 2600.xpsp_sp2_trm.040803-2158 : Service Paxk 2) (XP Professional +SP2 + Hotfix) -Fingerprint Microsoft Windows XP Pro SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Windows xp Professional SP2 German (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) with Agnitum Outpost Firewall Pro ver.+2.1.303.4009 (314) -# Microsoft Windows XP Professional Version 2002 SP2 build 5.1.2600 latest MS patches as of Feb 9, 2005 -Fingerprint Microsoft Windows XP Pro SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=FB8B|FC00%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Fingerprint Microsoft Windows XP Professional SP2 and latest updates -Fingerprint Microsoft Windows XP Pro SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=R%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=R%Ops=WNMETL) -T4(DF=N%W=800|1000%ACK=S%Flags=R%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00%ACK=S%Flags=R%Ops=WNMETL) -T7(DF=N%W=800%ACK=S%Flags=R%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# bsed on msg 1079 -# Fingerprint Microsoft Windows XP Proffesional (Polish) with SP2 and all patches available on January 19, 2005 -Fingerprint Microsoft Windows XP Pro SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=805C%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Professional SP2 ( Build 2600.xpsp_sp2_rtm.040803-2158) -# Microsoft WIndows XP Proffesional Version 2002 Service Pack 2 -Fingerprint Microsoft Windows XP Pro SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++|O%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows XP Professional SP2: Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158: Service Pack 2 (firewall disabled) -Fingerprint Microsoft Windows XP Pro SP2 (firewall disabled) -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%IPID=I%TS=0) -T1(Resp=Y%DF=Y%W=FC94%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(Resp=Y%DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Professional CORP. ED. Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) -# Microsoft Windows 2003 Enterprize Edition (version 5.2 (build 3790.srv03_gdr.040410-1234)) -# Microsoft Windows XP Professional SP2 5.1.2600 SP2 Build 2600, Athlon x86, no firewall -# Windows 2003 Enterprise Server 5.2 build 3790, srv03_gdr.040410-1234 as of Feb 22, 2003 -# Mircosoft Windows Server 2003 Enterprise SP1 build 3790.srv03_sp1_rtm.050324-1447 -Fingerprint Microsoft Windows XP Pro SP2 or 2003 Server Enterprise Edition -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP Pro Version 5.1 Build 2600 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<32578&>18D%IPID=I) -T1(DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FFF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<28CC6&>4A2%IPID=I) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=58%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Microsoft Windows XP Prof (Build 2600.xpsp2.030422-1633: SP1 -Fingerprint Microsoft Windows XP SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<8%SI=702%TS=U) -T1(DF=Y%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows XP SP1 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=291F) -T1(DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=C79C|FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Version 5.1 (Build 2600.xpsp 1.020828-1920: Service Pack 1) > latest Windows Update patch too (1/31/03) -# Windows 2000 with Service Pack 3 -Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP3 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<2461C&>3BA%IPID=I%TS=U) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP SP1 (Build 2600.XP SP2.030422-1633:Service Pack 1) -# Microsoft Windows XP Professional with SP1 and latest Windows Update patches as of Oct 12, 2003 except Q817778 -# Windows 2000 Professional with SP4 and latest Windows Update patches as of november 25th, 2003 -Fingerprint Microsoft Windows XP SP1 or Windows 2000 SP4 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=RI%gcd=<6%SI=<18DEE&>24B%IPID=I) -T1(DF=Y%W=402E|FC00|FD20%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -# Microsoft Windows XP2 - version 5.1 (Build 2600.xpsp_sp2_gdr.050301-1519 : Service Pack 2) -Fingerprint Microsoft Windows XP SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=F0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP SP2 (English) Build 2600.xpsp2_rtm.040803-2158 -# Microsoft Windows XP Professional Version 5.1 (Build 2600.xpsp2_gdr.050301-1519 : Service Pack 2) -# Microsoft Windows XP Professional (Spanizh) with SP2 and latest Windows Update patches as June 5,+2005 -Fingerprint Microsoft Windows XP SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=C6C|4000|7D41%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=C6C|4000|7D41%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# windows XP Professional SP2 and latest updates as of 3/7/05 -# Microsoft Windows XP version 5.1 600.xpsp_sp2_rtm.040803-2158 : service pack 2 -Fingerprint Microsoft Windows XP SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%TS=U) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# base on msg 570, 1033 -# Windows XP SP2 (firewall off). Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) -# Microsoft Windows Windows XP Corporate (French) SP2 build 2600.xpsp_sp2_rtm.040803-2158 on Intel Pentium 4 1.2 GHz -Fingerprint Microsoft Windows XP SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=7E4A%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=7E4A%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Home Edition (English) SP2 build 2600.xpsp_sp2_rtm.040803-2158 -# Microsoft Windows XP Home Edition (English) SP2 build 2600.xpsp_sp2_rtm.040803-2158 -# Microsoft Windows XP Professional with SP2 (Version 5.1 Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) -# Microsoft Windows XP Professional SP2 (Build 2600.xpsp_sp2_rtm.040803-2158) -# Microsoft Windows XP Professional SP2 -# Windows XP SP2 (build 2600.xpsp_sp2_gdr.050301-1519 : Service Pack 2) -Fingerprint Microsoft Windows XP SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U|0) -T1(DF=Y%W=6360|FC94|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT|MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows Version 5.1 (Build 2600.XPSP_SP2_GDR.050301-1519 : Service Pack 2) -Fingerprint Microsoft Windows XP SP2 -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows XP Professional Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2 -# Microsoft Windows XP Professional SP2 build 2600.xpsp_sp2_rtm.040803-2158 -# Microsoft Windows XP Professional SP2 and latest Windows Updates patches as of Dec 15, 2004 -# Windows Version 5.1 (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) -# Microsoft Windows XP Professional (Build 2600.xpsp_sp2_rtm.040803-2158 : Service Pack 2) -# Microsoft Windows XP Professional (Spanish) SP2 build 2600.xpsp_sp2_trm.040803-2158 -# Windows Server 2003 Standard edition, Microsoft windows vers.5.2 build 3790.srv03_rtm.030324-2048 -# Microsoft Windows XP Professional Version 2002 Service Pack 2 -# Windows 2003 Server Standard Edition germany -# Microsoft Windows Server 2003 EE Version 5.2 (Build 3790.srv03_gdr.040410-1234) -# Microsoft Windows XP Home Edition (hebrew) with SP2 -Fingerprint Microsoft Windows XP SP2 or 2003 Server -Class Microsoft | Windows | NT/2K/XP | general purpose -Class Microsoft | Windows | 2003/.NET | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows 2003 Enterprise Server patches as of 3 May 2003 - NO SP1 -# Microsoft windows Server 2003 Standard Edition (Corp. build) - Version 5.2 (Build+3790.srv03_gdr.040410-1234) -Fingerprint Microsoft Windows XP SP2 or 2003 Server -Class Microsoft | Windows | NT/2K/XP | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=B0%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# HP Jornada running Windows CE 2.11 (Handheld/PC Pro 3.0) running on StrongARM 1100 -Fingerprint HP Jornada running Microsoft Windows CE 2.11 (Handheld/PC Pro 3.0 PDA) -Class Microsoft | Windows | PocketPC/CE | PDA -TSeq(Class=TD%gcd=<36%SI=<28%IPID=BI%TS=U) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft PocketPC 3.0.11171 running on Compaq iPAQ 3870 Pocket PC -Class Microsoft | Windows | PocketPC/CE | PDA -TSeq(Class=TD%gcd=<6%SI=<104%IPID=BI) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=40%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Microsoft Windows CE 3.0 build 126 on StrongARM -Fingerprint Microsoft Windows CE 3.0 -Class Microsoft | Windows | PocketPC/CE | specialized -TSeq(Class=TD%gcd=12A%IPID=I) -T1(DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=A000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Windows 2000 Pro, Build 2195 SP4 -Fingerprint Microsoft Windows 2000 Professional SP4 -Class Microsoft | Windows || general purpose -TSeq(Class=RI%gcd=<6%SI=<457D6&>35E%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Professional with SP4 and latest Windows Update patches as of August 11, 2004 -Class Microsoft | Windows || general purpose -TSeq(Class=RI%gcd=<6%SI=<15E32&>1A1%IPID=I) -T1(DF=Y%W=FFFF%ACK=O%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows 2000 Server SP3 -Class Microsoft | Windows || general purpose -TSeq(Class=RI%gcd=<6%SI=<30714&>2A7%IPID=I) -T1(DF=Y%W=2DA0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2DA0%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Microsoft Windows Longhorn eval build 4051 -Class Microsoft | Windows || general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint MikroTik RouterOS 2.7.20 -Class MikroTik | RouterOS || software router -TSeq(Class=RI%gcd=<6%SI=<1B9B36E&>46A4A%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint Minix 32-bit/Intel 2.0.0 -Class Minix | Minix || general purpose -TSeq(Class=RI|TD%gcd=1|2|3|457%SI=C2B%IPID=I%TS=100HZ) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Motorola BSR 1000R(tm) version 1.1.19.PRR -Fingerprint Motorola BSR 1000R -Class Motorola | BSD-misc || general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Motorola System V/68 version R3V7 on a 68030 -Class Motorola | BSD-misc || general purpose -TSeq(Class=RI%gcd=<14%SI=<52F8&>C0) -T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Motorola Surfboard SB5100e VxWorks Version: 5.4 -# Motorola CG4500E Communication Gateway (cable modem) -# Thomson TCM390 cable modem; Software Version: ST33.07.00; Software Model: A801; Bootloader: 2.1.4c -# Motorola Surfboard Cable modem Software Version: SB5100-2.3.1.3-SCM00-NOSHHardware Version: 3MIB+Version: IIGUI Version: 1.0VxWorks Version: 5.4 -# Motorola Cable Modem SB5100E SW_REV: SB5100E-2.3.1.3-SCM01-NOSH -# Motorola SB5100 Surfboard 5100 Cable Modem vSB5100-2.3.1.6-SCM01-NOSH -# Thomson Cable Modem TCM410 -Fingerprint Motorola (SB5100/CG4500E) or Thomson (TCM390/TCM410) Cable Modem -Class Motorola | VxWorks || broadband router -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Motorola SurfBoard 4401 provided by adelphia -Fingerprint Motorola SurfBoard 4401 cable modem -Class Motorola | VxWorks || broadband router -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F|0%ULEN=134%DAT=E) - -# VxWorks Version: 5.3; Software Version: SB4100E-4.1.11-SCM05-NOSHELL; Hardware Version: 3 -Fingerprint Motorola SurfBoard SB4100E Cable Modem -Class Motorola | VxWorks || broadband router -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Motorola Surfboard SB5100 running Software version SB5100-2.3.1.6-SCM01-NOSH -Fingerprint Motorola Surfboard SB5100 cable modem -Class Motorola | VxWorks || broadband router -TSeq(Class=RI%gcd=<6%SI=286BF%IPID=I%TS=U) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N|Y%W=16D0%ACK=S++|O%Flags=AS|A%Ops=MNW|) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Motorola SURFboard SBG1000-0.1.3.0-SCM05-NOSH -Fingerprint Motorola SURFboard SBG1000 Broadband router -Class Motorola | VxWorks || broadband router -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint MultiTech standalone firewall box, version 3 -Class MultiTech | embedded || firewall -TSeq(Class=TD%gcd=<714%SI=<14) -T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=600%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=R%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) - -Fingerprint MultiTech MultiVoIP Version 2.01A Firmware -Class MultiTech | embedded || telecom-misc -TSeq(Class=TD%gcd=<714%SI=<14) -T1(DF=N%W=600%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=R%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint MultiTech CommPlete (modem server) RAScard -Class MultiTech | embedded || terminal server -TSeq(Class=TD%gcd=388|710|A98%SI=<44) -T1(DF=N%W=FA0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=R%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint MultiTech CommPlete Controller (terminal server) -Class MultiTech | embedded || terminal server -TSeq(Class=TR|RI%gcd=<6%SI=>FFFF) -T1(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3000%ACK=S++%Flags=AS%Ops=ME) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Multi-Tech Voice over IP Box. Model number (MultiVoip 2410) -Fingerprint MultiTech MultiVoip 2410 -Class MultiTech | embedded || VoIP gateway -TSeq(Class=TD%gcd=<1F502%SI=<1E%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400|800%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -Fingerprint NAT LANB/290 router Console Program V4.00 -Class NAT | embedded || router -TSeq(Class=TD%gcd=<80004%SI=<14) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(Resp=N) -T7(Resp=N) -PU(Resp=N) - -# NCD X server (SNMP says: NCD16 server 2.3.0 03/12/91 downloaded) -Fingerprint NCD X server (NCD16 server 2.3.0 03/12/91) -Class NCD | embedded || X terminal -TSeq(Class=64K) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=800%ACK=O%Flags=A%Ops=) -T4(DF=N%W=800%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NCR MP-RAS 3.0.x -Class NCR | BSD-misc || general purpose -TSeq(Class=64K) -T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NCR MP-RAS 3.01 -Class NCR | BSD-misc || general purpose -TSeq(Class=i800) -T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) -T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NCR S26 server (i386) running NCR MP-RAS SVR4 UNIX System -Class NCR | BSD-misc || general purpose -TSeq(Class=RI%gcd=<6%SI=<2BB718&>6FD5) -T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) -T4(DF=Y%W=6000%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NCR server running MP-RAS SVR4 UNIX System Version 3 -Class NCR | BSD-misc || general purpose -TSeq(Class=RI%gcd=<6%SI=<31BA1E&>7F38) -T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=6000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NEC UX/4800 -Class NEC | UX/4800 || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# Netcomm NB1300 ADSL Ethernet Modem/Router -Fingerprint Netcomm NB1300 DSL router -Class Netcomm | embedded || broadband router -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Host information: @WorkStation (i960 based) X-terminal -# Neoware (was HDS) NetOS V. 2.0.1 -# Hewlett-Packard Entria Model C3230A Server Version B.05.30 -# Cisco 11151/Arrowpoint 150 Load Balancer -Fingerprint Cisco 11151/Arrowpoint 150 load balancer, Neoware (was HDS) NetOS V. 2.0.1 or HP Entria C3230A -Class Neoware | NetOS || X terminal -Class HP | embedded || X terminal -Class Cisco | embedded || load balancer -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=|M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetApp Data ONTAP 3.1.6 or BSDi 1.1 -Class NetApp | Data ONTAP || fileserver -TSeq(Class=64K) -T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetApp Data ONTAP 5.1.2 - 5.3.5r2 -Class NetApp | Data ONTAP || fileserver -TSeq(Class=RI%gcd=<6%SI=>BBB) -T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(Resp=Y%DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(TOS=0%IPLEN=38%RIPTL=148%RIPCK=E|F|0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetApp Data ONTAP 6.1.2R3 on an F840 filer -Class NetApp | Data ONTAP || fileserver -TSeq(Class=RI%gcd=<6%SI=<83FEA&>B28%IPID=BI%TS=2HZ) -T1(DF=N%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -# NetApp Data ONTAP Release 6.3.1: Wed Nov 20 13:03:17 PST 2002 -Fingerprint NetApp Data ONTAP Release 6.3.1 -Class NetApp | Data ONTAP || fileserver -TSeq(Class=RI%gcd=<6%SI=<44A20&>AE7%IPID=BI%TS=100HZ) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetApp F360 or F760 Filer -Class NetApp | Data ONTAP || fileserver -TSeq(Class=RI%gcd=<6%SI=<7CA10&>CA2%IPID=BI%TS=2HZ) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -# NetApp Release 6.5.2R1: Wed Sep 8 17:00:29 PDT 2004 -# NetApp Filer F820 running Ontap Release 6.5.2R1 -# NetApp NetCache 5.6 -# Network Appliance DataOnTap v6.5.2 "NetApp Release 6.5.2: Sun Jul 25 10:56:02 PDT 2004" -# NetApp NetCache Release 5.6.2 -# NetCache OS 6.0.1 -Fingerprint NetApp Filer (Data OnTap 6.5.2) or NetCache (NetApp 5.6 - 6.0.1) -Class NetApp | Data ONTAP || fileserver -Class NetApp | embedded || web proxy -TSeq(Class=TR%gcd=<6%IPID=BI%TS=100HZ) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetApp ONTAP Release 6.3.3 -Class NetApp | Data ONTAP || fileserver -TSeq(Class=RI%gcd=<6%SI=<7128C&>B45%IPID=BI%TS=100HZ) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint Network Appliance Filer running Data ONTAP Release 6.4.3 -Class NetApp | Data ONTAP || fileserver -TSeq(Class=RI%gcd=<6%SI=<93792&>969%IPID=RPI|RD%TS=100HZ) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# NetCache 5.1D4 on a NetApp C1100 Box -Fingerprint NetApp NetCache C1100 (NetApp 5.1D4) -Class NetApp | embedded || web proxy -TSeq(Class=RI%gcd=<6%SI=1371%IPID=BI%TS=2HZ) -T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -# Network Appliance NetCache C1100 (NetApp 5.0) -Fingerprint NetApp NetCache C1100 with NetAppliance 5.0 -Class NetApp | embedded || web proxy -TSeq(Class=RI%gcd=<6%SI=<93D5A&>95A%IPID=BI%TS=2HZ) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=3415%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetApp NetCache C6100 (NetApp 5.5) -Class NetApp | embedded || web proxy -TSeq(Class=RI%gcd=<6%SI=<2642EC&>3974%IPID=BI%TS=100HZ) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint NetApp NetCache C760 os 4.x -Class NetApp | embedded || web proxy -TSeq(Class=RI%gcd=<6%SI=<4E51740&>FAA%IPID=I%TS=2HZ) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=5000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint NetApp NetCache running OS 5.4R2 -Class NetApp | embedded || web proxy -TSeq(Class=RI%gcd=<6%SI=<22AD62&>1619%IPID=BI%TS=100HZ) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.0 big endian arch -Class NetBSD | NetBSD || general purpose -TSeq(Class=64K) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Notes on NetBSD (written by Charles M. Hannum ): -# * The set of options in a SYN-ACK depends on the state of the -# `net.inet.tcp.rfc1323' flag. -# * Releases prior to 1.3 did not randomize the ISS at all. -# * Releases prior to 1.3 incorrectly added the IP header length to the IP -# packet length when returning an ICMP unreachable. -# * Releases prior to 1.3 calculated the window size slightly wrong. -# * Releases prior to 1.3 returned a non-zero window size when sending a RST -# in response to an ACK on a listening socket (thereby making them -# susceptible to stealth scanning). -# * Releases prior to 1.3H/1.3.4 did not return a response to the null flag -# test (thereby making them susceptible to stealth scanning). -# * Releases prior to 1.3I/1.3.4 corrupted some of the IP header fields in -# the encapsulated IP header when sending an ICMP reply. On little endian -# machines the IP ID field was byte-swapped. The checksums were always -# zeroed. -# * Releases prior to 1.3I/1.3.4 did not set the DF bit in a SYN-ACK when -# MTU discovery was enabled. -Fingerprint NetBSD 1.0 i386 -Class NetBSD | NetBSD || general purpose -TSeq(Class=64K%IPID=I%TS=2HZ) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.0 little endian arch -Class NetBSD | NetBSD || general purpose -TSeq(Class=64K) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.1 - 1.2.1 litle endian arch -Class NetBSD | NetBSD || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.2 - 1.2.1 big endian arch -Class NetBSD | NetBSD || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T4(Resp=Y%DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.3 - 1.3.3 big endian arch -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=>18000) -T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.3 - 1.3.3 little endian arch -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=>18000) -T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.3H (after 19980919) or 1.3I (before 19990119) little endian arch -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=>18000) -T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.3H-1.5 big endian arch -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=>18000) -T1(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# NetBSD 1.3I (after 19990119) -# NetBSD 1.4 x86 -# NetBSD 1.6L/Alpha -# NetBSD 1.6 NetBSD 1.6 (GENERIC) #0 Sun Sep 8 2002 i386 -Fingerprint NetBSD 1.3I through 1.6 -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=>18000) -T1(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N|Y%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT|M) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.5.2 running on a Commodore Amiga (68040 processor) -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=<7AAB142&>874A7%IPID=I%TS=2HZ) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.5_ALPHA i386 -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=<5CF5F1C&>EDF97) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.6 -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<8%SI=<601F422&>60539%IPID=I) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.6 - 1.6.1 (Alpha) -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI|TR%gcd=<6%SI=<656F846%IPID=I) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.6 BETA 4 i386 (20020630 snapshot) -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=<76BC4C8&>A6C26%IPID=I) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=4801%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.6.2 (alpha) -Class NetBSD | NetBSD || general purpose -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# 1262 -# NetBSD 1.6.2 (GENERIC) #0: Wed Feb 11 08:05:11 UTC 2004 sparc -Fingerprint NetBSD 1.6.2 (x86) -Class NetBSD | NetBSD || general purpose -T1(DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000|FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# NetBSD 1.6.2 on x86 -# Avocent Switchview net KVM switch - this is a embedded device that makes a regular KVM accessible over IP. -# NetBSD 2.0_BETA i386 -Fingerprint NetBSD 1.6.2 - 2.0_BETA or Avocent Switchview net KVM switch -Class NetBSD | NetBSD || general purpose -Class Avocent | embedded || specialized -TSeq(Class=RI%gcd=<6%SI=<7679164&>F13C6%IPID=I) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.6ZC (SPARC) -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=<67F4F30&>941F1%IPID=RD) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint NetBSD 1.6ZD -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<8%SI=<7C2EB86&>76383%IPID=RD) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# netbsd 1.6ZH GENERIC -# NetBSD 1.6ZK NetBSD 1.6ZK #1: Thu Feb 19 18:05:56 EST 2004 -# NetBSD 2.0 -# NetBSD alpha1 2.0_RC4 -# NetBSD 2.0.1 -# NetBSD 2.0.2 (GENERIC_LAPTOP) #0: Wed Mar 23 08:59:09 UTC 2005 i386 -# NetBSD 2.0.2 i386 -# NetBSD 2.0.2 on sparc64 -Fingerprint NetBSD 1.6ZH or 2.0 - 2.0.2 -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=<714D5B4&>50BA4%IPID=I) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# NetBSD 2.0 (GENERIC) i386 -Fingerprint NetBSD 2.0 -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=<71C334A&>9705A%IPID=I%TS=U) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# NetBSD 2.0 (GENERIC) IP Filter: v4.1.3 (396) Dsl Router x86 -Fingerprint NetBSD 2.0 -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=<73607AC&>AC1A6%IPID=RD) -T1(DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=FFFF%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetBSD/Alpha 1.5.2 on a DEC 000/300 LX -Class NetBSD | NetBSD || general purpose -TSeq(Class=RI%gcd=<6%SI=<736B300&>106DED%IPID=I%TS=2HZ) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -Fingerprint Netburner Model 5282 Embedded Ethernet Microcontroller -Class Netburner | embedded || specialized -TSeq(Class=RI|TD%gcd=<6%SI=<45498%IPID=I%TS=U) -T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=MNNNL) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AS%Ops=MNNNL) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Netgear DG824M Wireless (WAP) & 4-Port ADSL Router - Version 1.4 Release 05 -Fingerprint Netgear DG824M WAP -Class Netgear | embedded || broadband router -TSeq(Class=TD%gcd=<104%SI=<14%IPID=I%TS=U) -T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# NETGEAR FVL238 Firmware Version Version 1.5 Release 09 -Fingerprint Netgear FVL238 vpn/firewall/router -Class Netgear | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<2E7205A&>76E53%IPID=I%TS=U) -T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Netgear FVL328 vpn/firewall/router -Class Netgear | embedded || broadband router -T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Netgear WGR614 Wireless router -Class Netgear | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Netgear FM114P ProSafe Wireless Firewall with Print Server -# netgear wgr614 v4 Wireless router -# REPOTEC IP515H Cable Router / Print Server -Fingerprint Netgear Wireless router or Netgear FM114P/REPOTEC IP515H Router & Print Server -Class Netgear | embedded || broadband router -TSeq(Class=TD%gcd=<404%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Netgear PS101 print server with firmware 6026 -Fingerprint Netgear PS101 Print Server -Class Netgear | embedded || print server -T1(DF=N%W=5B4%ACK=S++%Flags=APS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# Netgear Printer Server PS110 firmware version: 6017 -Fingerprint Netgear PS110 Print Server -Class Netgear | embedded || print server -TSeq(Class=TD%gcd=<1A866%SI=<14%IPID=I%TS=U) -T1(DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=5EA%ACK=S++%Flags=APS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Netgear GS724T Gigabit Smart Switch -Class Netgear | embedded || switch -TSeq(Class=TD%gcd=<18%SI=<14%IPID=I%TS=U) -T1(DF=Y%W=C00|1000%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=Y%W=800|1000%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=C00|400%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=) -T5(DF=Y%W=C00|1000|800%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=1000|800%ACK=S++%Flags=AR%Ops=) -T7(DF=Y%W=1000%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint NetJet Version 3.0 - 4.0 Printer -Class NetJet | embedded || printer -TSeq(Class=TD%gcd=<4%SI=<4) -T1(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0|800%ACK=S++%Flags=AR%Ops=|M) -T4(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# IPAD Model 5000 (see www.ipad-canada.com) -# eSoft IPAD, v.1.52 -- 64 line option on i86 hardware -Fingerprint IPAD (Internet Protocol Adapter) Model 5000 or V.1.52 -Class NetMatrix | embedded || general purpose -TSeq(Class=TD|RI%gcd=1000|2000|3000%SI=<444) -T1(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1800%ACK=S++%Flags=AS%Ops=M) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Broadband Router (Farralon Netopia or Compatible Systems 900i) -Class Netopia | embedded || broadband router -Class Compatible Systems | embedded || router -TSeq(Class=TD%gcd=388|710|A98%SI=50) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=1000%ACK=S%Flags=AR%Ops=) -T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) -T7(Resp=N) -PU(Resp=N) - -Fingerprint NetSilicon NetARM running ThreadX 2.0 -Class NetSilicon | ThreadX || specialized -TSeq(Class=TD%gcd=<1F502%SI=<14%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Network Systems router NS6614 (NSC 6600 series) -Class Network Systems | embedded || router -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=134%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Nexland ISB Pro800 Turbo, Firmware version: V1 Rel 5U -Fingerprint Nexland ISB Pro800 Turbo Cable/DSL router -Class Nexland | embedded || broadband router -TSeq(Class=TD%gcd=<2004%SI=<1E%IPID=I) -T1(DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=16D0%ACK=S++%Flags=AS%Ops=MTNN) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# A NeXT Turbo, unknown version number -Fingerprint NeXT Mach -Class NeXT | Mach || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NeXTStep/OpenStep 4.2/Intel -Class NeXT | NeXTStep || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=F87%ACK=S++|O%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint OpenStep 4.0-4.2 or NeXTStep 1.0-3.3 (Intel) -Class NeXT | NeXTStep || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint OpenStep 4.1/NeXTStep 3.3 -Class NeXT | NeXTStep || general purpose -TSeq(Class=64K) -T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F87%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint NIB 450-E printer network interface -Class NIB | embedded || printer -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Nokia M1122 DSL Router (Nokia Mrouter rel-Gx1x2220.R08) -Fingerprint Nokia M1122 DSL Router -Class Nokia | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<1AF18&>43B%IPID=I) -T1(DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FAF0%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Nokia Rooftop Wireless Router model R240A -Class Nokia | embedded || router -T1(DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=7F53%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=40%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Nokia IP530 Network Appliance (IPSO 3.4-3.4.2) -Class Nokia | IPSO || firewall -TSeq(Class=RI%gcd=<8%SI=<85DD6&>987%IPID=I%TS=2HZ) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=E0%IPLEN=164%RIPTL=134%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Nokia IPSO 3.7-BUILD026 x86 -Fingerprint Nokia IPSO 3.7 running CheckPoint FW-1 -Class Nokia | IPSO || firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0|E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Nokia IPSO 3.8 Build039 (IPSO 3.8-BUILD039 releng 1404 07.23.2004-193500+i386) -# Nokia IPSO 3.8.1-BUILD028 releng 1518 12.02.2004-222502 i386 -Fingerprint Nokia IPSO 3.8.x -Class Nokia | IPSO || firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=E0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Symbian OS 6.1 on Nokia N-Gage v 4.03 -Fingerprint Symbian OS 6.1 on Nokia N-Gage v 4.03 phone -Class Nokia | Symbian || phone -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Nortel Networks BayStack 450-24T Versions: HW:RevL FW:V1.48 SW:v4.2.0.16 ISVN:2 -Fingerprint Nortel Networks BayStack switch -Class Nortel | embedded || switch -TSeq(Class=RI%gcd=<6%SI=<762A&>C8%IPID=I%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Nortel Networks Passport 1100 (version 2.0.7.2) -Fingerprint Nortel Networks Passport 1100 switch -Class Nortel | embedded || switch -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Nortel Networks Passport 8600 routing switch sw 3.3.0.0 -Class Nortel | embedded || switch -TSeq(Class=RI%gcd=<6%SI=113A%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Nortel CallPilot 100 voicemail system -# 3Com superstack 3 4300 (3c17100) Hardware Version: V4.0 Software Version: V1.12 -# Cisco 1538M Micro Hub running latest firmware -# HP TopTools Remote Control Card -# Enterasys VH2402 Switch Firmware 2.05.02 -# NTT East VoIP gateway of some sort ( http://www.ntt-east.co.jp/ced/goods/voip/index.html ) -Fingerprint Nortel CallPilot 100 voicemail system, 3Com Superstack 3 switch, Enterasys switch, HP TopTools remote control card, or Cisco 1538M hub -Class Nortel | embedded || telecom-misc -Class NTT | embedded || telecom-misc -Class 3Com | embedded || switch -Class Cisco | embedded || hub -Class Enterasys | embedded || switch -Class HP | embedded || remote management -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) - -# Northern Telecom Supernode - Nortel Micronode telephone switch running OS version GSM15 -Fingerprint Nortel Micronode telephone switch running OS version GSM15 -Class Nortel | embedded || telecom-misc -TSeq(Class=TD%gcd=<120004%SI=<14%IPID=Z%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Nortel Passport 4400 Series - Release 4.0.3 -Fingerprint Nortel Passport 4400 Series multiservice access switch -Class Nortel | embedded || telecom-misc -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Nortel Networks CVX1800 RAS. Software version 2.02 -Class Nortel | embedded || terminal server -TSeq(Class=64K%gcd=<6%SI=<14) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=8000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 3.12 - 5.00 -Class Novell | NetWare | 3.X | general purpose -Class Novell | NetWare | 4.X | general purpose -Class Novell | NetWare | 5.X | general purpose -TSeq(Class=TD%gcd=10|20|30|40%SI=<64) -T1(DF=Y|N%W=7D0|8000|2000|1FFF|7FFF|8000|FFFF%ACK=S++%Flags=AS%Ops=M|ME) -T2(Resp=N) -T3(Resp=Y%DF=Y|N%W=7D0|8000|2000|1FFE|7FFF|8000|FFFF%ACK=O|S++%Flags=AS|ASF%Ops=M|ME) -T4(Resp=N) -T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 3.12 or 386 TCP/IP -Class Novell | NetWare | 3.X | general purpose -TSeq(Class=TD%gcd=<6B4A%SI=<1E) -T1(DF=N%W=73F|F87|3F25%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS|ASF%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetWare 4.11 SP7- 5 SP3A BorderManager 3.5 -Class Novell | NetWare | 4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1843D74&>3E1D0) -T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint NetWare 4.11 SP8a - NetWare 5 SP4 -Class Novell | NetWare | 4.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2DB195E&>74F88) -T1(DF=Y%W=1FFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=1FFE%ACK=O%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint novell netware 4.11 -Class Novell | NetWare | 4.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RPI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MWN) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Novell NetWare 4.11-5.0SP5 -Class Novell | NetWare | 4.X | general purpose -Class Novell | NetWare | 5.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2B302C0&>6E8E8) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetWare 5.0 SP 3a -Class Novell | NetWare | 5.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<5641338&>DCCE9) -T1(DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint NetWare 5.1 SP3 -Class Novell | NetWare | 5.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2385886&>53F65%IPID=RPI|BI|RD%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 5.0 with Border Manager -Class Novell | NetWare | 5.X | general purpose -TSeq(Class=RI%gcd=<5%SI=>BBBBB) -T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7FFF%ACK=O%Flags=AS%Ops=M) -T4(Resp=N) -T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Novell NetWare 5 Support Pack Revision 06 Server Version 5.00.09 -Fingerprint Novell NetWare 5.00.09 SP06 -Class Novell | NetWare | 5.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1EDA0D4&>2F197%IPID=I%TS=U) -T1(DF=Y%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=FFF%ACK=O%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Novell NetWare 5.1 SP5 with Groupwise -Fingerprint Novell NetWare 5.1 SP5 -Class Novell | NetWare | 5.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2378ABE&>57780%IPID=BI%TS=U) -T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=M|MEWN) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 5.1 SP5 with Groupwise -Class Novell | NetWare | 5.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RPI|RD%TS=U) -T1(DF=N%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Novell NetWare 5.1 SP8 -# Novell NetWare 6.5 SP3 -# Novell Open Enterprise Server, NetWare 6.5 Support Pack Revision 03 -# Novell NetWare Open Enterprise Server (OES) (English, First Customer Shipping version) installed with everything on it, x86 -Fingerprint Novell NetWare 5.1 SP8 or 6.5 SP3 -Class Novell | NetWare | 5.X | general purpose -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=BI|RPI%TS=U) -T1(DF=N|Y%W=17FF%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=Y%DF=N|Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N|Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N|Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N|Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 5.1-6.0 -Class Novell | NetWare | 5.X | general purpose -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<2883446&>599C6%IPID=RD|RPI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 5.1SP4 - 6.0 -Class Novell | NetWare | 5.X | general purpose -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<253064A&>5F32F%IPID=BI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 5.1SP5 - 6.5 -Class Novell | NetWare | 5.X | general purpose -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 5.x -Class Novell | NetWare | 5.X | general purpose -TSeq(Class=RI%gcd=<8%SI=<286248A&>1B465%IPID=I%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=17FF%ACK=O%Flags=AS%Ops=M) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# NetWare 6.5 SP2 (running on a Compaq Proliant ML370) -Fingerprint NetWare 6.5 SP2 -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -Fingerprint Novell Netware 6 (no service packs) -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<3B034FE&>24038%IPID=BI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 6 SP1 -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD|RPI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Novell NetWare 6 SP2 running BM3.7 (with no service packs) -Fingerprint Novell NetWare 6 SP2 -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<30102C2&>766BA%IPID=BI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell NetWare 6.0 SP3 -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell Netware 6.0 SP4 -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=BI%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MEWN) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Novell Netware 6.5 SP2 -Class Novell | NetWare | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=U) -T1(DF=Y%W=1800%ACK=S++%Flags=AS%Ops=MWN) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# NSG 500 router. OS version 7.6.1 (http://www.nsg.ru) -# NSG-520/Network Systems Group, running Version 7.6.1 -# NX-300/3wl/1e1/Network Systems Group running Version 7.6.3 -Fingerprint NSG-300/500 series router running Version 7.6.x -Class NSG | embedded || router -TSeq(Class=TD%gcd=<50004%SI=<3C%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# OkiData 20nx printer with OkiLAN 6100e TCP/IP Ethernet module -Fingerprint OkiData 20nx printer with OkiLAN ethernet module -Class Okidata | embedded || printer -TSeq(Class=C%IPID=I%TS=U) -T1(DF=Y%W=2238%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Okidata 7200 Printer -Class Okidata | embedded || printer -T1(DF=N%W=B68%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Okidata OKI C5100 Laser Printer -Class Okidata | embedded || printer -T1(DF=N%W=C00%ACK=S++%Flags=AS|AR%Ops=M||MNW) -T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Okidata OKI C7200 Printer -Class Okidata | embedded || printer -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Open Network 501r or 531r (ADSL Router) -Class Open Networks | embedded || broadband router -TSeq(Class=TD%gcd=<2C%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint OpenBSD 2.7/SPARC or NFR IDS Appliance ( 12/10/00 ) -Class OpenBSD | OpenBSD | 2.7 | general purpose -TSeq(Class=RI%gcd=<6%SI=<8FC28&>16EC) -T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint OpenBSD 2.1 - 2.3/SPARC -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=>FF) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# This fingerprint had LAND patch installed -Fingerprint OpenBSD 2.1/x86 -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=>BBB) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint OpenBSD 2.2 - 2.3 -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=RI%gcd=<6) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint OpenBSD 2.6 with all available patches as of roughly Feb01 -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<4C22A&>C1A) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=F|E%UCK=F|E%ULEN=134%DAT=E) - -# With more info provided by Theo De Raadt -# OpenBSD 2.6 -Fingerprint OpenBSD 2.6-2.8 -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<1869F6&>3E6B) -T1(DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134|3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint OpenBSD 2.6-2.8 -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=1B9B) -T1(DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint OpenBSD 2.8 (x86) -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=TD|RI%gcd=<6%SI=1%IPID=RPI|BI%TS=U) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint OpenBSD 2.9-beta through release (x86) -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) -T1(DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y|N%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=Y|N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=Y|N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y|N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y|N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint OpenBSD 2.9-stable -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=RD%TS=2HZ) -T1(DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=5B4%ACK=S++%Flags=AS%Ops=MNNT) -T4(DF=Y%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint OpenBSD Post 2.4 (November 1998) - 2.5 -Class OpenBSD | OpenBSD | 2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=>FFF&62A0A%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Packet Engines PowerRail 5200 router version 2.6.0r10 - 16 Sep, 1999 -Class Packet Engines | embedded || router -TSeq(Class=64K) -T1(DF=N%W=0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=A%Ops=) -T4(DF=N%W=FFFF%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Packet8 BPA410 broadband phone adapter -Fingerprint Packet8 BPA410 Broadband Phone Adapter -Class Packet8 | embedded || VoIP adapter -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=578%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=578%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=578%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=578%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=Y%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) - -Fingerprint Packet8 DTA310 VoIP/POTS gateway -Class Packet8 | embedded || VoIP adapter -TSeq(Class=TD%gcd=<200034%SI=<1E%TS=U) -T1(DF=N%W=578%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=578%ACK=S++%Flags=AS%Ops=) -T4(DF=N%W=578%ACK=O%Flags=R%Ops=) -T5(DF=N%W=578%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=578%ACK=O%Flags=R%Ops=) -T7(DF=N%W=578%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) - -# Packet8 DTA-310 (DTA version 1.0 US (8x8 001239)) -# Packet 8 DTA310 broadband phone adapter -Fingerprint Packet8 DTA310 VoIP/POTS gateway -Class Packet8 | embedded || VoIP adapter -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=Y%W=578%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=578%ACK=S++%Flags=AS%Ops=) -T4(DF=Y%W=578%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=578%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=578%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=578%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=148%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=F) - -Fingerprint Packeteer PacketShaper 4000 v4.1.3b2 2000-04-05 -Class Packeteer | pSOS || load balancer -TSeq(Class=64K) -T1(DF=N%W=430%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# Packeteer IP-PacketShaper 2000 V3.1 -Fingerprint pSOS embedded IP stack, such as Packeteer IP-PacketShaper 2000 V3.1 -Class Packeteer | pSOS || load balancer -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint PalmOS 3.5.1 on m100 PDA -Class Palm | PalmOS | 3.X | PDA -TSeq(Class=TD%gcd=<138C%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=A78%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=A78%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Panasonic IP Technology Broadband Networking Gateway, KX-HGW200 -Class Panasonic | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<27BE484&>16928%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(Resp=N) - -# (printer, scanner, copier, fax machine) -Fingerprint Panasonic DP-3520 multi-function printer -Class Panasonic | embedded || printer -TSeq(Class=TD%gcd=27) -T1(Resp=N) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Panasonic WJ-NT104 Network Interface Unit w/firmware version : V1.01G 010323A -Fingerprint Panasonic WJ-NT104 Network video device -Class Panasonic | embedded || webcam -TSeq(Class=RI%gcd=<6%SI=<3183A&>7C8%IPID=I%TS=U) -T1(DF=N%W=2DA0%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2DA0%ACK=O%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Parks Altavia 671R router -Class Parks | embedded || broadband router -TSeq(Class=TD%gcd=21%IPID=I%TS=U) -T1(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=O%Flags=R%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Pelco Network Camera -Class Pelco | embedded || webcam -TSeq(Class=RI%gcd=<6%SI=<1000018&>28F48%IPID=I%TS=U) -T1(DF=N%W=B4%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=B4%ACK=S%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=B4%ACK=S++%Flags=AS%Ops=) -T4(DF=N%W=B4%ACK=S%Flags=R%Ops=) -T5(DF=N%W=B4%ACK=S++%Flags=R%Ops=) -T6(DF=N%W=B4%ACK=S%Flags=R%Ops=) -T7(DF=N%W=B4%ACK=S%Flags=R%Ops=) -PU(Resp=N) - -# Perle 594e Network Controller -Fingerprint Perle 594e Network Controller -Class Perle | embedded || remote management -T1(DF=Y%W=C39%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=Y%W=100%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=C39%ACK=O%Flags=AS%Ops=M) -T4(DF=Y%W=100%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=100%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=100%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=100%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Perle JetStream 8500 Serial/Access Server, v 2.6.0 -Class Perle | embedded || terminal server -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FC%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Philips ReplayTV 5000 DVR -Class Philips | embedded || media device -TSeq(Class=64K%IPID=I%TS=2HZ) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Pigtail Express VoIP phone (runs VxWorks) -Class Pigtail | VxWorks || VoIP phone -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint Pirelli Microbusiness ADSL router -Class Pirelli | embedded || broadband router -TSeq(Class=64K%IPID=I%TS=2HZ) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=20%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Pitney Bowes DL550 photocopier -# Konica IP Controller Internal Print Server Module for Konica Multi-Purpose Printer/Fax/Scanner, Model KCA_018823 -Fingerprint Pitney Bowes photocopier, Konica printer/fax/scanner, or Toshiba E-Studio16 printer -Class Pitney Bowes | embedded || printer -Class Konica Minolta | embedded || printer -Class Toshiba | embedded || printer -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# switch planet-fgsw-2620vs http://www.planet.com.tw/news/productnews/FGSW-2620VS.htm -Fingerprint Planet FGSW-2620VS switch -Class Planet | embedded || switch -TSeq(Class=TD%gcd=<14%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Planet WAP 1950 Wireless Access Point -Class Planet | embedded || WAP -TSeq(Class=TD%gcd=<1C%SI=<14%IPID=I%TS=U) -T1(DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=800%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Polycom Video Conference node -Class Polycom | embedded || webcam -TSeq(Class=C%Val=8B6A000%IPID=I%TS=U) -T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Polycom ViewStation -Class Polycom | embedded || webcam -TSeq(Class=C) -T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Polycom ViewStation 512K videoconferencing system -Class Polycom | embedded || webcam -TSeq(Class=C) -T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|80%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Polycom ViewStation video-conferencing system (firmware v7.2) -Class Polycom | embedded || webcam -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=5B40%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint PowerShow NetworKam webcam -Class PowerShow | embedded || webcam -TSeq(Class=TD%gcd=<194%SI=<14%IPID=I%TS=U) -T1(Resp=N) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=400|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Proteon OpenRoute 3.0 gt series router -Class Proteon | OpenRoute || router -TSeq(Class=TD%gcd=1%SI=0) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=ML) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Proxim Stratum MP FW: 7_8_18; managed via HTTP and only relevant data is (I guess) the firmware version: FW: 7_8_18 -Fingerprint Proxim Stratum MP Wireless bridge -Class Proxim | embedded || bridge -TSeq(Class=TD%gcd=<61AC%SI=<46%IPID=I%TS=1000HZ) -T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -# Proxim 8571 802.11a Access Point Software Version: 2.0-B11 : Aug 12 2002 11:08:16 -Fingerprint Proxim 8571 802.11a Access Point -Class Proxim | embedded || WAP -TSeq(Class=TD%gcd=<714%SI=<14%IPID=I%TS=U) -T1(DF=N%W=1770%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1770%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint QMS Magicolor 2200 DeskLaser printer -Class QMS | embedded || printer -T1(DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=0|800%ACK=O|S++%Flags=R|AS%Ops=|M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=R%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(Resp=N) - -Fingerprint QNX 4.24 - 4.25 realtime embedded OS -Class QNX | QNX || general purpose -TSeq(Class=64K) -T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1F0E%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint QNX 6.00 realtime embedded OS (x86) -Class QNX | QNX || general purpose -TSeq(Class=TD%gcd=<7D4%SI=<8C%IPID=I%TS=U) -T1(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -# QNX 6.00 2000/10/17-14:59:25edt x86pc x86 -Fingerprint QNX 6.00 realtime embedded OS (x86) -Class QNX | QNX || general purpose -TSeq(Class=TD%gcd=<4AB54%SI=<82%IPID=I%TS=U) -T1(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=WNMETL) -T2(Resp=N) -T3(Resp=Y%DF=N%W=800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T5(DF=N%W=C00|400|800%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=C00|1000|800%ACK=S++%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -# Quanterra OS/9 V2.4 on 68K (Quanterra Q4124 - 68030) -Fingerprint Quanterra seismic data acquisition system running OS/9 V2.4 on 68K -Class Quanterra | OS/9 || specialized -TSeq(Class=i800) -T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=C000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Quantum Snap server 4100 -Class Quantum | embedded || storage-misc -TSeq(Class=i800%IPID=I%TS=U) -T1(DF=N%W=2238%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2238%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2238%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Quantum Snap Server Network Storage Box -Class Quantum | embedded || storage-misc -TSeq(Class=i800) -T1(Resp=Y%DF=N%W=4470%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4470%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=4470%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Racal 7100 Host Security Module 1.05 / 5.05 -Class Racal | embedded || encryption accelerator -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Radware Content Inspection Director v2.10.03 -Class Radware | embedded || security-misc -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Raptor firewall 5.03 on NT 4 -Class Raptor | embedded || firewall -TSeq(Class=TR) -T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(Resp=N) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Raptor Firewall 6 on Solaris 2.6 -Class Raptor | Solaris | 2.X | firewall -TSeq(Class=RI%gcd=<6%SI=24B0) -T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Cisco 1538M HUB running Cisco 1538M EES (1.00.00) or Assured Access Technology ISAS Switch Release-2.3.0 or Thomson Multimedia RCA DCM245 Cable Modem -Class RCA | embedded || broadband router -Class Cisco | embedded || hub -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint RCA/Thomson cable modem DCM-235/245 -Class RCA | embedded || broadband router -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Redback SMS 1800 router -Class Redback | AOS || router -TSeq(Class=RI%gcd=<6%SI=<4CA7C&>C2F) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Redback SMS 1800 router AOS Release 5.0.3.8 -# Redback Networks SMS 10000 AOS 6.0.5.0 -# Thomson TMC 390 cable modem -Fingerprint Redback SMS 1800/10000 router or Thomson TMC 390 cable modem -Class Redback | AOS || router -Class Thomson | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<7B6BA&>BA7%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Redback SMS500 Redback Networks AOS Release 5.0.4.0 PRODUCTION RELEASE -# Redback Networks AOS Release 5.0.3.8 PRODUCTION MAINTENANCE RELEASE -Fingerprint Redback SMS500 Redback Networks router AOS Release 5.0.3.8 - 5.0.4.0 -Class Redback | AOS || router -TSeq(Class=RI%gcd=<6%SI=<56DF6&>337%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0|E|F%UCK=0|F%ULEN=134%DAT=E) - -Fingerprint Redback SMS 1000-2000 DSL Router -Class Redback | embedded || broadband router -TSeq(Class=RI%gcd=<4%SI=>1000&1BB%IPID=RD%TS=U) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=3401%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# RiverStone RS3000 System Software version 9.1.2.5 -Fingerprint RiverStone RS3000 router -Class RiverStone | embedded || router -TSeq(Class=RI%gcd=<6%SI=<60158&>7CD%IPID=I%TS=2HZ) -T1(DF=Y%W=403D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=400|1000|800%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800|400|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|400|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=134%RID=E|F%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint RoadLanner Broadband router BRL-04FW 6.15.02r Build 0091 L:01 -Class RoadLanner | embedded || broadband router -TSeq(Class=TD%gcd=<6E004%SI=<14%IPID=I%TS=1000HZ) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=MTWL) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Rockwell Spectrum 100 POTS switcher release 7.2 -Class Rockwell | embedded || telecom-misc -TSeq(Class=i800%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Ricoh Aficio 270 copier Ver. 1.4.9, Network Interface Board Ver. 4.0.7 (ELAND__99) -Fingerprint Savin 9927 Copier or Ricoh Aficio 270 copier -Class Savin | embedded || printer -Class Ricoh | embedded || printer -TSeq(Class=i800%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=2000%ACK=O%Flags=UR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y|N%TOS=0%IPLEN=38%RIPTL=1C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# Scientific Atlanta Explorer 4200 - Digital Cable Box -Fingerprint Scientific Atlanta Explorer 4200 Digital Cable Box -Class Scientific Atlanta | embedded || media device -TSeq(Class=64K%IPID=I%TS=2HZ) -T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=209D%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=68%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -# Scientific Atlanta PowerVu Program Receiver Model D9850/9010, Version: 1.51 2004-02-06 14:45:06 -Fingerprint Scientific Atlanta PowerVu Program Receiver Model D9850/9010 -Class Scientific Atlanta | embedded || media device -TSeq(Class=TD%gcd=<3D094%SI=<1E%IPID=I%TS=1000HZ) -T1(DF=N%W=209D%ACK=S++%Flags=AS%Ops=MENWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint SCO OpenServer 5.0.5 -Class SCO | OpenServer || general purpose -TSeq(Class=RI%gcd=<5%SI=>FFFF) -T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint SCO OpenServer 5.0.7 -Class SCO | OpenServer || general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=832C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=8058%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint SCO OpenServer Release 5 -Class SCO | OpenServer || general purpose -TSeq(Class=RI%gcd=<6%SI=>FFFF) -T1(DF=Y%W=165C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint SCO OpenServer Release 5 -Class SCO | OpenServer || general purpose -TSeq(Class=RI%gcd=<6%SI=<34A71A&>86B6) -T1(DF=N%W=1000|6000|111C%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=6041|108C%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SCO Open Desktop ( Same as SCO UNIX?) -Fingerprint SCO Open Desktop 2.0 -Class SCO | SCO UNIX || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint SCO UNIX release 3.2 -Class SCO | SCO UNIX || general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFC%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint SCO UnixWare 2.01 -Class SCO | UnixWare || general purpose -TSeq(Class=64K) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=|M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint SCO UnixWare 2.1 -Class SCO | UnixWare || general purpose -TSeq(Class=RI%gcd=<6%SI=>FFF) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# SCO UnixWare 2.1 LiveScan Fingerprint Server -Fingerprint SCO UnixWare 2.1 -Class SCO | UnixWare || general purpose -TSeq(Class=RI%gcd=<6%SI=<6D77C0&>B174%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint SCO UnixWare 2.1.2 -Class SCO | UnixWare || general purpose -TSeq(Class=RI%gcd=<6%SI=>FFFF) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint SCO UnixWare 7.0.0 or OpenServer 5.0.4-5.0.6 -Class SCO | UnixWare || general purpose -TSeq(Class=RI%gcd=FFFF) -T1(W=60F4%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%W=6041%ACK=O%Flags=A%Ops=) -T4(W=0%ACK=O%Flags=R%Ops=) -T5(W=0%ACK=S++%Flags=AR%Ops=) -T6(W=0%ACK=O%Flags=R%Ops=) -T7(W=0%ACK=S%Flags=AR%Ops=) -PU(TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint SCO UnixWare 7.1.0 - 7.1.1 (x86) -Class SCO | UnixWare || general purpose -TSeq(Class=RI%gcd=<6%SI=<403094&>8C71%IPID=I%TS=100HZ) -T1(DF=N%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=N%W=6041%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint SCO UnixWare 7.1.0 x86 -Class SCO | UnixWare || general purpose -TSeq(Class=RI%gcd=<6%SI=<442BB8&>AE70) -T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=NNT) -T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# UnixWare 7.1.1 i386 x86at SCO UNIX_SVR5 -Fingerprint SCO UnixWare 7.1.1 -Class SCO | UnixWare || general purpose -TSeq(Class=RI%gcd=<6%SI=<874330&>B9D5%IPID=I%TS=U) -T1(DF=Y%W=60F4%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=6041%ACK=O%Flags=A%Ops=) -T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Secure Computing SECUREZone Firewall Version 2.0 -Class Secure Computing | embedded || firewall -TSeq(Class=TR%gcd=<6) -T1(DF=Y%W=2017%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=N) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Secure Computing Sidewinder firewall 3.2 update 4 -Class Secure Computing | embedded || firewall -TSeq(Class=RI%gcd=<5%SI=>FFF&23) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sequent DYNIX/ptx 4.4.6 x86 -Class Sequent | DYNIX || general purpose -TSeq(Class=RI%gcd=<6%SI=<2E4AA&>752%IPID=I%TS=U) -T1(DF=Y%W=4000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=4000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) - -Fingerprint Sequent DYNIX/ptx V4.2.1 -Class Sequent | embedded || general purpose -TSeq(Class=RI%gcd=FF&8%IPID=I%TS=2HZ) -T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SGI IRIX 6.5.14, SGI O2 -# SGI IRIX 6.5 IP32 -Fingerprint SGI IRIX 6.5.14 -Class SGI | IRIX | 6.X | general purpose -TSeq(Class=RI%gcd=257%IPID=I%TS=2HZ) -T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint SGI IRIX 6.5.15m on SGI O2 -Class SGI | IRIX | 6.X | general purpose -TSeq(Class=TD%gcd=<104%SI=<1AE%IPID=I%TS=2HZ) -T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint SGI IRIX 6.5.16m -Class SGI | IRIX | 6.X | general purpose -TSeq(Class=RI|i800%gcd=<144%SI=<712%IPID=RPI%TS=2HZ) -T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# IRIX 6.5 6.5.20m IP32 -Fingerprint SGI IRIX 6.5.20m -Class SGI | IRIX | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SGI Indigo2 R10000 running IRIX64 6.5.20m -Fingerprint SGI IRIX 6.5.20m -Class SGI | IRIX | 6.X | general purpose -TSeq(Class=64K%IPID=I%TS=2HZ) -T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint SGI IRIX 6.5.25 -Class SGI | IRIX | 6.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=N%W=C000%ACK=S++%Flags=AS%Ops=MNWNNTNNM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=C000%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint SGI IRIX 6.5.7f-6.5.8f -Class SGI | IRIX | 6.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# SGI O2 running SGI IRIX 6.5.7f -Fingerprint SGI IRIX 6.5.7f-6.5.8f -Class SGI | IRIX | 6.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNTNNM) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Sharp DIGITAL Imager (copier) AR-507 -Class Sharp | embedded || printer -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sharp Network Printer AR-337 -Class Sharp | embedded || printer -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Shiva AccessPort Bridge/Router Software V 2.1.0 -# 3Com HiPer Access Router Card hardware 1.0.0 software 4.1.59 -Fingerprint Shiva AccessPort Bridge/Router Software V 2.1.0 or 3Com HiPer Access Router Card hardware V1.0.0 software V4.1.59 -Class Shiva | embedded || router -Class 3Com | embedded || router -TSeq(Class=TD%gcd=<6%SI=8E%IPID=I%TS=U) -T1(DF=N%W=1FFE%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=1FFE%ACK=O%Flags=R%Ops=) -T3(Resp=N) -T4(DF=N%W=1FFE%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Siemens Speedstream 2602 DSL/Cable router -Class Siemens | embedded || broadband router -TSeq(Class=RI%gcd=<6%SI=<22E601A&>31AA1%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Siemens HICOM 300 Phone switch (PBX) (WAML LAN card) -Fingerprint Siemens HICOM 300 Phone switch (PBX) -Class Siemens | embedded || PBX -TSeq(Class=64K) -T1(DF=N%W=808%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=808%ACK=O%Flags=A%Ops=) -T4(DF=N%W=808%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Siemens HICOM Phone switch (PBX) -Class Siemens | embedded || PBX -TSeq(Class=RI%gcd=4EB3%IPID=I%TS=100HZ) -T1(DF=Y%W=111C%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=108C%ACK=O%Flags=A%Ops=NNT) -T4(DF=Y%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Siemens HiPATH3500 VoIP PBX -Class Siemens | embedded || PBX -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=4000%ACK=S++|O%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# Siemens S7-400 PLC CPU-416-2 -Fingerprint Siemens S7-400 programmable logic controller -Class Siemens | embedded || specialized -TSeq(Class=RI%gcd=<6%SI=<583DCAE&>977AD%IPID=I%TS=U) -T1(DF=N%W=230%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=230%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Siemens HiCom 300E business phone system Release 6.5 -Class Siemens | embedded || VoIP phone -TSeq(Class=RI%gcd=<6%SI=<5D131C&>4A3C%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint ReliantUNIX-Y 5.44 B0033 RM600 1/256 R10000 -Class Siemens | ReliantUNIX || general purpose -TSeq(Class=64K) -T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# Reliant UNIX 5.45B20 running on an RM400 (Siemens stuff) -Fingerprint Siemens Reliant UNIX 5.45B20 -Class Siemens | ReliantUNIX || general purpose -TSeq(Class=RI%gcd=<6%SI=100C%IPID=I%TS=2HZ) -T1(DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=CC93%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Siemens RM200-C40 running ReliantUNIX-N 5.45 -Class Siemens | ReliantUNIX || general purpose -TSeq(Class=RI%gcd=<6%SI=<7DF64&>AAA%IPID=I%TS=2HZ) -T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=807A%ACK=S++%Flags=AS%Ops=MNWNNT) -T4(DF=N%W=8000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Siemens SINIX-N 5.41C0005 -Class Siemens | SINIX || general purpose -TSeq(Class=64K%gcd=<6%SI=<14) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Siemens SINIX-N 5.43C3002 -Class Siemens | SINIX || general purpose -TSeq(Class=64K%gcd=<6%SI=<14) -T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=NW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=NW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Siemens SINIX-Y 5.43B0045 -Class Siemens | SINIX || general purpose -TSeq(Class=64K) -T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Siemens SINIX-Y 5.43C4001 -Class Siemens | SINIX || general purpose -TSeq(Class=RI%gcd=<6%SI=<26E76&>625) -T1(DF=N%W=7FFF%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FFF%ACK=O%Flags=AS%Ops=MNW) -T4(DF=N%W=7FFF%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# Sipura SPA-2000 VoIP Firmware version 2.09d -# SPA-841 VoIP Phone (SIP) with firmware 0.9.5 -# Sipura SPA SPA-1000 Software Version: 1.0.33 Hardware Version: 2.0.1 -# Sipura SPA-2000 VoIP Adapter -# Sipura SPA-2000 Software Version: 2.0.10(d) IP Phone Adaptor -# Sipura SPA-3000, firmware 2.0.13(GWg) -Fingerprint Sipura SPA-841/1000/2000/3000 POTS<->VoIP gateway -Class Sipura | embedded || VoIP adapter -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=ARF%Ops=) -T3(Resp=Y%DF=N%W=3E80%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=ARF%Ops=) -T6(DF=N%W=0%ACK=O%Flags=RF%Ops=) -T7(DF=N%W=0%ACK=S%Flags=ARF%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SMC Barricade SMC7004VR2.0EU DSL-Router Firmware R1.02-DDNS -Fingerprint SMC Barricade SMC7004VR2.0EU DSL router -Class SMC | embedded || broadband router -TSeq(Class=TD%gcd=<68%SI=<1E%IPID=BI%TS=U) -T1(DF=N%W=16D0%ACK=S++|O%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Panasonic KX-HCM10 network camera -# SMC EZConnect Wireless Access Point SMC2655W V.2 -Fingerprint Panasonic network camera or SMC WAP -Class SMC | embedded || WAP -Class Panasonic | embedded || webcam -TSeq(Class=TD%gcd=474%IPID=I) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Softek Digi One RealPort serial device server -# Digi One SP Serial to Ethernet Converter Version 82000774_E 06/13/2003 -Fingerprint Softek Digi One serial device server -Class Softek | embedded || specialized -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=8E%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SonicWALL Pro 200 Firmware Version 6.4.2.0 -Fingerprint SonicWALL Pro 200 firewall -Class SonicWALL | embedded || firewall -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N|Y%W=0|402E%ACK=S++%Flags=AR|AS%Ops=|MNWNNT) -T2(Resp=Y%DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N|Y%W=0|402E%ACK=O|S++%Flags=AR|AS%Ops=|MNWNNT) -T4(DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=1000|C00|800%ACK=S++%Flags=AR%Ops=) - -# SonicWALL 4060 firewall running SonicOS Enhaced 2.5 -Fingerprint SonicWALL 4060 firewall -Class SonicWALL | SonicOS || firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=Y%DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=400|800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# base on msg 2615 -# PRO 3060 Standard SonicOS Standard 3.1.0.1-60s -Fingerprint SonicWALL PRO 3060 firewall -Class SonicWALL | SonicOS || firewall -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# Cisco 350 Access Point, software rev 12.02T1 -# Accelerated Networks VoDSL - But what sort of device? -Fingerprint SonicWALL SOHO firewall, Enterasys Matrix E1, or Accelerated Networks VoDSL, or Cisco 350 Access Point -Class SonicWALL | SonicOS || firewall -Class Enterasys | embedded || switch -Class Cisco | embedded || WAP -TSeq(Class=64K) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint SonicWALL SOHO-3 firewall -Class SonicWALL | SonicOS || firewall -T1(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint SonicWALL SOHO-3 firewall -Class SonicWALL | SonicOS || firewall -TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=400%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# SonicWALL SOHO3 (CPU: Toshiba 3927 H2 / 133 Mhz) Firmware version: 6.6.0.6 ROM version: 6.2.0.0 -Fingerprint SonicWALL SOHO3 firewall -Class SonicWALL | SonicOS || firewall -TSeq(Class=RI%gcd=<6%SI=<708FA&>904%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# SonicWALL TZ 170 SonicOS 2.5.0.2 Enhanced -Fingerprint SonicWALL TZ 170 firewall -Class SonicWALL | SonicOS || firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=2HZ) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=Y%DF=N%W=C00|400%ACK=S++%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=400|C00%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|1000|C00%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=1000|800|C00%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint SonicWALL TZ 170 firewall -Class SonicWALL | SonicOS || firewall -TSeq(Class=TR%gcd=<6%IPID=Z%TS=100HZ) -T1(DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=Y%DF=N%W=C00|400|1000%ACK=S++%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|800%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=1000|C00%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -# SonicWALL TZ170 Firewall with SonicOS -# SonicWALL FZ170 Unrestricted (firewall/VPN appliances) with SonicOS 2.6 -# SonicOS 3.0.0.4-41s on SonicWALL TZ 170 -Fingerprint SonicWALL TZ 170 firewall -Class SonicWALL | SonicOS || firewall -TSeq(Class=64K%IPID=I%TS=2HZ) -T1(DF=N%W=4000%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint SonicWALL/10 firewall -Class SonicWALL | SonicOS || firewall -TSeq(Class=TR) -T1(Resp=Y%DF=N%W=7FE0%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y|N%W=7FE0|7FDF%ACK=O|S++%Flags=A|ASF%Ops=ME) -T4(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T5(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T7(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint SonicWALL/10 firewall -Class SonicWALL | SonicOS || firewall -TSeq(Class=TR) -T1(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=2017%ACK=S++%Flags=AS%Ops=M) -T4(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T5(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) -T7(Resp=Y%DF=N%W=400%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Sony AIBO ERS-7 running AIBO Mind 2 -Class Sony | embedded || robotic pet -TSeq(Class=TR|TD%gcd=<186A4%SI=<64%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=2000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=R%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint PS2 Linux 1.0 on Sony PS2 game console -Class Sony | Linux || game console -TSeq(Class=RI%gcd=<6%SI=<20E2FE8&>5428C%IPID=I%TS=100HZ) -T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENNT) -T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=WNMETL) - -# This appears to be used by game developers to test performance. -Fingerprint Sony PlayStation 2 Performance Analyser -Class Sony | Linux || specialized -TSeq(Class=RI%gcd=<6%SI=<18EC23A&>3FCBC%IPID=I%TS=100HZ) -T1(DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7D41%ACK=S++%Flags=AS%Ops=MENNTNW) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sony NewsOS 6.1.2 -Class Sony | NewsOS || general purpose -TSeq(Class=64K%gcd=<6%SI=<14) -T1(DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=CDFF%ACK=S++%Flags=AS%Ops=MEWL) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Sony Ericsson P800 mobile phone, Symbian OS v7.0 -Class Sony | Symbian || phone -TSeq(Class=RI%gcd=<8%SI=<31996C&>200D%IPID=I) -T1(DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=7D78%ACK=S++%Flags=AS%Ops=MTL) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Soyo G668 VoIP phone -Class Soyo | embedded || VoIP phone -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=514%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=R%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(Resp=N) - -# speedstream router 5871 v4.0.1 -Fingerprint Speedstream 5871 DSL router -Class SpeedStream | embedded || broadband router -TSeq(Class=TR%gcd=<6%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint Spirent AX4000 Network Testing Tool -Class Spirent | embedded || specialized -TSeq(Class=RI%gcd=<6%SI=<761F6&>E8E%IPID=I%TS=U) -T1(DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=402E%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=0%ULEN=134%DAT=E) - -Fingerprint StackTools StackTos 1.0 embedded networking OS -Class StackTools | StackTos || general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=A8%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint StackTos 2.1 -Class StackTools | StackTos || general purpose -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=5AC%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0|20%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Stratus VOS Release 14.3.1ae -Class Stratus | VOS || general purpose -T1(DF=N%W=C00%ACK=S++%Flags=BAR%Ops=WNMETL) -T2(Resp=Y%DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) -T4(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=N%W=C00%ACK=S++%Flags=AR%Ops=WNMETL) -T6(DF=N%W=C00%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=C00%ACK=S++%Flags=UAPR%Ops=WNMETL) -PU(Resp=N) - -# Sun StorEdge T3 / Sun StorEdge T3B, Workgroup Storage Array -Fingerprint Sun StorEdge T3 Storage Array -Class Sun | embedded || storage-misc -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 5.10.1 -Class Sun | Solaris | 10 | general purpose -TSeq(Class=RI%gcd=<6%SI=<1C36BAC&>4838E%IPID=RPI%TS=U) -T1(DF=Y%W=C0B7%ACK=O|S++%Flags=A|AS%Ops=NNT|NNTMNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SunOS 5.10 Generic sun4u sparc SUNW,Sun-Fire-V250 -Fingerprint SunOS 5.10 (sparc) -Class Sun | Solaris | 10 | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) -T2(Resp=Y%DF=Y%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SunOS webbox 5.10 Generic i86pc i386 i86pc -Fingerprint SunOS webbox 5.10 Generic -Class Sun | Solaris | 10 | general purpose -TSeq(Class=RI%gcd=<6%SI=D98%IPID=I%TS=100HZ) -T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=C%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 2.3 - 2.4 -Class Sun | Solaris | 2.X | general purpose -TSeq(Class=64K) -T1(DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=2332|2544|FFAF|2229%ACK=S++%Flags=AS%Ops=ME) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 2.4 w/most Sun patches (jumbo cluster patch, security patches, etc) -Class Sun | Solaris | 2.X | general purpose -TSeq(Class=64K) -T1(DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2332%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 2.5, 2.5.1 -Class Sun | Solaris | 2.X | general purpose -TSeq(Class=RI%gcd=<6) -T1(DF=Y|N%W=2229|2332|4452|FFAF|8377|8EDA|879B%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 2.6 -Class Sun | Solaris | 2.X | general purpose -TSeq(Class=RI%gcd=<6%SI=<512B6&>CE8) -T1(DF=Y%W=212%ACK=S++%Flags=AS%Ops=NNTME) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -# SunOS dabox 5.6 Generic_105181-30 sun4u sparc SUNW,Ultra-Enterprise -Fingerprint Sun Solaris 2.6 (SPARC) -Class Sun | Solaris | 2.X | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=2297%ACK=S++%Flags=AS%Ops=NNTNWME) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) -T3(Resp=N) -T4(DF=N%W=1000%ACK=S%Flags=AR%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=0 -Class Sun | Solaris | 2.X | general purpose -Class Sun | Solaris | 7 | general purpose -TSeq(Class=64K) -T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 2.6 - 7 with tcp_strong_iss=2 -Class Sun | Solaris | 2.X | general purpose -Class Sun | Solaris | 7 | general purpose -TSeq(Class=TR%IPID=I%TS=100HZ) -T1(DF=Y%W=2297|2491|2788|4431|8371|8765|FFF7|FFFF%ACK=S++%Flags=AS%Ops=NNTNWME) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 2.6 - 7 x86 -Class Sun | Solaris | 2.X | general purpose -Class Sun | Solaris | 7 | general purpose -TSeq(Class=RI%gcd=<6) -T1(DF=Y%W=2491|462B%ACK=S++%Flags=AS%Ops=NNTNWME) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O|S%Flags=AR|R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 2.6 - 8 (SPARC) -Class Sun | Solaris | 2.X | general purpose -Class Sun | Solaris | 7 | general purpose -Class Sun | Solaris | 8 | general purpose -TSeq(Class=RI%gcd=<6%SI=<57A26&>DF1) -T1(DF=Y|N%W=109|212|2297|2788|4431|8371|8F4D|ABCD|FFF7|FFFF|2297%ACK=S++%Flags=AS%Ops=NNTNWME) -T2(DF=N%W=0%ACK=O%Flags=R%Ops=WNMETL) -T3(Resp=N) -T4(DF=Y|N%W=0%ACK=O%Flags=R%Ops=|WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y|N%W=0%ACK=O|S%Flags=AR|R%Ops=|WNMETL) -T7(DF=Y|N%W=0%ACK=S|O%Flags=AR|R%Ops=|WNMETL) -PU(DF=Y|N%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=F|E%ULEN=134%DAT=E) - -# Sun Solaris 8 // Sun Fire 80080 -Fingerprint Sun Solaris 8 -Class Sun | Solaris | 8 | general purpose -TSeq(Class=RI|TR%gcd=<8%SI=E0F%IPID=I%TS=100HZ) -T1(DF=Y%W=5B4|60DA|801B|807A|B68%ACK=S++%Flags=AS%Ops=NNTNWM|NNTM) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 8 -Class Sun | Solaris | 8 | general purpose -TSeq(Class=RI%gcd=<8%SI=<7FA08&>620%IPID=I%TS=U) -T1(DF=Y%W=6050%ACK=S++%Flags=AS%Ops=NWM) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 8 -Class Sun | Solaris | 8 | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=20%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Sun Netra T1 - SunOS 5.8 Generic_108528-24 sun4u sparc SUNW,UltraAX-i2 -# SunOS 5.8 Generic 117000-03, sun4u+sparc SUNW,UltraAX-i2 -Fingerprint Sun Solaris 8 -Class Sun | Solaris | 8 | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=60DA%ACK=S++%Flags=AS|A%Ops=NNTNWM|NNT) -T2(Resp=Y%DF=N%W=400|C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=400|800%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|400|C00|1000%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=400|800|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SunOS 5.8 Generic_108528-05 sun4u sparc SUNW,Ultra-5_10 -# SunOS fenix 5.8 Generic_117350-22 sun4u sparc SUNW,Sun-Fire-880 -Fingerprint Sun Solaris 8 -Class Sun | Solaris | 8 | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) -T2(Resp=Y%DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=C00|400|1000%ACK=S%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|1000|C00%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|400|800%ACK=S%Flags=AR%Ops=WNMETL) -PU(Resp=N) - -# SunOS 5.8 Generic_108528-16 sun4u sparc SUNW,Ultra-5_10 -Fingerprint Sun Solaris 8 -Class Sun | Solaris | 8 | general purpose -TSeq(Class=RI%gcd=<6%SI=10B4%IPID=I%TS=100HZ) -T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=C00|400|800%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(Resp=N) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Trusted Solaris 8 - SunOS SunRayServer 5.8 TS8 sun4u sparc SUNW,Ultra-60 -Fingerprint Sun Trusted Solaris 8 -Class Sun | Solaris | 8 | general purpose -TSeq(Class=RI%gcd=<8%SI=109A%IPID=I%TS=100HZ) -T1(DF=Y%W=60DA%ACK=S++%Flags=AS%Ops=NNTNWM) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=138%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# SunOS 5.9 Generic_117171-11 sun4u sparc SUNW,Sun-Fire-480R -Fingerprint Sun Solaris 9 -Class Sun | Solaris | 9 | general purpose -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000|800|400%ACK=S%Flags=R%Ops=WNMETL) -T4(Resp=N) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=F%UCK=F%ULEN=134%DAT=E) - -# SunOS 5.9 Generic_117171-02 sun4u sparc SUNW,Sun-Fire-V440 SPARC -# SunOS 5.9 Generic_117171-17 sun4u sparc SUNW,Sun-Fire-V440 -Fingerprint Sun Solaris 9 -Class Sun | Solaris | 9 | general purpose -TSeq(Class=RI%gcd=<6%SI=<2B77E4&>160F%IPID=I%TS=100HZ) -T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=400|1000|C00%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=C00|1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=1000|800|400%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Solaris 9 on a V120 -Fingerprint Sun Solaris 9 -Class Sun | Solaris | 9 | general purpose -TSeq(Class=RI%gcd=<8%SI=<9501A&>68E%IPID=I%TS=100HZ) -T1(DF=Y%W=C0B7%ACK=S++%Flags=AS%Ops=NNTMNW) -T2(Resp=Y%DF=N%W=800|1000%ACK=S%Flags=AR%Ops=WNMETL) -T3(Resp=Y%DF=N%W=1000|400%ACK=S++%Flags=AR%Ops=WNMETL) -T4(DF=N%W=800|1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=1000|400%ACK=S%Flags=AR%Ops=WNMETL) -T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=WNMETL) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Sun Solaris 9 Beta through Release on SPARC -# solaris 9 i386 -# Solaris 9 4/04 version (SPARC) -# Solaris 10 -Fingerprint Sun Solaris 9 or 10 -Class Sun | Solaris | 9 | general purpose -Class Sun | Solaris | 10 | general purpose -TSeq(Class=RI%gcd=<6%SI=116A%IPID=I%TS=100HZ) -T1(DF=Y%W=5B4|C0B7|801B|807A%ACK=S++%Flags=AS%Ops=NNTMNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E|F%UCK=E|F%ULEN=134%DAT=E) - -Fingerprint Sun Solaris 9 with TCP_STRONG_ISS set to 2 -Class Sun | Solaris | 9 | general purpose -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=N|Y%W=C0B7|8000|807A%ACK=S++%Flags=AS%Ops=NNTMNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N|Y%TOS=0%IPLEN=70%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Sun RSC (Remote System Control card) v1.14 (in Solaris 2.7) -Class Sun | SunOS || general purpose -T1(DF=N%W=2000%ACK=S++|O%Flags=ARS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=2000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Sun SunOS 4.0.3 -Class Sun | SunOS || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=) -T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# Sun SunOS 4.1.1 - 4.1.4 (or derivative), or GatorBox CS LocalTalk/Ethernet bridge -# GatorBox CS LocalTalk/Ethernet bridge running GatorShare version 3.0.3 (build X4) software -Fingerprint Sun SunOS 4.1.1 - 4.1.4 (or derivative) -Class Sun | SunOS || general purpose -Class Gatorbox | GatorShare || bridge -TSeq(Class=64K) -T1(DF=N%W=1000|2000|6000|C000%ACK=S++%Flags=AS%Ops=|M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000|2000|6000|C000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=1000|2000|6000|C000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N|Y%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=0|E%ULEN=134%DAT=E) - -Fingerprint Sun SunOS 4.1.3_U1 + ISI RFC1323 mods from ISI -Class Sun | SunOS || general purpose -TSeq(Class=64K) -T1(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AS%Ops=MNNTWL) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1000%ACK=O%Flags=A%Ops=NNT) -T4(Resp=Y%DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -Fingerprint Swissvoice IP 10S VoIP phone -Class Swissvoice | embedded || VoIP phone -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=2000%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=Y%DF=N%W=2000%ACK=O%Flags=A%Ops=) -T4(Resp=N) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(Resp=N) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=E%UCK=0%ULEN=134%DAT=E) - -# Symantec SGS 5310 Firewall -Fingerprint Symantec Gateway Security 5310 Firewall -Class Symantec | embedded || firewall -TSeq(Class=TR%gcd=<6%TS=U) -T1(DF=Y%W=7F53%ACK=S++%Flags=AS%Ops=MENW) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(Resp=N) - -# Symantec Gateway Security model 5420 (Iwill mobo) -Fingerprint Symantec Gateway Security 5420 firewall -Class Symantec | embedded || firewall -TSeq(Class=TR%gcd=<6%IPID=Z%TS=U) -T1(DF=Y%W=16D0%ACK=S++%Flags=AS%Ops=MNW) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Symantec Enterprise Firewall v7.0.4 (on Solaris 8) -Class Symantec | Solaris | 8 | firewall -TSeq(Class=TR%gcd=<6%IPID=I%TS=100HZ) -T1(DF=Y%W=807A%ACK=S++%Flags=AS%Ops=NNTNWM) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) - -Fingerprint Symantec Enterprise Firewall 7.0 running on Windows 2000 SP2 -Class Symantec | Windows | NT/2K/XP | firewall -TSeq(Class=TR%gcd=<6%IPID=I) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=MNWNNT) -T2(Resp=N) -T3(Resp=N) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(Resp=N) -PU(Resp=N) - -Fingerprint Symbol/Spectrum24 Wireless AP -Class Symbol | embedded || WAP -TSeq(Class=TD%gcd=<68%SI=<1E%IPID=I%TS=U) -T1(Resp=N) -T2(Resp=N) -T3(Resp=N) -T4(Resp=N) -T5(DF=N%W=400|800|C00%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=C00|1000%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=800|C00|1000%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# http://www.systech.com/catalog/RCS3000Entry.html -# RCS/3182 - Firmware rev. 06D (Apr 26 2001 15:15:33) - OS ver. RCS_3000_BDNL Version 06F (May 18 2001 16:15:18) -Fingerprint Systech RCS/3182 Ethernet serial port server (firmware 06D) -Class Systech | embedded || specialized -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=8000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7FFC%ACK=O%Flags=A%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Tahoe OS 1.2.1 running on Tahoe router -Class Tahoe | Tahoe OS || router -TSeq(Class=RI%gcd=<8%SI=6430%IPID=I%TS=U) -T1(DF=N%W=C00%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=C00%ACK=S++%Flags=ASF%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Tainet WANpro 2000i Broadband router -Class Tainet | embedded || broadband router -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=1000%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=1000%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=1000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=0%UCK=E%ULEN=134%DAT=E) - -# Talaris 1794 Printstation, firmware version 4.3.2, released 6/21/93 -Fingerprint Talaris 1794 Printstation -Class Talaris | embedded || printer -TSeq(Class=RI%gcd=<6%SI=<4010&>8F%IPID=BI%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Tally 9112 Printer -Class Tally | embedded || printer -TSeq(Class=TD%gcd=B05%IPID=I%TS=U) -T1(DF=N%W=1%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=1%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# From a Tektronix Phaser 350 -# Tektronix Phaser printer with shared Ethernet card, firmware version 3.01 -Fingerprint Tektronix Phaser printer -Class Tektronix | embedded || printer -TSeq(Class=RI%gcd=888&<4444) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=0|1000%ACK=S++|O%Flags=AR|AS%Ops=|M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Tektronix Phaser 860 Printer -# Tektronix Phaser 840 -Fingerprint Tektronix Phaser printer -Class Tektronix | embedded || printer -T1(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=0%ACK=O%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -# Tektronix Phaser 360 Extended -# Tektronix Phaser 750 -Fingerprint Tektronix/Xerox Phaser printer -Class Tektronix | embedded || printer -TSeq(Class=i800) -T1(DF=N%W=F87%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Telebit NetBlazer router version 3.0 -Class Telebit | embedded || router -TSeq(Class=TD%gcd=<100004%SI=<3C) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=APS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Telebit NetBlazer router Version 3.05 -Class Telebit | embedded || router -TSeq(Class=TD%gcd=40000|80000|C0000%SI=78B67%IPID=I%TS=U) -T1(DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=F%ULEN=134%DAT=E) - -# Treck Inc. TCP/IP stack (v2.1) on Orbacom T5 System Manager card (CPC-CAD) -Fingerprint Treck TCP/IP stack v2.1 -Class Treck | Treck || general purpose -TSeq(Class=TD%gcd=<3D094%SI=3F1C4%IPID=Z%TS=100HZ) -T1(DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW) -T2(Resp=N) -T3(Resp=Y%DF=Y%W=3E38%ACK=S++%Flags=AS%Ops=MNNTNW) -T4(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T5(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=Y%W=0%ACK=O%Flags=R%Ops=) -T7(DF=Y%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=Y%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint WTI Internet Power Switch 1.01 -Class WTI | embedded || power-device -TSeq(Class=TD%gcd=<6%SI=<28%IPID=I%TS=U) -T1(DF=N%W=1000%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=R%Ops=) -PU(Resp=N) - -Fingerprint WTI Network Power Switch v3.02 -Class WTI | embedded || power-device -TSeq(Class=TD%gcd=<2A%SI=<1E%IPID=I%TS=U) -T1(DF=N%W=800%ACK=S++%Flags=AS%Ops=) -T2(Resp=Y%DF=N%W=800%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T4(DF=N%W=800%ACK=S%Flags=AR%Ops=) -T5(DF=N%W=800%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=800%ACK=S%Flags=AR%Ops=) -T7(DF=N%W=800%ACK=S%Flags=AR%Ops=) -PU(Resp=N) - -Fingerprint Wyse Winterm System Version 4.2.077 -Class Wyse | Wyse OS || terminal server -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=F000%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=F000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=F000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -# WYSE OS Firmware V4.2.137 -Fingerprint Wyse Winterm terminal server -Class Wyse | Wyse OS || terminal server -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=7800%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=7800%ACK=O%Flags=A%Ops=) -T4(DF=N%W=7800%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E|F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint XCD Xconnect Print Server, firmware version CC8S-3.58 (98.09.21) -Class XCD | embedded || print server -TSeq(Class=TD%gcd=<272A%SI=<1E) -T1(DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=) -T3(Resp=Y%DF=N%W=3F6%ACK=S++%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=S%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=S%Flags=R%Ops=) -T7(Resp=N) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint Dell Laser Printer 5100cn -Class Xerox | embedded || printer -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=3000%ACK=S++%Flags=AS%Ops=) -T2(Resp=N) -T3(Resp=Y%DF=N%W=3000%ACK=O%Flags=A%Ops=) -T4(DF=N%W=3000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=4E4%RID=E%RIPCK=F%UCK=E%ULEN=134%DAT=E) - -Fingerprint Xerox 8830 Plotter -Class Xerox | embedded || printer -TSeq(Class=TD%gcd=1000%SI=1) -T1(DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T2(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=) -T3(Resp=Y%DF=N%W=200%ACK=S++%Flags=AS%Ops=M) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=O%Flags=R%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=O%Flags=R%Ops=) -PU(Resp=N) - -Fingerprint Xerox Document Centre 440 w/ CentreWare Internet Services -Class Xerox | embedded || printer -TSeq(Class=64K%IPID=I%TS=U) -T1(DF=N%W=402E%ACK=S++%Flags=AS%Ops=M) -T2(Resp=N) -T3(Resp=Y%DF=N%W=402E%ACK=O%Flags=A%Ops=) -T4(DF=N%W=4000%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=15C%RID=F%RIPCK=0%UCK=0%ULEN=134%DAT=E) - -Fingerprint Xerox Document Centre ColorSeries 50 -Class Xerox | embedded || printer -TSeq(Class=i800%IPID=I%TS=U) -T1(DF=N%W=1F0E%ACK=S++%Flags=AS%Ops=ME) -T2(Resp=N) -T3(Resp=Y%DF=N%W=FFFF%ACK=O%Flags=AS%Ops=ME) -T4(DF=N%W=0%ACK=O%Flags=R%Ops=) -T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -T6(DF=N%W=0%ACK=O%Flags=R%Ops=) -T7(DF=N%W=0%ACK=S++%Flags=AR%Ops=) -PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E) - -Fingerprint Xerox DocuPrint C55 -Class Xerox | embedded || printer -TSeq(Class=TD%gcd=1000|2000|3000|4000%SI=uh_sport = htons(sport); - udp->uh_dport = htons(dport); - udp->uh_ulen = htons(8 + datalen); - - /* OK, now we should be able to compute a valid checksum */ - realcheck = magic_tcpudp_cksum(source, victim, IPPROTO_UDP, - sizeof(struct udp_hdr) + datalen, (char *) udp); -#if STUPID_SOLARIS_CHECKSUM_BUG - udp->uh_sum = sizeof(struct udp_hdr) + datalen; -#else - udp->uh_sum = realcheck; -#endif - - if ( o.badsum ) { - udp->uh_sum--; - if (udp->uh_sum == 0) udp->uh_sum = 0xffff; // UDP checksum=0 means no checksum - } - - /* Now for the ip header */ - ip->ip_v = 4; - ip->ip_hl = 5; - ip->ip_len = htons(sizeof(struct ip) + sizeof(struct udp_hdr) + datalen); - ip->ip_id = id; - ip->ip_ttl = myttl; - ip->ip_p = IPPROTO_UDP; - ip->ip_src.s_addr = source->s_addr; - ip->ip_dst.s_addr= victim->s_addr; - - upi.ipck = in_cksum((unsigned short *)ip, sizeof(struct ip)); -#if HAVE_IP_IP_SUM - ip->ip_sum = upi.ipck; -#endif - - /* OK, now if this is the real she-bang (ie not a decoy) then - we stick all the inph0 in our upi */ - if (decoy == o.decoyturn) { - upi.iptl = 28 + datalen; - upi.ipid = id; - upi.sport = sport; - upi.dport = dport; - upi.udpck = realcheck; - upi.udplen = 8 + datalen; - upi.patternbyte = patternbyte; - upi.target.s_addr = ip->ip_dst.s_addr; - } - - if ((res = send_ip_packet(sd, eth, packet, ntohs(ip->ip_len))) == -1) - { - gh_perror("send_ip_packet in %s", __func__); - return NULL; - } -} - -return &upi; -} - -static struct AVal *fingerprint_iptcppacket(struct ip *ip, int mss, u32 syn) { - struct AVal *AVs; - int length; - int opcode; - u16 tmpshort; - char *p,*q; - struct tcp_hdr *tcp = ((struct tcp_hdr *) (((char *) ip) + 4 * ip->ip_hl)); - - AVs = (struct AVal *) safe_malloc(6 * sizeof(struct AVal)); - - /* Link them together */ - AVs[0].next = &AVs[1]; - AVs[1].next = &AVs[2]; - AVs[2].next = &AVs[3]; - AVs[3].next = &AVs[4]; - AVs[4].next = &AVs[5]; - AVs[5].next = NULL; - - /* First we give the "response" flag to say we did actually receive - a packet -- this way we won't match a template with Resp=N */ - AVs[0].attribute = "Resp"; - strcpy(AVs[0].value, "Y"); - - - /* Next we check whether the Don't Fragment bit is set */ - AVs[1].attribute = "DF"; - if(ntohs(ip->ip_off) & 0x4000) { - strcpy(AVs[1].value,"Y"); - } else strcpy(AVs[1].value, "N"); - - /* Now we do the TCP Window size */ - AVs[2].attribute = "W"; - sprintf(AVs[2].value, "%hX", ntohs(tcp->th_win)); - - /* Time for the ACK, the codes are: - S = same as syn - S++ = syn + 1 - O = other - */ - AVs[3].attribute = "ACK"; - if (ntohl(tcp->th_ack) == syn + 1) - strcpy(AVs[3].value, "S++"); - else if (ntohl(tcp->th_ack) == syn) - strcpy(AVs[3].value, "S"); - else strcpy(AVs[3].value, "O"); - - /* Now time for the flags ... they must be in this order: - B = Bogus (64, not a real TCP flag) - U = Urgent - A = Acknowledgement - P = Push - R = Reset - S = Synchronize - F = Final - */ - AVs[4].attribute = "Flags"; - p = AVs[4].value; - if (tcp->th_flags & TH_ECE) *p++ = 'B'; - if (tcp->th_flags & TH_URG) *p++ = 'U'; - if (tcp->th_flags & TH_ACK) *p++ = 'A'; - if (tcp->th_flags & TH_PUSH) *p++ = 'P'; - if (tcp->th_flags & TH_RST) *p++ = 'R'; - if (tcp->th_flags & TH_SYN) *p++ = 'S'; - if (tcp->th_flags & TH_FIN) *p++ = 'F'; - *p++ = '\0'; - - /* Now for the TCP options ... */ - AVs[5].attribute = "Ops"; - p = AVs[5].value; - /* Partly swiped from /usr/src/linux/net/ipv4/tcp_input.c in Linux kernel */ - length = (tcp->th_off * 4) - sizeof(struct tcp_hdr); - q = ((char *)tcp) + sizeof(struct tcp_hdr); - - while(length > 0 && - ((p - AVs[5].value) < (int) (sizeof(AVs[5].value) - 3))) { - opcode=*q++; - length--; - if (!opcode) { - *p++ = 'L'; /* End of List */ - break; - } else if (opcode == 1) { - *p++ = 'N'; /* No Op */ - } else if (opcode == 2) { - *p++ = 'M'; /* MSS */ - q++; - memcpy(&tmpshort, q, 2); - if(ntohs(tmpshort) == mss) - *p++ = 'E'; /* Echoed */ - q += 2; - length -= 3; - } else if (opcode == 3) { /* Window Scale */ - *p++ = 'W'; - q += 2; - length -= 2; - } else if (opcode == 8) { /* Timestamp */ - *p++ = 'T'; - q += 9; - length -= 9; - } - } - *p++ = '\0'; - return AVs; -} - - -static struct AVal *fingerprint_portunreach(struct ip *ip, struct udpprobeinfo *upi) { - struct icmp *icmp; - struct ip *ip2; - int numtests = 10; - unsigned short checksum; - unsigned short *checksumptr; - struct udp_hdr *udp; - struct AVal *AVs; - int i; - int current_testno = 0; - unsigned char *datastart, *dataend; - - /* The very first thing we do is make sure this is the correct - response */ - if (ip->ip_p != IPPROTO_ICMP) { - error("%s handed a non-ICMP packet!", __func__); - return NULL; - } - - if (ip->ip_src.s_addr != upi->target.s_addr) - return NULL; /* Not the person we sent to */ - - icmp = ((struct icmp *) (((char *) ip) + 4 * ip->ip_hl)); - if (icmp->icmp_type != 3 || icmp->icmp_code != 3) - return NULL; /* Not a port unreachable */ - - ip2 = (struct ip*) ((char *)icmp + 8); - udp = (struct udp_hdr *) ((char *)ip2 + 20); - - /* The ports better match as well ... */ - if (ntohs(udp->uh_sport) != upi->sport || ntohs(udp->uh_dport) != upi->dport) { - return NULL; - } - - /* Create the Avals */ - AVs = (struct AVal *) safe_zalloc(numtests * sizeof(struct AVal)); - - /* Link them together */ - for(i=0; i < numtests - 1; i++) - AVs[i].next = &AVs[i+1]; - - /* First of all, if we got this far the response was yes */ - AVs[current_testno].attribute = "Resp"; - strcpy(AVs[current_testno].value, "Y"); - - current_testno++; - - /* Now let us do an easy one, Don't fragment */ - AVs[current_testno].attribute = "DF"; - if(ntohs(ip->ip_off) & 0x4000) { - strcpy(AVs[current_testno].value,"Y"); - } else strcpy(AVs[current_testno].value, "N"); - - current_testno++; - - /* Now lets do TOS of the response (note, I've never seen this be - useful */ - AVs[current_testno].attribute = "TOS"; - sprintf(AVs[current_testno].value, "%hX", ip->ip_tos); - - current_testno++; - - /* Now we look at the IP datagram length that was returned, some - machines send more of the original packet back than others */ - AVs[current_testno].attribute = "IPLEN"; - sprintf(AVs[current_testno].value, "%hX", ntohs(ip->ip_len)); - - current_testno++; - - /* OK, lets check the returned IP length, some systems @$@ this - up */ - AVs[current_testno].attribute = "RIPTL"; - sprintf(AVs[current_testno].value, "%hX", ntohs(ip2->ip_len)); - - current_testno++; - - /* This next test doesn't work on Solaris because the lamers - overwrite our ip_id */ -#if !defined(SOLARIS) && !defined(SUNOS) && !defined(IRIX) && !defined(HPUX) - - /* Now lets see how they treated the ID we sent ... */ - AVs[current_testno].attribute = "RID"; - if (ntohs(ip2->ip_id) == 0) - strcpy(AVs[current_testno].value, "0"); - else if (ip2->ip_id == upi->ipid) - strcpy(AVs[current_testno].value, "E"); /* The "expected" value */ - else strcpy(AVs[current_testno].value, "F"); /* They fucked it up */ - - current_testno++; - -#endif - - /* Let us see if the IP checksum we got back computes */ - - AVs[current_testno].attribute = "RIPCK"; - /* Thanks to some machines not having struct ip member ip_sum we - have to go with this BS */ - checksumptr = (unsigned short *) ((char *) ip2 + 10); - checksum = *checksumptr; - - if (checksum == 0) - strcpy(AVs[current_testno].value, "0"); - else { - *checksumptr = 0; - if (in_cksum((unsigned short *)ip2, 20) == checksum) { - strcpy(AVs[current_testno].value, "E"); /* The "expected" value */ - } else { - strcpy(AVs[current_testno].value, "F"); /* They fucked it up */ - } - *checksumptr = checksum; - } - - current_testno++; - - /* UDP checksum */ - AVs[current_testno].attribute = "UCK"; - if (udp->uh_sum == 0) - strcpy(AVs[current_testno].value, "0"); - else if (udp->uh_sum == upi->udpck) - strcpy(AVs[current_testno].value, "E"); /* The "expected" value */ - else strcpy(AVs[current_testno].value, "F"); /* They fucked it up */ - - current_testno++; - - /* UDP length ... */ - AVs[current_testno].attribute = "ULEN"; - sprintf(AVs[current_testno].value, "%hX", ntohs(udp->uh_ulen)); - - current_testno++; - - /* Finally we ensure the data is OK */ - datastart = ((unsigned char *)udp) + 8; - dataend = (unsigned char *) ip + ntohs(ip->ip_len); - - while(datastart < dataend) { - if (*datastart != upi->patternbyte) break; - datastart++; - } - AVs[current_testno].attribute = "DAT"; - if (datastart < dataend) - strcpy(AVs[current_testno].value, "F"); /* They fucked it up */ - else - strcpy(AVs[current_testno].value, "E"); - - AVs[current_testno].next = NULL; - - return AVs; -} - -static FingerPrint *get_fingerprint(Target *target, struct seq_info *si) { - FingerPrint *FP = NULL, *FPtmp = NULL; - FingerPrint *FPtests[9]; - struct AVal *seq_AVs; - u16 lastipid=0; /* For catching duplicate packets */ - int last; - u32 timestamp = 0; /* TCP timestamp we receive back */ - struct ip *ip; - struct tcp_hdr *tcp; - struct icmp *icmp; - struct timeval t1,t2; - int i; - pcap_t *pd = NULL; - int rawsd; - int tries = 0; - int newcatches; - int current_port = 0; - int testsleft; - int testno; - int timeout; - int avnum; - unsigned int sequence_base; - unsigned long openport; - unsigned int bytes; - unsigned int closedtcpport = 31337; - unsigned int closedudpport = 31337; - Port *tport = NULL; - char filter[512]; - double seq_inc_sum = 0; - unsigned int seq_avg_inc = 0; - struct udpprobeinfo *upi = NULL; - u32 seq_gcd = 1; - u32 seq_diffs[NUM_SEQ_SAMPLES]; - u32 ts_diffs[NUM_SEQ_SAMPLES]; - unsigned long time_usec_diffs[NUM_SEQ_SAMPLES]; - struct timeval seq_send_times[NUM_SEQ_SAMPLES]; - int ossofttimeout, oshardtimeout; - int seq_packets_sent = 0; - int seq_response_num; /* response # for sequencing */ - double avg_ts_hz = 0.0; /* Avg. amount that timestamps incr. each second */ - struct link_header linkhdr; - struct eth_nfo eth; - struct eth_nfo *ethptr; // for passing to send_ functions - - if (target->timedOut(NULL)) - return NULL; - - /* The seqs must start out as zero for the si struct */ - memset(si->seqs, 0, sizeof(si->seqs)); - si->ipid_seqclass = IPID_SEQ_UNKNOWN; - si->ts_seqclass = TS_SEQ_UNKNOWN; - si->lastboot = 0; - - /* Init our fingerprint tests to each be NULL */ - memset(FPtests, 0, sizeof(FPtests)); - get_random_bytes(&sequence_base, sizeof(unsigned int)); - if ((o.sendpref & PACKET_SEND_ETH) && target->ifType() == devt_ethernet) { - memcpy(eth.srcmac, target->SrcMACAddress(), 6); - memcpy(eth.dstmac, target->NextHopMACAddress(), 6); - eth.ethsd = eth_open_cached(target->deviceName()); - if (eth.ethsd == NULL) - fatal("%s: Failed to open ethernet device (%s)", __func__, target->deviceName()); - - rawsd = -1; - ethptr = ð - } else { - /* Init our raw socket */ - if ((rawsd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0 ) - pfatal("socket troubles in %s", __func__); - unblock_socket(rawsd); - broadcast_socket(rawsd); -#ifndef WIN32 - sethdrinclude(rawsd); -#endif - ethptr = NULL; - eth.ethsd = NULL; - } - - /* Now for the pcap opening nonsense ... */ - /* Note that the snaplen is 152 = 64 byte max IPhdr + 24 byte max link_layer - * header + 64 byte max TCP header. Had to up it for UDP test - */ - - ossofttimeout = MAX(200000, target->to.timeout); - oshardtimeout = MAX(500000, 5 * target->to.timeout); - - pd = my_pcap_open_live(target->deviceName(), /*650*/ 8192, (o.spoofsource)? 1 : 0, (ossofttimeout + 500)/ 1000); - - if (o.debugging > 1) - log_write(LOG_STDOUT, "Wait time is %dms\n", (ossofttimeout +500)/1000); - - Snprintf(filter, sizeof(filter), "dst host %s and (icmp or (tcp and src host %s))", inet_ntoa(target->v4source()), target->targetipstr()); - - set_pcap_filter(target->deviceName(), pd, filter); - target->osscanSetFlag(OS_PERF); /* Let Nmap know that we did try an OS scan */ - - /* Lets find an open port to use */ - openport = (unsigned long) -1; - target->FPR1->osscan_opentcpport = -1; - target->FPR1->osscan_closedtcpport = -1; - target->FPR1->osscan_closedudpport = -1; - tport = NULL; - if ((tport = target->ports.nextPort(NULL, IPPROTO_TCP, PORT_OPEN))) { - openport = tport->portno; - target->FPR1->osscan_opentcpport = tport->portno; - } - - /* Now we should find a closed TCP port */ - if ((tport = target->ports.nextPort(NULL, IPPROTO_TCP, PORT_CLOSED))) { - closedtcpport = tport->portno; - - /* We'd prefer something non-zero */ - if (tport->portno == 0) - if ((tport = target->ports.nextPort(tport, IPPROTO_TCP, PORT_CLOSED))) - closedtcpport = tport->portno; - - target->FPR1->osscan_closedtcpport = closedtcpport; - } else if ((tport = target->ports.nextPort(NULL, IPPROTO_TCP, PORT_UNFILTERED))) { - /* Well, we will settle for unfiltered */ - closedtcpport = tport->portno; - - /* We'd prefer something non-zero */ - if (tport->portno == 0) - if ((tport = target->ports.nextPort(tport, IPPROTO_TCP, PORT_CLOSED))) - closedtcpport = tport->portno; - } else { - closedtcpport = (get_random_uint() % 14781) + 30000; - } - - /* Now we should find a closed UDP port */ - if ((tport = target->ports.nextPort(NULL, IPPROTO_UDP, PORT_CLOSED))) { - closedudpport = tport->portno; - - /* Port 0 seems to screw things up, so try to get another if available */ - if (tport->portno == 0) - if ((tport = target->ports.nextPort(tport, IPPROTO_UDP, PORT_CLOSED))) - closedudpport = tport->portno; - - target->FPR1->osscan_closedudpport = closedudpport; - } else if ((tport = target->ports.nextPort(NULL, IPPROTO_UDP, PORT_UNFILTERED))) { - /* Well, we will settle for unfiltered */ - closedudpport = tport->portno; - - /* Port 0 seems to screw things up, so try to get another if available */ - if (tport->portno == 0) - if ((tport = target->ports.nextPort(tport, IPPROTO_UDP, PORT_CLOSED))) - closedudpport = tport->portno; - } else { - closedudpport = (get_random_uint() % 14781) + 30000; - } - - if (o.verbose && openport != (unsigned long) -1) - log_write(LOG_STDOUT, "For OSScan assuming port %lu is open, tcp/%d and udp/%d are closed, and neither are firewalled\n", openport, closedtcpport, closedudpport); - - current_port = o.magic_port + NUM_SEQ_SAMPLES +1; - - /* Now lets do the NULL packet technique */ - testsleft = (openport == (unsigned long) -1)? 4 : 8; - FPtmp = NULL; - tries = 0; - do { - newcatches = 0; - if (openport != (unsigned long) -1) { - /* Test 1 */ - if (!FPtests[1]) { - if (o.scan_delay) enforce_scan_delay(NULL); - send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, false, NULL, 0, - current_port, openport, sequence_base, 0, 0, - TH_ECE|TH_SYN, 0, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000", 20, NULL, 0); - } - - /* Test 2 */ - if (!FPtests[2]) { - if (o.scan_delay) enforce_scan_delay(NULL); - send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, false, NULL, 0, - current_port +1, openport, sequence_base, 0, 0, - 0, 0, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); - } - - /* Test 3 */ - if (!FPtests[3]) { - if (o.scan_delay) enforce_scan_delay(NULL); - send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, false, NULL, 0, - current_port +2, openport, sequence_base, 0, 0, - TH_SYN|TH_FIN|TH_URG|TH_PUSH, 0, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); - } - - /* Test 4 */ - if (!FPtests[4]) { - if (o.scan_delay) enforce_scan_delay(NULL); - send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, false, NULL, 0, - current_port +3, openport, sequence_base, 0, 0, - TH_ACK, 0, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); - } - } - - /* Test 5 */ - if (!FPtests[5]) { - if (o.scan_delay) enforce_scan_delay(NULL); - send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, false, NULL, 0, - current_port +4, closedtcpport, sequence_base, 0, 0, - TH_SYN, 0, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); - } - - /* Test 6 */ - if (!FPtests[6]) { - if (o.scan_delay) enforce_scan_delay(NULL); - send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, false, NULL, 0, - current_port +5, closedtcpport, sequence_base, 0, 0, - TH_ACK, 0, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); - } - - /* Test 7 */ - if (!FPtests[7]) { - if (o.scan_delay) enforce_scan_delay(NULL); - send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, false, NULL, 0, - current_port +6, closedtcpport, sequence_base, 0, 0, - TH_FIN|TH_PUSH|TH_URG, 0, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); - } - - /* Test 8 */ - if (!FPtests[8]) { - if (o.scan_delay) enforce_scan_delay(NULL); - upi = send_closedudp_probe(rawsd, ethptr, target->v4hostip(), o.magic_port, closedudpport); - } - gettimeofday(&t1, NULL); - timeout = 0; - - /* Insure we haven't overrun our allotted time ... */ - if (target->timedOut(&t1)) - goto osscan_timedout; - - while(( ip = (struct ip*) readip_pcap(pd, &bytes, oshardtimeout, NULL, &linkhdr)) && !timeout) { - gettimeofday(&t2, NULL); - if (TIMEVAL_SUBTRACT(t2,t1) > oshardtimeout) { - timeout = 1; - } - - if (target->timedOut(&t2)) - goto osscan_timedout; - - if (bytes < (4 * ip->ip_hl) + 4U || bytes < 20) - continue; - setTargetMACIfAvailable(target, &linkhdr, ip, 0); - if (ip->ip_p == IPPROTO_TCP) { - tcp = ((struct tcp_hdr *) (((char *) ip) + 4 * ip->ip_hl)); - testno = ntohs(tcp->th_dport) - current_port + 1; - if (testno <= 0 || testno > 7) - continue; - if (o.debugging > 1) - log_write(LOG_STDOUT, "Got packet for test number %d\n", testno); - if (FPtests[testno]) continue; - testsleft--; - newcatches++; - FPtests[testno] = (FingerPrint *) safe_zalloc(sizeof(FingerPrint)); - FPtests[testno]->results = fingerprint_iptcppacket(ip, 265, sequence_base); - FPtests[testno]->name = (testno == 1)? "T1" : (testno == 2)? "T2" : (testno == 3)? "T3" : (testno == 4)? "T4" : (testno == 5)? "T5" : (testno == 6)? "T6" : (testno == 7)? "T7" : "PU"; - } else if (ip->ip_p == IPPROTO_ICMP) { - icmp = ((struct icmp *) (((char *) ip) + 4 * ip->ip_hl)); - /* It must be a destination port unreachable */ - if (icmp->icmp_type != 3 || icmp->icmp_code != 3) { - /* This ain't no stinking port unreachable! */ - continue; - } - if (bytes < (unsigned int) ntohs(ip->ip_len)) { - error("We only got %d bytes out of %d on our ICMP port unreachable packet, skipping", bytes, ntohs(ip->ip_len)); - continue; - } - if (FPtests[8]) continue; - FPtests[8] = (FingerPrint *) safe_zalloc(sizeof(FingerPrint)); - FPtests[8]->results = fingerprint_portunreach(ip, upi); - if (FPtests[8]->results) { - FPtests[8]->name = "PU"; - testsleft--; - newcatches++; - } else { - free(FPtests[8]); - FPtests[8] = NULL; - } - } - if (testsleft == 0) - break; - } - } while ( testsleft > 0 && (tries++ < 5 && (newcatches || tries == 1))); - - si->responses = 0; - timeout = 0; - gettimeofday(&t1,NULL); - /* Next we send our initial NUM_SEQ_SAMPLES SYN packets */ - if (openport != (unsigned long) -1) { - seq_packets_sent = 0; - while (seq_packets_sent < NUM_SEQ_SAMPLES) { - if (o.scan_delay) enforce_scan_delay(NULL); - if (seq_packets_sent > 0) { - gettimeofday(&t1, NULL); - int remaining_us = 110000 - TIMEVAL_SUBTRACT(t1, seq_send_times[seq_packets_sent - 1]); - if (remaining_us > 0) { - /* Need to spend at least .5 seconds in sending all packets to - reliably detect 2HZ timestamp sequencing */ - usleep(remaining_us); - } - } - send_tcp_raw_decoys(rawsd, ethptr, target->v4hostip(), o.ttl, false, NULL, 0, - o.magic_port + seq_packets_sent + 1, - openport, - sequence_base + seq_packets_sent + 1, 0, 0, - TH_SYN, 0, 0, (u8 *) "\003\003\012\001\002\004\001\011\010\012\077\077\077\077\000\000\000\000\000\000" , 20, NULL, 0); - gettimeofday(&seq_send_times[seq_packets_sent], NULL); - t1 = seq_send_times[seq_packets_sent]; - seq_packets_sent++; - - /* Now we collect the replies */ - while(si->responses < seq_packets_sent && !timeout) { - - if (seq_packets_sent == NUM_SEQ_SAMPLES) - ip = (struct ip*) readip_pcap(pd, &bytes, oshardtimeout, NULL, &linkhdr); - else ip = (struct ip*) readip_pcap(pd, &bytes, 10, NULL, &linkhdr); - - gettimeofday(&t2, NULL); - /* error("DEBUG: got a response (len=%d):\n", bytes); */ - /* lamont_hdump((unsigned char *) ip, bytes); */ - /* Insure we haven't overrun our allotted time ... */ - if (target->timedOut(&t2)) - goto osscan_timedout; - - if (!ip) { - if (seq_packets_sent < NUM_SEQ_SAMPLES) - break; - if (TIMEVAL_SUBTRACT(t2,t1) > ossofttimeout) - timeout = 1; - continue; - } else if (TIMEVAL_SUBTRACT(t2,t1) > oshardtimeout) { - timeout = 1; - } - if (lastipid != 0 && ip->ip_id == lastipid) { - /* Probably a duplicate -- this happens sometimes when scanning localhost */ - continue; - } - lastipid = ip->ip_id; - - if (bytes < (4 * ip->ip_hl) + 4U || bytes < 20) - continue; - setTargetMACIfAvailable(target, &linkhdr, ip, 0); - if (ip->ip_p == IPPROTO_TCP) { - /* readtcppacket((char *) ip, ntohs(ip->ip_len)); */ - tcp = ((struct tcp_hdr *) (((char *) ip) + 4 * ip->ip_hl)); - if (ntohs(tcp->th_dport) < o.magic_port || - ntohs(tcp->th_dport) - o.magic_port > NUM_SEQ_SAMPLES || - ntohs(tcp->th_sport) != openport) { - continue; - } - if ((tcp->th_flags & TH_RST)) { - /* readtcppacket((char *) ip, ntohs(ip->ip_len));*/ - if (si->responses == 0) { - error("WARNING: RST from port %lu -- is this port really open?", openport); - /* We used to quit in this case, but left-overs from a SYN - scan or lame-ass TCP wrappers can cause this! */ - } - continue; - } else if ((tcp->th_flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK)) { - /* error("DEBUG: response is SYN|ACK to port %hu\n", ntohs(tcp->th_dport)); */ - /*readtcppacket((char *)ip, ntohs(ip->ip_len));*/ - /* We use the ACK value to match up our sent with rcv'd packets */ - seq_response_num = (ntohl(tcp->th_ack) - 2 - - sequence_base); - if (seq_response_num < 0 || seq_response_num >= seq_packets_sent) { - /* BzzT! Value out of range */ - if (o.debugging) { - error("Unable to associate os scan response with sent packet (received ack: %lX; sequence base: %lX. Packet:", (unsigned long) ntohl(tcp->th_ack), (unsigned long) sequence_base); - readtcppacket((unsigned char *)ip,ntohs(ip->ip_len)); - } - seq_response_num = si->responses; - } - if (si->seqs[seq_response_num] == 0) { - /* New response found! */ - si->responses++; - si->seqs[seq_response_num] = ntohl(tcp->th_seq); /* TCP ISN */ - si->ipids[seq_response_num] = ntohs(ip->ip_id); - if ((gettcpopt_ts(tcp, ×tamp, NULL) == 0)) - si->ts_seqclass = TS_SEQ_UNSUPPORTED; - else { - if (timestamp == 0) { - si->ts_seqclass = TS_SEQ_ZERO; - } - } - si->timestamps[seq_response_num] = timestamp; - /* printf("Response #%d -- ipid=%hu ts=%i\n", seq_response_num, ntohs(ip->ip_id), timestamp); */ - if (si->responses > 1) { - seq_diffs[si->responses-2] = MOD_DIFF(ntohl(tcp->th_seq), si->seqs[si->responses-2]); - } - } - } - } - } - } - - /* Now we make sure there are no gaps in our response array ... */ - for(i=0, si->responses=0; i < seq_packets_sent; i++) { - if (si->seqs[i] != 0) /* We found a good one */ { - if (si->responses < i) { - si->seqs[si->responses] = si->seqs[i]; - si->ipids[si->responses] = si->ipids[i]; - si->timestamps[si->responses] = si->timestamps[i]; - seq_send_times[si->responses] = seq_send_times[i]; - } - if (si->responses > 0) { - seq_diffs[si->responses - 1] = MOD_DIFF(si->seqs[si->responses], si->seqs[si->responses - 1]); - ts_diffs[si->responses - 1] = MOD_DIFF(si->timestamps[si->responses], si->timestamps[si->responses - 1]); - time_usec_diffs[si->responses - 1] = TIMEVAL_SUBTRACT(seq_send_times[si->responses], seq_send_times[si->responses - 1]); - if (!time_usec_diffs[si->responses - 1]) time_usec_diffs[si->responses - 1]++; /* We divide by this later */ - /* printf("MOD_DIFF_USHORT(%hu, %hu) == %hu\n", si->ipids[si->responses], si->ipids[si->responses - 1], MOD_DIFF_USHORT(si->ipids[si->responses], si->ipids[si->responses - 1])); */ - } - - si->responses++; - } /* Otherwise nothing good in this slot to copy */ - } - - - si->ipid_seqclass = ipid_sequence(si->responses, si->ipids, - islocalhost(target->v4hostip())); - - /* Now we look at TCP Timestamp sequence prediction */ - /* Battle plan: - 1) Compute average increments per second, and variance in incr. per second - 2) If any are 0, set to constant - 3) If variance is high, set to random incr. [ skip for now ] - 4) if ~10/second, set to appropriate thing - 5) Same with ~100/sec - */ - if (si->ts_seqclass == TS_SEQ_UNKNOWN && si->responses >= 2) { - avg_ts_hz = 0.0; - for(i=0; i < si->responses - 1; i++) { - double dhz; - - dhz = (double) ts_diffs[i] / (time_usec_diffs[i] / 1000000.0); - /* printf("ts incremented by %d in %li usec -- %fHZ\n", ts_diffs[i], time_usec_diffs[i], dhz); */ - avg_ts_hz += dhz / ( si->responses - 1); - } - - if (o.debugging) - log_write(LOG_PLAIN, "The avg TCP TS HZ is: %f\n", avg_ts_hz); - - if (avg_ts_hz > 0 && avg_ts_hz < 3.9) { /* relatively wide range because sampling time so short and frequency so slow */ - si->ts_seqclass = TS_SEQ_2HZ; - si->lastboot = seq_send_times[0].tv_sec - (si->timestamps[0] / 2); - } - else if (avg_ts_hz > 85 && avg_ts_hz < 115) { - si->ts_seqclass = TS_SEQ_100HZ; - si->lastboot = seq_send_times[0].tv_sec - (si->timestamps[0] / 100); - } - else if (avg_ts_hz > 900 && avg_ts_hz < 1100) { - si->ts_seqclass = TS_SEQ_1000HZ; - si->lastboot = seq_send_times[0].tv_sec - (si->timestamps[0] / 1000); - } - if (si->lastboot && (seq_send_times[0].tv_sec - si->lastboot > 63072000)) - { - /* Up 2 years? Perhaps, but they're probably lying. */ - if (o.debugging) { - error("Ignoring claimed uptime of %lu days", - (seq_send_times[0].tv_sec - si->lastboot) / 86400); - } - si->lastboot = 0; - } - } - - /* Time to look at the TCP ISN predictability */ - if (si->responses >= 4 && o.scan_delay <= 1000) { - seq_gcd = gcd_n_uint(si->responses -1, seq_diffs); - /* printf("The GCD is %u\n", seq_gcd);*/ - if (seq_gcd) { - for(i=0; i < si->responses - 1; i++) - seq_diffs[i] /= seq_gcd; - for(i=0; i < si->responses - 1; i++) { - if (MOD_DIFF(si->seqs[i+1],si->seqs[i]) > 50000000) { - si->seqclass = SEQ_TR; - si->index = 9999999; - /* printf("Target is a TR box\n");*/ - break; - } - seq_avg_inc += seq_diffs[i]; - } - } - if (seq_gcd == 0) { - si->seqclass = SEQ_CONSTANT; - si->index = 0; - } else if (seq_gcd % 64000 == 0) { - si->seqclass = SEQ_64K; - /* printf("Target is a 64K box\n");*/ - si->index = 1; - } else if (seq_gcd % 800 == 0) { - si->seqclass = SEQ_i800; - /* printf("Target is a i800 box\n");*/ - si->index = 10; - } else if (si->seqclass == SEQ_UNKNOWN) { - seq_avg_inc = (unsigned int) ((0.5) + seq_avg_inc / (si->responses - 1)); - /* printf("seq_avg_inc=%u\n", seq_avg_inc);*/ - for(i=0; i < si->responses -1; i++) { - - /* printf("The difference is %u\n", seq_diffs[i]); - printf("Adding %u^2=%e", MOD_DIFF(seq_diffs[i], seq_avg_inc), pow(MOD_DIFF(seq_diffs[i], seq_avg_inc), 2));*/ - /* pow() seems F#@!#$!ed up on some Linux systems so I will - not use it for now - seq_inc_sum += pow(MOD_DIFF(seq_diffs[i], seq_avg_inc), 2); - */ - - seq_inc_sum += ((double)(MOD_DIFF(seq_diffs[i], seq_avg_inc)) * ((double)MOD_DIFF(seq_diffs[i], seq_avg_inc))); - /* seq_inc_sum += pow(MOD_DIFF(seq_diffs[i], seq_avg_inc), 2);*/ - - } - /* printf("The sequence sum is %e\n", seq_inc_sum);*/ - seq_inc_sum /= (si->responses - 1); - - si->index = (unsigned int) (0.5 + sqrt(seq_inc_sum)); - - /* printf("The sequence index is %d\n", si->index);*/ - if (si->index < 75) { - si->seqclass = SEQ_TD; - /* printf("Target is a Micro$oft style time dependant box\n");*/ - } - else { - si->seqclass = SEQ_RI; - /* printf("Target is a random incremental box\n");*/ - } - } - FPtests[0] = (FingerPrint *) safe_zalloc(sizeof(FingerPrint)); - FPtests[0]->name = "TSeq"; - seq_AVs = (struct AVal *) safe_zalloc(sizeof(struct AVal) * 5); - FPtests[0]->results = seq_AVs; - avnum = 0; - seq_AVs[avnum].attribute = "Class"; - switch(si->seqclass) { - case SEQ_CONSTANT: - strcpy(seq_AVs[avnum].value, "C"); - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute= "Val"; - sprintf(seq_AVs[avnum].value, "%X", si->seqs[0]); - break; - case SEQ_64K: - strcpy(seq_AVs[avnum].value, "64K"); - break; - case SEQ_i800: - strcpy(seq_AVs[avnum].value, "i800"); - break; - case SEQ_TD: - strcpy(seq_AVs[avnum].value, "TD"); - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute= "gcd"; - sprintf(seq_AVs[avnum].value, "%X", seq_gcd); - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute="SI"; - sprintf(seq_AVs[avnum].value, "%X", si->index); - break; - case SEQ_RI: - strcpy(seq_AVs[avnum].value, "RI"); - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute= "gcd"; - sprintf(seq_AVs[avnum].value, "%X", seq_gcd); - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute="SI"; - sprintf(seq_AVs[avnum].value, "%X", si->index); - break; - case SEQ_TR: - strcpy(seq_AVs[avnum].value, "TR"); - break; - } - - /* IP ID Class */ - switch(si->ipid_seqclass) { - case IPID_SEQ_CONSTANT: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "IPID"; - strcpy(seq_AVs[avnum].value, "C"); - break; - case IPID_SEQ_INCR: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "IPID"; - strcpy(seq_AVs[avnum].value, "I"); - break; - case IPID_SEQ_BROKEN_INCR: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "IPID"; - strcpy(seq_AVs[avnum].value, "BI"); - break; - case IPID_SEQ_RPI: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "IPID"; - strcpy(seq_AVs[avnum].value, "RPI"); - break; - case IPID_SEQ_RD: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "IPID"; - strcpy(seq_AVs[avnum].value, "RD"); - break; - case IPID_SEQ_ZERO: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "IPID"; - strcpy(seq_AVs[avnum].value, "Z"); - break; - } - - /* TCP Timestamp option sequencing */ - switch(si->ts_seqclass) { - case TS_SEQ_ZERO: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "TS"; - strcpy(seq_AVs[avnum].value, "0"); - break; - case TS_SEQ_2HZ: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "TS"; - strcpy(seq_AVs[avnum].value, "2HZ"); - break; - case TS_SEQ_100HZ: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "TS"; - strcpy(seq_AVs[avnum].value, "100HZ"); - break; - case TS_SEQ_1000HZ: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "TS"; - strcpy(seq_AVs[avnum].value, "1000HZ"); - break; - case TS_SEQ_UNSUPPORTED: - seq_AVs[avnum].next = &seq_AVs[avnum+1]; avnum++; - seq_AVs[avnum].attribute = "TS"; - strcpy(seq_AVs[avnum].value, "U"); - break; - } - } - else { - log_write(LOG_PLAIN,"Insufficient responses for TCP sequencing (%d), OS detection may be less accurate\n", si->responses); - } - } else { - } - - for(i=0; i < 9; i++) { - if (i > 0 && !FPtests[i] && ((openport != (unsigned long) -1) || i > 4)) { - /* We create a Resp (response) attribute with value of N (no) because - it is important here to note whether responses were or were not - received */ - FPtests[i] = (FingerPrint *) safe_zalloc(sizeof(FingerPrint)); - seq_AVs = (struct AVal *) safe_zalloc(sizeof(struct AVal)); - seq_AVs->attribute = "Resp"; - strcpy(seq_AVs->value, "N"); - seq_AVs->next = NULL; - FPtests[i]->results = seq_AVs; - FPtests[i]->name = (i == 1)? "T1" : (i == 2)? "T2" : (i == 3)? "T3" : (i == 4)? "T4" : (i == 5)? "T5" : (i == 6)? "T6" : (i == 7)? "T7" : "PU"; - } - } - last = -1; - FP = NULL; - for(i=0; i < 9 ; i++) { - if (!FPtests[i]) continue; - if (!FP) FP = FPtests[i]; - if (last > -1) { - FPtests[last]->next = FPtests[i]; - } - last = i; - } - if (last) FPtests[last]->next = NULL; - - osscan_timedout: - if (target->timedOut(NULL)) - FP = NULL; - if (rawsd >= 0) - close(rawsd); - /* No need to close ethptr->ethsd due to caching */ - pcap_close(pd); - return FP; -} - - // Prints a note if observedFP has a classification and it is not in referenceFP // Returns 0 if they match, nonzero otherwise static int compareclassifications(FingerPrint *referenceFP, @@ -1472,118 +452,6 @@ return; } -int os_scan(Target *target) { - -FingerPrintResults FP_matches[3]; -struct seq_info si[3]; -int itry; -int i; -struct timeval now; -double bestacc; -int bestaccidx; - int starttimems = 0; - - if (target->timedOut(NULL)) - return 1; - -o.current_scantype = OS_SCAN; - -#ifdef WIN32 - if (target->ifType() == devt_loopback) { - log_write(LOG_STDOUT, "Skipping OS Scan against %s because it doesn't work against your own machine (localhost)\n", target->NameIP()); - return 1; - } -#endif - - if (o.verbose) { - starttimems = o.TimeSinceStartMS(); - log_write(LOG_STDOUT, "Initiating gen1 OS Detection against %s at %.3fs\n", target->targetipstr(), starttimems / 1000.0); - } - - if (target->FPR1 == NULL) - target->FPR1 = new FingerPrintResults; - - memset(si, 0, sizeof(si)); - if (target->ports.getStateCounts(IPPROTO_TCP, PORT_OPEN) == 0 || - (target->ports.getStateCounts(IPPROTO_TCP, PORT_CLOSED) == 0 && - target->ports.getStateCounts(IPPROTO_TCP, PORT_UNFILTERED) == 0)) { - if (o.osscan_limit) { - if (o.verbose) - log_write(LOG_PLAIN, "Skipping OS Scan due to absence of open (or perhaps closed) ports\n"); - return 1; - } else { - target->osscanSetFlag(OS_PERF_UNREL); - } - } - - for(itry=0; itry < 3; itry++) { - gettimeofday(&now, NULL); - if (target->timedOut(&now)) - return 1; - - // Check if a status message is requested - if (keyWasPressed()) { - // Do nothing because the keyWasPressed Method prints out the basic status line - } - - target->FPR1->FPs[itry] = get_fingerprint(target, &si[itry]); - - match_fingerprint(target->FPR1->FPs[itry], &FP_matches[itry], - o.reference_FPs1, OSSCAN_GUESS_THRESHOLD); - if (FP_matches[itry].overall_results == OSSCAN_SUCCESS && - FP_matches[itry].num_perfect_matches > 0) - break; - if (itry < 2) - sleep(2); - } - - target->FPR1->numFPs = (itry == 3)? 3 : itry + 1; - memcpy(&(target->seq), &si[target->FPR1->numFPs - 1], sizeof(struct seq_info)); - - /* Now lets find the best match */ - bestacc = 0; - bestaccidx = 0; - for(itry=0; itry < target->FPR1->numFPs; itry++) { - if (FP_matches[itry].overall_results == OSSCAN_SUCCESS && - FP_matches[itry].num_matches > 0 && - FP_matches[itry].accuracy[0] > bestacc) { - bestacc = FP_matches[itry].accuracy[0]; - bestaccidx = itry; - if (FP_matches[itry].num_perfect_matches) - break; - } - } - - - for(i=0; i < target->FPR1->numFPs; i++) { - if (i == bestaccidx) - continue; - if (o.debugging) { - error("Failed exact match #%d (0-based):\n%s", i, fp2ascii(target->FPR1->FPs[i])); - } - } - - if (target->FPR1->numFPs > 1 && target->FPR1->overall_results == OSSCAN_SUCCESS && - target->FPR1->accuracy[0] == 1.0) { - if (o.verbose) error("WARNING: OS didn't match until try #%d", target->FPR1->numFPs); - } - - target->FPR1->goodFP = bestaccidx; - - // Now we redo the match, since target->FPR1 has various data (such as - // target->FPR1->numFPs) which is not in FP_matches[bestaccidx]. This is - // kinda ugly. - if (target->FPR1->goodFP >= 0) - match_fingerprint(target->FPR1->FPs[target->FPR1->goodFP], target->FPR1, - o.reference_FPs1, OSSCAN_GUESS_THRESHOLD); - - if (o.debugging > 2) { - log_write(LOG_PLAIN, "Completed OS Detection against %s at %.3fs (took %.3fs)\n", target->targetipstr(), o.TimeSinceStartMS() / 1000.0, (o.TimeSinceStartMS() - starttimems) / 1000.0); - } - - return 1; -} - /* Writes an informational "Test" result suitable for including at the top of a fingerprint. Gives info which might be useful when the FPrint is submitted (eg Nmap version, etc). Result is written (up @@ -1678,7 +546,7 @@ static struct AVal *str2AVal(char *str) { for(i=0; i < count; i++) { q = strchr(p, '='); if (!q) { - fatal("Parse error with AVal string (%s) in nmap-os-fingerprints file", str); + fatal("Parse error with AVal string (%s) in nmap-os-db file", str); } *q = '\0'; AVs[i].attribute = strdup(p); @@ -1686,7 +554,7 @@ static struct AVal *str2AVal(char *str) { if (i != count - 1) { q = strchr(p, '%'); if (!q) { - fatal("Parse error with AVal string (%s) in nmap-os-fingerprints file", str); + fatal("Parse error with AVal string (%s) in nmap-os-db file", str); } *q = '\0'; AVs[i].next = &AVs[i+1]; @@ -1724,17 +592,11 @@ static bool AVal_match_literal(struct AVal *a, struct AVal *b) { of tests when they are displayed. Returns true if and only if the test a should come before the test b. */ static bool FingerTest_lessthan(const FingerTest* a, const FingerTest* b) { - /* This defines the order in which test lines should appear. It contains test - names for both the first- and second-generation OS detection systems so - fingerprints from both systems can work with this one function. The - first-generation entries should be removed when the rest of the - first-generation system is. */ + /* This defines the order in which test lines should appear. */ const char *TEST_ORDER[] = { - "TSeq", /* 1st gen. */ - "SEQ", "OPS", "WIN", "ECN", /* 2nd gen. */ - "T1", "T2", "T3", "T4", "T5", "T6", "T7", /* 1st and 2nd gen. */ - "PU", /* 1st gen. */ - "U1", "IE" /* 2nd gen. */ + "SEQ", "OPS", "WIN", "ECN", + "T1", "T2", "T3", "T4", "T5", "T6", "T7", + "U1", "IE" }; unsigned int i; int ia, ib; @@ -2200,7 +1062,7 @@ while(fgets(line, sizeof(line), fp)) { if (DB->MatchPoints) fatal("Found MatchPoints directive on line %d of %s even though it has previously been seen in the file", lineno, fname); parsingMatchPoints = true; } else { - error("Parse error on line %d of nmap-os-fingerprints file: %s", lineno, line); + error("Parse error on line %d of nmap-os-db file: %s", lineno, line); continue; } @@ -2245,7 +1107,7 @@ while(fgets(line, sizeof(line), fp)) { p = line; q = strchr(line, '('); if (!q) { - error("Parse error on line %d of nmap-os-fingerprints file: %s", lineno, line); + error("Parse error on line %d of nmap-os-db file: %s", lineno, line); goto top; } *q = '\0'; @@ -2258,7 +1120,7 @@ while(fgets(line, sizeof(line), fp)) { *q = '('; q = strchr(p, ')'); if (!q) { - error("Parse error on line %d of nmap-os-fingerprints file: %s", lineno, line); + error("Parse error on line %d of nmap-os-db file: %s", lineno, line); goto top; } *q = '\0'; @@ -2287,95 +1149,3 @@ o.loaded_data_files[dbname] = filename; return parse_fingerprint_file(filename); } - -/* This function takes an array of "numSamples" IP IDs and analyzes - them to determine their sequenceability classification. It returns - one of the IPID_SEQ_* classifications defined in nmap.h . If the - function cannot determine the sequence, IPID_SEQ_UNKNOWN is returned. - This islocalhost argument is a boolean specifying whether these - numbers were generated by scanning localhost. NOTE: the "ipids" argument - may be modified if localhost is set to true. */ - -int ipid_sequence(int numSamples, u16 *ipids, int islocalhost) { - u16 ipid_diffs[32]; - int i; - int allipideqz = 1; /* Flag that means "All IP.IDs returned during - sequencing are zero. This is unset if we - find a nonzero */ - int j,k; - - assert(numSamples < (int) (sizeof(ipid_diffs) / 2)); - if (numSamples < 2) return IPID_SEQ_UNKNOWN; - - for(i = 1; i < numSamples; i++) { - - if (ipids[i-1] != 0 || ipids[i] != 0) - allipideqz = 0; /* All IP.ID values do *NOT* equal zero */ - - ipid_diffs[i-1] = MOD_DIFF_USHORT(ipids[i], ipids[i-1]); - if ((ipids[i] < ipids[i-1]) && (ipids[i] > 500 || ipids[i-1] < 65000)) - return IPID_SEQ_RD; - } - - if (allipideqz) return IPID_SEQ_ZERO; - - /* Battle plan ... - ipid_diffs-- if scanning localhost and safe - If any diff is > 1000, set to random, if 0, set to constant - If any of the diffs are 1, or all are less than 9, set to incremental - */ - - if (islocalhost) { - int allgto = 1; /* ALL diffs greater than one */ - - for(i=0; i < numSamples - 1; i++) - if (ipid_diffs[i] < 2) { - allgto = 0; break; - } - if (allgto) { - for(i=0; i < numSamples - 1; i++) { - if (ipid_diffs[i] % 256 == 0) /* Stupid MS */ - ipid_diffs[i] -= 256; - else - ipid_diffs[i]--; /* Because on localhost the RST sent back use an IPID */ - } - } - } - - for(i=0; i < numSamples - 1; i++) { - if (ipid_diffs[i] > 1000) { - return IPID_SEQ_RPI; - break; - } - if (ipid_diffs[i] == 0) { - return IPID_SEQ_CONSTANT; - break; - } - } - - j = 1; /* j is a flag meaning "all differences seen are < 9" */ - k = 1; /* k is a flag meaning "all difference seen are multiples of 256 */ - for(i=0; i < numSamples - 1; i++) { - if (ipid_diffs[i] == 1) { - return IPID_SEQ_INCR; - } - - if (k && ipid_diffs[i] < 2560 && ipid_diffs[i] % 256 != 0) { - k = 0; - } - - if (ipid_diffs[i] > 9) - j = 0; - } - - if (k == 1) { - /* Stupid Microsoft! */ - return IPID_SEQ_BROKEN_INCR; - } - - if (j == 1) - return IPID_SEQ_INCR; - - return IPID_SEQ_UNKNOWN; - -} diff --git a/osscan.h b/osscan.h index b697bc2d2..30a24685c 100644 --- a/osscan.h +++ b/osscan.h @@ -119,7 +119,6 @@ /* moved to global_structures.h */ /********************** PROTOTYPES ***********************************/ -int os_scan(Target *target); char *fp2ascii(FingerPrint *FP); /* Parses a single fingerprint from the memory region given. If a @@ -159,14 +158,5 @@ void match_fingerprint(FingerPrint *FP, FingerPrintResults *FPR, void freeFingerPrint(FingerPrint *FP); char *mergeFPs(FingerPrint *FPs[], int numFPs, bool isGoodFP, const struct in_addr * const addr, int distance, const u8 *mac, int openTcpPort, int closedTcpPort, int closedUdpPort, bool wrapit); -/* This function takes an array of "numSamples" IP IDs and analyzes - them to determine their sequenceability classification. It returns - one of the IPID_SEQ_* classifications defined in nmap.h . If the - function cannot determine the sequence, IPID_SEQ_UNKNOWN is returned. - This islocalhost argument is a boolean specifying whether these - numbers were generated by scanning localhost. NOTE: the "ipids" argument - may be modified if localhost is set to true. */ -int ipid_sequence(int numSamples, u16 *ipids, int islocalhost); - #endif /*OSSCAN_H*/ diff --git a/osscan2.cc b/osscan2.cc index 829b71165..f8418f1be 100644 --- a/osscan2.cc +++ b/osscan2.cc @@ -3124,6 +3124,13 @@ int get_initial_ttl_guess(u8 ttl) { return 255; } +/* This function takes an array of "numSamples" IP IDs and analyzes + them to determine their sequenceability classification. It returns + one of the IPID_SEQ_* classifications defined in nmap.h . If the + function cannot determine the sequence, IPID_SEQ_UNKNOWN is returned. + This islocalhost argument is a boolean specifying whether these + numbers were generated by scanning localhost. NOTE: the "ipids" argument + may be modified if localhost is set to true. */ int get_ipid_sequence(int numSamples, int *ipids, int islocalhost) { u16 ipid_diffs[32]; int i; @@ -3752,24 +3759,6 @@ static void printFP(OsScanInfo *OSI) { } } -static void doOsScan1(OsScanInfo *OSI) { - list::iterator hostI; - - if(!o.reference_FPs1) - o.reference_FPs1 = parse_fingerprint_reference_file("nmap-os-fingerprints"); - - for(hostI = OSI->incompleteHosts.begin(); - hostI != OSI->incompleteHosts.end(); hostI++) { - /* If the fingerprint found was so good that we want the user to - submit it, don't do gen1 os scan because the results might bias - the user into a wrong submission (or make the user less likely - to actually submit */ - if ((*hostI)->target->FPR->OmitSubmissionFP()) { - os_scan((*hostI)->target); - } - } -} - /* Goes through every unmatched host in OSI. If a host has completed the maximum number of OS detection tries allowed for it without matching, it is transferred to the passed in unMatchedHosts list. @@ -3875,14 +3864,6 @@ static int os_scan_2(vector &Targets) { Normally let output.cc to print the FP. */ if(o.debugging > 1) printFP(OSI); - - /* - * For the incomplete hosts, we fall back on the former os_scan engine which has - * a larger os-fingerprint db. - */ - if(o.osscan != OS_SCAN_SYS_2_ONLY) { - doOsScan1(OSI); - } } delete HOS; diff --git a/scripts/script.db b/scripts/script.db index 0c8b45a4b..74b4cbe84 100644 --- a/scripts/script.db +++ b/scripts/script.db @@ -38,6 +38,7 @@ Entry{ category = "demo", filename = "showSMTPVersion.nse" } Entry{ category = "demo", filename = "showSSHVersion.nse" } Entry{ category = "version", filename = "skype_v2-version.nse" } Entry{ category = "backdoor", filename = "strangeSMTPport.nse" } +Entry{ category = "demo", filename = "test.nse" } Entry{ category = "vulnerability", filename = "xamppDefaultPass.nse" } Entry{ category = "intrusive", filename = "zoneTrans.nse" } Entry{ category = "discovery", filename = "zoneTrans.nse" }